{ "Event": { "published": true, "date": "2026-09-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-09-01", "timestamp": 1788307382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8bfa475a-c41b-4e80-a0ad-7b3f9038e823", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b909db97-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788277342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277342, "uuid": "d9e17ce3-5430-4b5c-a586-504318eddaf0", "comment": "Malware payload", "value": "6b9a0f588239f22070d8fc00faf01425", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277342, "uuid": "50cbf4ab-09b7-4367-b588-f7eb5eb207b0", "comment": "Malware payload", "value": "0030c014ec4fae311492a87011f565f9ff3b1881137dda152953c6fe718e33e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277342, "uuid": "fc30e4d5-3e69-4d74-be19-19c8872e9d33", "comment": "Malware payload", "value": "6694c1cbb950291cb3487567fbaa1ad286c5af8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277342, "uuid": "1b9d820b-7f02-498c-9d67-c8508805bf2f", "comment": "Malware payload", "value": "3bec3ddc5b972789b66e58936dd8c890e26078c1d0c1bf9b1146bf534eb0481344baeac1274c0b2ccce1714ee52ae23e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277342, "uuid": "fbb127a4-0b30-4b8f-b2e7-c7a6cfe38578", "value": "T13955408FD49213B5F397FB73821AE6665DF6740680728634DF466D394F82E20A428ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277342, "uuid": "a5d00fc3-62e1-4a95-b833-20bb05685d40", "value": "12288:mGK5imhcJ+98GKwT0o4eFUSBcJRV88sZ0V60jj/odmzF7BdGsrwCa/XjNpbB:m5/hci8U+DHjj/oQF7ysECyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277342, "uuid": "2f24d28a-1b76-44d6-b1f8-5bf0a7e53f7b", "value": 1326080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277342, "uuid": "ac2bd877-c80e-4b98-ad1a-19923fcf5d81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277342, "uuid": "8c2af8ae-034e-43c0-8e5d-b979a6033851", "value": "60129a548307204fed1f4c698e12bc17d941592d81deb163f9fa63f4c6ecb3db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f929e211-a5d0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788245237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245237, "uuid": "8ed9c33c-e5b9-40be-b4c9-42d71eb1141b", "comment": "Malware payload", "value": "626f36a82b8bebc6db74f441c23bb610", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245237, "uuid": "5c0cbb19-c03f-498e-bde5-13068aa6c198", "comment": "Malware payload", "value": "00910dbf54bd447710f63b4e5309a676630d546c3b9f27b9ce7cd4271d163f69", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245237, "uuid": "329045fb-d5c3-4613-bdea-373c54f6e8de", "comment": "Malware payload", "value": "7df607b064d4fbc482df4f6b4d85dca35eca3e27", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245237, "uuid": "f0e9a309-1655-4915-a9cf-ccc839c54044", "comment": "Malware payload", "value": "a6da4bb7020fe40c1f380ac0c86317a0cda27beeb94411825adfe6fbd60fcc84fe2a7fa47f1ddfac2010003b495fc1bb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245237, "uuid": "fd1ef3de-3840-4e2c-b5dd-c39ff67ebc30", "value": "T1E9D1A2CBFD984632322D45746C89AA99FA47013349643D01F88FA4683F787ACF138F29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245237, "uuid": "565b4313-fd0d-4efb-89b0-cc417738442d", "value": "96:/lzjWXI2lRigKwDi5Dz/dNTnObuJNxVv8l/da1gNBFk2tOliUSmljTWYGEXcXP4v:/lvWYoRftDQDXpgNBOmmVTWYGQeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788245237, "uuid": "66b66c42-4001-48f7-b1f8-02ce5c22d919", "value": 6330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788245237, "uuid": "e66f4aa8-abad-40f9-a41d-0e24bdd3dff6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245237, "uuid": "0b484e0b-a14e-48a0-9e76-8833e2bc3605", "value": "gocl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245179ab-a5a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1788225123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788225123, "uuid": "7d6998e9-081b-435d-a7cd-f0a26b863b1d", "comment": "Malware payload (CoinMiner)", "value": "7dde3aa953a54b22666dcadc568a870e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788225123, "uuid": "1c7d2bbd-c7b2-4709-a025-c714b01b94e4", "comment": "Malware payload (CoinMiner)", "value": "00c4603f074afb652780bb8b3e703ae093c5644652b81954ec6d0fb983e79203", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788225123, "uuid": "01758546-a5ef-4548-b5c2-20be83fb93ae", "comment": "Malware payload (CoinMiner)", "value": "bc451286285ba16909ec5c884bcfec381a17c91e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788225123, "uuid": "49b9b911-38d0-44ba-ae78-6e18676a13f7", "comment": "Malware payload (CoinMiner)", "value": "7cca647633264074296af75d1d2a785eacee62937d5e0a73658596fa161b87b855597dee8a304365f410ed8f405000ae", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788225123, "uuid": "b1a78ee3-7f98-4f8f-8c08-9df032ee157d", "value": "T15A3633D368D698B8D076C3B857A3706CB3383BA18965BE4B36CD5A808D46F0C643E7D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788225123, "uuid": "2ccd3869-f5a6-4ea8-8eff-fcd38523f5c4", "value": "949ec789a5933fb6051c9013a550fb57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788225123, "uuid": "63220259-9f58-4b84-be76-51d5beee6cdb", "value": "98304:2iD/lciC3x4skpyjwgkejtnxHWQtlv1OSSAPeWDK/ChTcK5PcVnJWwv:NaxxlRkejtxHWQtlv1OfAPegK/9KqVJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788225123, "uuid": "6def34bd-4bb9-41e0-a5b9-0d4be82e4189", "value": 5274112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788225123, "uuid": "c4115a49-44a2-4adb-85f7-4853ea16ff1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788225123, "uuid": "012bdbca-31b1-4535-8ee3-9cfe44a8372a", "value": "00c4603f074afb652780bb8b3e703ae093c5644652b81954ec6d0fb983e79203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13666072-a628-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788282647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282647, "uuid": "7e3f9a85-e69f-4112-b78b-2601c3ddfa41", "comment": "Malware payload (ConnectWise)", "value": "d5f81164768b3808ec697c944054cd2a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282647, "uuid": "07d51f18-f00f-4343-99ea-3845a06dada4", "comment": "Malware payload (ConnectWise)", "value": "0142e425a1d24fef352524cfc26a83579e449894de3694901faca802af966b5f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282647, "uuid": "e93b2f9b-89b6-4e87-b73d-9ff508269fee", "comment": "Malware payload (ConnectWise)", "value": "5978b6b581224c96ed031f57ee72c06adcf9f00c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282647, "uuid": "4ad6664f-b74a-4647-9789-6394ef2082fc", "comment": "Malware payload (ConnectWise)", "value": "2eb3973fd23342648cc52a7fca45a408bd832f4c0260cf801429f493e24d3c4b71c7e56b07a7b03de6646fc00333f678", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282647, "uuid": "837ad454-0756-4544-90b4-a751523c86fa", "value": "T134647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282647, "uuid": "32b8f62a-0cc2-473a-9644-511e42dbe632", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282647, "uuid": "34c5cd64-948c-4ea7-a692-7602316eeda5", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9d:51iw7gryNkSV1hy1Z1u2JLu9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788282647, "uuid": "3f5a7d32-43af-4459-8ec3-3115ac61873e", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788282647, "uuid": "d0256265-4bca-4ab8-a225-e3106e09195b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282647, "uuid": "1be1e07c-8134-42d7-9fb4-b6546f4118dd", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02df0df4-a5b0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788231080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231080, "uuid": "cbd66591-9848-4b43-add4-d64c71eec74d", "comment": "Malware payload (Mirai)", "value": "8d7e10df86bcb04b1051e320bc445652", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231080, "uuid": "97b7c561-6365-4cd2-a9f2-63b0a282a460", "comment": "Malware payload (Mirai)", "value": "02c05faa97ebc77db971a14b06fd99ec004e669b662a55d520031b1bed808199", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231080, "uuid": "6f2ad1e5-d633-496b-8dca-b5d077d4605a", "comment": "Malware payload (Mirai)", "value": "6bd590fce821bedb3da8a8702dd29c33117432a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231080, "uuid": "ff3bfa48-56b5-4674-abcf-1ff969f8ee1f", "comment": "Malware payload (Mirai)", "value": "56dd4b41703dd951d176aab19133e8f00f2c56556725054ebf5105d1505dae1b5c5261d488b4a6e7bbf1c6055f43925b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231080, "uuid": "70852e34-34de-4e40-a355-bf48776eb41f", "value": "T15B933A86F98780F5C84748706167F63FDA31D8E92171C69DEFA58F31CA33A419623B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231080, "uuid": "b37f72bb-f46f-4f3d-980b-886c129a7170", "value": "1536:ql0oaz5Lo7HgfupPyEe9lKGIGHFxMyW4sOlVi37wLdmbHcfCoyIZT:O0XNLoHgm/GIcFcx6837wJmwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788231080, "uuid": "c2fbd94b-9e72-41f9-8085-205e31f8d505", "value": 95828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788231080, "uuid": "5585d026-0a3d-43a1-b7a4-728a5588d440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231080, "uuid": "a6598f3f-cb5e-48c8-a726-bc4e61c3f26d", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0908c6-a5ff-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788265425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265425, "uuid": "f5587208-5f9f-423a-81d5-7b9e4c7234c0", "comment": "Malware payload", "value": "c565ba07b5ef283c2e67346567b7ed60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265425, "uuid": "af55db68-7720-497b-a0a1-9e811b4c3a3b", "comment": "Malware payload", "value": "02d3ad426de6498186e159a577c771f8fcb61604cf62a378deef982dead505d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265425, "uuid": "391ed7bf-1b5e-4814-9429-c521fb5e4e71", "comment": "Malware payload", "value": "2cfe7d068308cf8ecd9604eb8eeca657d2419f85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265425, "uuid": "76f7795e-c879-4c8c-ab2b-465d070e7d65", "comment": "Malware payload", "value": "3d52299cd8bae245ca52b753be964855eced6bac3a806a51442d3bc833b10f3785fa431b2ad106c7c9801d69d30893f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265425, "uuid": "97ce7772-b8fd-460d-8ae1-2a949fcfed09", "value": "T1EC046B0AA7E521FAE277C534C9524901EB727C5547B0EAEF13904AB64F237E09E3DB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265425, "uuid": "bf2b73f9-6dc2-40c7-8e41-fa921f65de13", "value": "dacebb5128856b88c74408aed4ec7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265425, "uuid": "355f1a14-294f-41de-8466-8a60da074a71", "value": "3072:zCpwSjGC+a8MntX+e6casqGJRVNlEEsUT6aVSfsoOQd4R9+Xr:zTSjGCP8MntOHcaCxlN6KEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788265425, "uuid": "0a68dfb7-06e8-41e3-8d8a-c3273bede919", "value": 186848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788265425, "uuid": "ef870a36-ca9e-4a57-819f-3bc3f4ac84fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265425, "uuid": "88dfba1d-b167-410f-a894-c5d298423d67", "value": "updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b4d265-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1788243537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243537, "uuid": "d2e59b59-3419-4065-8050-ee96018cc6a0", "comment": "Malware payload (AgentTesla)", "value": "6ba4388fcd891e2cd71f16860dcd0b4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243537, "uuid": "85a48f33-648a-4af3-9e38-5d5b2a6a6be2", "comment": "Malware payload (AgentTesla)", "value": "02fedc08d040f9b9e2a96ffd364bbd4eb4f537205594072a0554adc651f6e5f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243537, "uuid": "6c1afd51-2b17-4117-8459-f5c474797b8b", "comment": "Malware payload (AgentTesla)", "value": "142a81e0e4e4718072fd6df6d4299c5ddb909e96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243537, "uuid": "98712b7b-9555-4053-aac3-8b8aeaeefc82", "comment": "Malware payload (AgentTesla)", "value": "7ee58687f16f11d2c82fbe785aa9c7a240081a23b94ffdcfbeac67e538c8709cf58a58e4d5e2f277f33a881ba7078fa3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243537, "uuid": "1fa471a3-9694-4bf8-8daf-dba22303271d", "value": "T159068170C5055E71693D3EAECA3656C8CA69132BD918E90E3DB83172EFAD331205DFA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243537, "uuid": "c4385526-cb41-4e46-b44b-d9db0a461041", "value": "98304:JreUlnec8ZM6FbEIk7lta21/oGM2fBfZASjlUnFZuB09S6rqpxqNEbFOFNwS1Qjk:FXR9feFABjpeMFWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243537, "uuid": "06aa6724-34a6-41d6-bde3-fc43739faa97", "value": 3900431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243537, "uuid": "a2932a96-528f-4f91-92b3-c25b51629217", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243537, "uuid": "de23605f-bde9-4432-b2cc-96677533fcee", "value": "zbzknwds.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df87fdc-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788278129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278129, "uuid": "5ef57daf-896c-475d-85f8-b202291ad5c2", "comment": "Malware payload (Mirai)", "value": "0b1cf59d62eaae1d38380984ff6c4437", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278129, "uuid": "02339419-c30e-4b09-aa04-53422e39c45f", "comment": "Malware payload (Mirai)", "value": "05167be9a9fb578c118ac1e19e50f0d6aa000f5b89ee75d3ad17659743b6e720", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278129, "uuid": "67f8245e-9189-48b4-a85d-2594e3a89840", "comment": "Malware payload (Mirai)", "value": "a6a91ce20a5a2870fa97855f6655397c8742d530", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278129, "uuid": "1143ff58-07a9-4d7e-8bab-f7c3d4e64898", "comment": "Malware payload (Mirai)", "value": "d6caff4e790e0f6583099de86c1d521d79589df4b495e80ae5b53082e94bfb18bc504e585fb52df37808a4b141e954c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278129, "uuid": "57c8b927-ef5e-4151-b4ad-d90d29af0e6f", "value": "T1B7E33A06B30C0A47D1A32EF43A3F67E093EF9AD121E4F640255F9B899271E365586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278129, "uuid": "98cf7a7b-8d22-4f1a-beac-da9fa5c16cc6", "value": "1536:/mKtwod9Ivd0aQq5uB4rxfnYWxf8v8JFjr7BWuOGp/u1vWqvApBFFUZVihIY5qOD:OKtBAZfYWxTJR7OwuET3nIO8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278129, "uuid": "34f551a2-10b7-4919-b6f8-5329bb829738", "value": 146320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278129, "uuid": "10e978b4-7e2c-40c4-842d-7c32b9ccf2ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278129, "uuid": "57c91354-6fec-4455-8c9a-d5584b50e315", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28048c7a-a608-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1788268938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788268938, "uuid": "6d1e6544-96a5-4cb7-9bb8-3443ac4a7fea", "comment": "Malware payload (CoinMiner)", "value": "0a910c63fc8053d4bf7fb905dde4d840", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788268938, "uuid": "9b839f30-9bbf-4867-89ca-5395f7ad48db", "comment": "Malware payload (CoinMiner)", "value": "05dfa058809006968aaf4c27425f91a2fa154a8d2a06e5458383849da4be27b2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788268938, "uuid": "76331239-2fe4-401b-b6ad-d0e53c94161b", "comment": "Malware payload (CoinMiner)", "value": "d801018d696fdd15d00108ddf9f62d29518a5d2e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788268938, "uuid": "29850f23-e8da-4120-90bd-73f4c5febd3c", "comment": "Malware payload (CoinMiner)", "value": "8f26965100d15211c997f62d57fbae71de4003a406af043372e2ec415daf9b7c2468eac0f9d8c21869f39777aa977550", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788268938, "uuid": "cb877d2c-8ff0-4096-b89c-3c3fca6a6ab8", "value": "T1C646339978EA90B4D013C378A293B0BDF23E3BA09770BC6B76C865544ED6D28503F756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788268938, "uuid": "28ed4156-bcea-43ae-b717-f330c18da6e3", "value": "949ec789a5933fb6051c9013a550fb57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788268938, "uuid": "03a13cdd-76b3-43c9-824b-4eaa0f2ef138", "value": "98304:vzURqaiV01GnNl1p83fzJ2TVYYRaMSziyuWZxVZ4My2A9ZhpI4h7Ht0zwS:vzGbiV01GnRp+JWuY0MsZjZ4XLI0uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788268938, "uuid": "05b6820e-460c-4770-a410-ac3003c75911", "value": 5349376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788268938, "uuid": "5eafabd3-54f0-46e8-ba3b-99ae8a7c3ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788268938, "uuid": "5a8685f4-637e-4bf0-87c5-316a54b84a43", "value": "05dfa058809006968aaf4c27425f91a2fa154a8d2a06e5458383849da4be27b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e6d26d-a60a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788269931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269931, "uuid": "fcffb919-aa69-4a42-bece-54d11b058bbc", "comment": "Malware payload", "value": "6f418901bb7476da8872b78a80801978", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269931, "uuid": "f8642162-26ba-4c2a-9901-4bf1e66e0f82", "comment": "Malware payload", "value": "06d029773ebf94844a3c5ffe5bc901f435b982f6f5af726e501c4a9d04e1456f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269931, "uuid": "619ee2bd-8399-4ef7-8c9d-141e250f6c4c", "comment": "Malware payload", "value": "5fa7aefaab01020adfd9f461b02d92bb5a76d52c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269931, "uuid": "c28de823-ddf3-4384-9971-2c2ff23e5e2f", "comment": "Malware payload", "value": "19584d31d17d7b8c8fc6ca25212b2256a57d2a04326669129e94f5f5590ad5755d79fc0971815a7a68026bf4e16fd6cf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269931, "uuid": "18e2c413-bc62-482a-9f99-c502a98430a0", "value": "T1BB235C512A857C14AA98C8371D7F2F0CB9A943E6324452DE7FCF3CF68C4AADD920961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269931, "uuid": "5ad1208f-578c-4743-ae1b-58919e39ca56", "value": "768:zQFWzZx5y9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:kkzNcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788269931, "uuid": "90b7dcdd-1fbd-401a-a8c7-86ce49c695ec", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788269931, "uuid": "108e2444-6a3a-4b2a-af8c-e9deb0d480b6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269931, "uuid": "ea3bbcfe-6841-4a23-a83f-a35d289654d4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fa6343-a5f5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788260883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788260883, "uuid": "7a76fc7f-b99d-447b-a7d3-92578067efaa", "comment": "Malware payload (Vidar)", "value": "9a7ee040e5bbe2fbac454e84c0ecea68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788260883, "uuid": "82cb5459-6e74-4355-8df1-633a69553534", "comment": "Malware payload (Vidar)", "value": "0729b27468ab4f7558b02d34769705ea2846706844deacfade369c739b25f7cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788260883, "uuid": "4557e732-be65-41ae-9583-418bf7c9af41", "comment": "Malware payload (Vidar)", "value": "8d1213571218b56f5ba7f9704ae951de28d04993", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788260883, "uuid": "74ddd9ea-847e-4ead-beb0-bb49ff8d6c5f", "comment": "Malware payload (Vidar)", "value": "a7e8ba9854d330175c465c798e68abcfebd3ecc086c08b68030d688a542e23f981ab8a8f4459dc937b40fc1c43238459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788260883, "uuid": "6bafa2c5-850e-46cf-bcd6-15ebaa7bfe59", "value": "T108967C077A559094D09ADE3880B60B956234BC8D87393BE73FA1AEB47F617C19736F80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788260883, "uuid": "b4780c92-1089-4365-9071-8a1d7b62dc85", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788260883, "uuid": "6cacfeae-f7c6-407c-8dcf-45827ba1d1e3", "value": "49152:Vx9GYoW+Xv505wRqEii9qfiRYsNOmBuX4s4VC2vuGqL0C7ypm/wjYF7e+PsmCwUv:VxSN05wTTqmBuX4j2NYUDfR2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788260883, "uuid": "d4aa30b4-948e-40e6-963f-0b54f453e3eb", "value": 9447344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788260883, "uuid": "63190893-5c1a-49a8-a4c2-7da7bdc5dfc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788260883, "uuid": "4086f7bb-0e19-4306-8d29-b1f0c16aec0e", "value": "0729b27468ab4f7558b02d34769705ea2846706844deacfade369c739b25f7cf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b490002e-a609-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788269603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269603, "uuid": "d709f6d8-c842-451a-baa1-7a0c9f537970", "comment": "Malware payload", "value": "3da54a64d98decc62e035cc18db2e03e", "object_relation": "md5", "Tag": [ { "name": "CarsoRansomware", "colour": "#A0FFA0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269603, "uuid": "8ea2d65b-de2d-4738-9a72-ae37a27d3557", "comment": "Malware payload", "value": "077da46ddd4a0ef891926d7666667d3f837e4ef6a76c05bf61e0ff1b8ea48e2c", "object_relation": "sha256", "Tag": [ { "name": "CarsoRansomware", "colour": "#A0FFA0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269603, "uuid": "407ee015-b407-402e-80ea-8308d309b0f7", "comment": "Malware payload", "value": "820ada8f026a448dcb88f288197ebaa8ed3673ea", "object_relation": "sha1", "Tag": [ { "name": "CarsoRansomware", "colour": "#A0FFA0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269603, "uuid": "0b89e1be-62d9-4ae6-8449-100fcfe6b43c", "comment": "Malware payload", "value": "f1cd85ff1d59571a1a8f4eeb9e15016c18957f1d0b0abe433ac494153f8bcae937e922ddf575595eeb885543f4367e6c", "object_relation": "sha3-384", "Tag": [ { "name": "CarsoRansomware", "colour": "#A0FFA0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269603, "uuid": "5dfb848b-5e37-4008-b0f4-a2564fbbdbcb", "value": "T19CC32A17BAA8017DE2F6D67DD9E28812EB727C49479167CF07804DA74E326D0EE39702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269603, "uuid": "6c7a6e18-1f4b-499c-8ae6-59878ba50282", "value": "8fc11c2c6de887de81bbe39813e94b7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269603, "uuid": "0ebe6a64-6704-4573-9da5-f08c58c7ae31", "value": "1536:4D3jKv4yPEwnPAg+W502YUe4gHFu7VmPZA//XjU6RpXBlMPZI6pvuJ4:QpyRPGOlteXFuMPK//XjU6RpXAq6puJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788269603, "uuid": "088df125-987c-4940-a447-321ba35f8436", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788269603, "uuid": "e34bec25-8844-44f4-8fbf-ac3ceccdf3a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269603, "uuid": "98d22431-1394-4ca3-8f32-653afc38de44", "value": "077da46ddd4a0ef891926d7666667d3f837e4ef6a76c05bf61e0ff1b8ea48e2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c203503d-a5a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788226247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788226247, "uuid": "efbc6ca6-83b7-4702-9b3b-822b1c3128fe", "comment": "Malware payload (Vidar)", "value": "2e00379a6c31a72dc3b8f7937faad2cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788226247, "uuid": "1ac18984-915c-4196-8b85-efa3d5782214", "comment": "Malware payload (Vidar)", "value": "0866f1acf9460fa133f76adff4182bbdf621083e807d49387b50a9e10bac3feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788226247, "uuid": "c31c859b-a804-4ecc-969d-201bcc0d7852", "comment": "Malware payload (Vidar)", "value": "283675e53d0d3d6a84a8e942e917fab0e81f1523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788226247, "uuid": "d9a10a90-a443-41ff-9a4c-d629dbff9849", "comment": "Malware payload (Vidar)", "value": "5ba5212f80b49366428bda642af769bd34071348d23e4c6e508b7e4097cea670d73a4cecb0c90c7852f5391414c7d815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788226247, "uuid": "d9de654f-658b-47b5-b42a-66aeba6c948d", "value": "T1FE366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788226247, "uuid": "ede0b2b4-ea8e-4ee2-b2cb-bb99952795cb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788226247, "uuid": "013f6011-2ad4-4c5c-a301-3125210d2557", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaV:uc3XND1aJrCOkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788226247, "uuid": "132685c8-1838-450b-acb2-a58731fed25f", "value": 5003417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788226247, "uuid": "c45cf891-4af7-4a55-8172-7e2a889332e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788226247, "uuid": "1c4a901e-8b50-4926-9d5d-ea03bdb2c863", "value": "0866f1acf9460fa133f76adff4182bbdf621083e807d49387b50a9e10bac3feb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0f914e-a5c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788242130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788242130, "uuid": "39f0ff1e-bd51-4674-ab32-fd36447310bf", "comment": "Malware payload", "value": "60a288ba373e6b16b6332fdcef1f2054", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788242130, "uuid": "f7c84604-e24b-47fa-9001-44036d46df3b", "comment": "Malware payload", "value": "08f3c21b845ef793a694381b2da6c4213a5276325224515198b37afbdb256d1a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788242130, "uuid": "070ebd4b-561a-47d4-8393-1840963593eb", "comment": "Malware payload", "value": "e791047bcc24c23a826f5830776151cff2ede203", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788242130, "uuid": "bb61b7f9-7e14-4603-ad91-053ac750d37d", "comment": "Malware payload", "value": "8ef14b1a89fe59b2b76bdcc380d744a4112fa9d1e904e09f5a46189f88b15c34ae626403ccddbc9eeb12aa737395854c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788242130, "uuid": "d788f048-a50a-4754-81a0-593ce0c96e0c", "value": "T157F05C4284A04919523016146EC0F9095AEAEB47434A6D8872EA50BD4FC4BC5CDCF57C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788242130, "uuid": "46fbc36a-570e-46b6-ad39-fb15d472c31b", "value": "6:qTIuJzhqIwGiY63fAbplilAl3t11/+SR0AqIbR2AWHwlMYAV4LKTjawlgxF0NAE/:qTp0JYyg9193R5qsPWLYAV8qAEd2QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788242130, "uuid": "9cf1aa09-96a2-4877-96f4-2ceab704ece8", "value": 446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788242130, "uuid": "fd027d96-f731-4e84-8745-0418f3eb2354", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788242130, "uuid": "95c8d2b0-2da1-453e-a9c5-f1c62e62f486", "value": "goodthingsforbestpersonforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a78eb6b-a5fe-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1788264594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264594, "uuid": "aded4622-02fa-47d4-9546-a619861279c1", "comment": "Malware payload (MassLogger)", "value": "59cfbfa1c167953401215831cd4d15ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264594, "uuid": "932e8f4f-e555-4b76-ac00-cc3cd8e6dd18", "comment": "Malware payload (MassLogger)", "value": "09eb32938a0f1265b45c4724b1d994fbc6d2b2ad99f0fab17f545c93e2f42693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264594, "uuid": "c4696c69-d6b5-45a6-b613-6b49227b7b24", "comment": "Malware payload (MassLogger)", "value": "857c0ecd878174772098d96a093cfb0b1b87a353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264594, "uuid": "5ad6fbca-aff9-487d-b285-cad9f36f972a", "comment": "Malware payload (MassLogger)", "value": "bbfad55f1de785cfe6ea66adddd0c3f7feeda5cfa783eeef606fe86bba7ddb5d4a2a7f67e4d5dc22ac769e4de35e8430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264594, "uuid": "2d8b729a-9cb8-4e70-b861-ca745d751e94", "value": "T18115F155222ACE12C4B64FF40971E6F40B79AEC5E521E303DFE6BEEFB53A7501904252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264594, "uuid": "ad823078-e16c-4995-817a-ed160c7fcbe6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264594, "uuid": "75d0ec17-832c-4c21-8cbe-62f44939ac48", "value": "24576:wNi2gM2WsXK3u7Gar4j28J5MA1xIA89lmQN5CTiQa:wovJT2Cf4jZdu9lmy5CWQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788264594, "uuid": "0d0715e0-8864-44d2-828b-be4c2977136c", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788264594, "uuid": "a6ec9f9b-af8a-43c6-b528-03beec801763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264594, "uuid": "73bd60e7-5451-41f6-be53-5196491cb047", "value": "RFQ26002365 - 2026 P.O No-1403 3048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adce49b3-a5e9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788255848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255848, "uuid": "c02cd280-3e9f-4768-9638-49263a7843e7", "comment": "Malware payload", "value": "17ea112029fe755c2963f0d9dcebcf94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255848, "uuid": "823fd310-706a-45be-8ee4-e3b562066dea", "comment": "Malware payload", "value": "0b37b477af11ec41fb6edbdeb6d9fecaa7b6e95636e036767fe64b029bbcb392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255848, "uuid": "03102034-7bc9-4679-be07-a768b10e46cb", "comment": "Malware payload", "value": "c44f024b37a3e1375fb7bb1a61fa0972e7e5f112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255848, "uuid": "4b67a960-7244-4e7e-9d18-5b843b8e8449", "comment": "Malware payload", "value": "1c21c947ce4d2747640934327893009cae44ba42c45b2d40b8da61832fa0c2e0f11386ed4b775b29ee064b83bd102d42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255848, "uuid": "b9dff0ba-750a-4e2f-baed-5065b73d3a9a", "value": "T15125D024535C7E0BD19E6A3394F1510C63A9A0B9E8D2C75A1544EB3D2FC1391BE32BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255848, "uuid": "0ee241dd-73b5-499e-ad87-f90041077ae8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255848, "uuid": "1e12791b-766f-4624-8a14-e4692f536a30", "value": "12288:I2m+olz2xoM2/71GaBscDo+OK92oaX1wqJsOUbrg0+JZTtILQbJlBYVsLSdTpgp:Jm+o5+2/caBhD033KqJ92jEtILvTBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788255848, "uuid": "212177d0-2090-4d9d-b7e9-930cb61d7392", "value": 970408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788255848, "uuid": "e64d0b76-0557-45ed-ad79-c8f1f32d2063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255848, "uuid": "d81f1e6f-4d0f-400b-880a-1f514d83af5f", "value": "SAC_tool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e687506-a5a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788224872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788224872, "uuid": "79c4cc5f-a44d-404c-a59d-6c274945c2ef", "comment": "Malware payload", "value": "05c2d033ed83f8d2f4967601626b8f36", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788224872, "uuid": "1223fb81-821b-417a-84eb-d01496ceb260", "comment": "Malware payload", "value": "0d4db24c7534f64e080fddc211c026c56976187b7a30bd2fdd35316ad6f450e1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788224872, "uuid": "e747da56-1c21-4bb3-b4f8-7360d78cbf53", "comment": "Malware payload", "value": "66e3425cbc77907a307053067cacd63703b54fd5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788224872, "uuid": "3f11a1fa-dc4e-4c3a-9ac1-848d771c82b6", "comment": "Malware payload", "value": "06829a70800304a1afe49312c561c75df30a3d9cecb32ae39ea5030291967621238d021e313930d98c477dfa8bab49f4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788224872, "uuid": "8dedcc87-fbf2-43ce-ae0a-8b0158908f35", "value": "T19B31139B00105BB10112CE8E77A3784DB68F95EB2D9FDAD48C491EE982887DCF261F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788224872, "uuid": "dadd84e0-42e1-4d1a-9124-33379ec55e1f", "value": "12:UF96FtBE6QFWGi6FWGlc8gT76gVB4vtir6tPvCDHI6HaBqXUDNnL6nK7pSiwJ6bt:3zGqGCJhH2RgK7d6+ovJv8N4yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788224872, "uuid": "f2dfd56a-63b4-48c5-a6ae-cd4846a12b2d", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788224872, "uuid": "dd4860ca-8845-4d9b-b247-2c7a8116c355", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788224872, "uuid": "37771f1d-9388-407f-bda7-5d83863f375a", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d46c49-a616-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788274973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274973, "uuid": "b3a0a336-72df-4de0-ac3e-9a4affb10789", "comment": "Malware payload (ConnectWise)", "value": "98ff1e31dbeba21050fd1415c706d4ae", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274973, "uuid": "22ef844e-73b7-4b3f-b4ba-d825135f810d", "comment": "Malware payload (ConnectWise)", "value": "0d946f5226d79db75e091cac5033f00d9f9c931258b1aabe0947f297cceb9d40", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274973, "uuid": "dbeb446d-057e-4afe-88bf-f037a0593351", "comment": "Malware payload (ConnectWise)", "value": "d1f67695fb22cf1642cd09277fea9d5c1451a41d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274973, "uuid": "4c41632a-d52a-4e14-ad20-d25df63c3416", "comment": "Malware payload (ConnectWise)", "value": "1c047fb058b7caf057204705a34a91f9817dd77b4f52bc13718d6b9270f8aa0f9a26c434080d0f57b66f0a5784263710", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274973, "uuid": "87abcb46-0c16-4f08-ae38-3995165083f3", "value": "T10546F141B3D695B5D4BF0638D8794266AA34BC109712C7EF57A4BD292D33BC08E323B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274973, "uuid": "5c291f34-11e1-4d98-8fdf-060834ba4255", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274973, "uuid": "c12375ef-4889-4826-906d-d48285fd1130", "value": "49152:0fmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:7rs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788274973, "uuid": "0477428f-fab5-45e2-839f-afe9119842d3", "value": 5719576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788274973, "uuid": "126fece5-6f18-4877-911d-45d80866e62f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274973, "uuid": "0ddc9796-007e-4109-8f4f-c9b935715d9d", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5d878f-a62d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788284862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788284862, "uuid": "8b8fc98d-e286-4f70-959f-ebf0e3e0d83c", "comment": "Malware payload (Mirai)", "value": "8541506e6a05622b05b76c9ec67adc99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788284862, "uuid": "e68b3788-01de-4727-aa5f-7fb003230fc0", "comment": "Malware payload (Mirai)", "value": "0e5a447ff15a611c404c2887d62a2fc81e45a9e9f55acd6d1dced124774187ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788284862, "uuid": "b9de5c41-18bd-4270-a0e6-159c71adea44", "comment": "Malware payload (Mirai)", "value": "93e7213d55fb8906c40f027a29ce40f88baf26fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788284862, "uuid": "bb5768b7-d5dc-4dac-be3e-53a582f01521", "comment": "Malware payload (Mirai)", "value": "69cb8ec0b95e6123019ccc5deb91ac4157065bb1118e7809b5177f4246a527426e997490920c6da41700644a02aa9aed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788284862, "uuid": "c95eb5ca-efa8-4c5a-a30c-5ade22f25bdb", "value": "T1AA840A44B3B1D3CBD254EE7053362E17AB6A863238E7F189610FBB73137617445DAAA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788284862, "uuid": "cbbd4c5b-eb20-4ed5-9608-d752e9309c3d", "value": "6144:/1fIhfFAQMoEoiNdCAnDPycxbsmGmVL8q6rJKodG8aJFCPKk0J3VRgSM:/SADqcxFL0JKhPlRgSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788284862, "uuid": "c59b018e-bad4-4ea3-9463-87de014d021a", "value": 392416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788284862, "uuid": "14f2cad3-c156-4b9d-90e0-e8b238d85036", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788284862, "uuid": "01791b3d-9633-46de-bb25-352929364809", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d823a73a-a624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788281260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281260, "uuid": "467dbc73-6870-41b2-b64d-dc4b333dcd62", "comment": "Malware payload (Mirai)", "value": "59e1661f2135de29d53b8305231c8f3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281260, "uuid": "bfed8fcc-1539-4218-b707-2d65edb0dcd4", "comment": "Malware payload (Mirai)", "value": "0ea66440d8fa52d4030b78718542f0865bb205d6593bf694a399bb4c29507051", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281260, "uuid": "937e4130-a369-496f-b9d1-620c799fe217", "comment": "Malware payload (Mirai)", "value": "358eea67ae0073fabda3a07b427fb3f4b3f05a01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281260, "uuid": "db052003-1c35-4896-b556-13ebdc4ab424", "comment": "Malware payload (Mirai)", "value": "f758c882dc86061520326c742adf6fa46c43a1c68ab4c5f7c831854026ec53a4d155f8d1d3915aa2868230673e1177c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281260, "uuid": "02394311-60ad-498d-a1bf-2c990147f009", "value": "T14AA43CC853E3D7CEE214E9744392681A6CF6063374E3A58BE26EB63313E719418EDD61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281260, "uuid": "8ea575fa-f742-4113-ac14-42a9e2f69a60", "value": "6144:WkNlar+fsAi1cpheo4CVaN2w+YXrIC0tUNw18ODm:WkN444WprVMvXKtUNwGODm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788281260, "uuid": "c76250a1-99af-4ac2-88d8-5858b59c1aa5", "value": 449848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788281260, "uuid": "e355721c-3cc8-40f2-a54f-83bd0213818c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281260, "uuid": "3fb5b823-5dba-4d06-96c3-fc6a6fb705c8", "value": "0ea66440d8fa52d4030b78718542f0865bb205d6593bf694a399bb4c29507051.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e4ee10-a619-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788276238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276238, "uuid": "beebd87e-e2b3-4c55-a01a-8b82935cac7a", "comment": "Malware payload (ConnectWise)", "value": "507a7c240fc334d9c5e74eaccdcc37b8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276238, "uuid": "f77d8277-f6e7-4596-b2d6-b1c58dc575be", "comment": "Malware payload (ConnectWise)", "value": "0eb45fdc5504805d34596dd7063c686536726536dd8300c030044d01521be41b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276238, "uuid": "eda5c3bb-8313-4462-924a-03e029a9cee7", "comment": "Malware payload (ConnectWise)", "value": "137c7a65c46c4e38007c397dcc96af10c4a65223", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276238, "uuid": "1e07372f-840f-4b55-ab37-87cc051de358", "comment": "Malware payload (ConnectWise)", "value": "7b382dcc3e839dd155ee2afcd73d7c4fe5bb801838365a7578f5e01bceddb66d4d391e2ba269347925bcdfd7cc78bc0e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276238, "uuid": "4abdb818-7d76-46da-ad95-a2816ed1411c", "value": "T16C46E102B3D695B6D0BF0678D87A46696734BC049312DBFF5394BD692E32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276238, "uuid": "cbf9ffcd-54b5-4be8-91ac-6d94655320e0", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276238, "uuid": "6f6a12cd-397b-4a4c-a839-a607b188d8ac", "value": "98304:8zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:8hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788276238, "uuid": "fa4e24b1-152d-4468-beaa-04b87bad0636", "value": 5686896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788276238, "uuid": "525af82d-9173-4a15-b020-7727f85c0591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276238, "uuid": "c5a3c4cd-7128-4462-85ec-0237d85f417a", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6b1ae1-a5c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788238342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788238342, "uuid": "832b0296-4e58-44fd-bf3c-39742dbad31e", "comment": "Malware payload", "value": "e055e41b4fcfae545c51506fa16d4085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788238342, "uuid": "f459a407-60ac-44c1-b3d1-888658d70b48", "comment": "Malware payload", "value": "0ec3487f79cb0fc47ea70ce3f93b13bb3013e54cd65c2e9b3c83c4663652321f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788238342, "uuid": "3e61bb9b-4c1a-4105-b2fa-8244da2d2015", "comment": "Malware payload", "value": "ee1089ea700471032c96531f52316c359ee2e696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788238342, "uuid": "0001a778-f24e-4d1d-b4c9-d4d858053252", "comment": "Malware payload", "value": "173362f75f99d79d38155fa15d00413f171541b7fd8b0d03ac6c83f79962cef8f13128192428b149852955a79376206d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788238342, "uuid": "168d41e4-b0a8-4d31-a6dc-6d1f8103ba42", "value": "T194E52354BDC67BB2E07AC3BB42E3A0BE3129378589A44C9D37896B113E639183D77345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788238342, "uuid": "b8f12cfe-b4e2-4fd2-a16a-bf93a04aeaec", "value": "5a2ed47d8c6c6433dbc831d38c92042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788238342, "uuid": "4963c5bd-2a3b-47f8-b147-a99b35be00c0", "value": "49152:/3VoV1Q8nE6+a9iD4KYDVyJv+CZXG+Eoi+IQywxoE9nLOf6OuEm3wHFiyr/Vkfvr:yV1QMETfcDsdZcrwGwn0Vrqwljrm5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788238342, "uuid": "7c0156e7-f520-477d-87fa-b5921a00e141", "value": 3041280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788238342, "uuid": "2cd875b3-6ec4-49f4-bda5-a0832c4658f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788238342, "uuid": "5c79d4f5-3939-4485-a540-fb8b8f397414", "value": "0ec3487f79cb0fc47ea70ce3f93b13bb3013e54cd65c2e9b3c83c4663652321f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc9f26f-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788278128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278128, "uuid": "50cec7cd-e7ac-4617-8c57-f5431735e472", "comment": "Malware payload (Mirai)", "value": "d13178332b8731ee8e3de755f7121672", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278128, "uuid": "ac00c8bb-3188-49fb-8c00-4e1f5a73fccd", "comment": "Malware payload (Mirai)", "value": "0eee4b37df76816992a7f7e087043489feaa391baddb8410be8d5f93c4514450", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278128, "uuid": "48996769-ef01-4706-80f5-0e6c15763c61", "comment": "Malware payload (Mirai)", "value": "0d43558c2d583a248bbfd30eec11cc344c29aae9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278128, "uuid": "37aa7790-31bb-4094-8f8f-0defc47f5bd7", "comment": "Malware payload (Mirai)", "value": "5a018fbb2a1416b2fc927f206e9d49c0f5758c53cbf58b16c0021149fde5908c39d11c04741a09ce78b88c2a86e9aa5c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278128, "uuid": "cb0bdea9-38ce-4dc5-aa0d-9e192e9f262a", "value": "T168A37DC5F643D0F6E94701B16177FB3B5B32E0B9102ADA43D3685E32FC92941961AAEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278128, "uuid": "98212303-aa43-4eff-96aa-796ad2d772e7", "value": "1536:hmuIH35ovikT0kXRWRDMBrPLbVCFbzdfTyliVJCS5xjeQ2tTnF:hmuE35oviC0kRW1MBrPHV2zdbyloLEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278128, "uuid": "e7d55da9-ffbf-4f5d-b202-f35adf6a4b2d", "value": 101672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278128, "uuid": "af55e94f-9b66-4648-9c0d-6ae1c5285202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278128, "uuid": "e62beefe-75ab-4d60-8b9d-9a72cb78dfed", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1d3c39-a653-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788301236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788301236, "uuid": "745a9ae6-606b-4fc0-b84f-ced9311e1954", "comment": "Malware payload", "value": "f692344f03c5fec20f49424c8a6de1df", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788301236, "uuid": "cb94841d-34fb-426e-a27f-82b732c40a29", "comment": "Malware payload", "value": "10d4a7e6b370aba96dab9da75d56b3fd3e53938423cd7f302790b59fc42b3f97", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788301236, "uuid": "9bcabf37-43fb-46c2-b156-46206d4f3476", "comment": "Malware payload", "value": "9791e5c2e1002827505243c7ea0f465b5e46925b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788301236, "uuid": "75fb4334-ee75-46c7-b367-dc5cac1c59a0", "comment": "Malware payload", "value": "21a49eac4d0e03b288f1e347a041ba40131275ad2d5b115697af77f58225bdb0a97ae605de2c72a4addb9bfe927ba694", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788301236, "uuid": "b578631c-c2b0-463c-ab98-c6cae5d87572", "value": "T1415191C417620A763C539DC337AF8C443188AAFE28C29E25A9EC74E4054EDCAF1C4B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788301236, "uuid": "dd5518a5-6e3c-4a71-82b7-9b99ea493af9", "value": "48:pKQvt8tXHtYt2t6tDtltat1totPatbH/tPtr:pJt8tXHtYt2t6tDtltat1totPatbftP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788301236, "uuid": "c1610fa1-6ff2-4e46-9f52-2a4071d7686d", "value": 2685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788301236, "uuid": "d811be6e-4bb6-481a-836d-294ca94fe313", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788301236, "uuid": "0b934b2c-dd1a-4ab2-878e-9e5d3c339f45", "value": "ruck", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1effd40-a624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788281222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281222, "uuid": "5cd68aaf-8587-4e61-9e6a-65ffb6615c55", "comment": "Malware payload (Mirai)", "value": "efb8761064078572a6c98a39b65d81ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281222, "uuid": "de299e88-9266-46bd-bb9c-a3fb806782c8", "comment": "Malware payload (Mirai)", "value": "11bb92874b800fef89cd738520791431f39df3e51caf89b8e50d19a46d95ab21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281222, "uuid": "f33eb373-69a1-4b4e-9eda-6cbd6487d088", "comment": "Malware payload (Mirai)", "value": "ae419a8d6e8f2f3f7df7d61406bf7ad0b1c6431d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281222, "uuid": "e5f7e202-0dcb-4d97-8a6b-9e6af3cfa4dc", "comment": "Malware payload (Mirai)", "value": "2e7f97b3dd3211723a4e02327741d39ca11418cf4062a8571156b59dd571436c7cdadbdbb12f1e1c8ea422bfd4a19fe2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281222, "uuid": "08123b67-bc33-415f-bf71-c8e8514cb803", "value": "T1AA741988D2E3E2FEF155D97012257A1B5D3246373093F28AF39DBA7392B614045EEA34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281222, "uuid": "54644899-4599-4acf-831c-72e7537eeb3c", "value": "6144:qMitcZEEus9+upjWzSWaN4nOtzPlK/+drHa9v9:q1mEEWupM4tzPlK/+JHa9v9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788281222, "uuid": "30d7674b-115c-427f-867e-574425bb375f", "value": 353892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788281222, "uuid": "a004a98d-4ecf-4301-90a0-71d548104b6d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281222, "uuid": "3935adb1-4f53-469b-be0c-70c335bd63ea", "value": "11bb92874b800fef89cd738520791431f39df3e51caf89b8e50d19a46d95ab21.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec425cf-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1788278318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278318, "uuid": "39080457-902f-4ea0-b55c-637a7743a557", "comment": "Malware payload (DDoSAgent)", "value": "59df7dece442003c8b2d648ee1bb54c2", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278318, "uuid": "45738ba8-1796-468b-ada7-e99a2d06626f", "comment": "Malware payload (DDoSAgent)", "value": "12005831c060b0a64e2ccd1f490e1cf6b7601a4ba9b815b2962bf1c2f6627389", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278318, "uuid": "5e8d8d28-1729-4163-bd2c-4b51737d2d94", "comment": "Malware payload (DDoSAgent)", "value": "0e8e6400f76839f88b099aed1a0963cdf751b55c", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278318, "uuid": "a722cc52-8563-433e-bb76-e992d660ad64", "comment": "Malware payload (DDoSAgent)", "value": "c51107d04eb5c88baaea258507e400fd97981ec3bf1b9e38e06bce04442629bc65fb2c2e0d8fe31acdf313a858c671ba", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278318, "uuid": "16e0820c-8cf7-4a24-af63-cac373e704b7", "value": "T1688628177B69EB0EC76921341CB2CA9427291C8506D7A527B381F31DE9F20BD4A6ECF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278318, "uuid": "eb15a3c4-a209-4cd1-99d6-796ec87fe310", "value": "49152:rz5PetxdC2jgIkc8T+v4Z35+AwF728IcMuWJy3pnkAxHJPEP3pdXtA6sGV5TzsVg:g3AAGDtA6b4+Pi5TsZoEIWhnUjEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278318, "uuid": "b73fa371-fa78-4577-a264-cc23d3ad2877", "value": 8323287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278318, "uuid": "96e7c878-0d43-469e-aee2-6c00a8287d12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278318, "uuid": "159c75a3-cff0-4a48-9286-dd5e7e20b282", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f05ddf-a5dd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788250654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250654, "uuid": "87789eef-f337-40ae-8e2e-8499a4c394fc", "comment": "Malware payload (Mirai)", "value": "9d8496cdcad8a6071951b9ba9d969c77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250654, "uuid": "54cd1ff3-1431-42c9-9c82-42158c6c76cc", "comment": "Malware payload (Mirai)", "value": "12b0ff56a1c0540202125f596611767650df8a32aa0690561153440b006abb3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250654, "uuid": "4bbb86b3-76bd-4ead-bdc3-955fc42fd23d", "comment": "Malware payload (Mirai)", "value": "84319e37f413e5743c4b6b169924c7026f8e6444", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250654, "uuid": "760f6abd-6a6d-487c-b93b-9c9b4e82eb9a", "comment": "Malware payload (Mirai)", "value": "d361e4cacdea236bb590b1fb806e83b23895016f0f3c360b5f3c8f512ccf8616704470d51079a8828ff251a2c06350e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250654, "uuid": "2bc39a60-262f-45ee-87ec-41ed07154288", "value": "T1E3048DA3DCB27E60D266C476F2668A3D1B13E02341475E64B93EC2744F43D98F2A97B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250654, "uuid": "58409e32-b3b3-4926-b3e0-592fa366b66b", "value": "3072:OY+iy1AhGdS9tzmIvZAxHPpAGXWknBZwHzQeJ1EssMZc/T03ImIys61X2h5oI:z+Ch5t6IvZMhmkHwHzQWEssMOjh5oI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788250654, "uuid": "82c35c7d-9fac-413d-b352-0ef705bdc733", "value": 183024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788250654, "uuid": "e1ead397-c27e-4e1e-b9ea-ba7c85dfdd11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250654, "uuid": "fb10dede-c22c-4b5a-959a-736c9220c0aa", "value": "12b0ff56a1c0540202125f596611767650df8a32aa0690561153440b006abb3b.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03633033-a61e-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1788278326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278326, "uuid": "5c6bc76f-ec89-4dfc-a44e-ffe74dc2f04d", "comment": "Malware payload (DDoSAgent)", "value": "0052f783d1d483a7b5064a1fc8ea4201", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278326, "uuid": "ce920869-fd2f-4c76-8229-298401b586d2", "comment": "Malware payload (DDoSAgent)", "value": "136c27594f93dcc214448491f91eddeedf46d40574664c17579c31e02200bd65", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278326, "uuid": "8afd020d-2502-4e65-91c3-adacee93a4d9", "comment": "Malware payload (DDoSAgent)", "value": "7768bb193755180debfbb8f9a467c36f2b2f61bd", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278326, "uuid": "a76d3a0a-d15e-4758-aa8f-02eb293c4252", "comment": "Malware payload (DDoSAgent)", "value": "e18bf55dd36ec04a928e1f5a3effe45ba0e49252af7736bc27ccc7e3e1f4f2b170b2b5c24749706929deeae583847064", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278326, "uuid": "9e2b52e4-fcb7-415b-96f4-815b5c6f75bf", "value": "T1FA763951FECB40F6E9031D3144ABA23F23325D058F28DB97EA507F29F97BA911936219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278326, "uuid": "f905e9f1-1528-41d6-81ec-29134a5e2f99", "value": "49152:PmkLMS2fu8KSqnUnW/mRSQwSMC6hQzPVFJ/3ayXLynTTRJOI7JizTQBuGt7Yt7H8:eWMSJkwSTKyiOyJioBuCMzr7bgwqES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278326, "uuid": "820209fd-5903-40ac-904a-3137f2af1af2", "value": 7393464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278326, "uuid": "1795b00d-7e87-4294-a653-96f02b712fec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278326, "uuid": "38353f69-0d04-4f7e-aa88-bd65518b8c44", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a4ca8b-a652-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788300804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300804, "uuid": "5060e548-1e61-4f40-bd83-10d568192015", "comment": "Malware payload", "value": "7ff11fad90576c8db08e151b2a3ce5f3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300804, "uuid": "d83c8b16-a1f2-4faa-9c29-51e518f8b5c8", "comment": "Malware payload", "value": "15ad30836554afa7786618ce3e07957031b2f73473b4e871e6b579a63e5ff386", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300804, "uuid": "380c1ece-1462-4594-8bb1-6dc9f546b8a8", "comment": "Malware payload", "value": "c1e48dae948257e357b4df9653f3379c54020f4c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300804, "uuid": "1ea689cf-423d-49dd-ad8f-da9cee6dedd9", "comment": "Malware payload", "value": "9f1d48de229cbd360a5dd1ce795d282e0e96305121c3e9b3845989a38ac528ec8db28962b3b0fd5cdcab3485420b9fac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300804, "uuid": "4cf4d477-0455-40af-8a5f-a7e3f88aad3d", "value": "T1D9236D661A857C14AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300804, "uuid": "ead236e4-6a84-4ef9-afe8-2dc3e52f69fd", "value": "768:mXRWNGxVH9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ClxCcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788300804, "uuid": "62605e74-6884-427b-98d2-355977589766", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788300804, "uuid": "4d001030-beba-4f3b-a61a-3bfe78c165a8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300804, "uuid": "56af9682-62dd-4748-b614-d7c5937c71c4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3231c46f-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788243615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243615, "uuid": "f074d1a2-6719-4301-9d87-6db6b44f9acd", "comment": "Malware payload (RemcosRAT)", "value": "b15d3f181706eaaad5faf16d77289618", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243615, "uuid": "582bdd77-b61d-479d-b833-1a23626c91da", "comment": "Malware payload (RemcosRAT)", "value": "16a300ecddf68f3a86f1e84ab9c806ada8ca4d085387f1088667abe830ac49ed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243615, "uuid": "00028c79-9310-4343-a554-24e5f36a534e", "comment": "Malware payload (RemcosRAT)", "value": "2b09b79dd07dee78b708662a0272911ef7d677b6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243615, "uuid": "d0cb7eb4-f1de-4e8c-ba90-1c2c843c43f4", "comment": "Malware payload (RemcosRAT)", "value": "41fd1cd3b60bfe5b03749cf47f6f94c21674717ac89aa603e3e792f225b759cf5fc2c610ccd08bdfcba0d2b2dc0313e5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243615, "uuid": "93e21386-92c7-4541-b7b7-997ecc5053b9", "value": "T1A33502519DB95CA71D1E4291FB87C93C28238EEF20ADB82CBE601EA1D3F1F51C5E1856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243615, "uuid": "7fe09e73-b9f0-4f6e-82c0-94e30fd67dbf", "value": "24576:1WZxysHpB2JWts08WXGiSRZCf4pdorjlgohAYk:g+vJ8eqMZi4+C4A1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243615, "uuid": "99933f4a-14e1-4709-a3e8-71da8f0a2e13", "value": 1128872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243615, "uuid": "9b205d65-9135-41cc-bc14-c994d78b573b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243615, "uuid": "43b19968-903d-4ded-80e0-f1cd17f43a37", "value": "QTN S& I OF FS AT WH.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88ff936-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788277448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277448, "uuid": "fa228328-4667-420c-974f-e02fb5eefffa", "comment": "Malware payload (Mirai)", "value": "03e9a925fb09654726a10d920069c3d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277448, "uuid": "13ad37f0-8be7-42a8-ab98-785a4e9f00fd", "comment": "Malware payload (Mirai)", "value": "16ed5ee95da495d3783464288eae6b29f8b81026adfc19d1ad49758144835e91", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277448, "uuid": "6601959a-038b-4892-a158-c01d0a5fd045", "comment": "Malware payload (Mirai)", "value": "a9ed2438fee52e2c02568c7e03ba0dca2fb68828", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277448, "uuid": "3fcb0954-924c-4c2b-8b58-51cea2d4f0ba", "comment": "Malware payload (Mirai)", "value": "58f3baf1f7effd60435b66ea25c8661986ab8b23556775a11532f7fef90468082f65975cf69c2caf9287eec5a0dc4ea6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277448, "uuid": "75471c00-4ae9-4020-a79e-e260274f3306", "value": "T1D814C606AF520FFBDC6FDE3706E9060639CC651722A53B7A3674C528F54A90B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277448, "uuid": "fc06a86e-601f-4837-bf35-0f36d3dfb6f2", "value": "1536:sI1AzE2QrRQVx9hxxozrj+SGF1fLyB9LpFgbWLr0Yrn9iyRTs6UDBdlVDQ1GLN4L:dKzEFrSV/xajlILylt46qckLNnhOF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277448, "uuid": "0f81301b-c8fa-43bb-a647-774a4963cc80", "value": 198968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277448, "uuid": "fa425783-4ffe-4509-89f7-cc9461ea4ab9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277448, "uuid": "4b707e44-39ec-4e7b-9376-8c88afdc18bd", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f0ecd7-a647-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788296159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296159, "uuid": "cfc3fb8f-d6df-471d-85d0-eeac0ada3981", "comment": "Malware payload", "value": "6eb58bba50732638a3a17e5a23f55678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296159, "uuid": "d1988161-8b4e-43f3-84b9-ae6919e77ebc", "comment": "Malware payload", "value": "170d46202f09e9b3a5cbb5e2056123838e7370e5f4e5edf7f4c4497d47842d01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296159, "uuid": "c9f96a30-1587-4762-83c5-e7fc9b5b93bc", "comment": "Malware payload", "value": "a4af68cb38e8f99ce1df74e2950f7d1c1949e0b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296159, "uuid": "7be7d1ce-fcd4-4369-9769-6c39768fbf8c", "comment": "Malware payload", "value": "866b1402bc2d3f2e8ed43be37eb9331a1b8a6be510d8df35f439b687cfc4ded3dc26c128a63d804001fbf2427697b82e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788296159, "uuid": "3213e2b3-57c0-4d91-a3ff-a2e736ccd999", "value": "T1FA864A077A9151B4D099AE30C07E9213BB65BCCCC73533A31E606A741F797E0BAB6B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788296159, "uuid": "41d44afd-9744-491a-8313-c13144b6a90f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788296159, "uuid": "7189f2a3-0168-44b7-9666-1b0c6a825234", "value": "49152:VrC6fB2e3pPfTtkBIL4EuQ9lpfPtSDTdJ7aVgkVBVY0kgnsTxvfBT+neBsC7qcAH:Vrpj9qFQf16J7a8hTBXz7UM+yWl8yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788296159, "uuid": "4732aa23-1260-44fd-82f3-b4a5b46597ef", "value": 8233928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788296159, "uuid": "c560287b-34c7-4eb6-a545-e804f7293841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788296159, "uuid": "3f4b6789-a9b6-4d28-8b83-6036089bff6e", "value": "170d46202f09e9b3a5cbb5e2056123838e7370e5f4e5edf7f4c4497d47842d01.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce805669-a618-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788276089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276089, "uuid": "ab2d1e62-242e-4954-8515-02b021c62436", "comment": "Malware payload (Mirai)", "value": "595486a5108206c8bc47b92592b83e28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276089, "uuid": "f5ec4d87-f30c-43f5-827f-3db2cfef7674", "comment": "Malware payload (Mirai)", "value": "17b1eca18b6fdb8f0fad504032c02d51a9e28713645403f53633a574df790900", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276089, "uuid": "aabefda3-9449-47b5-8ece-8b624d59c497", "comment": "Malware payload (Mirai)", "value": "f0198f54e1870cae0072f8585ac5259452219617", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276089, "uuid": "b47c2c1b-3fd6-4ecb-a0b7-6a70fbb60b96", "comment": "Malware payload (Mirai)", "value": "451ffd547e0e5ce3361a32419e592a8c70e3ca48ee62cf08e2568ac26e0de2d85fd277b33bbedb1f265fa0fde7029a8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276089, "uuid": "9c157ec0-57b7-41b0-b97d-e80e0d8d9059", "value": "T12F84E988E1F1E7DED1D4EA75B31978093A230736A1D73146A51AFE3323EB1490AFD921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276089, "uuid": "0bebf0e9-9cbb-42dd-bccd-f475134e571c", "value": "6144:TRYN8CLrmbzaPcu3ztwVwVDtYDOxj7g8IhtweTuIBAe9ga93J:KNWbzaVaiDawUDue2a93J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788276089, "uuid": "caa7f39e-2e8e-4e01-803c-e1e738a1b901", "value": 374056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788276089, "uuid": "828f99ec-5b96-4cc5-bed9-9f1e98213990", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276089, "uuid": "aeaa1dc2-c7d5-413f-96b8-ee0c2ca6ba63", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e481501-a5fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788264734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264734, "uuid": "886eebd8-fc76-4f62-9eba-b9505ac84f65", "comment": "Malware payload", "value": "635e071cb98e56f6c06c947a556773a9", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264734, "uuid": "b8ab0bee-10a0-44da-bf76-4e0a9f940b52", "comment": "Malware payload", "value": "18550b4058e42bce55ab7b285402be28f6b964735aef0bf46052d368f99b02af", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264734, "uuid": "e3500157-b53c-4c13-88bb-00006f016fa3", "comment": "Malware payload", "value": "21b0ec96ee2d703ca18f03d995328af42846f923", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264734, "uuid": "ec5468f8-7293-4993-b1c2-85e4ed2f402b", "comment": "Malware payload", "value": "8f46709af641199a21216e9c838cc3daafce38b0435a9a30d26e9a0417171c6d325472c5a7f05e59d819ff19a703060e", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264734, "uuid": "312526a8-80aa-4549-8c98-943ec5b13312", "value": "T19075395B7CD118B6C0AA9232896251A27B62BC440F3233DB2E61B37C2FB3BD15D75794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264734, "uuid": "ffd6b4aa-43b7-44b5-91ec-28ae6913ecdf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264734, "uuid": "63f440ed-3385-4eb4-a41e-c542d0596b82", "value": "24576:cCI3nTmu5SrIbm7doCkZpm1JRinPWOaHLjGnmwLy:cZ36u5S0gk/mc6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788264734, "uuid": "ac8ad680-c794-4d86-b98a-e81f11303d61", "value": 1610752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788264734, "uuid": "f228eb77-353a-47bb-972b-d65cc5ac5141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264734, "uuid": "9c7f758f-5e6b-4cdd-a1fb-050e1d500de4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4cae9a-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788243553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243553, "uuid": "3b840055-41c5-4b0c-ab8c-bdeef3096ef0", "comment": "Malware payload", "value": "cdf7508c51ab3aecb47e4a2d306e5cfa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243553, "uuid": "de9905eb-3c76-4844-9722-53930f33b223", "comment": "Malware payload", "value": "1861daf3c9f2540e8641e261eff59fdb7c9cca4c82a94b35024a93082c56a5b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243553, "uuid": "ed720104-cd44-474c-a523-ee57fe255777", "comment": "Malware payload", "value": "43c3a979ab9e9e55cc0c32b87656e51b7d43ee93", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243553, "uuid": "54fb45d1-1baf-40ce-93ed-87171355f00b", "comment": "Malware payload", "value": "34b4315c70af2754c4729b63a6556d01d6caf35affeab0e99c94e46e3ca1676b74d9b772166e509dce373ab2cc95247a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243553, "uuid": "dcdb74e8-8e7d-47a7-910a-14f67ccf3c0d", "value": "T172649A59EE30C4207FF7623ADE777A99E57D411A284C086B3B7C66404F3B0D897AE984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243553, "uuid": "52f2e841-fd15-4bc0-b16f-cb1be58a519a", "value": "6144:peA2syLPpsUU3+vZqAy2Ej9oyyXhRlzBHBbIqOMpWRjF07pPQjOl5:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243553, "uuid": "bfd1fcdc-aba6-4c73-9971-543ac23effe6", "value": 308705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243553, "uuid": "ca59c0fe-84c3-4824-80ae-97dc7d8beb29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243553, "uuid": "4c73da22-925e-40cd-8cf8-7c87dc2abf15", "value": "Cotizaci\u00f3n.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ad8aed-a5d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1788247696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247696, "uuid": "3f6b52af-8b50-4148-a0f4-22195ca6f7e2", "comment": "Malware payload (AgentTesla)", "value": "2f0bd3afcaebfc0e5c00cb24a010f249", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247696, "uuid": "52000a8f-b828-453f-86e1-c773012ec5ab", "comment": "Malware payload (AgentTesla)", "value": "18d02fe2f332e5d0543426ca66b90f3a1cb2f87931e3c35ac1a5389057752f97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247696, "uuid": "729be0e8-c9f5-4fac-8706-c8b74fd481c3", "comment": "Malware payload (AgentTesla)", "value": "bb3af92528f17ac92928a2613e49d53c71814c1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247696, "uuid": "651f5371-eca1-447b-b58b-7100bded50ec", "comment": "Malware payload (AgentTesla)", "value": "c019e73cb554d4c3e5218c7f1487c697184e192abc0edf268ee33f02d560c42d421a2393d78936d5833bd9f7ef5b5ee9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247696, "uuid": "bfd0fcea-71dd-4e2a-bd92-d4be6c9f4d1b", "value": "T12FD4F1B9F9091AB674ADC73FFB3BDD5E1A7901F2284DB09D400DA7BC879039589D0862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247696, "uuid": "7df6026f-acb4-404d-a6ed-a3125515c849", "value": "12288:MZIL9Si7oV4S/zKbsXyEK4LkvvlaYCidtUHC0fINHkfeXQ7Qe2C1Qib:MZM9o/IExCRCtSEfeWOCyib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788247696, "uuid": "4122ffa4-c53b-419c-a4d5-0eac2f57aeb3", "value": 617547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788247696, "uuid": "f65943f2-0f71-4d5b-ac22-27d50a678059", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247696, "uuid": "0954c28b-8624-4374-959f-e94bd51ca066", "value": "RFQ_20000782_ABHI_L ANGLE_110_MICRON.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57675ff3-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788243677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243677, "uuid": "db81a1aa-695e-4a28-9227-a616d436ed70", "comment": "Malware payload", "value": "c510e661d14d7f62def14300946a6106", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243677, "uuid": "314bbb2b-0f78-4760-a11c-e56043125c9e", "comment": "Malware payload", "value": "1b5c7dca0cd80c1f359438581789c81f07dab32f6bc2b866287af79c7788a3ae", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243677, "uuid": "dd9837b9-f16d-4f24-b84b-c0b7a0e6442d", "comment": "Malware payload", "value": "409defa73d3ebd6670f3fd908aa5def09a6c00ad", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243677, "uuid": "6cc74818-4b45-4474-84c8-d641d9bff25a", "comment": "Malware payload", "value": "62475229e28eb7f5b7e0d202785bb4b240c771a7df069af7f48d5ba7a06426128295d624b88477f106c630b847801104", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243677, "uuid": "4f6107a9-0f33-4953-b5be-9162c1d03c77", "value": "T11A643AB89526D8043033E41B0F3DD344B928B55B785FB9AE35BC44262F3B589E6F16CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243677, "uuid": "ea44b50a-e0bf-4148-a028-c319d40aa12b", "value": "6144:yhMvi+Z+WFI3q7VAIPJhNSU1nw/4PsobsBGSGRDuHi1:Zi+Z+WFI3q7VAIPJhNSU1nhPsobsBGSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243677, "uuid": "bca75e05-09b7-43a0-b415-127d148cc329", "value": 308152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243677, "uuid": "d70e382a-cced-4ead-b610-ae415380bc6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243677, "uuid": "dfb89706-ddc7-4998-a265-004d742bb1a5", "value": "Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a6c73b-a660-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788307030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788307030, "uuid": "ed3b2a91-0a59-4dd0-9701-ebb80f3500ee", "comment": "Malware payload", "value": "7b70dffebf111dc575795f0b9da73f01", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788307030, "uuid": "7949659c-5710-4d81-b0c2-90ed0df8a867", "comment": "Malware payload", "value": "1b723594e574c00aac2c946ff738a0454f7c24f6ebc84ae45a6af9628b08cb96", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788307030, "uuid": "77f9c7e0-4290-4559-b395-2114a00e58fb", "comment": "Malware payload", "value": "ab2179c9cae5c512b50368eec018c728a4390e85", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788307030, "uuid": "23691824-7a23-4d31-a8bb-93a8e910eed0", "comment": "Malware payload", "value": "4523c69183e6967af795e5a6a90cf13753befb3249d8379a091035474fb92e612a447e4cdf8bb54e95f8e5a3cd26980a", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788307030, "uuid": "3ab4b3b5-b914-453f-9212-16c0edac4971", "value": "T141963907EDA549E8C1A9D23486629113BB71BC485B3123D72FA0F7782F76BD06EB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788307030, "uuid": "4ad94296-ca98-49d1-89c6-1dfb48658e26", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788307030, "uuid": "22ab5d21-ea22-4a63-bf24-a71539b5b810", "value": "98304:CSKK+N1oCdOthPIn6+qOkd+rykA4dI/EH:CVx1ouOthwuV+rykAWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788307030, "uuid": "03977003-8163-4461-b4a8-c69df264c05a", "value": 8777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788307030, "uuid": "e6e4d849-d29a-40f7-907d-296134a325f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788307030, "uuid": "9a007241-be34-4a3f-a7da-b8f59f889429", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8450c23-a603-11f1-bd95-42010a9c0009", "comment": "Malware payload (Loki)", "timestamp": 1788267006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788267006, "uuid": "3af70d91-3f78-4130-858c-d00b510ce2cd", "comment": "Malware payload (Loki)", "value": "fd127ea7d3e1375b723541cdf5d52132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788267006, "uuid": "f747e92b-a391-49b4-bbd9-16109e9c7a18", "comment": "Malware payload (Loki)", "value": "1b92d7190164658d01f5d9fa78525171ad8b4d07bf61507f83c36de906eeb0d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788267006, "uuid": "eee360cc-e141-46a9-9f76-345cdd25a5ed", "comment": "Malware payload (Loki)", "value": "10841d5eae5a9e9cb4d20fd18b2b97124a1aa9fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788267006, "uuid": "e9e603ca-71cb-45ec-bae9-8d67f1d8e433", "comment": "Malware payload (Loki)", "value": "cca126a5e1636c6b2d69b085ca4b4975f998d1da19e134001a975deeda8089335c306153d2dda90ad32cd5db7e47ab6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788267006, "uuid": "533356e0-407a-446b-bf4f-e8c885168719", "value": "T19325C4A26503DD49CC640274C12468F1F7231D9AFBA2956F62973F183F311AB7BA3D86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788267006, "uuid": "4fe63b2a-77c6-45e4-8c4b-67daf6412987", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788267006, "uuid": "8c7d3a31-1604-4cec-bed4-c2b2f92e3fec", "value": "12288:K+XXJ0jkMAl5o5qO0iX9HqPrb59vmFCtov1T5z:KY0jkhK5WU9eiFCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788267006, "uuid": "620fc320-6128-464b-a6a6-354b206ec9a0", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788267006, "uuid": "403b5e71-5d55-4043-ae75-af68393fb2e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788267006, "uuid": "43106b90-c6a1-4031-834d-7c9c0791d52d", "value": "FD127EA7D3E1375B723541CDF5D52132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f495c7-a5b0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788231480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231480, "uuid": "5365d08c-98e3-41c3-92ff-af9e492054f9", "comment": "Malware payload (Mirai)", "value": "98c816a34539d1b537b02374696f1dff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231480, "uuid": "160df478-f0c9-4ab0-9cb8-92d6037e8031", "comment": "Malware payload (Mirai)", "value": "1bdabbd4b6ce490592faeaa2f5a45992bb396c52664c8a188aff0955b78a5d75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231480, "uuid": "35a74b71-04d0-4623-9961-4876770c9cfc", "comment": "Malware payload (Mirai)", "value": "96062d3648b083aea774d3d17cd3315cb26f87c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231480, "uuid": "ffff7831-4f76-48e7-91df-1891ff09cca2", "comment": "Malware payload (Mirai)", "value": "3acb1d1b17d88abc9a381d665b75739a163dd9d0fcc8f55eb7e622dec5cd34d7188fc213aab60ff0276d04f07b503bab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231480, "uuid": "7bddb6ed-7714-4331-8582-443d50f2b414", "value": "T1E5044B46E6408A13C0D717BABA9F5245333397B4E3DB73069A28AFB43F8675A0E77501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231480, "uuid": "6db791ae-3331-496a-84c5-bf3511a9618b", "value": "3072:RqJW84DNmCqDjOGB+n+s5MXqVgzOSJ2P8TcPSdYDGbyez1MpaVNcRReGGYfHaKVY:PKjOGB+n+s5MXqVgzOSJ2P8TcPSdYDGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788231480, "uuid": "5b2030ab-5031-411b-adca-14ce6ce8ccff", "value": 185647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788231480, "uuid": "8d293ab9-cd7b-4540-b49a-79ae99aabf46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231480, "uuid": "ee5ba9c9-3a2e-4a28-bb17-a3fd04db9681", "value": "1bdabbd4b6ce490592faeaa2f5a45992bb396c52664c8a188aff0955b78a5d75.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8087558a-a5cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1788243317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243317, "uuid": "560c3e59-a90d-47ca-b404-1d35ed2a59eb", "comment": "Malware payload (WannaCry)", "value": "4886f4e21008ca36c8f80ac6d53dea72", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243317, "uuid": "b9cb65d7-42fe-4c3e-b2ce-78765d5117f0", "comment": "Malware payload (WannaCry)", "value": "1c1647b1e53a5e9b4d8fc259a39838568fa9a794ad82738093ee314e90361e81", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243317, "uuid": "78a9f77d-c7e0-4d77-abf1-a9466248ad00", "comment": "Malware payload (WannaCry)", "value": "94be61bcb15ea56f1b30c4997df962ca5ce998cf", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243317, "uuid": "738773d5-8dc6-4de7-99f2-d112d6f65438", "comment": "Malware payload (WannaCry)", "value": "d202b12bf6ad24f148119149aebedf15d8e4cdcc24eb6a7fbed0ec81582e6f78dab9fccfa0538e3c08d641983bccf3f9", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243317, "uuid": "605fcc30-78e1-4450-9bf6-ffdd36889719", "value": "T11AE53368727CD1BCE00619B444B38E26E7733C5557FE5A0F8B5046AB1E13B9BBB90B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243317, "uuid": "8de42ea7-81a9-4912-a9d1-a62df2d0ab66", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243317, "uuid": "35f6e820-8b4c-4306-9bc4-4a57713db141", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P593:DXDqPe1Cxcxk3ZAEUadz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243317, "uuid": "846a24c6-bd42-4510-a2c1-a674ee915a4a", "value": 3250176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243317, "uuid": "ab77e516-7acb-452e-b09f-9de5cbfb4a90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243317, "uuid": "a08bb112-0125-4a13-81df-88baf8afd6f7", "value": "1c1647b1e53a5e9b4d8fc259a39838568fa9a794ad82738093ee314e90361e81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773e565c-a614-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788274225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274225, "uuid": "956f0759-a827-4736-bf7e-4a195041cbb2", "comment": "Malware payload", "value": "fe6f44c957f7859b44ba2a55a2b49817", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274225, "uuid": "1b8a9ac7-1887-4b3d-9984-dd5fb88f56ae", "comment": "Malware payload", "value": "1c1d10518e59ddba96d43aea4b8aa5e66bcc6ee8be335adc83455dc84282201e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274225, "uuid": "e553d4ae-ccdd-4469-8a9b-877bf5e60f3e", "comment": "Malware payload", "value": "a11baf5ebb7b77ace8393af86684ae3cfa76c338", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274225, "uuid": "08ef3698-d689-4649-9710-14513232a599", "comment": "Malware payload", "value": "0b9d36a42bb3042cb54394ef95634e592d155b4fe8ee66d3ca23a613c48b6253bee2d4635129cd64250839982c837fe2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274225, "uuid": "e2f0e950-ccdf-4159-b74d-ee48ad3029c1", "value": "T1BF31819A04192D321103CA9EB3F63189728EA5FB3D5FC7D4D9491DA982883CCF161B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274225, "uuid": "cf24f702-ad5b-476b-a0a9-fe6931843665", "value": "24:QFfYUrPcPZgrJeFMur8y2HFUFxnBpky90:QFfJUxgrJf9Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788274225, "uuid": "abd7c6eb-2db2-46b9-bdc5-d6b56413abd9", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788274225, "uuid": "36a9c48a-ffe1-439a-878e-ac21524d39e6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274225, "uuid": "3911132a-5130-4141-98c4-0eeac96220d4", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196f1aaf-a60c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788270632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270632, "uuid": "2415a3aa-5099-4116-804e-32e54ae45256", "comment": "Malware payload", "value": "09f423ee3683c54e6afbffca0f15d479", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270632, "uuid": "e8a3eca3-076a-44cf-b4e4-976472d1c70b", "comment": "Malware payload", "value": "1cf3daa7d184cb55db306c7a955e8b466b6a6f000a930bc1a195d65d7170e856", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270632, "uuid": "05a98844-050a-4884-a5ed-9fe8d9495f38", "comment": "Malware payload", "value": "e0d453435bf3e00e88ffa900482587d02a31d655", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270632, "uuid": "c19d06c7-19e5-4e13-9cb0-a5b0a1bd3058", "comment": "Malware payload", "value": "af87a4ea1bfc73cb1905b7c27e124f39f0947956e4476dcf74fb84a98a1bbad6bbd1bce3b47a515281ad92f667c99b7b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270632, "uuid": "2869306b-a97b-4757-ad7a-a23eb67e775f", "value": "T1D6236C6516857C14AA99C4365C7F2F0CBDAD43E6314492EE7FCE3CF28C4A6ADA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270632, "uuid": "2f5fb38c-3814-41ec-b718-471022fb38d0", "value": "768:8r9NyXsZztC89GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:aHusZEcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788270632, "uuid": "530a13de-5666-48a7-8cad-098744087d5d", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788270632, "uuid": "ed6e4f17-ccd6-40f4-91fc-bf8b7db9d64c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270632, "uuid": "03d0f213-14ed-4353-a0a5-743ad1bf6e55", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8dde9c6-a5e5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788254256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254256, "uuid": "8ca0a13c-9ba6-42d9-addd-1a58c4786aae", "comment": "Malware payload", "value": "61ac94b9a5a2e31f280c851387fdb094", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254256, "uuid": "3f8376e7-08f6-4afb-a7b6-6dc44d1483d4", "comment": "Malware payload", "value": "1d11124c4328c2000f193cf8f8a9489cd5597b7ae8c99f2472b046b77c0acdbe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254256, "uuid": "45100238-2bbb-4f6f-a26b-9bd13cb0bbe5", "comment": "Malware payload", "value": "39a3f9a0e9ecee31411ebeaaf4223f149771c56b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254256, "uuid": "ed0dd972-adbf-477e-a486-b9cc1ed7028a", "comment": "Malware payload", "value": "50b1cfe80082b74274d74fb59326801178d8072d674efc480e13f72881415e5dff3051e41a77d5b931d39f46916e0a93", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788254256, "uuid": "56da6618-0abf-45c1-9879-c6f7bb36ec33", "value": "T161C27D956A867C44BDC94A3E4CBD2B1D6DF5C3E1324942AC3D8A3C71DC11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788254256, "uuid": "71d69687-0626-4a71-809c-456482642ec8", "value": "768:v8vCB+25j6es8RU9FYpMSUpi+20qUpi+20YQX:v8l25Jyd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788254256, "uuid": "0627a86f-c26f-4581-bcac-44d55fd5e83b", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788254256, "uuid": "e597170f-e122-4efb-8af7-427cb6885101", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788254256, "uuid": "73761125-ca64-46a0-8b7a-67319f36392f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf048956-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788277352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277352, "uuid": "f1b8485f-9927-4202-a437-d763ab7d42aa", "comment": "Malware payload", "value": "ae198465f464dee2a93724b79e7ddb09", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277352, "uuid": "1c1ad08e-b862-4a4c-aade-e554d944d2f0", "comment": "Malware payload", "value": "1d7b20afb76769631fee6d73b8d42126add65645a45d80124ffb77f8006e386f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277352, "uuid": "61c6e7d7-56d5-4229-b6e7-0dbb32cedc90", "comment": "Malware payload", "value": "f67aff4e6bd58720842c15d8f5ffbe4622b8468f", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277352, "uuid": "425439be-1cf3-43ed-a5b9-cb93f1ffe1d0", "comment": "Malware payload", "value": "5c0835527df4157521eff58d2bb46ef86bd68094d1f1641135078266e9c8eb7e961d534dbb30b03a81b89909d1be2d85", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277352, "uuid": "07c8d0a9-59c8-44cc-ae64-db057eea9414", "value": "T1FF75AEE558B9236FF75E4B729A81866BD623B0A90A716153CDFD07C3791F09A0CE4383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277352, "uuid": "abe8b46f-591b-4374-bb0c-3baa16af9799", "value": "24576:Qdm99Xs8cOcHm1EGCZHjokNSrf7yKWNxhDo6gAavFwhrC/knKd:UOm8c5cEdGKSKIR/wRnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277352, "uuid": "ada446d9-fb1c-4250-8763-a9f47a93f6fa", "value": 1637888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277352, "uuid": "a5ee45d1-15ea-44e7-a5c0-a7a8e402a990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277352, "uuid": "0a2d495c-2c52-4f4a-ac9e-6b9917536b2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8da2dc4-a600-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788265826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265826, "uuid": "94a61a2c-eb35-47c3-85f9-0c79fa1905cf", "comment": "Malware payload", "value": "02d27db061b8d7a714fc541be13fd160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265826, "uuid": "db7b0345-4e1e-4159-9c4f-b7e51b8c5654", "comment": "Malware payload", "value": "1da8f4e1ce5896277bfee5b9f6628f29a7534ae830108387b6aabeb4204c7039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265826, "uuid": "15b90b62-8771-403b-8d2f-812a32e89fed", "comment": "Malware payload", "value": "c9edd32302ee135adaf7c84a29c9827c76490381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265826, "uuid": "6a24947f-304c-44b3-b783-b923bf773110", "comment": "Malware payload", "value": "e458b6808741f40dfa9ea759a3b07b23b8d34fa5f388f4a706fd19b4354475a014061586dd1e21352d98416c73920257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265826, "uuid": "7f1c5e88-e1ee-415f-9f82-a3e82bb2512b", "value": "T187D59C16B25500FEE456C1B8964A5132F6717C8A6B717EEF02A4F6392E77AF02F38704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265826, "uuid": "cf6dd76f-3c4f-4fb5-bb56-0d3a8e2b92e8", "value": "808bb654747ce1b6797aa8c45b2548b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265826, "uuid": "de73ae6b-9daa-439c-9bb3-9f8bd0b00322", "value": "49152:XTUYO8JoB8BdWYwBrVwASOwGtlqq23l6K0BY2LIU6iTofR8lLqbGXPzI:XT/WT3/KR+UfR05XPzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788265826, "uuid": "0c9c841d-6e1b-43f7-bd13-bf4e6aefa0ee", "value": 2941896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788265826, "uuid": "a588a97e-f6e3-483e-9bbe-984bf800f67c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265826, "uuid": "6ff92e07-2b27-46f4-b6f9-b407c99ecb71", "value": "VX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c3f0a1-a639-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788290087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290087, "uuid": "536d061a-2be5-41be-807b-982ad3d35226", "comment": "Malware payload (Vidar)", "value": "14a10b8f842d41a55b84a71bd668cfd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290087, "uuid": "c1134b13-7e4b-4145-b503-a229452a2dcb", "comment": "Malware payload (Vidar)", "value": "1e27a6aa8b48f29511e3568755e0761811a169cae721aeaa5d4ed5ca092fe7e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290087, "uuid": "6b87b0e9-ecf0-47f4-bccf-cfc8d49665c5", "comment": "Malware payload (Vidar)", "value": "e742728a52e365d4fe0535adc1f4c89d0a47eea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290087, "uuid": "73538a25-f334-4bb0-b5a9-0a26c097554d", "comment": "Malware payload (Vidar)", "value": "36b6e9f4f06fdbd8b6e5333ff02ef1ba3a78ef2ad34d4f0486694964077d760f0eb706fc750a010ee15071a2e7e92b0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290087, "uuid": "2039d872-0182-41ed-8db8-14e025bdcf2f", "value": "T1AC767B0B3A5646E5C5AAD639C57A9223BA307C4CCB3173E72E40A2742F327D179B6F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290087, "uuid": "c12ce000-4903-4603-a6a3-5416558c9bf7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290087, "uuid": "94837104-e8eb-4f31-bc0b-b24355883265", "value": "49152:dexRMCPHu/Bfj59Y51NxdoXRAafH7v7TkroWbgLNFWuJKsDGgGGxTCLLA6P7pTwI:dFN5ImNFNpDGgGGxT8LA6tMiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788290087, "uuid": "2b9af48c-51b2-4c00-b344-24b916434b74", "value": 7710136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788290087, "uuid": "a526bbcf-8ed0-464f-bd7e-a790ca600721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290087, "uuid": "a320607a-879a-4136-8e50-371c7cf05efc", "value": "1e27a6aa8b48f29511e3568755e0761811a169cae721aeaa5d4ed5ca092fe7e8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2294205a-a5d5-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1788247025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247025, "uuid": "01748bb3-a197-48d5-a937-0ee9f3c563da", "comment": "Malware payload (CoinMiner)", "value": "5bac5b809694dd78ca1327a6c58a4216", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247025, "uuid": "45717dc7-6af2-4dd0-834f-750ed946f96f", "comment": "Malware payload (CoinMiner)", "value": "1ea697ba648b51938166e2928f3ff3c9c474b997df65a7c04d2ac4feacbc4a7a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247025, "uuid": "8d509708-1215-40ee-904b-dac476444175", "comment": "Malware payload (CoinMiner)", "value": "9337f4b97ddbc50febfce3aa7809a34a13ec9db9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247025, "uuid": "225179d5-38d5-48d6-90bb-3e13fd8d9d5a", "comment": "Malware payload (CoinMiner)", "value": "25ad8cb64a1274113acb18f98ff8e8d4908404ef177ee0479d8de5aee64679c70fbad33b1b1e1cc8031a53f007f80df4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247025, "uuid": "5e0f91f5-4f5c-4551-9c73-4742401c7fa2", "value": "T12436339A68CA88B0C855C7F0990770BDB37D7B61DA617C5B32DE69444EBBF04503EB82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247025, "uuid": "49d45b7f-5a84-45b8-b3bb-6736e9ae73e4", "value": "949ec789a5933fb6051c9013a550fb57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247025, "uuid": "b50a96bf-3470-4791-9393-57ece5301560", "value": "98304:HJi2mcdMJAXL3otBo1m60Dhoqqqbgy8C4imJP3HPujgw:A2mDJAXMtJJuy8ni83Gjgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788247025, "uuid": "7db9b318-8e32-45fe-aa4b-bc773212a721", "value": 5277696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788247025, "uuid": "8cc7e9cd-78e5-4c51-b448-73b7f77dde38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247025, "uuid": "d06276f9-1131-4568-8233-9a010c73b5a9", "value": "1ea697ba648b51938166e2928f3ff3c9c474b997df65a7c04d2ac4feacbc4a7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd42b780-a5ab-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788229353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788229353, "uuid": "41502613-cabf-48a3-aaa2-e4222a153659", "comment": "Malware payload", "value": "9ab3a9df60651713928e1113708b01e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788229353, "uuid": "24860524-c9c9-417d-b633-d7ca237e02e4", "comment": "Malware payload", "value": "1ef57112f92d5496e7956dd4d037da219dcd133b92ec582cc2267b23f12c5b9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788229353, "uuid": "c0833690-bccf-44fe-98ae-a6ae5fc4ab83", "comment": "Malware payload", "value": "5662d74d54e6c6457ab4244418f29199d06b94d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788229353, "uuid": "3a385106-0d10-4236-9db2-15355918f277", "comment": "Malware payload", "value": "04f087ed0fc38d0bd3d45d811d183a932739b2e36ebf30d6e70d6ebf70e91e65987362e454b5ae2107543bf5aba5aca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788229353, "uuid": "7813c80b-916d-4c88-b17b-bba3c299c3c0", "value": "T1E4D5238D7DB61971E832C7A28E92F46CB07D3B810F358E5E7BCE69008D669115C367B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788229353, "uuid": "e5b3d304-6557-411e-9fc7-e5d271eb81bf", "value": "fe230628262faec735b6f015758b7519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788229353, "uuid": "0fe35153-c88f-4327-aa6f-a8712b030c90", "value": "49152:UqKvZv61siwNC1E7WPRuMHQZx7OTQiFjwL5FLcC3xfiSyJTzjQSqr9ZikY6/CVwb:IZC8NEEa51QZx6TQAjYFwChf/y5jZqrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788229353, "uuid": "2aedc6c0-8671-40d0-9223-300d17f52f5f", "value": 2988544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788229353, "uuid": "0abd4281-7ecc-4570-ba96-dd6b3e053ff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788229353, "uuid": "d2e05745-8a50-4e92-bcd3-1e0469994ff1", "value": "1ef57112f92d5496e7956dd4d037da219dcd133b92ec582cc2267b23f12c5b9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce029968-a5b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788232709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232709, "uuid": "85ddbcb0-2780-4e41-b120-f9cfc6f143f1", "comment": "Malware payload", "value": "acc52e0779066b81ab8d1da42af619d3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232709, "uuid": "546af02a-98ea-4c31-9449-3bff73f79c1e", "comment": "Malware payload", "value": "20dba69956576e1be144cdebbfba349c1bb70eed69be10061426b6aedb63185d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232709, "uuid": "ef61ae06-bc19-4091-868c-054fafd78a61", "comment": "Malware payload", "value": "8b03fa2cfeb46a251d711b77a308edfca7ded294", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232709, "uuid": "e51dbb3b-a3b3-4294-85c1-94bbde032f50", "comment": "Malware payload", "value": "83bcf34f655767863114a1ec97879b95ee82a3ed6e889ead1bf59f70dd501bfbff9a6629c1fc1c5320c774814596e11c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232709, "uuid": "30db8b0b-a949-436c-903a-a0783011dd12", "value": "T1BCC28C966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232709, "uuid": "ec6f52a3-d5d7-4c8f-b1dd-19a667c2ee48", "value": "768:b8vCB+25j6es8Ri9FYpMSUpi+20qUpi+20YQX:b8l25JEd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788232709, "uuid": "c05da49d-b65b-47fd-8278-1a1ae79609d5", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788232709, "uuid": "1ab48168-df91-402a-9092-b09fa87f5e71", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232709, "uuid": "b4a9c67c-b657-494f-8f26-ecc952a7ecbf", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb614d4-a60a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788270050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270050, "uuid": "ec4be4c2-b263-4582-b9c2-00bad0f469bb", "comment": "Malware payload", "value": "fe81590000ba07d6b82c27e7f6814338", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270050, "uuid": "112de89b-0590-42b2-ba46-d865f8a60895", "comment": "Malware payload", "value": "21606515f2330490b34ecde5972cfc2c0f1f9d86d76c867dc553fd8a32eb4d16", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270050, "uuid": "bbc2f7f3-8644-4a48-b267-5e898a7605f4", "comment": "Malware payload", "value": "275a2233e0fc02507f20ccfa649b0323cb55bad0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270050, "uuid": "d1404488-7adc-4aa7-9f22-6db19b6481f3", "comment": "Malware payload", "value": "6ed80c0eb060c287d7c9d5d5cbca2f8a67ae28bbe0451dbcc91f07ee617565eed3b243c67f8e1d45e6a5217c37b7286e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270050, "uuid": "9d4c5be3-bc56-429f-a399-64d3528b6b4b", "value": "T10FC28D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270050, "uuid": "59ef1a99-001e-41c6-8a32-309e61f76531", "value": "768:h8vCB+25j6es8R59FYpMSUpi+20qUpi+20YQX:h8l25Jfd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788270050, "uuid": "b4175bb3-8729-4403-95a3-4222d8e4f072", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788270050, "uuid": "7912e015-0122-4b51-b64c-6dfcface5148", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270050, "uuid": "9c7ebb0e-c661-454b-8ff1-c1f619cd1171", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e3a39d-a59b-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788222299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788222299, "uuid": "c24ade3c-4815-49f9-921a-3acdd83937ab", "comment": "Malware payload (ConnectWise)", "value": "548c6c4912046e948df0e2578cf4dd89", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788222299, "uuid": "36ebb14c-a656-475c-b037-ca7ada7ed7bb", "comment": "Malware payload (ConnectWise)", "value": "21ca7ea24b9faedcc3d82d803f71f3d61d407d518dd503b6da5ea9b8dac3d0bc", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788222299, "uuid": "de78a293-e9fa-4170-908e-b5cd70078dc9", "comment": "Malware payload (ConnectWise)", "value": "ffdbb80d7302f58a6b44cde7b7c390afe99487f6", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788222299, "uuid": "09278ce5-b9da-4677-957e-435160d66cf8", "comment": "Malware payload (ConnectWise)", "value": "b7489fb406f309851dcdac0f9a4f244b8bb3d418e3a1997ef4d92e9e95081c0b6b2a08ff633847095129aabbab77a536", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788222299, "uuid": "c03c07f6-c4b4-4b04-8003-bb5142988ab0", "value": "T1FD771256E2FD00E8D5BAC0BCC6575517EBB23459173097EB52A48A692F33BE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788222299, "uuid": "a4de8965-f2a1-4e28-a94d-2971ef208db5", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788222299, "uuid": "f7acd2d9-fcba-4196-8bf4-76ce1ecd959c", "value": "786432:fuMLJsXoeOvHiwB3sn+h1nW25F+wX0ff6yajCs6+4S3NftN:f5coeeCwDrnWG+tf6fj4ulN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788222299, "uuid": "57877816-5a46-497e-a2c1-1fda7281b352", "value": 35545785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788222299, "uuid": "20e40322-ad01-4232-9b83-8d33f0084afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788222299, "uuid": "a0b29452-fb44-4475-88bf-ff1ce15e49c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f3250c-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788277949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277949, "uuid": "2833f9f1-0215-42ec-8ae9-7687e8cfeef9", "comment": "Malware payload", "value": "d215d8da33d908d2ea5be3e13196e7e5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277949, "uuid": "cced8809-b2f2-47b1-8d2c-435ea4f12db1", "comment": "Malware payload", "value": "22762fc10a4bee3a24cc513e74a5ccfb6e7262c3202eda729c5663ee8df90dd8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277949, "uuid": "cc3b1e09-43a3-48a4-a36c-43813c3f55ec", "comment": "Malware payload", "value": "bf463dbf7604f08d8177ead66d1fe296e455d73e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277949, "uuid": "a8327312-2e48-48d5-8b16-878c47e79c1d", "comment": "Malware payload", "value": "6288e635294cbf5819c04553e8668f35f6117c4df41e77ee758c55f701948757f677dd325dec5babfa4207737df39580", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277949, "uuid": "d85e7768-3b12-4a79-b7c8-ed6be8179ecc", "value": "T1B5235C6516857C24AE98C4361C7E2F0CB9AD83E6324452EE7FCF3CF68C4A69D9109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277949, "uuid": "e5cebe2f-1542-4c6a-b840-80564c22ddec", "value": "768:B+m9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:B+Dcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277949, "uuid": "edb00fe8-a11d-441b-b347-3c245c8151e7", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277949, "uuid": "b9b35524-e80e-46b2-ad79-7a705ebe6aac", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277949, "uuid": "2b2fc35a-5f22-4c20-9b28-02fb8e8b742c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa4b5ef-a5a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788226377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788226377, "uuid": "9f2d1014-4ce0-4e46-810e-f2d374eb0a27", "comment": "Malware payload", "value": "ecf2a814b720c1ec88a27bf517808154", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788226377, "uuid": "2b248eef-05a2-4318-a448-7ae270a93a46", "comment": "Malware payload", "value": "2282000cd6def22a6473c19b1177c044d01aeea6a820cb4272c0106f1d4e5bbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788226377, "uuid": "08510dbf-7c6a-4290-a88b-104d417e7814", "comment": "Malware payload", "value": "421806bb9022fad301b1a4940c4c79c56d580878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788226377, "uuid": "8d45a2e0-cc84-4989-a519-7be651fdc404", "comment": "Malware payload", "value": "69f68e72c43ff15726eef9f585b012aef96692dc97bc4e2ac4941718948e050e11dc0427675cafc17e8b3cd9deacb4dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788226377, "uuid": "9397b47b-b6db-4823-9a9c-21ec525e21f4", "value": "T177D52299B9F709B8D836C7B58F96F4EDB1287B9203704DCB3A8C39408D126685C36779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788226377, "uuid": "5352a0f0-ee77-4ac3-882d-36e05304652f", "value": "58f4b17816a07f7a36dd14e504d515e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788226377, "uuid": "ff2da2f7-4093-4f91-a49c-957d86eb667a", "value": "49152:fcGC+h0AzvotZUIErW0Km0qumVNrF+/VjQcO0MgUTKwtOss2T1WMP:fcz+hX8ZUIEjKvqPF6VjUbrTKwcsseQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788226377, "uuid": "26bd1532-18fd-42d2-8f58-69da40642849", "value": 2966528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788226377, "uuid": "b6b633de-77bf-4329-ae5a-ca92d69fa168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788226377, "uuid": "0ec51792-fcc8-4c30-8469-8b3587ac16c6", "value": "2282000cd6def22a6473c19b1177c044d01aeea6a820cb4272c0106f1d4e5bbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6981eec-a62f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788285901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788285901, "uuid": "89067c7f-5da0-428a-8781-93ddc3535e1f", "comment": "Malware payload (Vidar)", "value": "512acdf34583d5d0e4304c4e45b82e73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788285901, "uuid": "02d1c3e2-c8cd-4f4d-89d2-3f1d03ef0e8e", "comment": "Malware payload (Vidar)", "value": "2287ade165ab2955754edf883cd1715ea952eaf8ac0f870cb9334b9d4c4eb310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788285901, "uuid": "ac122f10-34db-4791-bb06-49668078972e", "comment": "Malware payload (Vidar)", "value": "8b56fc36cc3e83a8d76e13eca207bb3d7e8dac5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788285901, "uuid": "64e453b4-2e2c-49b8-8071-d93b5e37cc5f", "comment": "Malware payload (Vidar)", "value": "70cdade9abf929102780b762a31c32421551e8d1e8adbd6744d2d7b036404a98676b79ec8835ff8105b82571406275a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788285901, "uuid": "a8183531-3bf7-4bcc-a978-cad1bdc5678d", "value": "T1A1F65A077B8A01F4D59ADA3580BB6721BB39BC0CCB3437A72E5061B42F653D2AE75B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788285901, "uuid": "5fba120a-14fc-471b-899f-efeffa6f4aef", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788285901, "uuid": "42dd50a8-a363-48f6-9257-36eb2f4b2563", "value": "98304:4QG0GYftQC7wuQNO/QPcTrlWi3dW+s1l1jNur9jSVqD6U+d:4Vo2SwuQcoPcTrki3dW+s1lyZjCFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788285901, "uuid": "539ad087-c523-4e3e-bd3f-ef48e1ab73d0", "value": 15900024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788285901, "uuid": "f7d963b4-699d-46c6-8443-3816677d02a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788285901, "uuid": "665de18e-7a9f-458b-b3f0-1c0d322fe8e6", "value": "2287ade165ab2955754edf883cd1715ea952eaf8ac0f870cb9334b9d4c4eb310.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced24daa-a626-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788282103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282103, "uuid": "5efec3b3-fdac-47f6-b474-74b0084fd720", "comment": "Malware payload", "value": "dc1ad55e95e63abea09a5992fb5ca68d", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282103, "uuid": "bb9451db-7124-4e55-b4ac-8810ff4c2797", "comment": "Malware payload", "value": "2312ac8f678732f80294e954268ca1d33ffdd223c323c8742ca28ce0d36abd9d", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282103, "uuid": "a732dcb7-44b6-48e7-a80d-5be250720506", "comment": "Malware payload", "value": "2261f4eb25af0306aabf1c1def4a94e012bebe26", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282103, "uuid": "9213121e-4f35-476c-9877-55ba57adedc9", "comment": "Malware payload", "value": "2d610daa3b0c56121e48d8ad7c8ae7a02488aa9e71ca81f60d407c436d4c724bebcf457cdc0500b43e176e9c060d3a3d", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282103, "uuid": "737a86a4-7deb-4f70-8737-68513dbb91b4", "value": "T1F9A7338629CBC0F4E6811514CA2F16DF13B29AB68DD48D38B7C53D46D9A1F72707E8A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282103, "uuid": "3356c224-60ed-4c60-9901-8d1550774aff", "value": "52838834580a31a417cd3130caa548c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282103, "uuid": "d21fb33a-f840-440b-9aae-08fc4a30f0a8", "value": "786432:qgOZ7Nx0ZrjyRbc16YJoz8GHiKjF1mxC0yj7wdTdBRohppI+Io4iiJ:qxZ4NXXKKC0e7wdChnI+Z4iK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788282103, "uuid": "569488a5-d9e3-48d3-9b7b-977442e1fc2f", "value": 45269504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788282103, "uuid": "ff959aba-f1f2-4b9b-8d3c-7131a374d92c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282103, "uuid": "46a946e1-4d5e-41d7-bbd3-f53ece2f833c", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69989527-a618-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788275920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275920, "uuid": "2e69950a-84df-4a42-ae8a-5c52d1cb508a", "comment": "Malware payload (ConnectWise)", "value": "5f28d1b939bc6bbbb094562a327e327f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275920, "uuid": "82adaef2-f1cd-4cd8-8b0d-20d526c47afe", "comment": "Malware payload (ConnectWise)", "value": "2344c98693cb066be5447238ac7929e306db30e20e5def57a18baf809e062bc3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275920, "uuid": "a5afc89e-b787-4cf7-bedc-f075bdc6f77e", "comment": "Malware payload (ConnectWise)", "value": "e35ceb6c7fc4d641fc152426c994d3d97f38a221", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275920, "uuid": "e213b015-d4d6-4096-8f56-2320f97b7ddd", "comment": "Malware payload (ConnectWise)", "value": "0e62445a6f6a3c64bafc98ffe5b321e93c4c978f5999ba0f95224056690b7380ca5e9e848547c53fed2d1cebdcff41d8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788275920, "uuid": "62760b6d-e22e-4845-be75-1497be2cc831", "value": "T1B146E111B3D995B9D4BF063CD87A82A99A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788275920, "uuid": "7034bfdd-cc67-4b36-acdc-dcff7022d72f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788275920, "uuid": "428fe4c1-2065-4b3c-914d-7cece983f12b", "value": "49152:MEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:lEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788275920, "uuid": "3460d37e-b0ec-44e7-a5cb-789595204855", "value": 5622088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788275920, "uuid": "86b7e5ae-7c37-4583-9b62-11c6ce2fcf39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788275920, "uuid": "549227a5-476f-4206-bc12-cb9bb00c446e", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfba02ac-a624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788281245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281245, "uuid": "fd78f69f-184a-4350-96ec-5b64f8c74053", "comment": "Malware payload (Mirai)", "value": "4cb28ddd70bcdeb5b6f1cea705d49da8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281245, "uuid": "60554b8c-c5a0-436a-9a8d-885c1ecd4855", "comment": "Malware payload (Mirai)", "value": "2460779da84d2d3b3a190d90b27c6f9f124f0bd3bd0b886543c725e8b7719583", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281245, "uuid": "48f403e6-ea2f-47a1-8371-73ea0b88d669", "comment": "Malware payload (Mirai)", "value": "f91b30db09e595d3cb6c9a8ba523fb6f6dc232a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281245, "uuid": "427113e1-5b17-43e3-8319-f7730c14766c", "comment": "Malware payload (Mirai)", "value": "176f109d3c2677337f07b91428ab0f37ce452c67815d1089fd0ae6e6a279dc768ff94639654cd1426c4caa3a0e908f0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281245, "uuid": "7503111e-a973-4d33-90c9-643ea7a3c57f", "value": "T169C3127309B7F2BDC1A67A79D4BD069CA201F4011415774F1AEE2CA79C739C42B38A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281245, "uuid": "3cf109a8-f824-4f13-ba73-90152e4607f4", "value": "3072:YrCp9X63HmwvzJhEMdiIGDJQvl/Z1+t07QMH:YG8GmDeIGtqSeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788281245, "uuid": "a81b869e-36f0-426a-89c1-ccdf69c177df", "value": 126140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788281245, "uuid": "7d32f6ec-42d9-4544-b7d8-41071b950223", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281245, "uuid": "2692c4f3-adab-43bd-ae7a-683c86fa4018", "value": "2460779da84d2d3b3a190d90b27c6f9f124f0bd3bd0b886543c725e8b7719583.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee331b3-a5a9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1788228309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228309, "uuid": "2acc55ed-eb08-46f2-ad0e-7ffe1614d1ee", "comment": "Malware payload (Stealc)", "value": "affcc0650b0502fdba71ab39f526f2ff", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trickbox_v1_proxy", "colour": "#4D900C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228309, "uuid": "d5aff3a7-2547-49ae-9f80-b9b7240fb70c", "comment": "Malware payload (Stealc)", "value": "2467a949be1e7b47aa11edaf1263469e9baf307a3cc0713b2980539d31ec3dab", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trickbox_v1_proxy", "colour": "#4D900C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228309, "uuid": "1a556abb-0b96-44f4-8410-29af43dedffe", "comment": "Malware payload (Stealc)", "value": "58b04f1cbfdfedef6889152a5dc58c1eb28aaf6e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trickbox_v1_proxy", "colour": "#4D900C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228309, "uuid": "e1a58d98-caa5-4d21-8790-17e3ba9450cc", "comment": "Malware payload (Stealc)", "value": "57ce5c1e6afefafd9f8c0d7c663246431f03b177399a67873ed7b394c867ab4b12a98dcca7b74a99c797baf721c511f9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trickbox_v1_proxy", "colour": "#4D900C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228309, "uuid": "5a2b9098-c657-419c-824d-219b116bd9fa", "value": "T161F52319D7E404FCE1B7E5B5CE464A52EB36BC4907B1EACF03B465A51F232909A3E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228309, "uuid": "b6217ca3-90b6-4190-97f9-2ac541efc34d", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228309, "uuid": "2176a74a-5c27-4e48-a14d-0ae2b81bfbd9", "value": "98304:MvOTcV1DqkOC+tcoYKwobrzKPq46tWAd0iX3zV:DTymw+Qibv82WNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788228309, "uuid": "122c7aa7-c14c-4362-990d-47f7e681f0f4", "value": 3637355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788228309, "uuid": "58fbf734-0dc1-4aa7-a574-69cafa9d4e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228309, "uuid": "bf134227-77b9-46bf-ae75-e69150cee7f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232718c4-a619-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788276231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276231, "uuid": "ca8db543-9d4d-4f6f-8be0-e792804746e6", "comment": "Malware payload (ConnectWise)", "value": "f28f0248162be5f909202df481a4f268", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276231, "uuid": "d514ab72-facb-4b36-a6a9-4686f5f8cf76", "comment": "Malware payload (ConnectWise)", "value": "249e01fa85faf9596b3c66a98291da359bddd1c2124316aada01bce376e4b5a8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276231, "uuid": "8bca8143-493d-4919-89e9-c201a1b1f54b", "comment": "Malware payload (ConnectWise)", "value": "5de2a3c0ab4db6b5abaee85a606d914548b9fef9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276231, "uuid": "fc850e0d-cef1-404b-b1b0-a8c1fd953798", "comment": "Malware payload (ConnectWise)", "value": "ba73cde7c80ab5eb4eb1a8d7b8ec35fb814c116e4d8656a2293602d07f247dd1755ae5fc6fd0590c52819177d88394db", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276231, "uuid": "76021ae7-eb61-44c8-8bcd-6dd814e04209", "value": "T100646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276231, "uuid": "708019c4-f023-476c-9d24-fb5783bdbb89", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276231, "uuid": "b4c02d65-b92e-443e-b082-f49050d078dc", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788276231, "uuid": "6a04d8e0-8b1e-4ccf-ba85-072f362a03d6", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788276231, "uuid": "25c8e22d-397d-4d54-9e62-e956a084b90e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276231, "uuid": "d031d28b-9b99-45af-8662-5d4d81eb97ee", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e5e7de-a647-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788296312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296312, "uuid": "7b732028-7648-4b08-80f2-cf9f5740662d", "comment": "Malware payload", "value": "35fc47b7579abeefcb06f5c37a51545e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296312, "uuid": "4fdd17de-37f3-4285-ad54-8c7a319f4057", "comment": "Malware payload", "value": "24c27d732059bdaf57c525c3910eddd3df1db9485656db4edf15a719a9ac1eac", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296312, "uuid": "f67daec2-01d6-4ca1-a526-92ceb61562bf", "comment": "Malware payload", "value": "916c0007b787badfbdd8a9a8e3ad220b27a169e0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296312, "uuid": "253eb96d-c9f0-4951-9905-70aea70d8a12", "comment": "Malware payload", "value": "001312f72884d824309ed1dfcbc12d9f9331cd1fd93898c8a5e21301cfbd2e060b87795022247f1ba5e5cd6f26541081", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788296312, "uuid": "723e574f-1afd-4759-8471-961939a89e36", "value": "T102C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788296312, "uuid": "3b056e8e-4ac1-4674-9f9e-fbfcd84cd826", "value": "768:48vCB+25j6es8RjZ9FYpMSUpi+20qUpi+20YQX:48l25Jj/d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788296312, "uuid": "da876b9d-e432-489d-86d8-9d0bf6c9bbb5", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788296312, "uuid": "8ebaee0f-c516-40cc-87ea-618e6abae7e0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788296312, "uuid": "6f1f926e-5402-4835-afe4-5b2a389936ea", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e9d2e1-a624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788281229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281229, "uuid": "653959c5-39b3-4fd1-b6df-e9a7efa04989", "comment": "Malware payload (Mirai)", "value": "317a026fe4ec5cc239c9ca67d15fb3f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281229, "uuid": "f7f99eff-0abc-4f8e-8d66-6211c7477e16", "comment": "Malware payload (Mirai)", "value": "26032ab4a30ff37fef3e4e714149b7d73d6f1c48cc52c622a7051ed31f47f164", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281229, "uuid": "b7971a8a-4439-4221-9dd9-bf9ab2d09678", "comment": "Malware payload (Mirai)", "value": "214471255eac19a42bb1daa14c8cae865e8e5fd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281229, "uuid": "04287365-29c2-4b74-9b50-ca28e365466c", "comment": "Malware payload (Mirai)", "value": "364e2d891e081a959f50d01e1a87b080b08b1b6a3469fd635af39c3741c14d123fc2b5d8fcd49dbfec510bb2526a2547", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281229, "uuid": "c9dc9d94-4da7-4385-90af-c3e3dc9c7129", "value": "T1B8E3129A5ACE828FD8E2587974E1CB6831B22E702C25CCE57F05FCD59C05305B1EE6D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281229, "uuid": "d3f09611-716b-4195-bb67-e70463803127", "value": "3072:lolj1/wvBTCev2T2Nu3K3UvX8czT1PJty3AzaxgUv3/IMVd:limueviKn+JPJteAPUHICd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788281229, "uuid": "553368fc-f08d-491a-942f-5921b794c959", "value": 147772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788281229, "uuid": "ee1225bb-a563-41a1-b745-36dbab661244", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281229, "uuid": "e70218fb-0d6b-4449-b56c-cb393c499a4e", "value": "26032ab4a30ff37fef3e4e714149b7d73d6f1c48cc52c622a7051ed31f47f164.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2550c09-a635-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788288498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788288498, "uuid": "b8b32bd6-5ecb-46d6-89e3-7711f1132540", "comment": "Malware payload (Mirai)", "value": "85d55c218725919223762eb44da2453a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788288498, "uuid": "b8744da4-3ff3-41d6-a323-6c23046687de", "comment": "Malware payload (Mirai)", "value": "261b597bc35aa52903878cfe1ad49e2a58ce157b6a3e3f513c019d7af8217d7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788288498, "uuid": "fbac712e-a918-414b-ab17-a51d20d5f208", "comment": "Malware payload (Mirai)", "value": "8e74cb2c2f63e3d4c3e83801ab7e435a6294dada", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788288498, "uuid": "bfdd2fd1-4d0e-4fc5-8938-28b7a84518db", "comment": "Malware payload (Mirai)", "value": "3fd5c182ae6b0feaec2125f38461a983046860656125b8e19e390d79452e5d62dd6f59abf98e14ce5dc6ce79aedd75ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788288498, "uuid": "caf2a5c6-5003-4edf-9496-722a4b77d209", "value": "T115A4F98953F1DFD9F268E93003736E1B5DB6063735D3A186E16EE92233A524844AFE70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788288498, "uuid": "1dfe8e89-e759-4f30-a69b-a58ffe8dbae4", "value": "6144:tfXv0t0G01I8IHVRyZHP7l+BMpOM8HVNNqbqfXqPjX4evj:tvLITw5g+OVXX2joevj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788288498, "uuid": "90cba941-f921-43e0-97e0-0ca63cecde32", "value": 468216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788288498, "uuid": "315e9937-c353-4e2b-a5e1-be1563476221", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788288498, "uuid": "82ff1dfe-6193-4049-8de1-8321a7864d81", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3808e3-a61c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788277723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277723, "uuid": "70cd7c0b-dc8b-49a3-862d-278f5903304f", "comment": "Malware payload", "value": "74656c78bf501feeee3e28ce26eaf2b7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277723, "uuid": "9ffaf704-1254-4285-8219-cd68c5b9925f", "comment": "Malware payload", "value": "2779ac942a1c5d8f07f6eec7d4707d1bf2583760029573da7fd23210084fa405", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277723, "uuid": "826dc030-98cc-4d0f-a8d6-136b4b44dcda", "comment": "Malware payload", "value": "f9be5de81df5f9556ad15e76ccbf7c652d3ac2d9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277723, "uuid": "69636078-1f73-4c77-867e-b91aeb944783", "comment": "Malware payload", "value": "81cae38892835ea5170e78c8398201db6f07f2c7e5799ae64d98960757e795bf5360bc8a03b17cc358dd9a14890fc5ec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277723, "uuid": "073ca2dc-f0e6-4fb3-a0ec-80d2e6777ef5", "value": "T16521A59F246CB81264088F4976D2C404A945E1CB659BCF987F9ADC3ECCA4E0D717CB79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277723, "uuid": "fb9793f6-2281-4a33-9b23-c395a242126b", "value": "24:GgdjOSOW0P8rOdpNYXMVTM+0wzsC2P02ZLZl:GcoPO7XMVTj0wzsC2dZVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277723, "uuid": "e33fccb9-be88-446f-983f-c56d54043b14", "value": 1399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277723, "uuid": "65c43709-fa4c-4467-8dea-f7fc6b17b00c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277723, "uuid": "307e86f1-c8c0-4cef-b91e-57b25710f9d8", "value": "c8r3nv.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4156f431-a600-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788265545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265545, "uuid": "69ab9d0e-7bcd-4907-a822-14c690acb296", "comment": "Malware payload (Vidar)", "value": "28a68370e62fc893cadac0d307db6771", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265545, "uuid": "9148c8e1-09be-489f-bae0-cf8805e9da51", "comment": "Malware payload (Vidar)", "value": "29d4563a365a0a6a49eefafecd1a46934b9d07df340ddd23da81ce35e4b92276", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265545, "uuid": "f75e0adb-8cbf-41fd-ae9f-8310d716e6f4", "comment": "Malware payload (Vidar)", "value": "0190d84dbb18907e952863552c6c032fb7de53c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265545, "uuid": "659b8011-e6e2-4a21-bee3-b6f1192bd339", "comment": "Malware payload (Vidar)", "value": "b69b95de6000a258cdceaabe670b6d430363ad33fa301a014bb9348e1642da7e5c6da31b8195d5c8e84ad76d1c9d9c0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265545, "uuid": "1b2a97f6-b333-46a3-b93c-3107e24a02b5", "value": "T122966C077A4494A4D096DE38C5BA0A51B134BC8D87353BDB3EA1BEB4BF217D19236F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265545, "uuid": "02599ffd-2472-4904-b182-14cc93527ff8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265545, "uuid": "3d9578f4-b802-4d25-b485-4c0f16ad4c17", "value": "49152:AVmvjlnNlRlMLlTFkKm+tKdlH76hfqTb1f4WLWFn6f9xbM8BTLKO+DwUP:A4rScYKbHOh9Fno9xA8tDZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788265545, "uuid": "d93716e9-01a0-4f82-882e-4a135a463ae8", "value": 9334704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788265545, "uuid": "245e9858-a98d-4ac7-a09a-c35212fb1312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265545, "uuid": "01b007d0-0fed-44c3-989d-cc9f09edfe0a", "value": "29d4563a365a0a6a49eefafecd1a46934b9d07df340ddd23da81ce35e4b92276.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee3b5ab-a64a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788297404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297404, "uuid": "63d347d7-4db9-4f39-9d66-a0dd925bc7d5", "comment": "Malware payload (Mirai)", "value": "01e10e1a318eb09fbb3b5b4b64a25b0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297404, "uuid": "df8b736c-06e0-498b-a0d2-aff3c80b4321", "comment": "Malware payload (Mirai)", "value": "29e114749b1ac3f2dfed0ad6345834b718f6410695805b7be7cc30a93ac5ed78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297404, "uuid": "728902ca-425f-4d14-8be7-b4c2c0896a5c", "comment": "Malware payload (Mirai)", "value": "bdf46e38c1216233c64cf7bc43f136121b00c8d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297404, "uuid": "d9cc8af0-a7e7-4d5d-9144-f3e50ca59bdc", "comment": "Malware payload (Mirai)", "value": "9c3f1ad728d707726df77bad71e053ebed9c854d018e79df0fcac8ed76842ef2a4071b89775b84630d2051e83131313d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297404, "uuid": "7fb991e1-236e-4949-8337-96553cfea418", "value": "T1E1F3C448ED14977BC3E277FAE78903CE373A4A58A7D733219E311A742BC97546D29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297404, "uuid": "c1e667bd-bf20-44b9-b863-745f07238442", "value": "3072:eNGe0JMXlfnMjpppqupcmZNg1oBLaagyCfHVfKBzJ:eN/2MXVMFtpc+g1oBLaPHVfKBzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788297404, "uuid": "71f59f49-cdae-4f0d-9438-cf9b343d51a9", "value": 165516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788297404, "uuid": "c7f1db53-b4fe-456c-9404-e20bf1da5e89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297404, "uuid": "eb12f605-d697-42e6-a50b-21402b3fd20a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b483ae79-a64a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788297521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297521, "uuid": "ccde09d5-a97f-4517-861b-3acc4660799c", "comment": "Malware payload", "value": "060416d6aa570bb8b5a04c0cd1b7277d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297521, "uuid": "25c52634-cd6e-47e0-9e45-7c2f8f93530b", "comment": "Malware payload", "value": "2a5b41f30fdc6cf62934d9f0cd9ce9ad77871699b0e0a23c4f1d4f70f90116d0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297521, "uuid": "dd43cd1a-9d55-4183-a569-fb251de62aaf", "comment": "Malware payload", "value": "c09810a1e0356fb202f6353cf90b93ab6896cf7c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297521, "uuid": "b83087db-b055-4ff5-946e-6e9c3207b601", "comment": "Malware payload", "value": "5e20ae9ceee5ae005a31ba546683e3dcdcbec66b267282a2b818335a0892fd77daf3f4916ae28154d60651db3385b56a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297521, "uuid": "1ab0436b-9a07-40e4-9742-6a9b44a215b4", "value": "T1D3313EDF02105E711503DA9E73A73548B18DA1EB289FC7D49C094EDD9A8978CF226B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297521, "uuid": "909a38dc-f473-4c78-a68a-f3e239227bae", "value": "12:USI6SwXFFd6rgwQSUU76U0B9jxz6tEwFr6Vt3aGaBr6aTgeGPteufpwSr6Lwx6b1:LCwXFWgZUz0B9KEjMZib7mxeaJmFBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788297521, "uuid": "4647e79d-2704-4a57-a19e-a4a53b5cf71d", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788297521, "uuid": "c8e580cb-decd-4ad9-ae03-75c26970d7c1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297521, "uuid": "20b5a8d1-acf8-4980-b7a4-c72f70d55bcd", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d5dd19-a5ea-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788256056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256056, "uuid": "a2cc8e58-1d44-4311-a1f3-2efe8cd963e7", "comment": "Malware payload", "value": "22710b9658adc92a262f065386af87a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256056, "uuid": "82030a68-b655-49f9-ad82-b4934b96bc8f", "comment": "Malware payload", "value": "2ac8a1f38889ab3d80f71399cbdc509e1cb3ca8b687fb4a9ee96f3d9c81f3bf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256056, "uuid": "a751ad6f-49cf-41d0-a0f8-6ca358ece6b4", "comment": "Malware payload", "value": "b6283a5f96705d92839b263c351080cd4692be91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256056, "uuid": "c381bd94-46f7-4940-b56e-7ed11393e800", "comment": "Malware payload", "value": "f78b7d10ce3d7fb45fe4ebb463a07387f09f38ed805848a2b4ee9712ac896697c2f91dbfb82c499e70457fd4c6bf97dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256056, "uuid": "9718ab57-1079-4275-96a5-a7ee6a16ce81", "value": "T12264BE10BA41C033DAA25532557ACB63993EEC705F6056CBE3845DB9DE30AC1AB39B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256056, "uuid": "fef589bf-3ec8-41ba-a60c-07fde91ed66d", "value": "d598ee4cd3ff94052d24222fbb311f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256056, "uuid": "f9332b22-4a13-4d99-b673-76b7400c6441", "value": "6144:EBMRPXP8GKZS87tUQpYhXWVVq9gpPMJ/RtYTNhZ32n:EKol7tU19ga/SNX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788256056, "uuid": "2d691dfd-781d-49e0-a192-c3c94d07ecc1", "value": 328408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788256056, "uuid": "9d1d04de-0bfd-4034-b88f-6dd6e716c0b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256056, "uuid": "ea9a1c37-2b62-495d-a3df-fdec65d323c6", "value": "Rapid_Book_Retrieval_System.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646ea009-a5b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788232962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232962, "uuid": "cd695d48-09bc-451b-af9e-dd52bd1587e5", "comment": "Malware payload", "value": "43f047ef3b95d1a805d25da4c9bd057b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232962, "uuid": "8c49f38f-5368-4460-b797-4034afabe244", "comment": "Malware payload", "value": "2ae07d8c604e0156932d22eba1f0da929821c1956a4a8830135b8a9bb40bb61e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232962, "uuid": "8c1cfe12-b6b0-4624-a026-b67f5acf8562", "comment": "Malware payload", "value": "6b939e580085d386757182e6976e3af13b0cfa4d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232962, "uuid": "639298d1-634c-48a2-8107-b03c8995f2d7", "comment": "Malware payload", "value": "7113a585d9dcd1dbd5195cb20de25383330f7277e2485c694ad37b7a286752e1b08e961c35c1778656a54d5d561cdac0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232962, "uuid": "d60c1a6d-af26-4588-9a93-9bca9bb07149", "value": "T1A1235C512A857C14AA98C8371D7F2F0CB9A943E6324452DE7FCF3CF68C4AADD920961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232962, "uuid": "52b89cd1-1c03-4f3e-afc2-57da70c965b8", "value": "768:hQFWzZx5/9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:akzicr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788232962, "uuid": "1c58b1b2-534e-4c86-a7cb-c51ab8783d0d", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788232962, "uuid": "dca0352a-947c-4efe-8da0-07be4bfcdfe2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232962, "uuid": "ed51d6ed-9662-4d99-88a7-a23db1ddc3d9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfe2e84-a5cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1788243524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243524, "uuid": "75aa0d75-b866-4482-8cb9-9567969e51e8", "comment": "Malware payload (Formbook)", "value": "0058be165ad7cffecdb1c79236e6eb7c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243524, "uuid": "d2ab74e3-f454-4be0-bda2-6ad04c1ecc46", "comment": "Malware payload (Formbook)", "value": "2b05c268953cbd4441cb8a112ba5aefba0ccb0c86552107e1809453affed7e31", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243524, "uuid": "c9d069af-2d98-4921-a555-b57489070ddb", "comment": "Malware payload (Formbook)", "value": "b6b3a6c2c5b3fef339ee6f1d645889494cb626ca", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243524, "uuid": "91796a27-2432-45a6-8671-1d13a52756b1", "comment": "Malware payload (Formbook)", "value": "59e973079775057a36f380988c6dfcb740882b1f17370948087b0f293713f83bb368f5e1b6e0723841687fc3721e592b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243524, "uuid": "02fb0492-5fcf-4f4a-b0d3-37b8703a2be3", "value": "T1FDC41304BE447D3047EE02B8865FB49E4DF58C280168E9CD49B9FBC50CCD79658BAE66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243524, "uuid": "c91e092a-5b76-4059-b474-1aff84b5efc8", "value": "12288:EJsljC61bUv734NseUNHozacWAbNgCG1Yzr1IZN:RlCv734RsoRWsgDoxIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243524, "uuid": "4d6ad93e-41c9-4442-a87e-6e402966a9f7", "value": 565222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243524, "uuid": "55d62def-b5a0-4a29-a152-9e016803aa30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243524, "uuid": "91b1afed-228b-44dd-ace1-487dbf486122", "value": "Producto y especificaciones adjuntas_.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab3ab2c-a64f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788299410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299410, "uuid": "2e96e9b9-f3e0-4ad3-ba3a-96126cd56046", "comment": "Malware payload", "value": "852d5fd1451087eaf3058fcfbfe13de0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299410, "uuid": "1320da45-8c5e-48a2-8a47-1311a2ae3261", "comment": "Malware payload", "value": "2b208d76e495001a3c3f687a49b7692f7f2ba2bf62d0798665b13d1d3c79214f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299410, "uuid": "60853ce5-ac43-47dc-85da-13c9ad64f676", "comment": "Malware payload", "value": "d282d7e56c275388aab2f504a7bf406c3d5f2d28", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299410, "uuid": "176b8209-efca-45f1-b3d7-7eb510c08b4e", "comment": "Malware payload", "value": "9f02c1e4a17858486bd910cdb22e4b566083c5a41ae08a787c74fbec724f1488624c11270dddea4332e401917175353a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299410, "uuid": "9e963120-56a4-4d25-af35-c6b7271974ac", "value": "T1C1235C661A857C14AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299410, "uuid": "37236d82-55f0-42c9-8832-8c1769882a9d", "value": "768:2XRWNGxV79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ylxqcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788299410, "uuid": "32ebeb23-dc0b-433e-9e6b-29a8b3eb0b6d", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788299410, "uuid": "50061960-0517-469d-b08c-7c5f57b436b4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299410, "uuid": "b38de1d2-f525-45fa-9048-8a00945968af", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670a72e9-a5b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Heodo)", "timestamp": 1788233396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788233396, "uuid": "1daa0919-01b7-4fe3-9217-afc4b25f49a7", "comment": "Malware payload (Heodo)", "value": "1813869bc6abb707250d89ae8b57ccb1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788233396, "uuid": "2fa45a63-f411-4dbc-b457-0ca78a822a43", "comment": "Malware payload (Heodo)", "value": "2b371117fd3dc235ab72fa57397da7ed522ab65c665b2b0d62526ceafa3aa2c3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788233396, "uuid": "369b1425-c384-4ecd-b174-edc49227e5af", "comment": "Malware payload (Heodo)", "value": "a2d518da5c2c73c5f209cec920532d756e7d931f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788233396, "uuid": "53d15df4-fea5-46c4-bca8-ad72f6ea5cc3", "comment": "Malware payload (Heodo)", "value": "c3e06a45afa20e5cbb7206c7d571c9f472ed1a88727252d6e9719689db229778dee867f328bece6f4f4e0c288e3f5b89", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788233396, "uuid": "770e9e07-9632-4b98-ae05-deb784698b90", "value": "T15416023FB28B653EE06A5A367A76A210553F766165138C16D7F4C88CCF250B01E3FB86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788233396, "uuid": "65eeb254-0569-42bb-b0cb-53a36d2dc623", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788233396, "uuid": "17830887-ac37-43c2-a1a0-cc95273c3924", "value": "49152:puI2h0/UpSX/OSU/arO4Eo2uVryCoEjXecfxGeJF82hbNYFWfoSL3rdf/rVltjkY:p5O0/DlEarZEo2ayCoAppHJm2rJztF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788233396, "uuid": "e96392f8-f0d1-46e0-9b53-c9458442b6d4", "value": 4255102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788233396, "uuid": "7d7c5fd1-a456-49e5-aa2e-2525909cd10f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788233396, "uuid": "20831e68-c600-478a-98ad-5f976f10a65e", "value": "\u7231\u63a5\u7801\u5e73\u53f0\u5ba2\u6237\u7aef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed02bbc-a5ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788256924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256924, "uuid": "defa6e84-8c76-414d-8d23-9dcf73353e67", "comment": "Malware payload (Mirai)", "value": "dcd67d9a9a2678cdc5d1219e5c98ad09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256924, "uuid": "396aef61-26e9-440a-943e-e46fd4cc9daa", "comment": "Malware payload (Mirai)", "value": "2c3ee30b7ccfc0b38d145997c6f353b487589cdd2bbc2d6c9fe96947fa461569", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256924, "uuid": "cc0203d0-2af5-40e4-80e0-0e201b602e52", "comment": "Malware payload (Mirai)", "value": "104bc1fa42307824ff673ef738996bfb578591d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256924, "uuid": "8d102812-24ac-4fd9-bdc4-0cccc85635f3", "comment": "Malware payload (Mirai)", "value": "2f072b803396ed68d48cd1dfe9b3ff3d34ff05b992034ccb6341aa62040054081c8ff0ac238555914cea4ba0154f1060", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256924, "uuid": "f084bc23-ee93-4169-aebc-aa66310b98fa", "value": "T1E3143941BCA29612C6C3527BFB4E428D371A636AD3DD7102FD2D6F603F8A42B4A77581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256924, "uuid": "8065990a-6683-40f4-bc5c-b5e1322fcd4a", "value": "6144:Nxw2+r2pgnnd5vwqCd0o4sYpxI0xsKSGG/EssMOjh5oHq:j7+r2pgnnd5vwq7o4J3TAEssMOjh5oH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788256924, "uuid": "16922ca4-1b6d-4f31-af54-69909be1d6df", "value": 207564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788256924, "uuid": "bcb8db87-930c-43f1-b9e9-84008527a6fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256924, "uuid": "3e76e11a-ac52-4ed6-9b34-85bbfbac6dbe", "value": "2c3ee30b7ccfc0b38d145997c6f353b487589cdd2bbc2d6c9fe96947fa461569.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2cc26e-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788278315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278315, "uuid": "b69dbebf-9c35-4be3-a605-a6f93a61c728", "comment": "Malware payload", "value": "3d9b314ee31f37dab34773822f7114e0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278315, "uuid": "49598468-ec92-42ea-a416-7b0a9aefa001", "comment": "Malware payload", "value": "2f43448fbf7a8a51e84f531dbd644ece019b4508da237200abd646fc27d18d40", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278315, "uuid": "7ecef058-b132-4a9a-9e37-7a9716f35c72", "comment": "Malware payload", "value": "f858fa100079a409006492a2b7842dcaedc88d21", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278315, "uuid": "916ef79b-e46c-4a67-8b90-0a542f3bb895", "comment": "Malware payload", "value": "705869ebfa3318ce8523055d9353b1a7f0b4a49f9429b37860324389155ea5540bb4925e20eede4dcd92528008081cd5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278315, "uuid": "1265156e-f805-4e11-aaec-54df8ca1a64d", "value": "T106761997B8924952C4E83A37BCBD80D433631EB99B87565A6D05FE383EBE1D90E34314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278315, "uuid": "338b4b8c-9e79-4851-bd31-6b85a6362fff", "value": "98304:UdVVgDl3pPW0TqlKc5GLZ4hLFs6zARE15:UCG0TqlKc504hLFs6j7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278315, "uuid": "21b79867-a6de-443f-8305-0428ffe22f9f", "value": 7536824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278315, "uuid": "d42b4818-c74a-431b-ba68-a7a52a237ac6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278315, "uuid": "77b5fdbf-e77b-4139-87c1-76a3c644b443", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec09497d-a659-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788304056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788304056, "uuid": "5c492066-4d60-4958-8b2b-d38834393696", "comment": "Malware payload", "value": "97f1abb216dd1d9e2b2b4b7c673965af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788304056, "uuid": "f90dd644-ad7b-4d8a-b726-0e26c34373ae", "comment": "Malware payload", "value": "2f4348bb0f04eb8bd5f416ab396831fdf6198f74d23ebfa03a4a4bc9a0023fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788304056, "uuid": "cedc3407-2be6-4ba1-b628-5d7aa3244c73", "comment": "Malware payload", "value": "bbea5b3f29625347e44b164cdb399ec3df6504cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788304056, "uuid": "e8b8ee5d-99e9-4f0e-9c01-da23e69ad164", "comment": "Malware payload", "value": "fbc8f052855308d1f157f2535b466ee8afe536fe8d4b67ce0c9856abafafbb77c1172c45ab59dd054e2152254d533881", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788304056, "uuid": "e7bb007c-1a15-4b5f-8dff-69a8f21d194c", "value": "T12ED52398FCA759B5E473C3FB8283607EB0697B844A618D5B36CC1B412E46A147C7A339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788304056, "uuid": "579971a6-144c-4ab0-8081-57324455e28b", "value": "5a2ed47d8c6c6433dbc831d38c92042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788304056, "uuid": "3d72a11e-0135-421e-945a-a33a5d7925b3", "value": "49152:7UeZNer6Otn6H5NcZvHF8i9xScrzO4IKvJucvcsnucwi1qfiJfiPe8P7hrxERs0:Bb3Ota5NcFFj9x7rAgN3qKfclS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788304056, "uuid": "1123f125-91c1-4649-8436-47f3d0ff0688", "value": 2978304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788304056, "uuid": "fd8e7da9-dd93-4d1f-865b-ebe7a8fdf775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788304056, "uuid": "ebf22deb-1600-41c6-9f4a-dac95d30f36b", "value": "2f4348bb0f04eb8bd5f416ab396831fdf6198f74d23ebfa03a4a4bc9a0023fe0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f230a85-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788243583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243583, "uuid": "c6e17a35-682d-4eed-8eef-565518eb6f25", "comment": "Malware payload", "value": "5f8ededeb1504b5f56c39c0ea2786eea", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243583, "uuid": "9656ecb4-d237-402d-baf6-69f959979509", "comment": "Malware payload", "value": "2f9b061c52d00c94c62044d16a64e50410743ff33edbcf3e367bd6f58dbaa559", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243583, "uuid": "dbe08232-2087-4e0e-b4d0-f746a5d7de92", "comment": "Malware payload", "value": "9d5ab63fd0ead30104b985cab02b1ffee8c68a09", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243583, "uuid": "51c8265b-7650-4653-9311-88e7efdf9e92", "comment": "Malware payload", "value": "15d4884a02e26f254b3796dcb6bca4550bfb7518aa30656992e6e6d34edc4709fb77cb0fb49a66f144529a1d10fef273", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243583, "uuid": "c2c6480f-2dd6-461e-8d19-b0e8bbd2cbfa", "value": "T1E8B4F040EF5708FD81D4506502F68B3936754FFB03E1FA843A7EE886E35B99D229A4C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243583, "uuid": "3a7f3b71-4159-4d55-98bc-2cc2fce56a61", "value": "12288:sDI9rLeD1yDVUjTHqPIn2l9ZD47WiJTDga42Ju2s:+9/n2l9ZD47pJTXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243583, "uuid": "c26a3504-530a-4378-8313-e6b87eca4c7c", "value": 497356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243583, "uuid": "ac268d20-ae73-43ba-8d5d-7c114bd352b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243583, "uuid": "922160ab-a914-4944-8da9-224f60cc6ca3", "value": "Confirmaci\u00f3nVerificaci\u00f3n de Pago______Pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f270b1dd-a649-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788297195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297195, "uuid": "4bde8ae5-0a68-47f8-b356-c82157444b2e", "comment": "Malware payload (Mirai)", "value": "e9205fd7f93c35693a4d6057ce8cc560", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297195, "uuid": "ba4c0af2-1aa0-443d-b925-709ee2a73f80", "comment": "Malware payload (Mirai)", "value": "3081380240ce27efb753ce0fe2a25fe3cadce5d925f55d707c9853a9e6dc67be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297195, "uuid": "3eb3e42f-7247-483b-a969-aaf4a8292825", "comment": "Malware payload (Mirai)", "value": "074660a7afa085cd7ae0bd858ad05f3747a3455e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297195, "uuid": "1bf25fde-5eb0-4d78-9d56-08284bbe5c1b", "comment": "Malware payload (Mirai)", "value": "ce80032918217427e4aab2267b59b53cce4f9cfd20ac2f43bd46eaab61916ac370e091ac547cf0f0be10a3f9b382fd42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297195, "uuid": "afaf3d9f-f7b9-45fa-999b-a5d12467c5b0", "value": "T19274094892F2E2FDE198DA305316BC1BAD3275363077724E729EE97313B665046EDB20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297195, "uuid": "19795bf1-6597-46c8-bb95-fb1405975a9d", "value": "6144:t9xoKSR9FJKZj5JtwnZyEFkWRECt7Hqkf9O9Ua9AO:TxdtwZy4kwECJHz9O9Ua9AO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788297195, "uuid": "7eb065ff-9b2b-42d2-bc6c-ce27346e434d", "value": 367304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788297195, "uuid": "df7b9569-82dc-493b-b17b-1a3b38c63723", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297195, "uuid": "d4b519fd-37cb-4225-95f2-497b2aa891eb", "value": "5d9b849863383550748d8997bc0f9eb52ec0753d5244499d85c301515d2438e4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709c646b-a646-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788295689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788295689, "uuid": "f1adf74f-88fe-4bb2-9ba2-09535f42b3d6", "comment": "Malware payload (Mirai)", "value": "4186127cf19c6724a62644a231e4831c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788295689, "uuid": "dfdcaf6c-5700-48cb-a4a2-8ca0c836bf37", "comment": "Malware payload (Mirai)", "value": "30e0026d26c7994333a3661f3a4f7d2a663e551eddf6356df5c5d838819cf064", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788295689, "uuid": "9ac79414-b729-42d3-919a-383f951d18bd", "comment": "Malware payload (Mirai)", "value": "e57ec6f493b0bec0abebf0187657f9ca03a1b6ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788295689, "uuid": "f238b9a3-3830-49f6-ba0d-46e738812944", "comment": "Malware payload (Mirai)", "value": "283d7ac8bd36caff8da2228cb64750254be95ec87425033f340250477a8d66b08428e3557b39f788bc84a6c8de3ec928", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788295689, "uuid": "471cee4c-b8ba-4e17-b899-b8734553763e", "value": "T182841A5463F1D2DAD244E971D3227F16ABB2063630B7B28B324EB67313B326545DEE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788295689, "uuid": "fc19398b-c505-47a6-a4d0-fdf9929bf2ad", "value": "6144:Dw/eRawvsmj9m2bsxzSSCZMOkiNfUj8kibQ8F7IIf4s2rxyDq1dG:30m4cPH3GigdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788295689, "uuid": "e480e49a-b0be-4ea5-8109-d8bb5efb34e2", "value": 397296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788295689, "uuid": "fe6b79c3-2a9a-45a6-aab9-f935a57d1b6a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788295689, "uuid": "2e53bb46-759d-434a-8f2d-49de0bf07ed3", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17f9863-a64f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788299690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299690, "uuid": "0ca002c4-4107-4637-939e-45b2db35d620", "comment": "Malware payload", "value": "4a598a498189e616fe1237f8eb2345a1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299690, "uuid": "b7b88e95-f1dd-49c1-9971-eb7c582d044e", "comment": "Malware payload", "value": "314a49ed66522f202101b625c9cc85b6ef3cc6af528e49ea06da2701aa7af8a4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299690, "uuid": "f7a854c9-7827-45e8-9664-676b34fba3b8", "comment": "Malware payload", "value": "2ec8f48b9f4ae8bae64224110cc29a668287b7df", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299690, "uuid": "b4f4cba2-0744-4823-9c1a-ec5db9e3198c", "comment": "Malware payload", "value": "d472efe83fe6712fd6f0f18dd9c26ff892b87fe03b99405ea128ac0232be46ca8dd6a7d06bd2ef4e20a4f0b67aa46749", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299690, "uuid": "39137289-5ade-4aae-835f-0e82c8b12b3c", "value": "T1D05170C517620EB63C53ADC337AF8C443588ABEE28C29E55A9ED34E4454ECCEB484B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299690, "uuid": "131c64e9-21d9-49cf-a7f7-7b0135cea2c8", "value": "24:pKQTxtijX3VZEdWVBY5P8N/WDX7kbHdNXL:pKQtSXFm4E5Pk/WPkbHdNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788299690, "uuid": "30dafc11-0132-44a7-a995-d3b339035217", "value": 2655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788299690, "uuid": "e1899b09-f135-4196-9bbe-66c81a8baa46", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299690, "uuid": "9bca034d-1a13-4901-9287-ac011f13ea62", "value": "av.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc20f69-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1788278320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278320, "uuid": "3290443a-8c29-4686-a05a-6b8df84fe799", "comment": "Malware payload (DDoSAgent)", "value": "627234203dc302192e9f7ab1d9f5c73f", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278320, "uuid": "797ed51e-1574-4d62-8fc9-b355ef6723a5", "comment": "Malware payload (DDoSAgent)", "value": "377e2b28d13ffd865201839b14fadbb6d3fc275a3e8e58211e84d425013f6cdf", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278320, "uuid": "06338560-26fd-462d-99fb-3537e51f7148", "comment": "Malware payload (DDoSAgent)", "value": "4d2a1a7f9785192eb08e720fee3834dbbe94f56d", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278320, "uuid": "3e332fad-affd-46b3-a2fa-9aec96508727", "comment": "Malware payload (DDoSAgent)", "value": "5cac491fd2aae5b66bdc6535a46859f168f8457ccbd3205c26fbed8a2f1adce60584d55fc61dcd7ced49869c7e218601", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278320, "uuid": "e39fade9-5688-4cb1-a757-9df95e925be0", "value": "T131766B81F788A136D94A0B3288A30B70B3712D82D1E5C96F5709F72F15B26F6694FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278320, "uuid": "51283098-50cc-4f03-8132-600e4b38ef29", "value": "49152:5zPv98deA+PQZRJp++9cclZ95M8AXZS4A7QffRPk36QOGK+8qm2CbIfaHHUt5Ebq:cMPm3M8x4A7GdiJOE8q8kynUjEm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278320, "uuid": "56f489c1-ee9e-4adb-9e45-022be4d731e6", "value": 7471288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278320, "uuid": "8300f47a-23de-4b44-a30e-01007801047b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278320, "uuid": "16a71ed6-d0c9-499a-a6ef-f690a667e261", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35f4df7-a648-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788296660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296660, "uuid": "70598930-9860-4ecb-85ee-447b0c8c97f9", "comment": "Malware payload", "value": "2df9c6104f7bbbea2616536c415fd70e", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296660, "uuid": "0c931e76-1b53-455f-9308-805ade69d5cf", "comment": "Malware payload", "value": "3846c7915cef375ef299531f75075279eb97834a331fb2b06330504fb79a73dd", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296660, "uuid": "d5151a2a-0868-4f57-b814-c297fb0e95cb", "comment": "Malware payload", "value": "b4e2882e26b495ac6750f6b80c0214a473644a8d", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296660, "uuid": "00dbef60-73a3-4d5f-bfc9-8112dc9d9760", "comment": "Malware payload", "value": "5a1e4aa1cb8e31664800571a66f26044420934815d2f100477497b1cbd5c203706ba3e08ec5ca76488d9543ab5ecfc21", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788296660, "uuid": "5d20f903-2d74-4b39-94ad-fdbb8098465a", "value": "T168C4021AFBA505F9C46687BA48550B51BEB2B8425FA447EF03A109072F17BDC4F3E7A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788296660, "uuid": "3762473b-4647-4f1a-986f-999cc75bcb75", "value": "92f0f7aa4a6391931022407f86031058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788296660, "uuid": "8f295455-de64-44f6-b7c5-8dbc60c49368", "value": "12288:dKoOZh1iRhhAgfcjEBizpuvpogGH71Ov4FCEEt:daZXAnf09zp0pE7bFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788296660, "uuid": "ad19b0bf-053f-4008-bc15-07d7c4c6e1d0", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788296660, "uuid": "09373c1f-c525-4f45-b868-1a84c20c0d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788296660, "uuid": "0be197ed-1786-4719-aad9-ff9ad0d2d056", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31224574-a5b0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788231158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231158, "uuid": "a0f84f24-4a2d-41f4-82e2-0d2c5f7efe9a", "comment": "Malware payload (Mirai)", "value": "5e12af97584d2e58ffcdfe1563bba652", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231158, "uuid": "78ea1935-97c5-44dc-9aab-78e724607779", "comment": "Malware payload (Mirai)", "value": "386df9ad75375fa794a0caf827cce7025f179368ac9389a5db47bc4c40f6d954", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231158, "uuid": "8482ec90-46ba-4ae9-9ece-0bb80818c5d8", "comment": "Malware payload (Mirai)", "value": "85c3d71494da8be00b7a3272c5b3824dfaef5b39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231158, "uuid": "754df7fe-7c0f-40a9-bb7c-3b745f54f659", "comment": "Malware payload (Mirai)", "value": "a385960f4ddeac26a4ad4e31a92569749f1474f076c8106f2d864299a435b576fbbf85effcc19a9aac66c694bf0580b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231158, "uuid": "a72b16b1-bd93-4f46-ac6b-da746420a0c9", "value": "T1E8B33B87F800DD7DF80BD6BA45630E0AB930A3A14A931B337767FD63EC721951926E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231158, "uuid": "94679421-f7ad-484b-8b03-f4c82bf31f9d", "value": "3072:+pumESClt2V2YjoeJyrvbyPZfh0/OsL/42W260yu:+paRt2V2YjozyPtu/pLQ260yu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788231158, "uuid": "7a97f394-2bac-4184-8c57-cbd1f6f3f557", "value": 107696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788231158, "uuid": "ad7b02fb-61b9-429c-a092-d93aab7709f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231158, "uuid": "06f4cafb-26ee-48f3-8b1e-d45a003cee26", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdd22ca-a5d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788245727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245727, "uuid": "7345de1b-ae5f-485e-9ac6-ee615c0dbdc1", "comment": "Malware payload (Vidar)", "value": "4e6f06b2eac9f0ca4b5246138073f694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245727, "uuid": "5efd8f89-b2f8-4c8c-9e4a-8b03719d9c07", "comment": "Malware payload (Vidar)", "value": "38dd98448e32585b7dc80ac2a8b6cce4b51532094264261e604d3698d4a23a34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245727, "uuid": "655649eb-fc81-4096-bcc0-728c8e80dca4", "comment": "Malware payload (Vidar)", "value": "ffebb5e6aa2b407b74f441f7c83e3a3e2136c2df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245727, "uuid": "e8683a78-ee77-4e3d-9f98-ee4acbea8f16", "comment": "Malware payload (Vidar)", "value": "67f1e5b27acd0c8e7e4c5cf2108a32d46f906a7b77c67df3884ecfc2fe44356cf192e4532ea79b9b36866b6bcebaac5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245727, "uuid": "4b664841-b457-4121-9514-5dfe35be8485", "value": "T11118330B7E859924D4A69F38D5774211763A7C48C73523BB2EA0A2743F317C26DBAF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245727, "uuid": "ef4325ad-ebb2-424a-bd85-841c6c497e41", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245727, "uuid": "71c0633a-6044-47fb-8aff-7b7ed07a5357", "value": "1572864:ptaYbWSIJOtp6wjTC40vWG9XPJjzezNb698vkT2ScNsM+QOSHvhL65:zIJOt8w/C40jZRyWdqsM+QLPh65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788245727, "uuid": "58dd5f08-9c27-46d8-a80c-65f61b7cdf9c", "value": 92371320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788245727, "uuid": "e34cd21a-a0f5-41be-a115-965afa069539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245727, "uuid": "94b35abf-8c71-41df-a52d-fbaf42ff1939", "value": "38dd98448e32585b7dc80ac2a8b6cce4b51532094264261e604d3698d4a23a34.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d0f84e-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788277365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277365, "uuid": "682bc786-7dcc-4cf6-a7be-2e62b2edf0e5", "comment": "Malware payload", "value": "e74108b06cc233fd1780db10109fc91f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277365, "uuid": "3ecebc2b-695b-4faf-a26a-f7684983bab1", "comment": "Malware payload", "value": "3941e8b6ca541c8f030f7907f265c546e1191159bb844b8f9d21551defd0ba41", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277365, "uuid": "eb975ed9-c9b9-46b6-adaf-dffc3583ebac", "comment": "Malware payload", "value": "fb9b0f200cef815f1b9abe4f0329e481548558b7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277365, "uuid": "68a3aeb4-a499-443d-8c61-dea6143070ec", "comment": "Malware payload", "value": "58f5f326027c227aad8e48ba8247556435cf03defd36a587c0def8ff3d53fd52043977adf6cb4c0333bc8df62bbf716e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277365, "uuid": "f8e36899-f5a5-4dff-8c15-0425eb130d46", "value": "T10AD633166BC71031F2690E794871E408CC457C98A8FA60492F7DD24F8BF9BE56EB7B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277365, "uuid": "1ae81678-4019-408b-a901-073a6d89fad7", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277365, "uuid": "b6e7941f-d487-46b8-8e4b-f060e33f8ca5", "value": "196608:NjZ5jt+v4rr9QrfdyZWs88A5NI7oeBpXrmKZuH51FWn7kW4wVSPuc1/9+c4lg7d:Nd5jtVW1s6NSBBB2DWIW4iSPucjsgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277365, "uuid": "685b28ce-c3fb-4a61-8946-726f83fb9cb5", "value": 12636828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277365, "uuid": "a9885654-8a17-4684-847d-ad68fb214b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277365, "uuid": "a1768a35-7828-4c49-a83d-8ebeeaaf725a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605d743a-a63b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788290937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290937, "uuid": "f2acee47-15b0-4546-847b-16569e2e42f1", "comment": "Malware payload", "value": "28690b255ab84b168b0df6b9f05d8454", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290937, "uuid": "236fa340-bd16-441f-9dd6-11be65bfc820", "comment": "Malware payload", "value": "39cf634622d15b5139c8646de73d0e69191cc89c4ff3fe6ebfbe71c672a2200f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290937, "uuid": "e7fa7f42-a69f-4b99-9e7a-a068076510c8", "comment": "Malware payload", "value": "1914ed2287d6b65823218c667b0e3eb4b296c6aa", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290937, "uuid": "52259b28-3ea5-4e33-aefc-e0663a530d72", "comment": "Malware payload", "value": "01fd28e87d072479ab399b36f3102e721eb14e64a58497f7177bbd589819e909b713d54ec028c88f9a5af299af89111a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290937, "uuid": "6405da0e-0181-40a4-848b-15e040c77d99", "value": "T1ED273396FB40969EF8B58A3398714671D1C38E758F87C287384473BC68376E84F16AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290937, "uuid": "5a4ae35e-8c21-4b9e-b25a-34544f8aa74a", "value": "393216:CtccCO+el0wCMNwavUCFq1aRflpfXESBeiZm/UPnrfCENIrcYW10Jfh:Ctc0pv7vUCFUYL/ESBeOPnFNIrXt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788290937, "uuid": "3c6b1752-9b84-4a43-9762-5552a8304d9a", "value": 20852033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788290937, "uuid": "b2d6fe25-3787-44e9-b7fd-2064659fd68e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290937, "uuid": "c1533a56-9570-42f7-88fe-aed4df2d9d89", "value": "Tiktok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f18183f-a5d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Loda)", "timestamp": 1788246724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788246724, "uuid": "572b97e7-af23-4f1d-ae7f-582d0b0d8832", "comment": "Malware payload (Loda)", "value": "7fe9e7c78b6338f423dbd0c46b923f4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788246724, "uuid": "6c4a8fb0-b535-4a67-a6fb-4b1c28260b6a", "comment": "Malware payload (Loda)", "value": "3b2752fb0962f3b7209adee1074d0fe77a35987182bd9e67f6ece9984668653d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788246724, "uuid": "8879fde4-e7f5-485b-afe6-74cb20fa04fe", "comment": "Malware payload (Loda)", "value": "6fea815c06e8d0b9e1a83e547dffcbed46d5c63a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788246724, "uuid": "97c6d436-99ec-42a8-83cb-4d62839579e0", "comment": "Malware payload (Loda)", "value": "6ab4065fdee71284fc42b287b93c97032a93f444cec2948042426b69fc89becbe8c3e4f51dfe473a245bd91bebf6ce1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788246724, "uuid": "3c094d07-f42d-4ebf-9388-eeadab0ea0ad", "value": "T12C65DF0367DE92A5C6725173BA66B701AE7F7D2405B1F19B2FD8093CEA60131821EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788246724, "uuid": "1a434339-335e-4703-9e9c-18a64a8a6e15", "value": "0e136cae6f625c80ecae333d9e2a37fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788246724, "uuid": "29868af8-f483-4549-b448-e88dbb771a51", "value": "24576:E4lavt0LkLL9IMixoEgeaOyEwSbtW+MNcGPbiM555Z97GdSq9MmCS:Tkwkn9IMHea5EwstQewT55NLaPCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788246724, "uuid": "f33b52aa-95a9-4f59-abf4-391f207dc6fc", "value": 1478656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788246724, "uuid": "debaf966-e2b6-4570-af84-b50331833b4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788246724, "uuid": "ded34a0d-8661-4b2f-8156-f13b66d9629b", "value": "3b2752fb0962f3b7209adee1074d0fe77a35987182bd9e67f6ece9984668653d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55ff71a-a658-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788303535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788303535, "uuid": "bb5e7bde-a502-42b2-84d9-130eca3964ce", "comment": "Malware payload", "value": "ef77cbff6f7e2157c38d27fea5b927ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788303535, "uuid": "305ad728-f110-4d62-adbc-22f5db9dc4a2", "comment": "Malware payload", "value": "3d10f5aa66dbf90ab7b1f3736bd9b3f3bf52b4b241a3eb67ba8a0c35d53f2fac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788303535, "uuid": "856fa711-51cf-40cb-b39d-5b8a7a7df657", "comment": "Malware payload", "value": "5b84234672c3f2219f8c6c1124cc9e7240eb3b55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788303535, "uuid": "7cb6f713-6d61-4a67-a1bf-066dcabe0296", "comment": "Malware payload", "value": "0b7680020467678de2771d71bc3818cab9dba73fb0c0c98a557d6101be94e29d87c51339dbcc658e7c1e7d32752e2ae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788303535, "uuid": "45a42cc1-076e-4026-8c57-3bc18ad3cfe9", "value": "T191C66B03A96502E5C9AAD778C5F74242777878488B3233E36E10BAB42F757D0BEB6714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788303535, "uuid": "560e2f17-4558-4042-983c-8452d0ead76f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788303535, "uuid": "be6005ee-fc67-4ed3-bece-d2c2218ed45e", "value": "49152:wJW7mTvJ+qY1qPQQEXG58VyysDQz9IP+FD2hg5RhFCaoHOkUhFe07IHbNMURptXk:wjgqod4cyy33+1HarU7WwVaHN0jfBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788303535, "uuid": "0b4a5758-55e1-4ed0-8c22-9f664a06747a", "value": 12094336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788303535, "uuid": "f30e3692-0f3d-46c3-ab3f-85b0b96ba2e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788303535, "uuid": "ff367521-9c9f-4361-b21f-c02a45645e81", "value": "3d10f5aa66dbf90ab7b1f3736bd9b3f3bf52b4b241a3eb67ba8a0c35d53f2fac.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fba2bbf-a5af-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788230726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788230726, "uuid": "90f604cc-f313-43b6-be25-09d59d7984c5", "comment": "Malware payload", "value": "2fddd506a860cc54e9f6103be0ae0213", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788230726, "uuid": "a21b248e-ef4d-4959-87d0-fc6245c34298", "comment": "Malware payload", "value": "3d578e83e82ac112c0dedc3f390b7ecbbca4ee77b4f50bff900bd30663bfe20f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788230726, "uuid": "4563711b-f42f-463e-8339-f9c030a43281", "comment": "Malware payload", "value": "8bbd518710f31c4ee9d03d2e7fb284216d4c2a8a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788230726, "uuid": "356da896-66a4-47fb-9d83-293e82a84651", "comment": "Malware payload", "value": "6cfacbb8eda9e8075f07195cebdc6ab0b6c362ad889b98188afee537be2c328e98c21cace03524fcaaba0e56d684eef0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788230726, "uuid": "2b5305f2-bf65-46ac-a335-30a27100a45d", "value": "T152236C6616857C14AA98D4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10872D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788230726, "uuid": "fa063576-c167-4b54-82c8-21c181499e55", "value": "768:jtXRWNGxVv9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:rlxWcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788230726, "uuid": "fbbe2f17-fa36-45d2-94f8-784ae2640a71", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788230726, "uuid": "e8e5ff20-489b-49ae-b92f-0926973edb9e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788230726, "uuid": "1ca48705-dd4c-4d65-9bc7-7e069a0bad8a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d99f94-a61e-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1788278323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278323, "uuid": "9a043af7-c5bd-4a68-85ee-22092b2c9331", "comment": "Malware payload (DDoSAgent)", "value": "0ffff8fc028c5ed2453f375bdf4b179f", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278323, "uuid": "64045ce3-fa17-4912-bfc9-783f6ede502d", "comment": "Malware payload (DDoSAgent)", "value": "3e36760ba1929dd8ac335daf75f10912f21cde1f7c79848dffcfc287536ff794", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278323, "uuid": "0b5d752c-0812-440e-a4fe-66a8e4eec563", "comment": "Malware payload (DDoSAgent)", "value": "33f1181a680ffb2567505fb50eb53a9ca51c5d84", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278323, "uuid": "78a3b1fd-8533-4587-bb76-115c1ec7050e", "comment": "Malware payload (DDoSAgent)", "value": "12144967953261c72be8ee46402a3ba398e8ca09cfdd9e7fbcd5ae1129fad22f7c202960817b9999caab2f1e7e96f061", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278323, "uuid": "f758421b-285c-4585-ade2-50050f04565f", "value": "T16B86F919BDC42BEAC45C5A7440EACD5622705E140BF2462A31A4FFE9BC7A275BF07C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278323, "uuid": "60b22173-e504-4515-bb67-f18669184f64", "value": "49152:chNMey+930ejJh3Xm7mIsl12txZVI5zWo31q0MCVeO6Y5EG:GBQyIsoI8aXVREG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278323, "uuid": "68fa1a38-1906-4005-b088-4445a0b587a1", "value": 8323287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278323, "uuid": "e5abbcf7-4e87-41cf-bbb1-9e5a70ca500e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278323, "uuid": "95c95daf-a8b4-4d9b-800b-cb213421c173", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340b6b62-a608-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788268958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788268958, "uuid": "26f419fb-4655-4e5b-8c9b-e345e43e95eb", "comment": "Malware payload", "value": "3c26edaebe6dddbca397bf668b371c54", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788268958, "uuid": "40268717-0909-4289-8865-9aab22485405", "comment": "Malware payload", "value": "3ef4326e2c1d7ef0a51f1335c016d9a65012f7bffec820b2deaf84ae92e3c044", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788268958, "uuid": "93a81c02-bbc1-42bc-ab36-20a5bb8d3bc4", "comment": "Malware payload", "value": "cc5227b3b2858e9530713f58c719460db18ed13c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788268958, "uuid": "55525aca-5d0c-4bc4-9451-bc89ffc731f0", "comment": "Malware payload", "value": "49c5a938b9ed30ae74b02a62c9dc2bbdb45fee545a4e9e2b227fb244b055b88aaf7b60aa8da02681648dee216500497d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788268958, "uuid": "03ae63ea-76d5-4b9a-be7d-e4199adeb752", "value": "T1ED463313C2028B0DD9F7C7354635971592B6B224AB6346BBD41EEA39AE8F6D42F11FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788268958, "uuid": "a2870e87-3d2e-4683-9638-bef84adea3cc", "value": "98304:sHXrtoCr0r9fWEoonIplmhpGaaHZHlUi+Kbm1UbMlSrCvlz/8lRhLfXO/uawi6Gz:ToonIy/aFUtvyrCvVcLPOWaw+DgjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788268958, "uuid": "2a9884db-1670-4b8b-a32c-743a5697be5f", "value": 5747338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788268958, "uuid": "cd20ad7b-80d5-4a37-bc79-3fb52f60533f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788268958, "uuid": "98ee84c7-f611-4372-babb-86feb2cd85ae", "value": "3ef4326e2c1d7ef0a51f1335c016d9a65012f7bffec820b2deaf84ae92e3c044.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cae68e-a5c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788239219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788239219, "uuid": "fe692c2c-b6bf-405f-a348-5e7438771c34", "comment": "Malware payload (Mirai)", "value": "b20a2beec7e081c2d1fe8abc1607a8b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788239219, "uuid": "7c4a52c6-3326-4b5d-9aa6-ca66abf1845a", "comment": "Malware payload (Mirai)", "value": "3f406f1968f6c47503b8ef56a39540d6cf3b2b7c80f6f58e952be5987eae64a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788239219, "uuid": "086fd11b-44f5-472d-a016-4583d707571c", "comment": "Malware payload (Mirai)", "value": "b365b8e00fae34751f301ec1f1f1797facf8e90d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788239219, "uuid": "e3b8495d-b1b3-4abf-afaf-542deffded09", "comment": "Malware payload (Mirai)", "value": "fec443000acf966b9d4df0421a92774183db1b5a7a155bf278c65666f3fc1e9e874145a8b9b241a5e4013e536910c9d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788239219, "uuid": "05dc9fe7-73f6-4e39-8f9c-287d5d9cd38f", "value": "T19FF37CC1A9E3E0F1E5A3497A436F971A4A36D4370219DA01FB2E68347F46050E7BB79C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788239219, "uuid": "61b9b5a2-c51d-46ba-9567-d7f296220d79", "value": "3072:do5lrHgJcLAVp9myCSCbsjoyzINpcyn8J1EssMZc/T03ImIys61X2h5or:mRHgJiAVNoyUncyn8EssMOjh5or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788239219, "uuid": "9c1c2739-b36d-4b75-93ae-c05eb7173acb", "value": 160236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788239219, "uuid": "12fb31c0-06da-47b0-a9e1-f7e132db6b9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788239219, "uuid": "59ba764e-d6bc-4c4d-b7af-6b755381bb11", "value": "3f406f1968f6c47503b8ef56a39540d6cf3b2b7c80f6f58e952be5987eae64a5.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90ebfca-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788277449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277449, "uuid": "a8c467a7-1c24-40a9-975b-f8161ae959ba", "comment": "Malware payload (Mirai)", "value": "cd4a1f8b1bd5362e4bf5426d1e5011ff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277449, "uuid": "0a5cabcf-ff7d-4cfd-af5f-655cffa385a1", "comment": "Malware payload (Mirai)", "value": "3f52d12b296c888fa180bf211cb63e9cd5cfb7252625c483bd04689ec85c140d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277449, "uuid": "464e70f1-7bee-4f15-a614-93a593cf7ef1", "comment": "Malware payload (Mirai)", "value": "c78035f36424bb32eb16c68c7ed73077477ac0b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277449, "uuid": "5936900a-47c3-41f9-8034-80223a33bc2b", "comment": "Malware payload (Mirai)", "value": "150480e4bba756b7ced0ecdfb62273859e9964b5c8e2025231837aaa697c4597671bdf3c1ede729c43bcb03b76a81168", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277449, "uuid": "b1f8243d-3ede-4c67-8f44-28cec51cb410", "value": "T12DD36B73CC356F58C668D9B4B4318F785BA3AA2081475FBE64A6C2794047DCCF90A7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277449, "uuid": "3a30759a-a2d6-478b-ae1a-0dd439228b2e", "value": "1536:GJRmqeLGb9B+jiIYG6vZz/CloKZKxvoRR96/DxWzkKbHh9QX45K:GjR8GxQjiIYG6pcPZkm9WxWQKbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277449, "uuid": "bce75c6e-e9fb-46fa-93e1-c5cd54d1e19e", "value": 133848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277449, "uuid": "2bdb4ed1-419e-4c4c-88e2-977307dd9bb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277449, "uuid": "c0610b14-2c12-4248-98fa-6c0a4d21c970", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87277956-a614-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788274252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274252, "uuid": "45eb1f13-0345-45f5-bae7-c3cc5aa9a09c", "comment": "Malware payload", "value": "c191c6039e73f9f6e57051264ae7fb23", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274252, "uuid": "594c1a8f-d1ce-4485-b6ee-a7b2beb31b29", "comment": "Malware payload", "value": "407156dcc6b97cb70efde9994f8e6ff8cfd2c9cd7e4f3d179f39edacd4d557d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274252, "uuid": "41a648ad-971d-4f96-bae0-966f083759f8", "comment": "Malware payload", "value": "752cafabe6f2eec44b3db0dd4444da19ef85ab5e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274252, "uuid": "24722458-50eb-43e5-8e25-3f00b3a496f7", "comment": "Malware payload", "value": "cbe7ef16e19aca443d60c2ca3eff0169b3ad9bb95d03b25190b514386357b9a0843b4d3876a0102cdfad1be826f5bf62", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274252, "uuid": "3766d656-1cc5-45f9-abf6-31e652858c0f", "value": "T1EE833BB5F5A894B132CE9239AA8491107993367F99142C34B0DDEE8C1F6F438D2BE375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274252, "uuid": "094f0284-a217-4a1a-840d-3b1b25f6fdbc", "value": "1536:bHcJIqBIhAYRfLSnn8Tn5p8IVPywGvuKJAJnKj+8XPwszJIPU+xW8u:bHjQKbBsIVQvPAJKi8XPwsOP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788274252, "uuid": "e6dc232c-51a6-4666-af9e-9b9db93c0eea", "value": 88365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788274252, "uuid": "e1bca93c-182e-46a9-ba50-eeb2b5ac0acb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274252, "uuid": "f232be76-93e6-48ee-9f7f-ae959aad193d", "value": "ps_Q4huLTcs.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8ea681-a64a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788297616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297616, "uuid": "f4423355-dfa0-421c-8ea4-50fbe6718458", "comment": "Malware payload", "value": "b135d924f409aeb7be55feacd68e946f", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297616, "uuid": "46117403-e121-44da-ba58-f1168fe31cb7", "comment": "Malware payload", "value": "40b643468356c0fd751893647ad0dc9e2a0019427e4f5f0e2f6e559efcecb977", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297616, "uuid": "22eb4bdb-9629-4798-b835-153021eee028", "comment": "Malware payload", "value": "a7b0d89d2f4f846e38ce3c4ea904d16113fda9ea", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297616, "uuid": "89410bb3-5669-4530-8bdd-2357254049b7", "comment": "Malware payload", "value": "a1a8c5d51137ae484407903a46029949ef5c4d912dd7d24d6038969ff4bcf3b5614a1ca86d7a67a6bbd5dd2737ca84f3", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297616, "uuid": "421e7fbe-c5b2-4dbd-8e42-94916a0af08a", "value": "T1A1667C0B3E8081A5E49ED63995B75252AB34BC4C9F7633D72D50B2301F763E42BB9B48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297616, "uuid": "a71f4d33-1f4c-4cc9-b32f-515e7ee460fd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297616, "uuid": "222327f1-1a62-4a31-911f-f8728049a21d", "value": "98304:JjxkpalhmhcBwROSWaUVJTOdTEo3qYScS4y:JtmalhccBwRNUnToQky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788297616, "uuid": "83480e41-8587-4b72-bc14-b0c38b15e3bc", "value": 7019440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788297616, "uuid": "887142a3-ea6e-4220-95da-a87b089b74ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297616, "uuid": "ef952021-8049-40ce-afc2-a71eaa4569b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d13952-a652-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788300803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300803, "uuid": "741faaad-6db0-4112-9b7a-bd43dc9f2c9c", "comment": "Malware payload (Mirai)", "value": "67eabf7dcdad1030585393bedb06e2c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300803, "uuid": "fc84ceed-55ed-4961-bcb8-0e712aa6d64a", "comment": "Malware payload (Mirai)", "value": "4125fe7e5b34d5a2d5db97a5b00d0c73dc1cfc1c13a73cd986616828f5051b95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300803, "uuid": "130bd9e6-43cf-4893-8239-d09fb8c7a9a6", "comment": "Malware payload (Mirai)", "value": "d73234e3526961b63ea2da0043601d0b3055df68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300803, "uuid": "41f6bfed-9630-4953-85b6-b339eec067e1", "comment": "Malware payload (Mirai)", "value": "e66e952e1a839026eb6df5d4c2f87839fca62a6ceb17ef012baf1f6095b7f8196aee8c84b772afd1f40ab1b2e1114307", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300803, "uuid": "fe5f1a53-e781-4104-95ad-f6cd3788c357", "value": "T19A143039BE217F7EE3A882310BF62FB4C35611C626929781E2BDC6545EB428C4C9F754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300803, "uuid": "49cfdac3-2464-4ba6-aeb0-cdce78119081", "value": "3072:4RPi4G+IFcTr0gv15U+RF9LzYwkkC6e2N/2WEDiat9zsVfjgo0Nd+r8J:4RKNduaTzsVrgo0Nd+r8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788300803, "uuid": "43374af5-2f80-4528-b5a3-63095f4176ec", "value": 203843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788300803, "uuid": "495c5d79-a7ca-4d01-b06a-f19c93f5968b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300803, "uuid": "c503589c-b665-4b0c-a496-ec7cbcc4aef3", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817028c2-a5dd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788250620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250620, "uuid": "a956ea02-03b8-4eb0-97e0-4004ea6b9e0e", "comment": "Malware payload (Mirai)", "value": "159b866dd9f08eca897dc1f5fb4a68e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250620, "uuid": "b45023dd-76c3-4f74-a220-1437a80f23f5", "comment": "Malware payload (Mirai)", "value": "41c2cbedda0c269614e79bdd4d734855f11c3b6685365c1bfeb3e36c80ff40e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250620, "uuid": "32c03e94-fbbe-481e-8682-8595190a50e2", "comment": "Malware payload (Mirai)", "value": "ad1df759f5fd99cbb87b7bdae90b2fa6cd62fe73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250620, "uuid": "ecdaa7c6-ee40-4eaf-85f0-8d5a08549fd6", "comment": "Malware payload (Mirai)", "value": "07a54cf2275d09ccb2f8ae7b7593fbb5e463180eab499983ec644cbfef572021bcaec3a8ca39aa785207b15390d12f48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250620, "uuid": "4956ab5f-8605-45c2-a198-9d67d49918f8", "value": "T1E444D51E2E728F3EF2A9873487B74A25D75862D723D5D640F16CD1102F2025EA46FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250620, "uuid": "853b0fe1-a423-4b4b-9b93-69eec018791f", "value": "6144:NX/mjWWzWkuS2eKWMcz0psa2f1pzjJTO1EssMOjh5owF4:5S25M0mF2EssMOjh5owW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788250620, "uuid": "4e640323-8e3b-4063-b6b0-271d867a4c10", "value": 260100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788250620, "uuid": "2572a9c4-6670-4653-b8fb-4579dc796c65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250620, "uuid": "7f46af5f-7c2c-445d-933e-578bbe4f12ec", "value": "41c2cbedda0c269614e79bdd4d734855f11c3b6685365c1bfeb3e36c80ff40e0.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11641934-a627-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788282215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282215, "uuid": "2686325b-cd48-44ed-9120-f9ce09c55306", "comment": "Malware payload", "value": "0dcea8df663843c5ba60c2b163a1848e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282215, "uuid": "8b1d7d39-ac6c-4ec7-af1c-c83be6abba38", "comment": "Malware payload", "value": "4296820a20cc78b80a9d063cdcff2d15f6e26f1b16a597d8ee17407b0ecc98b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282215, "uuid": "7a40dec6-f0d3-41eb-b4c7-66dbbac83fb3", "comment": "Malware payload", "value": "d7fb16238430b21a999fdf4014c39c428c0790fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282215, "uuid": "44bc7c35-17d1-495d-8355-3c7ca00c1c58", "comment": "Malware payload", "value": "73cd764f170ebaeaa6e55a7e22c97109e2ebd9867186879755f0386796524e2daed85c2fc134b0a049c5679c364f9a7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282215, "uuid": "c67de7a3-4e19-4938-af72-795b5909040a", "value": "T116D63318BB5050FAF9F3803D89D29C12E7E2B6161B96D2DB27B045752F272F05E3CA64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282215, "uuid": "ded3feef-29b0-454b-b287-0ebff841fa83", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282215, "uuid": "112802a5-5b39-4b53-942d-74ed5823e6db", "value": "196608:N+Io5IEXEpXnH2ph1iutoxSiLCw10+u41ZPcUQ+jlJg4MtAy9bW6q7ZtyavonYpp:0IWhXEAphVta510MjRnpASryavUYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788282215, "uuid": "2cb3ebdb-da6d-4634-9644-0fa3af4de3d6", "value": 12708822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788282215, "uuid": "a055e1f0-24c5-47de-942a-43c608f6ddfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282215, "uuid": "12b90b19-400b-4c19-89d0-818276ea507b", "value": "autoclicker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd592b05-a630-11f1-bd95-42010a9c0009", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1788286369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286369, "uuid": "119914af-587f-477a-8dbd-97a9ac308df9", "comment": "Malware payload (Spambot.Kelihos)", "value": "3dae16b34762512f7fa6c027857f371e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286369, "uuid": "c410eb95-eade-492d-a6b3-fa5cc576f374", "comment": "Malware payload (Spambot.Kelihos)", "value": "435475ac115a91544e9c4fc17551ed14cb241cf1b8a0c70f1f6e20043406925e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286369, "uuid": "12171c1c-e31f-4101-a25a-6a1d4283e297", "comment": "Malware payload (Spambot.Kelihos)", "value": "bc89f1aa50ae33f237f20dbc1b72ce86824712a3", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286369, "uuid": "076ff255-cf84-455b-9e39-81f2437d6561", "comment": "Malware payload (Spambot.Kelihos)", "value": "9d418eb869ec0d44f2e912bd15cd8c3cac61b71400263ceba121c121d41a07703f186535fc6a5b638f6041718e184a77", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286369, "uuid": "9cf08034-2ac5-4264-a890-08a6364e637f", "value": "T1047500523651FD7D029693B56E1646F0A86ACA80CEDF8556F24DCE8CB14DC823AF93C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286369, "uuid": "ff0ed663-cd8b-4faf-9598-0e0edb340c9f", "value": "12288:kUwWhuxyGyQOiPm1y9ptV4jxeRRHWd+oKSbfngBLkeYYI/VD7p3ArRqch8IiHCBr:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788286369, "uuid": "eedc1cf0-750d-42d9-93bb-c598a3a99f80", "value": 1658540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788286369, "uuid": "ddb4570e-468e-4c50-b210-eac3b045df18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286369, "uuid": "033628bb-4e7f-4f49-aee5-1af1a9c49571", "value": "snowplow-byte_coronawins_ladywin.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519b99b6-a626-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788281893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281893, "uuid": "f0979582-9f03-4ab4-a70d-34c21f893989", "comment": "Malware payload", "value": "c70d4875f09e91e837c4366ebe91355b", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281893, "uuid": "019c7ec5-3e98-4db1-8a14-d86420add8b2", "comment": "Malware payload", "value": "43d0e094c015b78412cc58c2ef1ab1b5734c8096e96add06105cae3e44bfdb8b", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281893, "uuid": "c84b74b7-932c-40c8-819c-76ebb1e9d153", "comment": "Malware payload", "value": "1e23723389a007c1885b758868239f5355d7b9cf", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281893, "uuid": "1f399348-e7b3-4f6a-9ca4-6749adb3be04", "comment": "Malware payload", "value": "c8603aa0dc588e69634d00d817b0dd63d52bb4d96b391fe6b513595fd2bc23dac69caa9a4040c86ecf3ec49c794cd42e", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281893, "uuid": "3ccf239a-20f1-4d0c-b8e5-9eda8fa786b9", "value": "T1EFF733D076B7814DE620687F93185A7DFA0EC535C61E7C528ABFD7A9B111E002A2CB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281893, "uuid": "fd95b7a5-5a35-45c4-a7cb-5936693ed1f9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281893, "uuid": "c398b7a3-26d8-4030-8a05-608bf13a3fea", "value": "1572864:PejOYfjvSjtt1+mbzEJE7jc1eaGTvXLy5YeG8+OqdYVA7:P4q/1jAJ4YwdXm5Yj8+vduA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788281893, "uuid": "e1a4e775-1b01-4e3a-8b63-cddcc2d800bc", "value": 74491453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788281893, "uuid": "d9cb473e-299f-4688-a8bf-4d77092992f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281893, "uuid": "856598e8-fde2-4600-91d0-5ab3451c2515", "value": "LatestVersion_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d00ef9-a624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788281254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281254, "uuid": "691fc074-7730-4f41-8336-60cf4686dbb3", "comment": "Malware payload (Mirai)", "value": "34b8de9af25351c80d4c5d2f72c0f2e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281254, "uuid": "f3e14e96-44f7-42ff-aac4-10ef2dcf7f62", "comment": "Malware payload (Mirai)", "value": "43fcee5bf45748de9cced8d92f778bf7530ea0abaa7fab4f4445b7799a31853e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281254, "uuid": "a9f5d0b8-4efc-4465-980b-ee44d4299371", "comment": "Malware payload (Mirai)", "value": "de2af582dca54780cb92fcda3c18f0e71f9066ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281254, "uuid": "a4b74243-2165-4ac0-a3b1-477f84adaf94", "comment": "Malware payload (Mirai)", "value": "cf672c1b70f78e5c84eb12905cbbb6753150c8a3c124a88f2ce1ef4431c4ac58ea8f11e3e958b3a52f494a5623ab0238", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281254, "uuid": "83a9d091-3daf-42f5-8842-cad1b2a15635", "value": "T15E84E988E1F1E7DED1D4EA75B31978093A230736A1D73146A51AFE3323EB1490AFD921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281254, "uuid": "9d48b9f3-a8a4-4b43-9f65-0830c2d4b748", "value": "6144:TRYN8CLrmtJaPc/3ztwVwVDtYDOxj7g8IhtweTuIBAe98a9lJ:KNWtJaoaiDawUDueSa9lJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788281254, "uuid": "5b7df25a-d56e-404a-a1f1-54696769ff65", "value": 374056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788281254, "uuid": "a7c524aa-5b07-4498-8366-858ce200f04b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281254, "uuid": "7e9c39a5-2f0b-4795-bf69-dc1680623b87", "value": "43fcee5bf45748de9cced8d92f778bf7530ea0abaa7fab4f4445b7799a31853e.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9d8269-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788277452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277452, "uuid": "9ee59e38-4ecf-48ba-a4f6-dcb93feecbf8", "comment": "Malware payload (Mirai)", "value": "8b1834190b38cc582d0c016bc6275184", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277452, "uuid": "7e6bff86-2023-45b9-bc67-713b0b22d2a2", "comment": "Malware payload (Mirai)", "value": "44a47cbb1f36ac9a51251f8171913385eba9d7caddfa5fa392fd7d7c1d39010d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277452, "uuid": "e196d95f-7750-4f49-92bd-564eb2f139e3", "comment": "Malware payload (Mirai)", "value": "c9ca6e20ac9427882a298b90f51d5a460cafbdad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277452, "uuid": "57e90e7f-578d-4b8b-ab14-577c60ef616a", "comment": "Malware payload (Mirai)", "value": "7dc74c652e1ef85c7d8dfd5c7ed0162be0312ee0a842701b384297db036227b0ad9305b3fc37aa6b96ddb563535aee72", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277452, "uuid": "ce75e194-5ec3-4077-a229-520224da4b5f", "value": "T150E34A13B9C184FEC8D9C1B44FABA136DA32F45D1139B26B27C4EA221E5EE305F6D644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277452, "uuid": "cc2cad9f-f707-4d7e-bd54-3b938376ec50", "value": "3072:QMc7/ZlEtCcGkM2eOiATcNdB6ysoCq0ZKnBV1:Q7EfALovS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277452, "uuid": "db4c29af-9c8a-4cfd-b1e8-f96df1d9fd24", "value": 154600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277452, "uuid": "19f08afd-afe2-48f7-a675-a1da7dc74dc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277452, "uuid": "c266a64f-84ef-431b-a95c-6e5a9ebbaa5d", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245f3a68-a5fd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788264208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264208, "uuid": "593288e8-ea8a-47f6-b861-a1db2f59d330", "comment": "Malware payload (Vidar)", "value": "bb0438616439b60170233a6c41e036fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264208, "uuid": "29dc5e91-b18c-46cd-92c6-b1a742fe5b85", "comment": "Malware payload (Vidar)", "value": "44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264208, "uuid": "f5d87301-bd3a-45d9-9638-cded3045560f", "comment": "Malware payload (Vidar)", "value": "5adbc92ae75fa92b8e6fa13656a47214927f4477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264208, "uuid": "d11b7adf-9013-4174-a0e5-dd805d8a01f7", "comment": "Malware payload (Vidar)", "value": "b63e65ef95b16265c04462a01bfc2a4fbb442c5a69bce8577b1327ae13ec9bc4071c914a406309e4a052c6d2867c050b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264208, "uuid": "1f3a48ed-5507-4812-9b93-8c0eeac686a9", "value": "T104665B07AE5441A5C96BA73CC6BB0225A6B8BC4CEF753ADB1E8174307FB67D06976300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264208, "uuid": "beb84827-1a1d-4ba9-98f6-12697a0edc4e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264208, "uuid": "5445c929-1723-4ff1-a31c-c807aff370a9", "value": "98304:gtJndFRPOCbDjyoG0qzKaW2wsTRukz3x0:gtlYCPjyoG6aXTEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788264208, "uuid": "8a2f1582-a031-4d58-a52b-21e2b6e3bd51", "value": 6686208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788264208, "uuid": "b4430115-2869-4f2b-b9fd-e2c436d5aa77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264208, "uuid": "01a90c88-f87b-4736-be90-3039998bd3f4", "value": "44d642befc8738199f8ce2a97940cbf5fdbfdf3fefd004266b526197d3c4b317.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df52845d-a5cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788243476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243476, "uuid": "fb8d4680-10c6-4a20-86a4-f8b3c9ce640b", "comment": "Malware payload (Vidar)", "value": "deda32158e677dbe042d30f3258ddebc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243476, "uuid": "41396c86-0709-47ca-837f-c85efab8a105", "comment": "Malware payload (Vidar)", "value": "46c08edfae30e6cf9363d9af2f7dfebb611f983277661c3e704dfc8a30521466", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243476, "uuid": "510ab150-6194-4e44-b5e7-452355972f04", "comment": "Malware payload (Vidar)", "value": "dd23a5533a7eff30318de1270ca8c34fce5aaac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243476, "uuid": "1685c66f-61c3-4071-b55b-e1f217048f33", "comment": "Malware payload (Vidar)", "value": "c31fc565140939c9335f1682ba941cd5040aab92dc1f56fc139ed99eeefe63b367b3b15537623b594b88c86db2f5042a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243476, "uuid": "37d3c083-d527-42cb-a878-3d27db78a06f", "value": "T1E428334A7E85A964E5AA8F39C577421176357C4CC73533BB2EA1A2343E313C26DBAF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243476, "uuid": "fde18e94-09a2-4185-aea1-ede8cb43e1a8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243476, "uuid": "43c44ad6-13aa-4af6-8ec1-7276306eda27", "value": "1572864:ptaYbWdsJa4/aEl5nPPxEwkSUVYrzghWnuphv5pqYPqDRvYVLCUyOlvTeQdo/Ve0:zaAn3qfecxv5AntvYVJvTeQStewwUFhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243476, "uuid": "1427d3f7-79a9-4383-bcc6-ea9f030483aa", "value": 99711352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243476, "uuid": "ad925f65-c4ec-4629-9354-47e56b23d2ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243476, "uuid": "0612d91c-36b6-4430-9a70-e8f1c79360eb", "value": "46c08edfae30e6cf9363d9af2f7dfebb611f983277661c3e704dfc8a30521466.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60e5f36-a5d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788247702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247702, "uuid": "6603ab24-e9f7-4653-bfa0-67d01ade66b2", "comment": "Malware payload (RemcosRAT)", "value": "afc8cdb2a73db30c38a2486f663efd1f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247702, "uuid": "53080c51-088b-43b2-8823-8b0b59fa8a0e", "comment": "Malware payload (RemcosRAT)", "value": "4700d78dc9cc9beaa47defa2d4146bb248cec26a3efaef5df4c10d3ed26a65f2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247702, "uuid": "90cf931d-9e79-42da-939a-7f8a90fa3b28", "comment": "Malware payload (RemcosRAT)", "value": "fd5b0e242041ed0e702499f1f50a3c1224ce5af1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247702, "uuid": "dc582c54-0628-4bde-a170-a65cac0cacd6", "comment": "Malware payload (RemcosRAT)", "value": "f48587120775663d6831204c3e1eae6f2a910d444afd5b475f5422cf8675fbb31f38d5a4dce6762e2833534f3f0b3c02", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247702, "uuid": "4acd6d7f-7f14-4753-9453-2b24d2fb0576", "value": "T13DE3123AAD00FD90816931D1E467FD9D12D13F0B96399E883B1988F62925344EF9FAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247702, "uuid": "74139ff8-8707-42a2-b322-601b234eaf9b", "value": "3072:a+y3dN70l8StZmOsYjUo0/mua4/INxXciU2Nq1sbs4NzFbtvBdHP4A2X9:a93D70nsw0NANxMzgq1s9tFbtvBdHPvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788247702, "uuid": "818ab0c1-de4b-4e06-95e6-ede579e0875e", "value": 143105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788247702, "uuid": "8823bce3-8d60-4325-820a-68a3130acb8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247702, "uuid": "f9c469f5-5de3-491d-99e0-fc0bce0eb7ae", "value": "MT ATLANTIC PRINCESS (IMO No. 9899363).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7a28c4-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788277452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277452, "uuid": "621f2643-0469-4d60-8a77-68f6e9d3a438", "comment": "Malware payload (Mirai)", "value": "5991eab7e9225f6b1f4f7b807e517005", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277452, "uuid": "a2193c15-a366-45c1-9300-92d859ad9348", "comment": "Malware payload (Mirai)", "value": "474201e1bba26666acfa8e48b1a946305450327674d6e7fafc9797dc1c63882c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277452, "uuid": "c51f6817-8cfe-481b-ac3a-42de8bef5dbe", "comment": "Malware payload (Mirai)", "value": "f2dd4f37854c46809c7b91655c1c8b63a1990ae3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277452, "uuid": "290ada26-b336-41bf-b00e-a3a550887621", "comment": "Malware payload (Mirai)", "value": "73e090df198004dfe7d8e4a49f78494b00ea9268a6c94df02b0c0d15a1928dc0ee5b3a9db2f767e2d2407fe4d30df995", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277452, "uuid": "f4a65a2b-c19b-4e82-b043-eefbc27257f2", "value": "T11EF33BD7F900D9FAF40AE73B88530909B230B7A610425B373257796FEC3A1990577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277452, "uuid": "28cc231a-ca62-4d40-bb6b-c7cf04d53639", "value": "3072:FLgk3JxDxNMXMBlAQKyJRhDOIPHnO0nsCcEVxjbifLzuET:FrNMYuyJnDOIvn1sCQLHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277452, "uuid": "ca86083b-3029-409a-813e-6e6ba95046b2", "value": 172816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277452, "uuid": "c03e2324-21f0-4a28-8f7e-c79cc844fb2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277452, "uuid": "f0a9cffc-5ba9-44dc-a300-7e27773fe619", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f69de60-a646-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788295687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788295687, "uuid": "ce31e365-bce6-4118-9442-74e913e3835d", "comment": "Malware payload", "value": "7afa14a7c1cd7feec217313e24f6f84a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788295687, "uuid": "f40c5afc-7bf4-4557-9342-421f435d9a59", "comment": "Malware payload", "value": "487d71cde80b2bae91c6f2b408703c5c4d57d91653a28f725f776e58fff03a61", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788295687, "uuid": "48de53d5-2fa3-450f-86c2-ade14e167a64", "comment": "Malware payload", "value": "3eec018999f3ce64ad592224ac1d166b73a642fc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788295687, "uuid": "80638073-0c50-4ce6-89ff-663fc61313f6", "comment": "Malware payload", "value": "7104f584106e171805d2a9762b97d030a79b5e7cbdf3e33aa0919c05bd0bb5036447aa8665b86db4a3c1c6c2a6f5da01", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788295687, "uuid": "c8d06776-0419-4c49-a945-525338199188", "value": "T1D7518EC917420F703CA39DE733BA9C053588AEEF54C66E19A5F938F4868ED81B081B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788295687, "uuid": "37752d22-a8c0-499a-8208-3f2151d6074c", "value": "24:vgAFihC/cDXx2m5HU5FjsIGXJAZoS8b75fdB:vgAAC/U8mG5ZsIGZAZoS8b7Fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788295687, "uuid": "a86d89eb-faf4-4f9a-a1e8-d3916d462abf", "value": 2528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788295687, "uuid": "d38df397-51e6-45d1-9986-4decf4f3bf88", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788295687, "uuid": "909acb0e-bad5-491d-850f-bb24779f56ad", "value": "k.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9379de48-a60b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788270407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270407, "uuid": "f3b41bfa-794f-4f78-b6de-a250ccf2710c", "comment": "Malware payload", "value": "637f8a0b7fb5f3e7215539175e199973", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270407, "uuid": "99e5a7cc-0fdc-4d53-bbfa-beb74bc2eff4", "comment": "Malware payload", "value": "48c4ace07fe6dc6110e4b829edfb3f5cbfe1cf27229972e7b7b6202fc43d9378", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270407, "uuid": "3ec70c9e-793e-4ca3-9861-32257a221f1d", "comment": "Malware payload", "value": "a88bb4a92c53f4c9241635881bdffe8eea6ac204", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270407, "uuid": "7d353f7c-c091-4026-b84d-e53f9ef7ada8", "comment": "Malware payload", "value": "1d974579fb00234247d9bf636027c98080357e0dc51e3d6d3b8350416c11df022eb8c8155d67cf7510e87081c43acd34", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270407, "uuid": "e330fd07-737a-49e2-b64b-295c487a33ec", "value": "T172C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1224A42AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270407, "uuid": "5749ba97-4e32-4e48-b55c-b86ca52fb4f5", "value": "768:38vCB+25j6es8RRX9FYpMSUpi+20qUpi+20YQX:38l25JXd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788270407, "uuid": "40600a32-875f-451f-97bb-d3a65faad0fb", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788270407, "uuid": "eb75ee64-1419-43c9-b359-662a96ab35a5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270407, "uuid": "3a885f80-842f-4a0c-adf3-a55d440d7f8f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7669ecde-a651-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788300423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300423, "uuid": "016aaf31-efca-4510-87bb-58b7c13e0335", "comment": "Malware payload", "value": "db9135d30e3b40b01a8e5ccc9f18c254", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300423, "uuid": "f27fbc4f-bb58-4c1c-abfd-f04cde0f42c9", "comment": "Malware payload", "value": "4aa60d3b9b7cc7c494a3e4daaab89735d1ef2fed27eff9838ad5780d585a2919", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300423, "uuid": "4764aa4c-0814-412e-9e23-3e61b0dfb5cc", "comment": "Malware payload", "value": "d44e14f213c187dd5d46c18ed7238e6b025e6828", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300423, "uuid": "3460183a-1dff-4ba8-9c3b-f197da1d1e3f", "comment": "Malware payload", "value": "15dc406a92dd72899b417856834a393b2e2b1cd7deb3ce56cb40cc925fd76f3fbe3431dc9d6cec829b24c09e36878863", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300423, "uuid": "d9bcd138-cc7a-40d9-b99e-4230fa494a46", "value": "T1BE519FC413624EB53C63ADD377AF8C443188AAEE28C29E15AAEC34E4454ECCEF084753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300423, "uuid": "3566ce09-9f04-4fde-ae2f-9a6f775ad75c", "value": "24:pKQTA8tii8X3M8ZR8dr8VBd8Y8G8808W8r8DX7x8bHk808XNn:pKQJ0XxYWilXCHIPCbH5pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788300423, "uuid": "f3675413-d143-4ca3-8c20-44280f014fae", "value": 2670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788300423, "uuid": "fbfa65c2-feca-4efe-95f9-71e1bf1d3b62", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300423, "uuid": "e11c0c8c-e512-4a2a-befc-a782971f667f", "value": "sdt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9974d73-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788277450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277450, "uuid": "f96f5f40-c160-4575-9dd8-4e17581c398f", "comment": "Malware payload (Mirai)", "value": "984c6181e65e25bd300661131e872d90", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277450, "uuid": "44664a9a-a5ff-4142-b736-174809c85b99", "comment": "Malware payload (Mirai)", "value": "4b77b451c0b718630ab712634c6bd1f39fe557ca6f30c185f79fbe64f8f1e615", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277450, "uuid": "2da6c80f-3624-4628-8c31-7f5f353d1e7a", "comment": "Malware payload (Mirai)", "value": "77e10ce538c5cc350089c9db8b305b5a8ccc9c88", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277450, "uuid": "70d1a382-61e8-4dbf-9e06-51aabfbbab10", "comment": "Malware payload (Mirai)", "value": "14dccb4fd012dc8d75a36b97f180c6fe237767d05b5bd9ecb4313f778a9e1b479226a5f4fbafb0ba3beaa53f189d5944", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277450, "uuid": "6e13f452-15c7-4fd1-865a-f956db2c8553", "value": "T159A36BC5F683D0F6E86605F56077F3368B32E539902AEE93C3689C32D851951DB1A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277450, "uuid": "2b8e012c-ba8c-4714-aa1f-3523380dc087", "value": "3072:z0D+n9AlVf2TC1QqBboxYPBNQ1qNUdSh:z3n9AlVu+1QlYPfrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277450, "uuid": "beaab542-5e1f-4abb-b603-72553b05e0fb", "value": 105324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277450, "uuid": "dde74c8e-e9b5-410d-aa4f-aedd29aeda04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277450, "uuid": "73454cda-e6fa-49f0-90eb-1f5381bcd4bd", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8e58d8-a628-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788282641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282641, "uuid": "bc52b5fa-c922-4699-9eab-dcde093445b9", "comment": "Malware payload", "value": "50a0e401d405e108da19d05a2efecf7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282641, "uuid": "25b4f11b-44cc-4b09-8bc8-1a35f8d460e1", "comment": "Malware payload", "value": "4bc8af0ee6c3228340d135cd197db62363a8f0b6b76d0bfa90970ead58dab91b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282641, "uuid": "dd9390be-0f12-439a-b38b-492665bd3f65", "comment": "Malware payload", "value": "c12e3b85d43499cbf9243fb2df8eebd494d2be6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282641, "uuid": "b4dd72d6-ef5a-4f6d-b8e0-f3cfd4bd5290", "comment": "Malware payload", "value": "619567aebdd70cf51fae1ebc7ba65a8265af1150f513a8931efd969f822b63ca900f39c5ab029b14da3597b4eaef521c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282641, "uuid": "c785d943-f530-451a-af2c-7c5fa8b8a201", "value": "T1B7E7336397241A36EB021FB8539D6F21F08CAF707B8B00962FE9061DD6212D5B97FD25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282641, "uuid": "2a127460-f44d-4ad9-a710-bbf3d5677039", "value": "1dcd477cce07724ec6b817b3be71540e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282641, "uuid": "9ed46e39-fea0-4723-a023-4b5482cf3dc1", "value": "1572864:Sp6xHMMX4hQkI57k9RlH7kphMQWninGCnkKN+hnMwO3I:SqHn4Y7QH7kXm6GCnkFu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788282641, "uuid": "cc437c7a-1e39-4898-ab34-15187b005678", "value": 65254554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788282641, "uuid": "551fd185-dcc0-4383-b89b-f68c7ff3a858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282641, "uuid": "b296c0c4-196b-47c2-aa3f-0e5df9d383aa", "value": "BEN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "facabb1f-a651-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788300645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300645, "uuid": "5c54a619-4a4c-42b8-9af1-ae875f2be8ad", "comment": "Malware payload (Mirai)", "value": "a7d8cc6ae11792d6071d89abbc49c3f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300645, "uuid": "a8eaa3d9-07b7-465d-a2fc-b3b059ed96d5", "comment": "Malware payload (Mirai)", "value": "4c1df8578967cb249ebb3ab7998f8cb754638002e22d2bcb95bb80f7b090c437", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300645, "uuid": "f8229f54-887f-4c6c-8381-10d4fa90544c", "comment": "Malware payload (Mirai)", "value": "e42f63f66f7424cb5a09734ee5288d61e1d62428", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300645, "uuid": "4cfc08b9-ab3b-4d30-b5b0-324c8cd55f38", "comment": "Malware payload (Mirai)", "value": "53fe5e80d9d345cee965e359aecd360e569303c7f74053d6de181568551e5d01577f943b87113d356bf1200bef432e58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300645, "uuid": "140cf6c8-e057-47b2-b08c-e0fc2b1c4010", "value": "T126F3C448ED24973BC2E273FAE78903CD373A0A58A7D773219D352A752BC9B546D39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300645, "uuid": "32cbd72b-ef35-4cc9-9a06-b63ae1cad3f6", "value": "3072:xNqQ0JLylfJrrpL8qrbekkFQoNvXaHiyLKr30GWZKHJ:xNJ2LyTr99benQoNvaCr30GWZKHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788300645, "uuid": "6763bddc-25c3-4fb6-85b7-42f02bac4545", "value": 172971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788300645, "uuid": "23451020-36b8-48b3-9406-47f2100998db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300645, "uuid": "2af63eb6-bc69-4022-9720-d42f61e3bd07", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3e9096-a5e9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788255847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255847, "uuid": "e735dd86-1767-4223-be45-d38a5060d794", "comment": "Malware payload", "value": "a3655f67af52090c5c9a869a1c04da6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255847, "uuid": "42215da8-ed26-4a76-9c19-24f3528de10e", "comment": "Malware payload", "value": "4ca3a0088c63497d7fce4a305c3fd98646badb2278cbca85571b0831f915adde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255847, "uuid": "74e07d5b-7d0e-457e-b897-f91e2baf2181", "comment": "Malware payload", "value": "bea2c9c8a39f2bf0009814730d46bbbff6fe3f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255847, "uuid": "5afd4fd9-e3db-485f-9495-5acc9e646431", "comment": "Malware payload", "value": "d85c4e0fca49cb814da0b063eba8a292d193c40a240f74cd951733367fdad8438a0b66dcd7999636c6424f57f3a980fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255847, "uuid": "d5ad4afe-82fd-43ba-a0e6-2b74dce65a03", "value": "T141235C8A2B6C8633DE8D497D94E3664206F3B233B952E34F9CDC85D859623C819143EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255847, "uuid": "285be72b-1809-4d3f-a5b8-f81c4593e69b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255847, "uuid": "879d03db-63be-4d4a-bcde-20f89f7d6e50", "value": "768:BsCqfxdxvG1/blL1Ml6qxI4khI/q0fdPIwbLfw:BFqpiXGe4khI/q0lPIwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788255847, "uuid": "5f4c9847-c577-46df-8408-466e48120c26", "value": 48680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788255847, "uuid": "ec91ac80-e231-44f3-abde-823c9dcb1793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255847, "uuid": "40d23ece-662f-4895-9346-a7ee602c63da", "value": "Lecoos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3efd143-a603-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788267106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788267106, "uuid": "faad4938-50e2-4e66-a3dc-052822f575e1", "comment": "Malware payload (Mirai)", "value": "9607a8f7f1aad0a582dbc415549f8d2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788267106, "uuid": "fd482de7-60ff-4533-bb3e-d2b653476012", "comment": "Malware payload (Mirai)", "value": "4ceccee0d3fb702d0ff6b3540858b605c718fd2746ea620708a2bed968fb86f2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788267106, "uuid": "9ee77c40-45a1-4069-991d-6bea2b4ed8aa", "comment": "Malware payload (Mirai)", "value": "1accfb3e777625c89661073ffc1a11857b72cf6e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788267106, "uuid": "4205694c-551b-4983-b407-0a88729aed54", "comment": "Malware payload (Mirai)", "value": "6fe58f2e6e7d03e9022aff99ea3692ffcac87abc80959c822011d5058d2b47b36d04af28b4cdd6d82749f85923e6d888", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788267106, "uuid": "ded9a12f-8bc9-4832-b9c6-30604b25962b", "value": "T18D3143DE54215A311246DE8E73A2354CB39EE9F72D5FC7E0DC4D0EA9864828CF162B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788267106, "uuid": "e3170539-efeb-4c54-901b-805972831fe2", "value": "24:pG+Eu1GJNQ1d0dM8lIYKscZ4hZS1j1r4iLEEqXqo/F:Z1YA78qYKscrRHqXqo/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788267106, "uuid": "80d85e61-4cc3-4645-911f-272344b099c4", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788267106, "uuid": "3b4271d4-f267-4b65-9199-2c895adcc817", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788267106, "uuid": "bea3b9cb-d565-4ab9-9f58-e4cdf5da3f50", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3add4d0-a601-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788266247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788266247, "uuid": "5e3ffa15-7f4d-45da-8043-3a5c30e6f613", "comment": "Malware payload", "value": "78094b85fba3908e511c3456cb72d828", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788266247, "uuid": "2f732d19-00c5-4d7e-9e5a-3b63c86c6106", "comment": "Malware payload", "value": "4d3505ab2134914e00d257f7e784f451be2bb90fd6afa09e98de003b1245fe13", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788266247, "uuid": "6981097d-8bd9-4d05-ad6b-33077c038d7d", "comment": "Malware payload", "value": "0d4a52d0926193219c2cf5b02395bc540308a276", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788266247, "uuid": "d13125eb-baef-49f9-83be-d49347e50037", "comment": "Malware payload", "value": "fd47bbdbb38eb8036bc73ded097bbf591203ec01d17697847b2909f9b31ea438d3ab7fa6ad893c5b0185c414197f8c51", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788266247, "uuid": "c411ca73-342e-4825-8e79-59ccdc94aa86", "value": "T1A1F0968F252CA827740C8E4636D294046444E2CB7A5FCF847B589C2ECCD4A0DB179B7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788266247, "uuid": "edc5caed-0bf5-46d1-99a4-a6599f6efa1d", "value": "6:SAY9PSlUyFAGyAY9CDnJjuJY9eQiASXdAY9YeyOHY9JeiN26gY9f1ivXiJh+Pn:41Gy2DJjcASXueyOdkxL9iP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788266247, "uuid": "c93fca83-12f2-4d02-be97-7205beb3a3be", "value": 561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788266247, "uuid": "af5ef2ab-b5c1-4c41-bb3d-82eb6e7ae725", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788266247, "uuid": "468e5a07-e44e-4e89-b217-26e90b131d65", "value": "c8r3nv.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d644d916-a638-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788289846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788289846, "uuid": "fb0f85fd-df1d-489b-ad36-dc4d1419904e", "comment": "Malware payload", "value": "2d3c5d5a5289636503abc978f9cb1224", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788289846, "uuid": "7f79c4c6-ddae-41d8-94e4-abad7c553825", "comment": "Malware payload", "value": "4d9724d7b0782295deec078bf0f6e8da05af94d758332afa7fc0a8a0543228e9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788289846, "uuid": "04ff31c7-a8be-43a2-b648-829d092f8c99", "comment": "Malware payload", "value": "394142d92836ff069d02d4358021f1f2b06e86cb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788289846, "uuid": "f3799607-0592-49ee-a49b-74f644dc8c19", "comment": "Malware payload", "value": "bae1778a51cd00e813b14074b09b8b3353260a522fed7f49a137c9a4ad30dcf574c6a2b76bd44473316e66ed76af76d1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788289846, "uuid": "94ed4f0e-ff06-4b34-a289-2334ebf12ff1", "value": "T14F27235ABB829A69FCF6423369B156B2E0076C764F4796F72810733D39731E40F49AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788289846, "uuid": "894affba-fffa-4919-a6e0-39ba1c95541e", "value": "393216:TtUinBBWWugo499YEI9fRXVIyD7bLMdJZBN880IZOXmkT/4gLwL:Tpn3vua9abLLMDZBNpO3/rwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788289846, "uuid": "30a40838-fe34-4725-ba97-ebda6f426a80", "value": 21342988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788289846, "uuid": "f3be8577-66af-4dac-821f-eb5f07bf007d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788289846, "uuid": "3b796426-ecce-466a-8cdd-6abf2e39e857", "value": "Tiktok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e298b063-a5e9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788255937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255937, "uuid": "32c4cc14-a63d-40dd-a28b-8cb5266cfb28", "comment": "Malware payload", "value": "be45798f06e71d0fe8ba7ec188fb44a0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255937, "uuid": "d6e7fd98-e032-4121-a541-e58e9922e040", "comment": "Malware payload", "value": "4df4bad80eb6db91b138f9852b9c2cbf42daf7637e9e5e9a9e7ab9000e1bf5c6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255937, "uuid": "f6116135-7bc6-4845-b31c-ce191f1f51d1", "comment": "Malware payload", "value": "21e275328248200f4776d1d5838da2b26b724e9d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255937, "uuid": "7ee983c1-cda9-4f85-9e1c-a90bbf2fe812", "comment": "Malware payload", "value": "e9915413a8dd05f6e8753f1dbe3e32228f59274011c869a6b60d62fdcd65061dcecd284431c8a63e2beb05d5b05bc9fb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255937, "uuid": "2566482b-cf06-4e69-8428-6d27ac89301b", "value": "T1EAC28D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255937, "uuid": "4947fa21-7c4c-4736-9ed0-17d94bddee3f", "value": "768:h8vCB+25j6es8R/4O9FYpMSUpi+20qUpi+20YQX:h8l25Jwod2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788255937, "uuid": "77f081b9-af67-4201-9d7e-97283f71a87c", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788255937, "uuid": "31180c52-5fb8-4b58-9bad-a1c33a9340c9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255937, "uuid": "d3902fcf-ec90-45a7-ac71-bc7c42416b26", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191ab01c-a64f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788299407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299407, "uuid": "86b5c13f-447e-4a6c-b333-95f0004bc3b7", "comment": "Malware payload", "value": "f46b57629b132da22be3d848b80c2a51", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299407, "uuid": "576a8a8f-1810-4065-9a76-e80c2b266281", "comment": "Malware payload", "value": "4e06f71b325f9f47397f3319fa9e6d8156062eccfd3c2f40d265864d93e23822", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299407, "uuid": "9fe8d6ed-2481-46e3-a403-1547ba2dc32f", "comment": "Malware payload", "value": "067e0a6c6b1ebd10435f8ce16e7d1513c97cf0bd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299407, "uuid": "c0c660bd-5335-44a4-87ee-53d093c347e5", "comment": "Malware payload", "value": "3852b7a85460a4ff355082e7300bdbcd21c07da04bb1cf4f795f5a4c17f6fd982f658b68374e3f67347cb258b9c8c414", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299407, "uuid": "87c9d505-5091-4990-ae24-c0a2f003994e", "value": "T13A515ED517620AB53C53ADC337AF8C447588AAFF28C29E59A9ED34E4494ECCAB084753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299407, "uuid": "3f02bf46-1734-4e36-b503-0b9a1bf3d246", "value": "24:pKQTZtiXX3dZod+VBsBT81j+DX7IbHl1XH:pKQVaXtuMoBTIj+PIbHl13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788299407, "uuid": "d81d165d-91ff-4379-a3a2-a36c35ddcda7", "value": 2655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788299407, "uuid": "3dad35db-d300-4146-972f-994a94040218", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299407, "uuid": "738762ac-42fd-4440-a94d-212f11a39b34", "value": "li", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7403ceeb-a5a0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788224398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788224398, "uuid": "c1acab21-0f50-4641-ba15-c00d59bbae0a", "comment": "Malware payload", "value": "9376bd4425826b722f5ce824f68e2755", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788224398, "uuid": "a2a79117-9bf9-4425-b170-919140a413ab", "comment": "Malware payload", "value": "4ff5127f162125a80bbeedf7ae42e56f24efba63a719f84d152c4266f3518242", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788224398, "uuid": "93038f82-cbc4-41ee-b2d5-1a4d52ecae34", "comment": "Malware payload", "value": "b1edb18aac912484a1db382dbce512defa86d420", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788224398, "uuid": "8e758e92-98cb-45eb-abd6-5bf955af94cd", "comment": "Malware payload", "value": "94892b9b470e4d9901151251f7f3df9c14407a86ebb21327a19e6302da5992d9726cb70b46dc8b991df3ed96aa4eecd4", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788224398, "uuid": "efd11853-dae3-4c00-b933-64b8634fa204", "value": "T199868D1493E449E0E12FD634C9668732EB707C555B31C70F1A7AE20A2F736F1CE6AA25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788224398, "uuid": "c4b065e1-3bb5-4316-837a-df1cc98dd306", "value": "e5cd8af6498ac8cd593af4ca716a6703", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788224398, "uuid": "14f631e2-39b2-4dd5-ba57-d4d8625ae36f", "value": "196608:kb4DdS4vCC2mV21TgfZZZZZSZZZZZZZZZZZZZeZHfSs8p:ICS4vCC2mV280", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788224398, "uuid": "896b8e5d-7dd0-4a38-81d6-8114ec8ea0bd", "value": 8347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788224398, "uuid": "4119fce6-46b3-41c3-9b53-541ff26a692d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788224398, "uuid": "b3c74897-f961-402d-ab69-746b60e098fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f0cb10-a651-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788300640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300640, "uuid": "5825db17-74e4-430f-a5e6-a3481cae9eb4", "comment": "Malware payload", "value": "3876857962bd54c1d1937a7600c817aa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300640, "uuid": "0c5b4cd6-b05e-439e-8e5b-ee5aec8379c9", "comment": "Malware payload", "value": "503dca2a79244bb2ad2dbeae2bdab48613fe6d16d4b4d8b16646c816c82c65cb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300640, "uuid": "990cf9fb-cd7f-43e2-99c0-665b0125e4c3", "comment": "Malware payload", "value": "3c424d54c5cdb531d7bc92508d168846a90052a0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300640, "uuid": "39bbdc26-75f2-48f9-8703-992bb01f63d2", "comment": "Malware payload", "value": "3fbb66fb72263de71701c8872b127961555da5785468f036d7a05f0cb9230498cdb305622ceb670d9073339d3050d638", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300640, "uuid": "18a76b8b-7c6f-4a9f-a252-0e8405465b38", "value": "T1B5518FC817A20A763C53ADC337AF8C447088AEEE28C29E15E9EC74E4054EDCAB0C4753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300640, "uuid": "c01fe1e9-93fd-4882-8e1f-08c4fd625e8c", "value": "24:pKQTxtiXX3NZwdOVBMJr817ODX7QbHl1Xn:pKQVyXd+swJrQ7OPQbHl1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788300640, "uuid": "37cdac15-31ab-4be1-9fb4-6472d8dac80e", "value": 2715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788300640, "uuid": "e2e1b2e2-4038-4d0e-ae33-d540255d6d5e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300640, "uuid": "d215590d-e779-4924-882b-8b17b89c50ed", "value": "ruckus.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc93a39-a5b3-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1788232575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232575, "uuid": "801b0fc5-7240-4735-92cc-f6dd56905e8c", "comment": "Malware payload (AgentTesla)", "value": "c80c2f7dd8d937d1db3a8b70076312bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232575, "uuid": "02130769-211e-4c80-a498-5bd9d773263e", "comment": "Malware payload (AgentTesla)", "value": "503dd959a7d2fb5309e3870beb60a8c9ee518b71712dfd40161052fb838aef42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232575, "uuid": "5eaff81b-5b47-4ef1-b707-fd297d02a2e0", "comment": "Malware payload (AgentTesla)", "value": "d5fee08bcf992ee856c6a292eb743a2b34012931", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232575, "uuid": "414e0696-0147-4da8-9f1e-b3226c66e70a", "comment": "Malware payload (AgentTesla)", "value": "4215702239f605632e69530103cc793edf04ea534283a22f6673391af03d4d816a6da01fb3f233fb01a7b75be42250ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232575, "uuid": "3148dec3-0ef9-4040-8fbd-06da657c5ad0", "value": "T13E253308B97AE1F32F3000EB3055EF97B497CE9642414191A38F6EEA8EFD9256813DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232575, "uuid": "e9ccd14c-6c57-4899-8955-c070266122ca", "value": "24576:anSP5aGI3nskpKvrNveeVEYdc+3R69wKfJ6K18auObTKF+01l3jDfAocq:045RILurMQZiOVKfJ6U9KQ01lz8oL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788232575, "uuid": "d77675ef-e7c8-4937-9689-5bdb22e91b6b", "value": 988840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788232575, "uuid": "4516d642-d857-4624-a09a-9ea9fabafa4b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232575, "uuid": "317f8b1c-ccb7-40c9-97df-2fed5b78e5b4", "value": "Payment_Advice_pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b95cf0-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1788243675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243675, "uuid": "04725a98-6e08-444c-ae21-da1d2275118e", "comment": "Malware payload (AgentTesla)", "value": "2d97702f9848f10b741423562e49baff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243675, "uuid": "b21fd94c-b341-41a4-907d-2b3912a04dae", "comment": "Malware payload (AgentTesla)", "value": "50b96fd6fd4f9efc978d548607b9d0063f97e5dc74a67a61014e14888c661041", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243675, "uuid": "d10c23a9-0035-408b-ae16-816e90e20181", "comment": "Malware payload (AgentTesla)", "value": "e540ada001e583b7f26546e76e58af149a5c105b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243675, "uuid": "517251b9-5e19-46b6-a875-2cd9b3b60de8", "comment": "Malware payload (AgentTesla)", "value": "faba46f3c1883410b7b19189523c0bbb324f3e2dcbf2bc5261f109699c7256869c3d64b306238a98c4f8d9fb006fb93c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243675, "uuid": "cf2a5660-56d3-4de4-8a02-31fc09a19e2e", "value": "T18364645645F0726514B79ABA4EF92AF4FF09A13B0EC34EBA777F66941F330406250B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243675, "uuid": "a8555618-a560-4d5d-824a-18571c13f1b4", "value": "1536:HelszvC0/zRK050zQ2Y/KnZGV+EoTX6oAJ3ZeINZxjtJF9D:Nz60LRK05005/KnAzeIJjtJTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243675, "uuid": "00015c70-4139-41b4-bcd2-65077783e1e6", "value": 310590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243675, "uuid": "a2b561c7-586d-42ef-81fb-793f404217c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243675, "uuid": "866e459d-6a71-442c-a121-0d5a42121584", "value": "HJR735-OPF0466-AXU0256.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae1f5d9-a629-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788283063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788283063, "uuid": "af47ba67-5be9-49bf-8e49-b62f8cfd37e8", "comment": "Malware payload (Mirai)", "value": "5d866ec3d8a1d486cacca3e2bba14a91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788283063, "uuid": "c90bcae8-5b14-4023-85da-816b910744a8", "comment": "Malware payload (Mirai)", "value": "50c406939bc2b051dc88c4df82bbdf6155c533a553d034a45783e7016ee23e83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788283063, "uuid": "2b1d2216-7129-4392-8d6d-9806e82d8d27", "comment": "Malware payload (Mirai)", "value": "6fce63bf6860346b391fddfae2bfc54d04e6a843", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788283063, "uuid": "f5fce163-57a4-4ca9-982d-039e8a81b18f", "comment": "Malware payload (Mirai)", "value": "c30428a0dfe6ffda1a73ed3dae95017cd0043aa55139576715a95eaf854092a90c316541f04aa04332e1d00497c444b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788283063, "uuid": "61934eb5-9342-40e0-b03a-38223e719330", "value": "T190742A8C92F1E3DEE158EA7453207C1A5C72463B3097728A619EB97323B71944AFED70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788283063, "uuid": "e81749e5-3dd3-4669-bcac-5eda47bf11a8", "value": "6144:uw83P30kXjYu4HwstbnLKH9SMnXEa9e1:S/30kEZ/tLMnUa9e1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788283063, "uuid": "f87bf468-dda2-4b93-9d95-5f952b50d6ef", "value": 339808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788283063, "uuid": "76883515-05a7-49b4-bdcf-b077a2d5a724", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788283063, "uuid": "bd37198e-3c54-4794-9b70-46f64cc3c09d", "value": "riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c35ced9-a5bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788236277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788236277, "uuid": "f7ed00c9-8698-4939-93f9-7254b7b9383e", "comment": "Malware payload", "value": "6d2655dd96414630257ab0a29f3b4c7a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788236277, "uuid": "a84afbb5-1eff-412e-bae3-ac9cedb4bd6d", "comment": "Malware payload", "value": "5159769b2b36c72598bb55b7d77340f95828e33c0e15fc0af186e9e94f6ed6ca", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788236277, "uuid": "6da6f841-f50e-42e1-a99c-3421344f9cca", "comment": "Malware payload", "value": "c97e8b88b38d6c7e9d987ff461789165b3ee6b02", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788236277, "uuid": "f42a24f6-8454-4b53-928b-38ebfbd297df", "comment": "Malware payload", "value": "a0b0c448178d394b9dbfa219ad12758a38de5e11721167b1bdecdb9a398d4d55ea87198e8147b8b784be6bf45683287c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788236277, "uuid": "bc4c81f5-2517-4123-bbaf-11301e257655", "value": "T182236C6516857C14AA98C4365C7F2F0CB9AD43E6314492EE7FCA3CF28C4A6ADA20861D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788236277, "uuid": "550d9308-6111-4961-95a4-0090d65ab3ee", "value": "768:lr9NyXsZztCm9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:tHusZOcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788236277, "uuid": "8bd25a9f-d5f7-470b-a089-fe8de0eb0c98", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788236277, "uuid": "c50410a8-3d34-4b79-80f8-01ef1713ba3b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788236277, "uuid": "bafbe0d8-b0ba-498b-9bd4-ae15fda40820", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e9d1ab-a64f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788299409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299409, "uuid": "68c2fe41-0f41-4229-a5d6-8ac3f73da2b2", "comment": "Malware payload (Mirai)", "value": "c4145dbc06262668e05e1392717a623d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299409, "uuid": "3c3e2065-fcc1-4f32-ab8c-d1fdf087fdec", "comment": "Malware payload (Mirai)", "value": "51e0e80af7100b9a2b296aa3e171e247a65276b9d19228c837c3c20e3ccadb27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299409, "uuid": "250705f6-b394-49e1-bbe2-36ca1c6696ef", "comment": "Malware payload (Mirai)", "value": "447930c82da28a61f2ae4430a48a6247db532aaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299409, "uuid": "c8185d19-d845-4bba-a877-5df6b7160984", "comment": "Malware payload (Mirai)", "value": "65412ff5aa4843e95a895cd26f19118d4de1f5b389d7da2e6fc145013de31cf667d5299976fc5518c5444533a2e1b6b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299409, "uuid": "2db63a5d-a515-4ca0-9f17-ae8b8c3be0fc", "value": "T1AE04D83F2B231F63C0DA257141D76232ACBAD70834AC4BD7ACD06C6D2F1A99835566ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299409, "uuid": "57bda8ca-e900-4b68-b834-48299c6ec0c2", "value": "3072:akC6LYhQw6gVK2mNlEml/qeGgKN5+8KGl8J:akCNhQw6gV2PEk/qe4N5+8KGl8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788299409, "uuid": "0c2c370b-40b4-4621-a86b-376afba493fe", "value": 173082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788299409, "uuid": "f78e87e7-c82b-43ce-a528-9f6727c50fc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299409, "uuid": "19e13632-6082-4abf-a557-4d5a7e5d76a1", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5b8d8d-a5db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788249888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249888, "uuid": "8366140e-9921-4ec6-9d51-ae6e1655717a", "comment": "Malware payload (Vidar)", "value": "9b96009facbb218606b253b3050a57e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249888, "uuid": "c1ba7817-b9df-4137-af33-0c200827f2c7", "comment": "Malware payload (Vidar)", "value": "565ba9b5e88872b48714394d927f67e2fe6ed786ff319c8672e3c8cd6b9c4f01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249888, "uuid": "a34dd0e3-137e-4b59-825e-424292dedbd5", "comment": "Malware payload (Vidar)", "value": "eaefc06b6811d28b1c0533869ea1c563e9deab4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249888, "uuid": "b03067c6-afb4-476d-b9e5-447e6d49b9d1", "comment": "Malware payload (Vidar)", "value": "c214ae0700ea65e94ea6b8b801c360152c720dfe548a5281e8a3f265eec0c4e7fce4c5bcd5b04586d1df29bbd3a4e1f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249888, "uuid": "79ebebef-786d-4b73-b4be-524b24224160", "value": "T10E28334A7E859924E5968F39C5774211763A7C5CC73633AF1EA0A2343F213C26DBAF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249888, "uuid": "c25142c1-d83a-4f85-96a5-964fdb792e18", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249888, "uuid": "3aeeb7ab-c8eb-40e6-9ef1-04e1d81c4957", "value": "1572864:ptaYbWIPPHiZ4B8VD3aezig/rRU7E2ScHr/uO3rx55sO//Ny8f7Rxoh9pr:fnHiRD3aui4RTPO3rX//7fVxoh99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788249888, "uuid": "477e0026-63cf-46f3-ad0b-b07eab9ef476", "value": 96565624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788249888, "uuid": "a251e90f-ebfa-4d07-a8b5-732e63ae33ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249888, "uuid": "5e3628ae-9d77-44bf-9e51-5c47836d8b7a", "value": "565ba9b5e88872b48714394d927f67e2fe6ed786ff319c8672e3c8cd6b9c4f01.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2051784c-a616-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788274938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274938, "uuid": "db52d178-1d58-4224-83ef-89fd2a198e5f", "comment": "Malware payload", "value": "bfc485de5f918654b6a40c2d3d64b21e", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274938, "uuid": "358b6b27-e66d-4f25-8ce7-3a67aced1d1f", "comment": "Malware payload", "value": "566003b60bdc0ea51392b656c00c0d2a31271143555d042da431695a9851db39", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274938, "uuid": "14c03252-dc45-44c5-85f0-2c888c559613", "comment": "Malware payload", "value": "7f3cb4ac3c61b1613b1ba3571614398a87412040", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274938, "uuid": "6a34548b-9292-494b-995f-19fda9333fdf", "comment": "Malware payload", "value": "86fbebd4ab6d232f7bca2fc7ee6d014890071bf5aa8bf883c4855a133da83657d10c2a2c9e5d97821694476e0ae17d94", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274938, "uuid": "6cc7760c-4141-4395-bac9-0667b20f0c31", "value": "T164A5F629AA69822DC153F27C1CDEE19BE2B57705439571DB2386130B0F6A7F24A2F53C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274938, "uuid": "1675d4bd-84a6-435e-9477-dea4d7ca9ab1", "value": "24576:0rfYIfHVIOhxj5m4wPrALhAYvogQEKZm+jWodEE7C87yoi:KfLmmErALVvt38r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788274938, "uuid": "6c3f171a-75cb-4800-abea-ddf24b48756c", "value": 2193408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788274938, "uuid": "18d5dad7-a9fe-4a44-8b0e-e0066e6cff10", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274938, "uuid": "14e2963d-7266-4c2b-b1a9-24f558708855", "value": "z6220260901_679428_7F31D5B8C2A9.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c662765-a64b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788297883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297883, "uuid": "eedf7ba6-5376-4d70-88a1-79265ba4e969", "comment": "Malware payload", "value": "c59da6b48ce08ebef39f8ef6db23d57a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297883, "uuid": "56b97a21-2aff-434a-ad66-c18c7af9d917", "comment": "Malware payload", "value": "567564ca8951af7b4d8d3f16d6dfef87b30fab048482dbfa5e878897e90e6814", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297883, "uuid": "9b237615-678c-42fe-a0d7-4d669c346958", "comment": "Malware payload", "value": "0b31d858683f926dccf13c5083058d2c664a5c6a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297883, "uuid": "b7177041-c27c-4257-9bb6-143bdc607e7e", "comment": "Malware payload", "value": "d147968f44431f347f5b7749139170be2efe26d37e8f1ba87680ce76c99b225968ebfd278c2260e93769d284abf54774", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297883, "uuid": "99d2bdae-5a1c-4ec2-9438-59d4d4d2a867", "value": "T1B3518ED523420F713DA39CE723BA9C0835889EEF54C66E1AA5F938E4854ED81F180753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297883, "uuid": "167fb36d-b45c-43be-9895-94784808c278", "value": "24:vguLFifLC/ctLXxoLYL5HSL5FNLsWL4LXHLuLZ2LS8FLlL5fdV:vgggC/EMa65bsI6bgZoS8JpFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788297883, "uuid": "ee4dfca8-6a92-4e10-b32d-636fbf6cb1b0", "value": 2573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788297883, "uuid": "b805e16c-1a15-4f33-97b1-57dd5e885fdb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297883, "uuid": "1c12400c-18c1-4183-85ec-451b4b18801b", "value": "gocl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a4ea5e-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788277449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277449, "uuid": "4a10ca35-ac63-4d0d-acd0-5e2f1a394275", "comment": "Malware payload (Mirai)", "value": "5474dabfc0dfb5fd15737aaeac82a622", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277449, "uuid": "605b752a-7235-4b3c-abb2-8e56369cd194", "comment": "Malware payload (Mirai)", "value": "56eeb726d77fe336a1379a1894c84b6276c5cffd4b4965e4b1ceca8af80d7fbb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277449, "uuid": "28708254-056a-46af-b55a-2d0e1a4f6840", "comment": "Malware payload (Mirai)", "value": "6c611ae23b42d54e5014b4023d24f0389767a99d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277449, "uuid": "7be7cf6d-bca1-4da6-b449-65ed93a0674f", "comment": "Malware payload (Mirai)", "value": "f0a63a8f0b2becdac3688df7bab69458010e47083d172c0cd6d802e822b67faa48861966ea4164e00db98cc14320f1b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277449, "uuid": "00f84aa3-84bb-4a01-a628-59051308934a", "value": "T15CE32A45F9514B27C6C662BBFF4E428D372A0768D3EE720399255F21378796B0E3B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277449, "uuid": "b385444f-5e37-41a0-b7d8-bc10b06ece61", "value": "3072:/45XQZuRfWECKUS64XNVI1L+tiZGDyTH/VO:/45AZudW9FS64XDptiYDufV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277449, "uuid": "cb2fee13-4d6d-4926-8f67-a9c14542d7ef", "value": 150196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277449, "uuid": "5b7289dc-22f9-4462-8e49-a696817dc765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277449, "uuid": "9f2a98f1-fec4-47e3-aaa5-f707e7ed9382", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1db45f-a64a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788297403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297403, "uuid": "29192e23-bf38-44e2-a8fd-c1c41265f160", "comment": "Malware payload (Mirai)", "value": "27aea885acbc4052488bb7c45184660d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297403, "uuid": "615844a6-8842-4e31-8554-564a104a3897", "comment": "Malware payload (Mirai)", "value": "57b1e438ea9864efa7ce4c5f310d039d618d52fa352dcd992d7f042591bf4b74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297403, "uuid": "26af521d-629f-4105-afb6-6277170f3701", "comment": "Malware payload (Mirai)", "value": "48d659b0c03fd53d94ae5743df283deca6305e16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297403, "uuid": "ed046fdd-5d0f-457c-b9d6-2902a8f648ba", "comment": "Malware payload (Mirai)", "value": "dca881be8b9423b7c9cfdfd2f13ba99f1525f9b419321d11f2c89bbf23195aacc3ad13386b5f2d4d56d57dd0099bcf75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297403, "uuid": "b5d571e0-2a7a-4d01-9178-d3f946e09ff8", "value": "T15284F8CC51B0E3CED064AD32D32579A79967123724837A8C61DEEB7B12F724606B9E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297403, "uuid": "81628e6d-77bb-48d8-b4c2-5084a66b4e71", "value": "6144:bUQdl3QTOyBB2Q2Q17+3WchtsnoRd6558LwxFCO:b5nyBBCQ170hPD65M2IO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788297403, "uuid": "d02c235f-4d70-43e3-a5fa-d0e33e1c7e43", "value": 399152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788297403, "uuid": "2f4c51ce-617e-4655-b9ba-bd743cdb34aa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297403, "uuid": "6b385b63-3ac6-441c-bf10-cf314f9ea536", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f2f043-a658-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788303531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788303531, "uuid": "0c735e2b-3aa6-4dc9-a8f3-e4356b85571c", "comment": "Malware payload", "value": "6553bac9717b08d09db81cf9d47361e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788303531, "uuid": "de517928-447a-40c1-998c-391f6edb1c16", "comment": "Malware payload", "value": "57f406023f5ac9e575c7c9e7befd31c42cd0699904a38cbd612b7cf72dcabf11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788303531, "uuid": "5b6a1739-503f-4f1a-ae15-3cde9afd1ad5", "comment": "Malware payload", "value": "3c0c6f56c903c2714d10754b46d5a73a8947e146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788303531, "uuid": "2dc6202c-91bb-4d2a-92c3-cc5f9f9ce395", "comment": "Malware payload", "value": "42f217896f23d7ff126dae49282951bc4951bbc8e3063067702796a6b248bea742a2c3629d5667a8366df8e23013071b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788303531, "uuid": "c82cad4d-00d6-4b14-b573-d9b0416b7e93", "value": "T119F59D0B7C9148EAD46EA33288765165BB35BC094B3623D72E90B6793F727D0EC36B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788303531, "uuid": "9c70246b-ce71-4a60-8a98-5b49a54f0bb8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788303531, "uuid": "c59beeff-9648-4b4b-823b-a374757cf169", "value": "49152:Olko47u4Ns0oaTaIYWUmtUFqO8Vmzk2htuSABezCq7oj:OKjI1QOimIKcjezVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788303531, "uuid": "2d4c343e-2863-42b3-a23a-1bf13d47fe63", "value": 3339632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788303531, "uuid": "e39ff76d-f70c-4312-8576-0295fbc48b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788303531, "uuid": "b89c49bb-833d-4864-90e0-91144ce60400", "value": "57f406023f5ac9e575c7c9e7befd31c42cd0699904a38cbd612b7cf72dcabf11.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd319642-a5cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1788243526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243526, "uuid": "8875e303-02d1-4fbd-b72c-444adb938901", "comment": "Malware payload (AgentTesla)", "value": "a3b649bb151be8e9b2a1db576fa62388", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243526, "uuid": "b79bd461-7baf-46c2-97f5-44f74d0b215d", "comment": "Malware payload (AgentTesla)", "value": "5868d4ab68bec3677385fd0e9b60b2f1b0b6f1cb0e48ecd9a659770467435d0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243526, "uuid": "c255e979-bd58-4fd0-ba2e-b8ba816f27bc", "comment": "Malware payload (AgentTesla)", "value": "f58adf9b09ea9d617795f1f2668db2ae303103c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243526, "uuid": "93af4e37-a85a-4d01-96fe-982c72748573", "comment": "Malware payload (AgentTesla)", "value": "12e101cf0e56f902caa2b4354f1a96a7cfaa94e2a5263693d3eca222078f188168dc0ea837414867a1979480fbd41a62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243526, "uuid": "205318c7-ee21-4564-8099-512431c6c2fa", "value": "T192B4121227D9783207D8FA3D849DCB0B8AEA0CD54A3DE6FE9940E5C759817958A3BD0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243526, "uuid": "d8d78ce1-6370-4119-b986-32405ecb0403", "value": "12288:R1wEKDJE4yjaIDE7iuKx91oJrWTrVt1EAQLxZrogVGwqqy:RuEITWzyr6Vt1dEMgVGwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243526, "uuid": "b2c36929-7ad1-496f-9983-0bdaf5b3bcfd", "value": 508621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243526, "uuid": "554c8514-5c6f-4a12-8423-47115df30071", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243526, "uuid": "22ed371b-076e-453c-8cb7-043a189f6d32", "value": "Realice el pago total seg\u00fan lo adjunto.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e47062a-a598-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788220926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220926, "uuid": "4eadffae-2734-4eb5-9ef9-27ca63b51d2e", "comment": "Malware payload (Mirai)", "value": "4cb8aff0a7e868c8394b316891963f7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220926, "uuid": "215d3d54-49bb-4636-8125-8f04186e11d5", "comment": "Malware payload (Mirai)", "value": "5a377ec931f19b8d8848f35dde27211101c7165212309e2065de22a32598506c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220926, "uuid": "115a87ba-6bb2-4c2d-aad0-63885b2436d5", "comment": "Malware payload (Mirai)", "value": "05d9a381645b23097c258ad0133f7be250ddc4f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220926, "uuid": "166cff98-df96-4476-9edf-97e8d50a9a21", "comment": "Malware payload (Mirai)", "value": "6f342c434530a349a9c50c4dbb2a71be5adfbe2c79b5e3a7cc2d4a3543454599fa34bbea0a8ff0a9200f15ae79b9e440", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788220926, "uuid": "3e6b8d82-8fae-4ef7-8d2f-5a26eace7ba9", "value": "T14E532992F882491EC6C417B5B79E765D3762A3F9D1CA3607FD104F113AEAA0B4C7AD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788220926, "uuid": "310d4264-7c9e-4a4c-969d-f90b4cc331b1", "value": "1536:i4buUW7vpqgFhfGNQeRNVrcqv8IN0BitYyRAqxG:iUuUW7vpqgFsQY9cqJqiE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788220926, "uuid": "d732d8c7-4db1-4ee4-8cc6-5cf60b66175a", "value": 63240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788220926, "uuid": "5012bd0a-62d9-4249-9683-b69179b44732", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788220926, "uuid": "f17065e5-49da-447d-b153-d6fc31223886", "value": "5a377ec931f19b8d8848f35dde27211101c7165212309e2065de22a32598506c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87070f59-a5c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788241180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788241180, "uuid": "cf4cbeea-1ef4-4ec8-9f9d-174565d20a67", "comment": "Malware payload", "value": "1c3af731aed593c3ad36d2da488a818f", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788241180, "uuid": "38958269-b074-46a6-997f-6b14257cd8df", "comment": "Malware payload", "value": "5aaf23589b0b24d1dc018e3360cd04276e5d0370eb0c075cb2726827c18eda64", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788241180, "uuid": "e0743260-f703-474b-8726-aa99c6d2423e", "comment": "Malware payload", "value": "69d176003c6e91fa21f795f6149c2484aa6a9ccb", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788241180, "uuid": "3f4d4a0f-109d-4b87-9a43-5431ed75861d", "comment": "Malware payload", "value": "bd29736bc0f5f1b0c8b9d05cf6190a731dca704159d9eb373fe71511c7ab655cd3091e23212ac441cce884c6ac090b7e", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788241180, "uuid": "b1844f59-cb7b-40b4-b5fa-cfd9d603671b", "value": "T1FDE68B07ED9555E9C0AD92318AB692137BB13C450B2263C71B60F7387F36BD4AEBA350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788241180, "uuid": "ce189d5e-a7c0-4f9a-854a-f2354f857472", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788241180, "uuid": "59a0a680-054c-4282-9d3f-0c6934e7401e", "value": "196608:nql5pz8yRUQJD1iqMhCP+KcQE+ahkIzaBpOQ1:nVyOQOqVnE+ahkJpOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788241180, "uuid": "b35b94e9-a699-4c19-9663-307bdd24b9b3", "value": 14046704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788241180, "uuid": "25acfb09-d9b6-4559-9d2f-c00e4ffb6721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788241180, "uuid": "36f130a5-056b-4f0f-a959-01a6f7ef39f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986c178e-a5d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1788247652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247652, "uuid": "3d636070-e366-4b3e-bc04-2c9f0244a670", "comment": "Malware payload (AgentTesla)", "value": "3e2cce996dc96f4e0898840ab59fe489", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247652, "uuid": "c0fc5ff2-de09-47f7-9d30-de67fa58aa1c", "comment": "Malware payload (AgentTesla)", "value": "5cae6238d47f085d7b339de163d62e7e8076132882ac3eb52b37d9a3d240b445", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247652, "uuid": "4dd378fa-e72c-4cb6-a548-e994243e025e", "comment": "Malware payload (AgentTesla)", "value": "fd21a5a735765891aa5e78e7c5288c1c6e625cd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247652, "uuid": "1fa85f03-4f7c-47ee-89c3-0c9c384bfdbd", "comment": "Malware payload (AgentTesla)", "value": "511dcf80a8838f296a3d0e3bc3d676db955b48f273d610ef1c3fbfccb4f3825a6b848d93e4dcc1a0cf5f74424799d62c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247652, "uuid": "0b6c787d-578c-432c-8741-239a65aad40e", "value": "T154D4E04449C4A56C0EADA3FFCB0FC2282538B7D2FC9A59BD5CC472DA49193318FA6E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247652, "uuid": "cd4de5ba-1526-48f7-8e67-e2681c42c3b5", "value": "12288:re8Zo1LT5CIjANF5Rv9ui1b9GFB9zImrTl+onq6oLuZTDKIKv:re8Z2LTcIE1RVbR9GFBJImrTtPKIKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788247652, "uuid": "dd14a44c-25dd-4347-82c0-db141fee37bc", "value": 619251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788247652, "uuid": "1c84f26a-a981-4073-904f-795b666dc9e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247652, "uuid": "a38bfa0e-0deb-4766-85f7-bbd3312451a6", "value": "shipping doc..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2c84fb-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788243711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243711, "uuid": "233ab62f-9969-4446-826e-68951d0dd0cb", "comment": "Malware payload (RemcosRAT)", "value": "adab01c299262e537ddc74c56295bd18", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243711, "uuid": "4561cdc8-8bfa-4c3f-94ba-02c9a50710b6", "comment": "Malware payload (RemcosRAT)", "value": "5d8c15bb1165dde4e3022a4870401dd4f878aadb532aaabb9e38f0ef68d6dd44", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243711, "uuid": "baa280a0-07d3-4d2f-873c-c9b726ea25fd", "comment": "Malware payload (RemcosRAT)", "value": "cef4c801cd4b68d4fd8c0ce3741a054f16188402", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243711, "uuid": "a10df25d-c1e4-47ad-91a9-5278977236b2", "comment": "Malware payload (RemcosRAT)", "value": "4f5f11156dddafc671ea0ee080c737c82b289a9f6dc9ec4e8687390825ba2435bad1fcc3e261665b70a203f1b7e7c46c", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243711, "uuid": "0e3c8774-960f-4c57-859f-329f615a7686", "value": "T19BD312298F34EE240679F80574A13A0512E8FF534054C9599B8D0CFAB772B0FAB83B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243711, "uuid": "cea99bdc-a971-4d12-954a-0aa0b53ba305", "value": "3072:zTxIfA6pdLZENkTNqi/L66Uk7afvZnGCQ/qWk7CTZcw42G8ncB5W:PxIoeLZEGqi/LmhGR2zT8ncB5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243711, "uuid": "3520bc44-f4e4-4ae9-a83a-e5ccfd6f68df", "value": 139248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243711, "uuid": "c9b9c65f-5135-4f2d-b74d-48ebb1621592", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243711, "uuid": "0cf705c0-82ae-42ca-8a96-3a8cb014ad31", "value": "awb_fedex_shipping_documents_tax_clearance_custom_duty_2026_08_31_docs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c8e366-a649-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788297181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297181, "uuid": "ff1a3b15-7bc5-4af0-a4e7-1fa9021e961d", "comment": "Malware payload (Mirai)", "value": "ffeb214a0d783c1be29b79d5c3b3ac3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297181, "uuid": "4464c01f-4e1e-4ce7-a029-9294eb76c504", "comment": "Malware payload (Mirai)", "value": "5d9b849863383550748d8997bc0f9eb52ec0753d5244499d85c301515d2438e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297181, "uuid": "4a1ec913-3e26-40bf-b58e-91d5d6631f57", "comment": "Malware payload (Mirai)", "value": "df15b901a09c5efe844247300b7d7d45fe0705e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297181, "uuid": "6bf237b3-d2de-47c4-8059-0ea41025f432", "comment": "Malware payload (Mirai)", "value": "12adb09892dd535b06d31d594a2269ff69f6573e03e4aad5b565eb250a3b16c2d612474a80bc3a6d4b112e17db43a005", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297181, "uuid": "42329997-731b-40ff-95fe-df3b73246649", "value": "T129C312B34D510F38D856BE75F8294A8AD483D8DD20D589F728D8A67F86F3B400537A2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297181, "uuid": "6f93a26e-1d9a-4d99-8d70-cb365d7544a9", "value": "3072:TIVs9JfRxSm1Il+St1msFpyIH7iI3VngijJn+t07QX1Ck:TIy9Jfrd1vumQp5vhgidCh11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788297181, "uuid": "163a50ce-dfd3-41dd-8746-2bf2cd6719ff", "value": 126140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788297181, "uuid": "34ad3479-4757-42aa-a5c9-0614116793d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297181, "uuid": "3c32464d-b0d0-409d-bf3d-14b55b5fb288", "value": "5d9b849863383550748d8997bc0f9eb52ec0753d5244499d85c301515d2438e4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e25a3d3-a646-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788295685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788295685, "uuid": "1e4030e1-635e-4c02-a64a-3270dd40ce53", "comment": "Malware payload (Mirai)", "value": "1e19bd68eee9eafdf29e17108d11b322", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788295685, "uuid": "8e087a40-e455-4cbf-9fcb-89789915bf11", "comment": "Malware payload (Mirai)", "value": "5f9f09ba0b922e4d9f892c200eb365b6fcc00b06a991bf160ac4ee0eb0910e69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788295685, "uuid": "416cfaa9-6057-487f-8b51-7049f0e79135", "comment": "Malware payload (Mirai)", "value": "289586d9e8272ff6dd0e39c9ba9c84c19d3646c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788295685, "uuid": "4a807100-32c8-41b3-badd-fcf4e348bbbf", "comment": "Malware payload (Mirai)", "value": "0d1345af9f48ce3854d69fa5641dbb297d4197027ce377f8de7e37730e1357499595388acd99c32bb825ec1669739a52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788295685, "uuid": "7be54a18-9450-42fb-9014-af31cdef0f48", "value": "T1EC354A16F2B370ADC093C139479BD7B2A939F07902126D7B32C19A35394AEA05F19F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788295685, "uuid": "a16b7377-b766-481c-8682-f4a379b407e4", "value": "24576:Xu23llpsIbaMspVClAjvE8X6X1HvHt1H0s:T3llpsIbUpOYvEw6X1HzH0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788295685, "uuid": "7414be9d-c7ef-4702-b8db-9f7211e097dd", "value": 1102512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788295685, "uuid": "4bc0b7bc-662a-4ced-94e5-39874b38e298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788295685, "uuid": "04dae3c3-f09f-471f-adf3-ecf3cdd935d5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fef3f99-a5b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1788233303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788233303, "uuid": "47013f96-ce4b-4bde-9db8-347f28c5080a", "comment": "Malware payload (Formbook)", "value": "29a02f10c81c3b42f0c0324484427707", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788233303, "uuid": "d0d6ea3a-4cb0-48fb-a6e6-b570718d4327", "comment": "Malware payload (Formbook)", "value": "5fc2d30f108373d11a5bcb3c6b6f840bb13506b7211ff088c83d9f3ca4b3b403", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788233303, "uuid": "cf81d333-01da-49ce-9253-6de4563864ff", "comment": "Malware payload (Formbook)", "value": "e8efd72c6c652ba2f8bc28f762bdf4018104e7ec", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788233303, "uuid": "cb1838e8-c614-4c0e-bf67-67277f2d7706", "comment": "Malware payload (Formbook)", "value": "3367e095e662d3453555b32b137a5034132945e05c2e39cfe431855b2a4ea2729504df5c25f20551a0afd553dfc2a3fe", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788233303, "uuid": "7ae0e14b-8c6a-4a5e-ab64-9b5472c16ea4", "value": "T128920E05589238849373677B631BA8D0E7BB076B0144494BB8BCB8819FF2D1DCED59BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788233303, "uuid": "b2bbaf26-b21b-4f6b-a6c5-a2944f7abced", "value": "384:5UIheQKVDiUi/PeNkyvNAedmy2BQ0EpSgQrC37n8wZn/2VJ21Ky6656BkTMcB43v:eIheQ2DiUi/PeNJvNAedr2BQjYgQrC3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788233303, "uuid": "479728fe-1fda-419b-8d1a-798ff3233e36", "value": 20909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788233303, "uuid": "369e7f86-1597-4cd2-81db-2038a8ad9d3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788233303, "uuid": "62d25a91-71bc-4e69-9d58-07e7593011cb", "value": "Harga RFQ New 0260891566.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd767369-a620-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788279604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279604, "uuid": "fba9817f-c2c9-40dd-b3ee-f131b29944ab", "comment": "Malware payload (Vidar)", "value": "178add8445530cddaceecb8d972e1a59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279604, "uuid": "88ef7b9f-22e6-453f-a194-c30eec1bca85", "comment": "Malware payload (Vidar)", "value": "60074193b7ab89da6a34af5c1846d9c2a1a7107f7d1d6d6cde95b76148aa619e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279604, "uuid": "872ab95b-50d6-42e5-95d6-9781d93e8299", "comment": "Malware payload (Vidar)", "value": "9a367fa6194fb87f17cc3a6f328c1923f8a674a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279604, "uuid": "0005ee3e-0316-452b-89a2-24ad4400137a", "comment": "Malware payload (Vidar)", "value": "a83a2993c67ac2fd43564e46698a2f6bd231e7af078488594111eb169548c532dfcf1c4d12e7971dd84b5e0583925309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279604, "uuid": "0cbcd28c-90c4-40e2-9914-fea281296e68", "value": "T150F65A07BF4602E0C59ADE35D0BB1721AB25BC4CCB3437AB2E5461B42F653D2AEB5B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279604, "uuid": "32982960-9f50-476d-bf69-0c662fdbf047", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279604, "uuid": "1e980c71-3c0d-475f-b250-be73e5033208", "value": "98304:rV8caBXOthfNHaUg4meKNaBS0smU4YsjTRVfkIPrrEJUR:racaBGfKNaBS0sj4NFPrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788279604, "uuid": "c26573fd-6154-45da-819d-85f3691c7d3a", "value": 15813496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788279604, "uuid": "42447b20-e492-4ae5-8774-8af594012d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279604, "uuid": "a34bd59f-fc4a-4eb3-9e71-68f45b59380d", "value": "60074193b7ab89da6a34af5c1846d9c2a1a7107f7d1d6d6cde95b76148aa619e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b149bf6f-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788277329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277329, "uuid": "347f1f8b-13d4-4714-ba29-a89e69738d6f", "comment": "Malware payload (Vidar)", "value": "fa032c661188ba828278d9d2bdaac819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277329, "uuid": "5acf0186-40a3-47ae-8d08-1acdc5532eb7", "comment": "Malware payload (Vidar)", "value": "60129a548307204fed1f4c698e12bc17d941592d81deb163f9fa63f4c6ecb3db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277329, "uuid": "a9151ded-c693-4730-accd-377f6cf22e1b", "comment": "Malware payload (Vidar)", "value": "fb8dffc6b8746204799dc9ed6452e643cb2f6b95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277329, "uuid": "5a709ba1-9c30-4e69-8d07-a1fe9c83b4da", "comment": "Malware payload (Vidar)", "value": "5eb73c457079773fef89243e169b48b0241a1bb5e76c79ed609d0d30b43d4374eeab2822b8c10b3c451e42ce9509ab6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277329, "uuid": "d1b846c3-c589-4887-a80c-b89a54e1f6ea", "value": "T1927423569A24F04CDDEE41734A9892B00F9C233D339EE7FD865D81ED6789EB48741A1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277329, "uuid": "2217a8e5-ecd9-43ba-86e2-6b5f0be1364a", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277329, "uuid": "0a6beb03-9ad3-4d43-925f-6e3535368012", "value": "6144:v4bod7g8wsXGwYhOR4NGG3gxz5L/cdBxBrbouX04clvy6IuqcdgJ0CsnAPND7O97:v4Md7gaWwYIeNZw3UnBrX09v8eCsnA1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277329, "uuid": "b1be72a7-a5d3-4501-8263-7af8e9bb4365", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277329, "uuid": "1f807141-044f-4d7a-b86e-0f433661fd72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277329, "uuid": "2272d7c9-0252-4cf3-b10f-6e170fb632a9", "value": "60129a548307204fed1f4c698e12bc17d941592d81deb163f9fa63f4c6ecb3db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6d4576-a59a-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1788221733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788221733, "uuid": "4d83a49b-a407-41df-9558-e872c78aab71", "comment": "Malware payload (WannaCry)", "value": "6947fe506ee83239c32a4213a91e1365", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788221733, "uuid": "f8fc6378-cd40-4fd8-ad43-207ddc802765", "comment": "Malware payload (WannaCry)", "value": "609996da0ee3ae21db2ecc8c98c656994723fc8359410a118a2042c418b53f03", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788221733, "uuid": "9922c110-a29a-4ff5-a338-f56a4fa2447c", "comment": "Malware payload (WannaCry)", "value": "10956e3f7ca522e8c0c0841446d883f7f65a9c70", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788221733, "uuid": "d8130d3c-fdab-4726-8f5a-38e105cbe28b", "comment": "Malware payload (WannaCry)", "value": "b263cf2a9150aae7fd4557947347a7e4d3079da6d5f7c05e87ad1b6eea4512248c41273aebef56f6a1bd776e65f2ec6a", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788221733, "uuid": "e9a0175b-e576-474d-9c2a-60e56cd79b45", "value": "T13536239931BC81FCD106197484B78E22F3B37C6A26FE5B0F9B40457A1E13B56BB60B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788221733, "uuid": "c5ba7df4-4cfb-4ed0-ba72-ebf3b56e96d7", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788221733, "uuid": "86c60dc3-eab0-4982-a6e0-af0022bd7957", "value": "49152:jnsnlMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DMlPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788221733, "uuid": "1191cb47-34f2-4ccd-b4bb-bc229fc19910", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788221733, "uuid": "049bdda4-5525-4f98-a7ea-7a3d108cf7fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788221733, "uuid": "ace5e05f-19b0-43a4-ae37-17f99645bec5", "value": "609996da0ee3ae21db2ecc8c98c656994723fc8359410a118a2042c418b53f03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfaaae74-a5a9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788228390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228390, "uuid": "c504dcdf-c7ab-4a2d-ab57-887daedb4e90", "comment": "Malware payload", "value": "08002e145a5b211e9541ef43e43a2903", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228390, "uuid": "b9451062-add7-432c-96a6-feb22a926910", "comment": "Malware payload", "value": "622632461f08d057fe5a14c61257bee3cad49bd0c7b89f571dff86debbdb37d9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228390, "uuid": "2ff262f1-d140-4e29-9e7e-e43751207042", "comment": "Malware payload", "value": "82bd237e7e610f7126e26c879c80247b33880d35", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228390, "uuid": "012d6d70-d7f7-40b2-af86-59cd1e457fd6", "comment": "Malware payload", "value": "5fa087d1a38e78cc0ecc6e3df9fdf6c758a198b36d1f2897d84ee0c25af66fe49ee2aa0d3b482f8c863e6e70264abb78", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228390, "uuid": "f9f4b3fd-778f-4ee8-8afe-3db10658f1bc", "value": "T146F58D475891516AC1AAE679843A6512EAA0FC4DC33433F72FD0A6B02F727C15EBEF05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228390, "uuid": "126a0691-c644-46d8-bc9d-1ce28c53cbe9", "value": "49152:RD+feoalkLgM2+S4qVCeimNqt40rpX+w6KUZsfU0+fHMWioBXMA9wjXK562VrhDk:Re4My+qQFlp6/Zs+IUxwrS6Erc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788228390, "uuid": "e70ec8e8-10d8-487e-8e56-d0cf1836a4b7", "value": 3473408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788228390, "uuid": "e8558228-0fa8-4704-813b-e57f50c1baa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228390, "uuid": "0659859d-e148-41dc-9e0c-146e9ec2fffb", "value": "tfmb_0a954e02c5c334fc_0a954e02c5c334fced26459329feccbe9750614c0bdb1cb26e9196d5a2d7044b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8740295d-a5b3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788232591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232591, "uuid": "e9a1d89a-7d7a-430a-be61-10bf4d582a82", "comment": "Malware payload (Mirai)", "value": "f3d7a85ec61ae50cb499452f54bd8621", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232591, "uuid": "c37cd9b4-5e17-48d0-ba1a-f809e9cf576a", "comment": "Malware payload (Mirai)", "value": "6306fecf65be40a727d3a199beb9bc3ad1a431b9af21ae66ef38d03655f89a95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232591, "uuid": "c8280aa9-2f82-4715-8595-a2cf1617a7c8", "comment": "Malware payload (Mirai)", "value": "d1b0a72e17ead88019add24195a344c20afaf5e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232591, "uuid": "9a656bdc-d4dd-4877-9ccd-f26443dce017", "comment": "Malware payload (Mirai)", "value": "79814e1ab904c7a3459fa29d2aba196b8d2824b70ca9588cef906b0057b5008fd44591f03231a98a6b17855309079454", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232591, "uuid": "2bf454a9-195c-4a2c-85ac-f0a2ae20600f", "value": "T19DA33B46FC824A12C6C516B7FB5E518D3B2643ECD2EA7203AE159F2137DB91B0D7B980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232591, "uuid": "389079ce-920d-4059-a2b2-e1c5f74553f9", "value": "1536:23H6uUW7F7GdCaKFhUpwqVDKrX4W7oSstSG+pMgOeIcUiuX5Dm8vuyRDOH:m6uUW7F7Gsay8lQVstSG8nL4Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788232591, "uuid": "267e4eae-44fa-4086-a901-3187637e0770", "value": 104156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788232591, "uuid": "27163895-43ec-4e86-b8ca-5e95944897f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232591, "uuid": "076ddb85-774f-47a4-94ed-aa58c34c771a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5ba321-a630-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788286372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286372, "uuid": "27861bd1-9ebc-4ce3-8ea2-d16e834f6b54", "comment": "Malware payload", "value": "3b1d9ae65dd6dd1229ebe9928676454e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286372, "uuid": "03a4cc93-3de0-4e7d-bb16-81306be7085a", "comment": "Malware payload", "value": "64258a04e00ca400cb089e6f2d2cd562b1f33755ba7b58a1ed2b3fd282faedff", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286372, "uuid": "6e1620d1-79a1-48b4-8226-a4d91368166d", "comment": "Malware payload", "value": "7aa1f917dd58abf1b8e66a3842c53d0384c29066", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286372, "uuid": "6fff9780-42d2-4e76-bafd-65c00e176a4c", "comment": "Malware payload", "value": "9880fa95eec20c9cd4314199d90c2a9ababd9b462833aa42dccbf4459e15a0b64ac9ec8764165c74cbbdd63fcbc2a43d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286372, "uuid": "538d7d51-af48-4a24-b545-b099d9716847", "value": "T124B1E757F7AD87AC505E96E1AC82760EFB42C13E917618A8D2E8E18455C3ED53FAC034", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286372, "uuid": "03d80e02-161b-4f04-b55f-619c8e6724fd", "value": "96:5PSuQf8lt6bBoPTXnY19Kizr7qzi9/kIjVgH3kezx9jokHXX/NFjuM:5PSus8l4bB+TIyAXqzlLxxrXXlFjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788286372, "uuid": "1afac044-47d1-4f2a-a49b-ff7959b749c0", "value": 5448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788286372, "uuid": "db1af2a1-0132-4653-af08-5c688a960d38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286372, "uuid": "ee8998e7-a1f2-4e43-a029-0f514fc376a5", "value": "rubendeckwerth.ch_clickfix.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aacc136-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788243656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243656, "uuid": "110efbc8-f74d-4aba-8a63-3689285696e4", "comment": "Malware payload (RemcosRAT)", "value": "5a368d6a7d1d4f9c624051f3327cd78a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243656, "uuid": "1dd3977d-3f94-4f22-8c14-1061fa0dd2b6", "comment": "Malware payload (RemcosRAT)", "value": "6454180389217f668ffb991cdab5b3e73c6009101cc2031e30b0a1ce00bfad72", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243656, "uuid": "4fb05f4e-3a2d-47cf-a39f-2a8f7b6db203", "comment": "Malware payload (RemcosRAT)", "value": "396b97b745f5dfee8bf0dedaec8dbc3e3c3daaca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243656, "uuid": "d2500ee6-9333-42aa-9180-ce29f17ba589", "comment": "Malware payload (RemcosRAT)", "value": "c2382911da146b4a7cef543586d677c7617ce6ba46acbdf66a834336b3c4d41260028616f2deda3196980aa726f16069", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243656, "uuid": "581ffecc-9e5d-461a-a220-a5ab9766dd9c", "value": "T1C8546A59FE61E191742BA9E1322B7985CC28878F9FD2DC35797C970B7FB48D28780980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243656, "uuid": "2af11b50-1369-4be0-a9f6-49a9e8b336fb", "value": "768:ImbRaogR9lFSRvs6sjGhhfftyisZ1q5cEXaQJGhxHU14LtNcy39deBjuFVxF7F0l:pyfVrU1ath+mnZgCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243656, "uuid": "7fc4531c-cb9b-4515-b33c-2d773462f145", "value": 301036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243656, "uuid": "b529c552-f0df-4e9c-afa4-328619cd4c5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243656, "uuid": "b31e1b4c-31de-4111-b401-dcbe857f0075", "value": "Bank_Account_Confirmation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7b454e-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788278129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278129, "uuid": "e134a112-78d1-4cae-9c38-25e6868515d7", "comment": "Malware payload (Mirai)", "value": "4d8f8de97a1cf1f28a95a0da098b96d5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278129, "uuid": "49733f4d-2015-4df5-9f7d-a6ca1f6b010e", "comment": "Malware payload (Mirai)", "value": "648f217b312999a91e10665e72e778f68e84cf1bfda932d52d7e1c78f7664437", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278129, "uuid": "81105772-682f-4a89-ab29-2eb5e7aa0f11", "comment": "Malware payload (Mirai)", "value": "00279bded0c7d9aecbc797775aaeaca93c9f16de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278129, "uuid": "d8a639a4-5d58-481c-b276-8896eb766c29", "comment": "Malware payload (Mirai)", "value": "7c0e626b80974d3234bf8c8f4d1254dc4862af531db67f5b79d421b780d050e3e1e995dcc3792b4bd0d2c046c86fed04", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278129, "uuid": "1bb96231-82ce-48ce-9d4d-9f6af4493c8f", "value": "T123E31B56F8818B11D5D111BAFA1D128E37131BB8E2DE7213AD246F607B8AD7F0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278129, "uuid": "bbd725a8-1a5a-4437-b4db-69e90bed1a38", "value": "3072:k9LvBEeUcV0iaXYGF8bzayv5VXIuSwzVgeP:k1BzfvaXPF8faOEwzVgeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278129, "uuid": "9a916e29-2f08-445a-9f79-08ae3084599b", "value": 156668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278129, "uuid": "0a425afd-6fc7-4bb8-ba8a-34d96c227550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278129, "uuid": "fde405aa-bfba-4fb3-9d0f-b2b621799f5b", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f720df-a5ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788229869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788229869, "uuid": "7b0dc59c-ce9a-4aeb-ab0c-0f92c3d86e15", "comment": "Malware payload (Vidar)", "value": "b64858880be2a14420e0b4f4f45fa797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788229869, "uuid": "3f1a9991-2255-4286-97a3-cef98dea74e6", "comment": "Malware payload (Vidar)", "value": "64a9ab0128ae49ec44ce91019fedecd5676372564f84455b9c55215a8f31bbbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788229869, "uuid": "a44e2558-108e-4a0e-8461-4495087e8fa0", "comment": "Malware payload (Vidar)", "value": "c294ef12a084c8d62585b02a7c3730ce0d162bec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788229869, "uuid": "5ba18e41-5a59-4c08-857b-407d69953ed9", "comment": "Malware payload (Vidar)", "value": "147972478c493ced4118b9664804c48fb2a3dc62fe335f873cf7825a542e9799f7731c3aa1d65f60ad0009f2322d47d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788229869, "uuid": "920f9055-2e9f-4d19-bc3d-e3729e909aaa", "value": "T1F2765A07BF914198C01BEA39C5679213B6757C8C8B3473EB2EA1A1382E3A7D12D79F54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788229869, "uuid": "2b27a044-5157-407e-a1d7-2866f957c010", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788229869, "uuid": "fa3034ce-5d46-48ff-8bca-c1aabf82e379", "value": "196608:jP1aGx4LQa9IEkGvQVNs5CZcOzkWBKv1RzvDfhIw:DqyCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788229869, "uuid": "9f9c81fd-7763-4932-9cad-fac4f772210d", "value": 7327656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788229869, "uuid": "6644ea83-13d0-4257-86fb-6ed32635c64e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788229869, "uuid": "8fd775ab-c2fe-4335-b5b1-f1747eabd096", "value": "64a9ab0128ae49ec44ce91019fedecd5676372564f84455b9c55215a8f31bbbd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2715ca2-a624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788281250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281250, "uuid": "58fd135f-c819-4ee0-b534-f5c367b4eea9", "comment": "Malware payload (Mirai)", "value": "63850c27394e9f45137b6391e96d62f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281250, "uuid": "14a67451-fac8-424f-b3a6-b31ebd36c161", "comment": "Malware payload (Mirai)", "value": "65784db63663e78ca43e87afd61a6f8bfd4321f61ec6352cbee42a4c8d084cc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281250, "uuid": "70a4f34e-4567-49ad-94c4-7f3319838f61", "comment": "Malware payload (Mirai)", "value": "9ea50783836a7ceb4c661d9d50025544ecf2fb67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281250, "uuid": "ac95146b-839f-4f52-97df-30f2a879ad62", "comment": "Malware payload (Mirai)", "value": "24bf77d609b52db8dbbf9f9335e4f81cd7208b9c1c98291e0458aa13c7cafb878077a50969d9df62ee792ebac7d5cf07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281250, "uuid": "2457e2f5-89a2-4f82-82a5-6e1f7da6bf2b", "value": "T188A4F98953F1DFD9F268E93003736E1B5DB6063735D3A186E16EE92233A524844AFE70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281250, "uuid": "9ac54236-f073-4444-aa42-8b1cff10a94e", "value": "6144:tfXv0t0G0CIwIHVRyZHP7l+BMpOM8HVNNqbqfXqPjXECvj:tvAIPw5g+OVXX2jUCvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788281250, "uuid": "786e78d1-d3b1-465e-83e9-369cfa9284a5", "value": 468216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788281250, "uuid": "be68b93c-0f6b-4f02-b3ab-7ed54b105a1d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281250, "uuid": "44ee3546-3a71-4bdd-b9a6-c0df972a9c0a", "value": "26032ab4a30ff37fef3e4e714149b7d73d6f1c48cc52c622a7051ed31f47f164.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbcbafc-a653-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788301479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788301479, "uuid": "50e61f2c-1e54-4c74-8f27-45d0f0f767b3", "comment": "Malware payload (Vidar)", "value": "07ec1d0d4f4b2029430ba43303cfde85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788301479, "uuid": "4909f85a-dd88-49b3-b340-6ad51f131102", "comment": "Malware payload (Vidar)", "value": "65be921e09dc27a0e34a9ce31ad9cbb99854a4d7b4be828e158b19ac849332d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788301479, "uuid": "8332fd9e-30bc-4ecd-aff8-bce4bab6923b", "comment": "Malware payload (Vidar)", "value": "b9d338eeaaef4ad7ba2ca7d759ec97928d5de04a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788301479, "uuid": "95e8e922-695f-43a3-b498-85a0272d0eb8", "comment": "Malware payload (Vidar)", "value": "c6e0167ca4a1d797281caa5f9a56f7efa8fe2d44309c3ed1009af94e978551f416bbc7a00dca5932763f520b7be95f18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788301479, "uuid": "327e216a-68d1-42ca-8814-853e580c7b64", "value": "T1F1967C037B519594C196EE38C0A64A55A138BC8DC73537EB3EA1AEB47F217C29237F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788301479, "uuid": "c8f13b4b-a044-4af7-90ce-8e469cd56448", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788301479, "uuid": "e1592454-0d5a-48c9-b6e1-0af151348212", "value": "49152:T6S0jKAk+VrVagSd1wixUmvnwT+io2c3VcHmyWGP2A2g/McHZoRvJwUc0:T0dxqxbP8c3VctP27cHuRvGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788301479, "uuid": "37c9a282-a57c-4f25-b47d-9774d1016225", "value": 9425840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788301479, "uuid": "e9c98b4d-3f7a-4ec0-9a22-9068532ab872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788301479, "uuid": "32318a63-35e0-45f4-ad31-0c8358208ccb", "value": "65be921e09dc27a0e34a9ce31ad9cbb99854a4d7b4be828e158b19ac849332d0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5a41b9-a5d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788247711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247711, "uuid": "657779f3-49ed-43de-962b-78de1a319d26", "comment": "Malware payload (RemcosRAT)", "value": "d6c38e85ffdf2fe9bb6e907dc7f5fb05", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247711, "uuid": "a1232519-6b54-4c57-a1a5-4905983dd26f", "comment": "Malware payload (RemcosRAT)", "value": "66f346a37951e4a78a341be0434f480d6ec0744bd53cc986caf8f25f3806ca1c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247711, "uuid": "c21613ca-a0aa-4947-a5b4-b70edc35b9e5", "comment": "Malware payload (RemcosRAT)", "value": "3f50de099cd76c3390b7e3915b538e386fe26849", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247711, "uuid": "af8b852f-80f4-4a64-8f06-92c24661036b", "comment": "Malware payload (RemcosRAT)", "value": "312321db7ecb1a52c3cd7805216c22f5110e0e9afb84f89272f42116b62f3cccaa35c81d0cb7df49651f69b582702501", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247711, "uuid": "7f5846f7-dace-4e60-a272-c896702e0bc8", "value": "T1E4D58DB7C20E4D8BCB3CD774D4D80948ED57C89782A892C87A5B887ECFB89A51474973", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247711, "uuid": "9bdd8bc3-b810-4832-917f-494d7ee5b12a", "value": "24576:mD6E14BJrg0h2HGAJ8QSqT+wmqN8aFHGIRDFJc9lQMFOWNTmbpuWTRlDl9uyw5VQ:mD6OoJrg+mTbSNTM19ua8Tg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788247711, "uuid": "15f52250-aade-40d9-993d-952b18870007", "value": 2924103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788247711, "uuid": "24ae76e5-d25f-459f-a060-5c1822104be9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247711, "uuid": "244867fa-a9b1-416f-85d3-f7f9e07826dc", "value": "Stopanska Banka_\u043a\u043e\u043f\u0438\u0458\u0430 \u0437\u0430 \u043f\u043b\u0430\u045c\u0430\u045a\u0435.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fa507d-a5d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788245717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245717, "uuid": "b8455c21-eb59-4b6b-b0e9-dfaa278aa3ff", "comment": "Malware payload (Vidar)", "value": "7eba73fde69fbfbaedb7cfa1aef66e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245717, "uuid": "6328b2ac-d45c-470f-a45b-2c448883686d", "comment": "Malware payload (Vidar)", "value": "67d133d367056150efaf96416373b73c9e6eac7983b0b6ae435d724f5b44012d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245717, "uuid": "eba05551-33da-4a73-95c0-572191fd9e9e", "comment": "Malware payload (Vidar)", "value": "8bdf9e9162388949acad37884696629a767f5bdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245717, "uuid": "7b456b88-3968-429f-808a-d299b89a2b73", "comment": "Malware payload (Vidar)", "value": "ab1fc83e77b998a8bcabbe4ac02adf2ee8128f73a9d60ac0dff1ccedc22d48c7b77850112a31a7b96355b761ce212ee4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245717, "uuid": "8ab69739-d3ce-4000-b20d-b1a20ddf2ae2", "value": "T16628330A7E859914D5AA9F39C5774311767A7C48C73133AB6EA0A2343F307C26EBAF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245717, "uuid": "4b2d915f-b3e0-41bf-a289-1169a4cf1e38", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245717, "uuid": "d8ce6838-56dc-400f-b8ad-4f87f24445eb", "value": "1572864:ptaYbW9ZOsBRyyeI/6GWWDioFLnMiYri1LjlA6rw1d4rEr8iuoxUoCzp43ypS4di:yZOsCy5/bDx2iYriJjl4d4IPuouvpJK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788245717, "uuid": "3ea062ac-3a0b-4e07-9843-2052d33e6ffb", "value": 97614200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788245717, "uuid": "70beaecd-fb77-4e21-bcf5-fcf2511822bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245717, "uuid": "f554ff6c-f749-4ab3-879b-02a19417c117", "value": "67d133d367056150efaf96416373b73c9e6eac7983b0b6ae435d724f5b44012d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390dc715-a615-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788274550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274550, "uuid": "8b12a5ef-0737-475a-b6a8-df2dca66cb30", "comment": "Malware payload", "value": "1a284c22250d0843be7f1ea272a4c560", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274550, "uuid": "84009673-9b5d-4def-98af-7711e8f6e5de", "comment": "Malware payload", "value": "6927e0215a2cc46f422a7af54cbb9bd2e0c0fa2c7a578d5a943d80434431c4bb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274550, "uuid": "3423e7c4-108a-478c-8255-622da277f21c", "comment": "Malware payload", "value": "027db54e74ba4015569638f96f3e7f7d3a0a220d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274550, "uuid": "24a010c4-b68f-423a-b61c-1b7f2051ce7c", "comment": "Malware payload", "value": "b80285aee35737e81e6e49098fa58a81e45893c745300519ab2deb820b83f9e7ba114370a8219f81313263bf2ceda7f2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274550, "uuid": "dc06939b-83cf-46af-8970-629014c187cc", "value": "T11F3104DF14ACA83264488F453692C408A908E5CB644BCFD87F5D9C3ECDA4E19B239B78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274550, "uuid": "d094403a-c53f-4ec2-bed5-7a3cd2ce53ac", "value": "24:kXUpWLdj4SFIJGrOXTNSXMDM+0izsCIs002/dZl:kEpSeJUtXMDj0izsCIr//l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788274550, "uuid": "723ae41b-f177-4777-978e-995d5a7e7643", "value": 1541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788274550, "uuid": "704322e9-f8bb-4b60-ad6d-805fbf6250d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274550, "uuid": "34199ca9-f921-49ab-bffa-012e0cfa35c0", "value": "a7m2qx.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59dd00fd-a64b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788297798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297798, "uuid": "564664c1-cc52-49de-9cb1-f555d5b27924", "comment": "Malware payload (Mirai)", "value": "47ea4ca573ae718a18b9d3cf5d540fda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297798, "uuid": "18f1e71c-b705-44ae-9e35-943883dab7d2", "comment": "Malware payload (Mirai)", "value": "6938ce6a856e17dbc4026262136bfb6f6d226055d295c13f1681597993274df2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297798, "uuid": "074e07ea-803f-4b98-b514-4b5d9c7a4e05", "comment": "Malware payload (Mirai)", "value": "41f2db613546b758259cc550e406c026e88aa22e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297798, "uuid": "577d12fb-66bb-46da-8cb9-9f4974f80a07", "comment": "Malware payload (Mirai)", "value": "fa2a71e451b1a6d2b06884b4efb1b15d5930df728e10a0b1eaa1a96fb4ce001a2f8cc369421521a2a620edfb58a4ad4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297798, "uuid": "baaf1d6e-d4ec-4e1c-a919-cbc8655b18e7", "value": "T11DA42A8C97F19BDFE06DDD3063296A171CBE493770E377A6A17DE86232AB14405E7820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297798, "uuid": "8707e1e0-7d5f-49ed-8f47-40fd9723044e", "value": "6144:SFPWLROGFs9R++I3eLxTaN6+gDyyOdI7/4CPyLFDr2Lao9a9dG:hdOGFsa+Rx+N6hCQ0yLao9a9dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788297798, "uuid": "bf1bfeb0-be25-4edb-9cf1-8f75d2e8f278", "value": 469288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788297798, "uuid": "90ca0780-3ee0-40e1-addb-a88535bf89f1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297798, "uuid": "397a9ee6-163b-405e-af59-980ab32f2156", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fee0620-a5e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788252577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788252577, "uuid": "8f7de21d-81d1-4962-ad98-2b1795992a48", "comment": "Malware payload (Mirai)", "value": "3aabecfee0fea0b0d889e975268b6fd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788252577, "uuid": "1d86b2cd-0901-4027-94e7-7dd1a16afc3f", "comment": "Malware payload (Mirai)", "value": "6955d78197fe503a53c57ffff66643de59c4bea21d79fbc95f2c24ec5ae89a82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788252577, "uuid": "15809ca7-c653-4b49-a181-b9d255b3d836", "comment": "Malware payload (Mirai)", "value": "770534a084a3193b2c469108e5267226ef593a0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788252577, "uuid": "62051ab8-1993-428a-9fa1-0c0387326970", "comment": "Malware payload (Mirai)", "value": "de133559b309d4c1e5ac578009ba2df10f3de4aef4ff479b3fbbace098fb836371869de59fd019c112436add1c2abe0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788252577, "uuid": "a36163b0-18be-4b60-903c-fa0b95e1701e", "value": "T16DB31A40F9448767C3D227FBF78E439D37356A6497E733116A386EB42BC5B892E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788252577, "uuid": "a9157a0e-3115-459c-b4b3-64ee8c030e04", "value": "3072:n5QeE7YlkF/tYZo9lAWo/9LmVQkhzlm6oiQH3A65h8A:+YZ+qWoFLmVrm6oiQH3A65h8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788252577, "uuid": "fc6d3ffb-6fd1-4449-bf47-6d831cce7d4d", "value": 118011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788252577, "uuid": "93c2e8ad-5da4-4795-aa47-cad803a001ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788252577, "uuid": "d2a2f47c-4ddc-460f-bb4a-2f2b8fcd8d6d", "value": "telnet", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6287e036-a63c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788291370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788291370, "uuid": "0fdb3d2b-0b9f-44aa-b1e1-b8c2e1883ddd", "comment": "Malware payload", "value": "670a3439a911840c4e092711bff819ba", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788291370, "uuid": "80240397-04eb-45c4-8131-79ccd645062e", "comment": "Malware payload", "value": "6af5634511b96d2f4e92255fab614aa1eb5f0fb8963375f2c0b7e82ebeac4982", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788291370, "uuid": "044e2d25-9d7a-40f9-9ce3-a09a6b3aa9a9", "comment": "Malware payload", "value": "61fc1e0a88a69dc65aa2586831615312d7508fd8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788291370, "uuid": "eaad0042-c44d-45e1-9a0c-4453ae56ee7e", "comment": "Malware payload", "value": "f6b512325550e5d4e84cdfd40d1ab24845818e48234a4f4fcc2aec428e3fd665210f47d014bc89f30e9f21dbcbe35fc5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788291370, "uuid": "86b7198d-5168-456b-917e-c03873d06dbb", "value": "T19E663332E369D532C8B2DB34F6142337F02182A31D57B66A76769385CBF288D6BCC855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788291370, "uuid": "5bb52567-8325-4828-b6cd-093b038e0318", "value": "196608:NwdJ0WlOfWBdugNPYSRndjOWfsphsYZjZk6K5r:NTmRnd508YDk6K5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788291370, "uuid": "d598a4db-7c5e-4d37-b073-46e1bb52bbb5", "value": 6918080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788291370, "uuid": "fa391b28-a292-4f52-bd24-d384a5e8832b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788291370, "uuid": "06f7cc36-8849-4981-9180-f826e10a12d4", "value": "IndusInd_Credit_Card.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32450d3-a5d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788247724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247724, "uuid": "03d7c15d-8c40-447e-8422-a0d370a66215", "comment": "Malware payload (AsyncRAT)", "value": "835cac04b366190171f5cb34e6b8d8ef", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247724, "uuid": "b464faa5-3100-41f6-a983-6a0277e91952", "comment": "Malware payload (AsyncRAT)", "value": "6b28d053621f8ad9e748fa9315c5b411f13fb7e65ff0be5f11db2954053d5084", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247724, "uuid": "9dd489b1-4848-4936-9afe-0446e057b68a", "comment": "Malware payload (AsyncRAT)", "value": "b3cf6c58e164e9fe42ba0b01012bc3dad79805d1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247724, "uuid": "4c005adc-7503-4eac-8b39-459f916bdd7f", "comment": "Malware payload (AsyncRAT)", "value": "4d6b392d08dcb432f11ed279e4302d202e28e7f69d572441beea80ace219a03b8402efe938d980cd19763b4bca63577d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247724, "uuid": "87089774-8ce5-4339-aaa3-6b53cfd06045", "value": "T14DE4E8A227DE718A1221B32E644D5D85CF2DC61606836AC7B0EF19909F2F446FAD1C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247724, "uuid": "2b9e3e90-262a-4023-a22c-f18394caed59", "value": "6144:UzDJCox6AIv2QznvDXmG25aB0kydiMbH4co6Og2r75L1ITPBzFS4nPukKXUY4suN:+x6b/2ytcHOga8pFzPukKEJNzQpnEX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788247724, "uuid": "2f27a5ed-9e0a-4c7f-98b7-5e7b7115047e", "value": 693335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788247724, "uuid": "d128ab9b-fc4a-434b-9f46-a48d0168c9e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247724, "uuid": "4ab13e3b-7f4c-4d93-9fb4-bcbd4df2f267", "value": "startup.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe19c917-a623-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788280894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280894, "uuid": "a8632bcf-261f-4712-8230-595f82416b21", "comment": "Malware payload", "value": "794bddaf1a008a52fc31ec4eb5fcd720", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280894, "uuid": "9c742a69-b3a0-40ad-9a34-ae549536dbff", "comment": "Malware payload", "value": "6b40106c4b9bb3cb4f2ca0c712e38fb8e473c4822c3cc76c4447d45abec20660", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280894, "uuid": "fc56882a-5ae2-4d24-b75e-d1e081f2e6d1", "comment": "Malware payload", "value": "6aad962bffd4e34fe9c7da6c17f62c2f95b5d90c", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280894, "uuid": "7026e711-6bff-4a93-811d-5625e6bc8fed", "comment": "Malware payload", "value": "c176d05c41d3515c8cb5b7e1dfe069699f4d1ef1c01442b99efeee07d3c46fa0c464b72ce933024f0d8b3a26da6b2401", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280894, "uuid": "e6b148c0-5388-4da3-b8b3-b8a1ce931598", "value": "T183063342E18CC8D4177A435B6B4B1CCE5FE86AF8A4B3C7DB4CCA1E16C568CBC44A459E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280894, "uuid": "a9a53ccb-b831-4188-8ec4-eaf0373482c0", "value": "98304:uGQAN1h9mN4EULnKKOl6a+l8YvRM9U4+LW/mdA0Mzc:uGQU1C+JDKKe6YYvy1+q5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788280894, "uuid": "39553505-e5f9-49ce-a247-94fc3f482f05", "value": 3658036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788280894, "uuid": "c1690b7c-3db5-4b2a-a2c4-f3e7d0ad4dfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280894, "uuid": "7b6d20f8-431f-4987-a3ba-ff747388f153", "value": "bot_linux_x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c40eaf-a5b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788232593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232593, "uuid": "d248780e-53cf-4db4-98e9-ed1644601a75", "comment": "Malware payload", "value": "1ca2abe20ac161fcedbd7a0d3e386576", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232593, "uuid": "3f124c42-010f-40a2-b37c-132753119f53", "comment": "Malware payload", "value": "6b4ac27c66d4a77a4c2325afd61060001580043011194036c1a4a58702d836f7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232593, "uuid": "6a894fe0-613f-4da1-baad-ea1ed614d659", "comment": "Malware payload", "value": "47e755175e8981503179cc4ac94e7ff226f9faf7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232593, "uuid": "b74ed6c2-1225-4db5-9dee-18d4d46087fa", "comment": "Malware payload", "value": "5b0f2c9af9628d4761b40ae2b381befe8b8bc422db76e0934e760e4c08f0a16e35e3a212dfe3a94c4f89d2bcce5cf01b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232593, "uuid": "020aaa90-539b-4bd6-9afb-f7d5c9db4c7b", "value": "T126C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232593, "uuid": "c58cbbd6-339a-456e-988c-d652f7662e81", "value": "768:NN8vCB+25j6es8RB9FYpMSUpi+20qUpi+20YQX:f8l25J3d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788232593, "uuid": "ba6705f5-9d2f-4c4c-9774-15cbbecaedac", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788232593, "uuid": "45586943-0359-451d-af7c-5a1451a8dca5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232593, "uuid": "74f12329-14d6-421c-973d-4bb891e183f0", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0019fcd3-a61e-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1788278320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278320, "uuid": "67f8b8a0-7beb-42ab-96dc-e3d942af9f1c", "comment": "Malware payload (DDoSAgent)", "value": "ab0fadf7decddd185da0c09f44eb8f83", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278320, "uuid": "75e9ba14-293f-4357-aba4-1b12cec16b1c", "comment": "Malware payload (DDoSAgent)", "value": "6b7b76c98480df34a93606564a986f63d984d46f4c6dcb626f6a953a09a1d372", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278320, "uuid": "91f74d71-29ce-4b3f-b0d2-21dc83c4d43d", "comment": "Malware payload (DDoSAgent)", "value": "a7cc0275f6d90345518aa1de1e14fb9f58527d13", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278320, "uuid": "c068f16b-0d11-468f-86e1-aef50326129b", "comment": "Malware payload (DDoSAgent)", "value": "f689e6a2f7f29f7df905e9a97ceb81159faa8898c9c377fbbc1fc152958d96220748a10f0fffbb909cfca2aa0e2d9319", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278320, "uuid": "0e429e81-f248-4741-8c0d-144f7935f023", "value": "T16C863B65BEC22B66C18C037445EEA26662607E454B91032337E8EBEC3E7773DDF56848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278320, "uuid": "239d1f18-f3af-4b9a-afae-9e84d8a03434", "value": "49152:GHQLSEASVwQoV+QDZsK0IVS2YOuYXmj9U0f/4DgY5ES:GwuAVjoV+MZssGYDxES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278320, "uuid": "0ef7abfe-0ecc-4e29-a17b-778b9d89e581", "value": 8388792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278320, "uuid": "1fe9e14f-5cb6-41ce-844c-5a8ca3501cb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278320, "uuid": "b3e02e2e-c8ce-4f1f-a178-972998c94257", "value": "mips64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e33ec51-a5dd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788250641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250641, "uuid": "16622bd4-f60b-4379-8af0-34e2614187cc", "comment": "Malware payload (Mirai)", "value": "bbd6f2ac7977cf023ef4ed0cd042a184", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250641, "uuid": "180945b4-d62c-41db-8672-af72e710fe3e", "comment": "Malware payload (Mirai)", "value": "6c14c68f1e6c08afc6a5ba3ebe983aafe9e8b72e73b94539bcaaa760a83e0c0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250641, "uuid": "30b33b0d-12b4-415c-8f0b-cdab3260935c", "comment": "Malware payload (Mirai)", "value": "596238fce28620f832d18b8415a9a1d387f736ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250641, "uuid": "929774ab-1b53-4a80-aeef-5ea67bfc1973", "comment": "Malware payload (Mirai)", "value": "94358bab14771647aca3a326a6c8a844ce3443a0fb38a6b3508d0a5bfc4c046470d3fa8d6bb5aecf5f635358fcbbdddf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250641, "uuid": "716de835-8b74-40b8-9262-5f91f1468d5b", "value": "T1B9144A02776D0403D3632DF42B3B13D1939FE49321A4F604790FAA995FB2932A696DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250641, "uuid": "471cb1d1-2a08-4ee5-b203-448feb0f137f", "value": "6144:secVI2kxvkgxIvKg1+vWw4sufEssMOjh5olUO:NY7uCCWXEssMOjh5olUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788250641, "uuid": "670b1936-02bf-456a-b6db-75f35d78e99f", "value": 203576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788250641, "uuid": "29dbc01c-b405-4e22-a641-066e33fbe2f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250641, "uuid": "f3a92d60-65ad-4661-a7be-0c176e446799", "value": "6c14c68f1e6c08afc6a5ba3ebe983aafe9e8b72e73b94539bcaaa760a83e0c0f.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac99b75a-a609-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788269590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269590, "uuid": "5d4e06b3-e6ed-490c-9f05-8efd82cb4297", "comment": "Malware payload", "value": "7e8f31a27b82443fbc62bd53a2f1d104", "object_relation": "md5", "Tag": [ { "name": "CapyAgent", "colour": "#1553B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269590, "uuid": "ad328a8c-70c1-4982-b952-ab00fb0668ea", "comment": "Malware payload", "value": "6c3e48b62fa60ac3d565c1cedba9d3c85e3689a9b05312fe5e8a7a30e9e2a5de", "object_relation": "sha256", "Tag": [ { "name": "CapyAgent", "colour": "#1553B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269590, "uuid": "d78a4a71-49f6-4c92-9197-92b58b7cbddb", "comment": "Malware payload", "value": "9220bc18c5f83ff9853725b61445ddb3937fc101", "object_relation": "sha1", "Tag": [ { "name": "CapyAgent", "colour": "#1553B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269590, "uuid": "9392e266-c07e-4261-909f-a2fc29853797", "comment": "Malware payload", "value": "421de1595169457df310ae4d9d5573a49c50534d51672952b27461619ec1b44461a32ab3a85b01c9850638755a3e0ce5", "object_relation": "sha3-384", "Tag": [ { "name": "CapyAgent", "colour": "#1553B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269590, "uuid": "e0fb00d7-a1c0-4d9b-ae27-ea3ea700491e", "value": "T197D64A47E8A506E4C0ADD535C6629613BF313C889B3067D36BA0F7682F77BD0A9B9740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269590, "uuid": "b0817e41-2de9-4953-948d-d20eba8e7dd1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269590, "uuid": "693f52df-7dcf-443d-b024-558c4feac42e", "value": "98304:lqDnbbG6KyuiHiteknUaaxVjcIj8uQ55OHT/hVm79POBGLRJWnEuf:l6XG0daaxtcI7QkT/hVm79PEEuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788269590, "uuid": "51970d83-0f76-4cf4-9be3-cdf9eabab3f9", "value": 13671936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788269590, "uuid": "aa824758-66e8-47d0-9fba-8e3902aa182f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269590, "uuid": "8632e225-ea6d-4302-9631-b12808ae353c", "value": "6c3e48b62fa60ac3d565c1cedba9d3c85e3689a9b05312fe5e8a7a30e9e2a5de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b99ffe-a5dd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788250632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250632, "uuid": "ccf0b730-ec9a-4fbc-b166-749104c20181", "comment": "Malware payload (Mirai)", "value": "33392a685f1c2ab3b9be37ab39a22c3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250632, "uuid": "2ea11ab1-e695-44b0-b3dd-ea8d5b806484", "comment": "Malware payload (Mirai)", "value": "6c420372a15415c1544790df5fe5ce9c6ff0bbef65546c83e02110307e3a32ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250632, "uuid": "97949999-cbe5-4d56-840e-e3728dee0ae9", "comment": "Malware payload (Mirai)", "value": "4fdbc2bccb46ad42fccb832b9ef45a38a93b448f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250632, "uuid": "003726f6-722d-40c6-b973-bc032b148b5b", "comment": "Malware payload (Mirai)", "value": "7c4cba08c4fc4cbd20aaf5fc1b0198cfc9e66b77dc7fbeef7aeb9e89a87d3482a92650decd0e422e0bae2e7609922854", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250632, "uuid": "4073a23e-6d9c-42b0-aad8-e9a485f33f41", "value": "T10744D709AFA20EF7D86BDD3706E9160625CC641722A87B35753CD928FF0A54F4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250632, "uuid": "3619544c-d2d7-4cc0-9d97-14fc0c1ef427", "value": "3072:GZ6rHIHfYzmdOntW5HPriZyuDuEQNYtB0FxEbOVJ1EssMZc/T03ImIys61X2h5o/:aqtWRP+laEQKgCbO1EssMOjh5ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788250632, "uuid": "ba7d8b05-bb98-445a-8ac7-3b9aefb9a3cf", "value": 264708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788250632, "uuid": "fafda90e-3a1e-446d-9d6d-c854d71abdac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250632, "uuid": "da1094aa-4ae8-4d63-a3a3-357d2ca2044a", "value": "6c420372a15415c1544790df5fe5ce9c6ff0bbef65546c83e02110307e3a32ff.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906f700a-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788278133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278133, "uuid": "9c80e4a3-f16c-46f8-a710-c872042b08ed", "comment": "Malware payload (Mirai)", "value": "ae1ea41863be4ef197df98da5dbdb0c9", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278133, "uuid": "91eb1b82-a57a-415b-a4a8-1676b20a5e07", "comment": "Malware payload (Mirai)", "value": "6c4995159c694207517468ee6991102558433bb126e6b65a85cdc4ad950b54d4", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278133, "uuid": "8cc3e3e4-d96c-4861-bf61-c206a0b25ab6", "comment": "Malware payload (Mirai)", "value": "fb085a88a8e226ebac6302078f3de9e028f400d8", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278133, "uuid": "2e14727e-66fb-4026-8227-cc6979054a65", "comment": "Malware payload (Mirai)", "value": "b35aa66aef363fc1db3ab5bfc7bb47b9f5d033fedf81b9a6e377781f85e60a29018854b3465ce72ad22ea2d6b6af9540", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278133, "uuid": "b3b5e19a-94de-417c-ba55-20b1c8b82634", "value": "T185142B46EA414B13C0D627B9F6EF4245333397A493EB7305A5246BB43F86B9E4F23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278133, "uuid": "b4ebb373-3698-4cdc-97d8-73d5575b77ee", "value": "3072:N0Qub01nsgI/AAaFYaOb/5eQwdLSPK+7mSkPjZvo1M/R+vIw+rX1W7JO:N8xgIoA8Ya2/5eQwl07mTPtQ1M/R+wnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278133, "uuid": "16db0947-993e-47a8-be41-ea936444a895", "value": 195149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278133, "uuid": "ca21a937-b9aa-4342-af3c-29c94d4d1a55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278133, "uuid": "29745310-95d7-4505-a7dc-42a07c4cd84a", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc890654-a5de-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788251256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788251256, "uuid": "2e8026e7-72ec-417a-bd1f-2652bd5d702d", "comment": "Malware payload", "value": "c183c80a0b4ff918321d9051d2d24fa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788251256, "uuid": "6f645edc-90e6-42be-8e13-b4db8eb598fb", "comment": "Malware payload", "value": "6d31a9a4eae70a21641c0e86b619126ec1ee906c723b3b8966bd20f56f29561b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788251256, "uuid": "2e2ad7cb-a9ed-4f0d-9479-aac67b631377", "comment": "Malware payload", "value": "694e3bc73dd2b34d63f5300a0142a748c5506740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788251256, "uuid": "5d25d51c-c2ba-4d72-b0de-ee4c689e0150", "comment": "Malware payload", "value": "9e8454460c2d953b06f02bfc97a0ddb7250b14c9ca0c45f354dbc374e35e8ae402734c677eeaafadeaf773e38162d753", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788251256, "uuid": "05397072-ffe1-4f35-a3ee-3c2eaf472d41", "value": "T123D52355A4B359B8C833D3B58F82E87DB03D7B8207548D8A72CD5E108D626AC6C7B376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788251256, "uuid": "4128cd40-09e2-4e87-bdef-bea62242aa75", "value": "fe230628262faec735b6f015758b7519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788251256, "uuid": "c22eb95f-1038-4581-a233-aa130a3f3a36", "value": "49152:a5g8Ruhq1yZHZjLYafD/sATU5UJT01SPkf/S+5ziQrrvdUj:aCb7Z5oa7/sVUt2SPk9EQCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788251256, "uuid": "6fa1f392-7f2a-4e34-bd9e-a5d84d6845b9", "value": 2929664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788251256, "uuid": "c8d2bb38-5834-4ce7-835e-507f9ac9d328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788251256, "uuid": "96a8ab15-9935-426c-a878-1179ebeb0e82", "value": "6d31a9a4eae70a21641c0e86b619126ec1ee906c723b3b8966bd20f56f29561b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ec28eb-a5d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788247673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247673, "uuid": "14024669-dd97-4d7e-8ae4-00f9c1fd1b0a", "comment": "Malware payload (AsyncRAT)", "value": "fea17585cd5e1c5521fe86bc56d62f52", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247673, "uuid": "b946650b-e76d-4129-b8da-3c6fa637e406", "comment": "Malware payload (AsyncRAT)", "value": "6da03d103d6d73e1dd8e4b9719bd030e69bcf192098613ed25e85f65da2c735d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247673, "uuid": "1706d885-cc2f-46ab-bbb3-755d7f4026b2", "comment": "Malware payload (AsyncRAT)", "value": "df2308bc0a2df3b4be391bb9a030891a7b5b325f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247673, "uuid": "7f730d72-f8ec-4e5f-8031-fd4e7065c7ad", "comment": "Malware payload (AsyncRAT)", "value": "62cab3491dbbb63ede46747b4a3ab98b1be2f88f4e3af32081b0583369f9ead748a211927df854e02fd597311f7be971", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247673, "uuid": "8fcf619b-1afb-45ff-be55-8d4f3c17c8fd", "value": "T1FA54E6454768D64BCCF66E26EC2B6688E918E70FC06517813EFE78129FB0C0A7456F39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247673, "uuid": "0a002fc7-29c3-4726-92f7-9968e992c1aa", "value": "768:ZQQB00e0C/wxYXYVsZ5vAMWeFVSC5+Ou0m0ED+pATP4vzJ5:fk0CwYXYVsZ5vAMWeFVSCgvv0EDPDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788247673, "uuid": "2dd9d671-b35d-42c3-aef6-cf996eac5242", "value": 300204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788247673, "uuid": "75bfb8bf-95b8-4657-aa63-d08f150c34d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247673, "uuid": "26a255fe-f052-4789-bb42-5b646d29ef6d", "value": "CV.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be8fafd-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788278125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278125, "uuid": "f4ff9ea8-200d-4720-af01-b5d8eedd7c7d", "comment": "Malware payload", "value": "c68918183bfba4f63d6b2637873ec099", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278125, "uuid": "da222190-23d9-4988-bec7-e4127c24a9c7", "comment": "Malware payload", "value": "6e16d0d61ecbc8f37aeddaa3d59442b014356796bd6daf27e7c9f2db1cf09e06", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278125, "uuid": "e5fe978f-1c9d-4f6d-aa9b-8848e57c17f6", "comment": "Malware payload", "value": "d11ad854f0a360935dbf80dddc9a88c675ca69e2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278125, "uuid": "504ae384-6954-489b-b850-32bfe55ca096", "comment": "Malware payload", "value": "9c69e475b4fc10175b32d73e9b839453d78d5e0b8132a8bef4079da86556612e535a06a11363350a78ee2677c8e5fba7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278125, "uuid": "213781ad-39bd-4a79-8de3-18c34bb611a9", "value": "T18B61BDD80160AF3AD6F2C94AF3F6498690A645DE78D307ECCC940AE1151D4B7FD89A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278125, "uuid": "ec496af4-ec08-427f-ae40-9b565bf7faa9", "value": "96:krV1Hr6b6u4aDx9/aZEwqUzbPpOpHb1eZt57mFma0A77X7r7F73q9zhtvGJpQpsS:kJ1Hmb6u4aDx9/aZEwqUzbPpOpHb1eZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278125, "uuid": "22cade97-7c25-4230-9fe9-68aaa5056805", "value": 3239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278125, "uuid": "10a19823-aaae-433b-a937-86d74a7e40fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278125, "uuid": "59c6e851-f553-447b-a01d-c9de95a08916", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2102cec-a624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788281249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281249, "uuid": "ed915d6b-18db-4855-893a-8c9956f35d5e", "comment": "Malware payload (Mirai)", "value": "8f02e19c2acaec0ef2cbb47d0295c097", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281249, "uuid": "2fcbc396-2a7a-4c1c-be43-fac6492d2e63", "comment": "Malware payload (Mirai)", "value": "6e286ddad3641d8eb77cd657e1360969bc6fe730c005d0c30db503de8d10f9fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281249, "uuid": "3c85dad9-6851-4aeb-b4a1-e9ab37536c46", "comment": "Malware payload (Mirai)", "value": "98812357e252237c7f0f3bd3c4a9676afa9a3977", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281249, "uuid": "63a1478c-a35b-4b54-82d7-f7d4431c57a8", "comment": "Malware payload (Mirai)", "value": "66e1d06ce2ba414ad8022df9c6a39ff8bdf01be6625a690ce51198f8b378b8aeb80013299a21b6672e84c49fa7320c45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281249, "uuid": "b7188e7c-831d-4a74-b24b-d988b5862c89", "value": "T1E984E888E1E1E7DED1D4EA75B319780E3A230736B0D73146A51DFE3223EB1590ABD921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281249, "uuid": "e160ac10-d1d3-4294-ba59-dd40fc7f20e9", "value": "6144:Pb9vBEvzJIupKtc70R0i7suIuLAdwzt8glu4UH8a9lJoDnnnn:p4zJIupwcQyi7sONpl53a9lJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788281249, "uuid": "30a1da94-f3d4-4eef-9fcc-66d660223c7d", "value": 372056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788281249, "uuid": "64051bd4-bcf1-4450-886c-5982be7e3798", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281249, "uuid": "a66176ef-1bcd-4f85-87c6-5eed17d676a5", "value": "6e286ddad3641d8eb77cd657e1360969bc6fe730c005d0c30db503de8d10f9fb.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11a1240-a5db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788249894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249894, "uuid": "ddc6567c-2d6d-4359-98f3-6e6f44d778b6", "comment": "Malware payload (Vidar)", "value": "1e7869f2649c3105cbe22b8ca889025f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249894, "uuid": "bf0a9d88-e8b6-4e2f-a90d-27bafab9dcb8", "comment": "Malware payload (Vidar)", "value": "6e6e055dbab7e0356bdd666530a7f94c4ec84d930312062cbc7f12be53373224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249894, "uuid": "44d25b92-a5ed-4a01-bfa4-65ab68f3ee92", "comment": "Malware payload (Vidar)", "value": "b35be5df21dba8bd6a35602420308656d01e0210", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249894, "uuid": "e989f674-16dc-4cd1-9ce4-f6a05aa63cde", "comment": "Malware payload (Vidar)", "value": "d430caceaaaab74e20c107713787a2f9f124559b417f161ab4ee7dfb47a3f47d73a21c64da2025f7087bcd5440abd65e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249894, "uuid": "7e072713-7898-413e-96b5-f470b9bc6f9b", "value": "T15B18334A7E859964D5A68F38D1774321762A7C48C73533BB5EA0A2343F317C26DBAF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249894, "uuid": "44807afd-1668-498d-a5e3-d4dd12c0b69c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249894, "uuid": "d50bafc4-74e2-44ef-9823-62695e29a75b", "value": "1572864:ptaYbWmFID/d7/iZgGZZ4i9KURHO1DTpJEctjR7CeDs+VRa3roJ/:n+D/duZgWDHO1DEcDOKpYboJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788249894, "uuid": "f4d67cba-ddbd-4efb-aa4c-f6a148fdfa95", "value": 90274168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788249894, "uuid": "aea1754b-82ac-4eb7-afce-39be0a8a894d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249894, "uuid": "f2411b85-0e33-494a-852c-9a8b130cc3b0", "value": "6e6e055dbab7e0356bdd666530a7f94c4ec84d930312062cbc7f12be53373224.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ec3592-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1788243640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243640, "uuid": "2b572d01-f909-449e-abfa-851463c91427", "comment": "Malware payload (AgentTesla)", "value": "05677144370ebd5ddcfa507edb66b537", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243640, "uuid": "4ad836bb-2a5d-4ea7-9830-1c237bbc41aa", "comment": "Malware payload (AgentTesla)", "value": "6ec549c8b0dae394475bed076f4d68b0547c866228ea07723438166b1cf1dea3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243640, "uuid": "1ea0b210-8e60-4066-88da-c8dcdfb73501", "comment": "Malware payload (AgentTesla)", "value": "d621468618e5470a7f8a649eb6baf8b81644ba58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243640, "uuid": "1b61cc1f-9e5c-4a23-a615-1be117be8f46", "comment": "Malware payload (AgentTesla)", "value": "9af9077125a865ee78ea4b941dda78645d470bfd537fc2eabe88e8a2c835ea16828cbadcdb13a37563e60750aa548aff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243640, "uuid": "50f6c1f4-da8c-4cb8-83cd-d3b0027c45ad", "value": "T184549B49C779DAC12EA847E50937A308EAF6F7876C5280213FFE6E164F25760D79488C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243640, "uuid": "a992c768-1b68-4e23-8c35-a7e0833a7a12", "value": "384:+Z3CXmIfLZ2axhv6nbVRdQe8YOaxh2hdQX6emDhJ+BfXPGTLa3KapoO9HYWy2+Li:+s1TybzHYWynhwPNnQ/RsARNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243640, "uuid": "8d09ab51-e01a-4c2e-8fc7-59815d469cdd", "value": 297485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243640, "uuid": "76f1fa5f-2ce9-46e6-9bf5-d83cf1a005ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243640, "uuid": "1bef6151-1ab5-4299-a45d-0ade099577e2", "value": "jazzy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda66b2c-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788278316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278316, "uuid": "4f1c4ee2-7f1a-405c-a9ff-4697f22c34b4", "comment": "Malware payload", "value": "a2ff3be4a42b690b0c16a474bec59418", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278316, "uuid": "d69d2b7b-5cff-4b68-a3c3-19c6080cb6e3", "comment": "Malware payload", "value": "6fdaf2a16399ae318a33bef674cb569e21765022f7f1e30a4196aa511327f087", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278316, "uuid": "2ea88049-9a3f-426c-8efb-b657794a75e6", "comment": "Malware payload", "value": "12b67e0d7b19c9f6a66ca497bf172c48004aa4f1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278316, "uuid": "fb640142-289c-40dd-aa94-587038e6d7b3", "comment": "Malware payload", "value": "fee7be0291c4e2cdff2896db6ebdee1f62a501fe8eac37fbee63138e41add2e5ea1c30d1a94d7d1f4c3e63dd583e6932", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278316, "uuid": "b5555c68-bdc1-401d-88c8-2a2b256c1ed9", "value": "T10A761997B8924952C4E43A37BCBD81C433635EB98B87561B6D15FE383ABE1D90E38314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278316, "uuid": "765abfac-76a8-48ab-9ff2-00cf83eafc12", "value": "49152:ZZz9FFNQtV1w4RHw5yG6hJ1rKNlui4kyLPXjfPrlE78guAaJMu045ER:HhFQj1w4RHw5yG6hJaMrlE78xAaCQER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278316, "uuid": "b5ae9c99-a285-44e6-b26b-72193c52cc92", "value": 7471288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278316, "uuid": "63b3c878-378c-4a1f-87bb-0108f6ea5db7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278316, "uuid": "119e8f5a-558d-4c48-b1d0-a7a1e8da4be9", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bb5895-a5cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (HijackLoader)", "timestamp": 1788243005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243005, "uuid": "a2324031-4c25-4934-97b0-1079acd36f95", "comment": "Malware payload (HijackLoader)", "value": "92276e19d0164243f1be8f18d5ce473a", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243005, "uuid": "5dd75709-6ca5-4e31-ac13-b7784f2e0552", "comment": "Malware payload (HijackLoader)", "value": "7030b5e9939d7bd8ad240d44386c2b7d2830642d7cd5e2bf5652c9b808c3aa71", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243005, "uuid": "5281142d-d516-423f-93bf-79adfdfc222c", "comment": "Malware payload (HijackLoader)", "value": "31fdf757171bec3077867b13c309bd7cbc592942", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243005, "uuid": "df6125a1-6572-4531-879a-bc6c354f9970", "comment": "Malware payload (HijackLoader)", "value": "848bfed0c3cdf375608a1ef3eba98963e824938d56809cc3fe36a384abc03bf16fcd40fa3d5955ec99dc0409e14ce1da", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243005, "uuid": "463d0743-0dc4-4dc1-aede-327769a6401d", "value": "T1E9B5338E68DC40B9D642E934E29CC5C5AEA4DE31AF466D65F094F32D2B3C6117DC0BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243005, "uuid": "fec28361-94f5-4b0d-a927-671f2602932d", "value": "49152:xQF6JyDhpoEcHEajfH7qSQm5uXx2r9V2I5EjCtU537fShjH9uGGfxv:gXonqRhU9VlH6SRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243005, "uuid": "08a08244-04d6-4751-978a-b9f1e079efc0", "value": 2449408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243005, "uuid": "1660138a-a432-4596-b40a-5b29ba3a76a2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243005, "uuid": "e578d495-61a4-4931-937b-5fcf9cc39bc5", "value": "EXEENMLP.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f3c9e8-a630-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788286361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286361, "uuid": "4e4de1c5-e6f0-48f8-a04a-76d2953ae5c3", "comment": "Malware payload", "value": "d5557c8e4a42ceb04fe2fe270c93f231", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286361, "uuid": "07afcec8-6db7-4d63-9889-2e7e2ba534a7", "comment": "Malware payload", "value": "705861f94f918b7c8bfa471cd90730037f73384976e7e9ee51f169e8ea0f066c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286361, "uuid": "8a422b9f-d687-4a38-9ec4-94aee6e7511f", "comment": "Malware payload", "value": "b0250ebd020a8dbf23253c8f7a8c1d42c6781a1a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286361, "uuid": "1a68eb55-55d2-4507-82c5-0cfb217e0e14", "comment": "Malware payload", "value": "fce01c4af46b43c0b81f62f9ec6f2cb888748704543f07e985a26b3a320673a706bc382b995397bb2b500ca139f449e0", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286361, "uuid": "94827e5f-7cd1-453e-8d8a-84799e9176d8", "value": "T11FC1DA3BFB58CB7D608A55AEA5C23E0A5B05802E713A15F0D3F5C54457BBFA12E2D234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286361, "uuid": "00260d5e-c2ae-4572-ae83-af887fa61429", "value": "96:Hge5PKf3YlW5aqoQt4BnQLk3i16RkICJ0AxzrO6Bg4UGj0lFTTomt:Hge5ifol1qd2B4cnUJ0G5Bg42FUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788286361, "uuid": "6f526c3c-5c49-43e5-94b9-e7e5f50161fb", "value": 5995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788286361, "uuid": "0c976513-e3bc-40d6-b3e0-8cbe7360fa52", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286361, "uuid": "ca93776b-10e1-4370-a9bf-2f23413ded99", "value": "aeb.ch_clickfix.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9da2eb-a5dc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788250348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250348, "uuid": "a5c0620d-d81c-44d9-b5f9-1982d775a3ec", "comment": "Malware payload (Mirai)", "value": "fbc868c3ce5e0dc995596ae9a7f146d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250348, "uuid": "5d480bef-2bc1-4be5-8a28-de71beb1eec3", "comment": "Malware payload (Mirai)", "value": "71135c344ddcb367c8ab941ef73bc6755006aee6cda6a580e631874e2d8dbf3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250348, "uuid": "1ec90f76-7e89-444f-a8df-a3e70696b801", "comment": "Malware payload (Mirai)", "value": "1012420d025732be81f412f79d173bf6db242a97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250348, "uuid": "e0d2ae9b-7ce6-446b-9384-4b095039a93e", "comment": "Malware payload (Mirai)", "value": "0b4222741751246b586127680cd79e2fb8f9216de65f846c642d70c2885877a7328a92a539c8f8a8850e3ed82bd7739e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250348, "uuid": "7f965540-9289-423b-8e42-445630c55982", "value": "T15B240852BCD29B11C6C2467EFB0E514E3313677AD2CE7212FD2C6A703F8A46B0A7A551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250348, "uuid": "f48e540d-a27f-4c19-b5c4-46b5daced4c9", "value": "6144:lds6asm6M7NxBb4NeYXcEWoaWwEMPc3enChnEssMOjh5opQ:g6asm6M7NxBb4N7XcvoaTLPcOwEssMOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788250348, "uuid": "a35fb040-dccb-47ed-a626-94b0f0f65eb2", "value": 215824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788250348, "uuid": "6b810836-4949-4450-88db-8fb51db6dea6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250348, "uuid": "69bbae70-599d-4aa1-9b97-baa53cc54c32", "value": "71135c344ddcb367c8ab941ef73bc6755006aee6cda6a580e631874e2d8dbf3a.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d5b404-a5f0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788258915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258915, "uuid": "a866b4de-b550-4cce-8ffd-0446cbc905a3", "comment": "Malware payload", "value": "d6ba5bbcb314030cea998a0c353a9bad", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258915, "uuid": "ac099360-4e1d-49ee-8426-1250a22efdbd", "comment": "Malware payload", "value": "71fa5b48bd9f5a30f38be236a427c6a003edb31098f46d16dd8328e033f3bbd7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258915, "uuid": "ec1f4c8c-cdf1-45d4-8015-44df6bfd72cd", "comment": "Malware payload", "value": "63fa960d370a68108eb798413d9c629dbd35a696", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258915, "uuid": "068cd6e9-2e54-441d-8713-600f2bb5142c", "comment": "Malware payload", "value": "d725232474b6d0d920197d42827afa2d80485b808fa42107f2e15221f76b65f71b19dcc84b8f41af80b018ebb9290b00", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788258915, "uuid": "46a5c22e-ed0b-44db-a38a-4dd8461157d3", "value": "T12E2623FB45B2A5536AA04667EB0F2C1A339B19E13614D342EA01919C3F7B1D38F92737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788258915, "uuid": "925bb3e8-d9b9-4b75-9d5e-c99c605b862b", "value": "98304:yoyEFPZZitJ45gzjAr/z5ZoXXsnt6BcdmPfT51nXMI+VbKoTuRZbr7H:byEFPZZitJ424zQcdmPr51XMIqlTIbrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788258915, "uuid": "92ea5e03-4bb6-48be-9f3a-44c073494bdd", "value": 4818035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788258915, "uuid": "0b972b52-6c3c-45ab-baa0-f14c1cf18fcf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788258915, "uuid": "fd0d58cd-9332-4d05-9583-3e1efe819b87", "value": "PaymentXSwift_4765aff4631082026.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbbb9f8-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788278127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "8328a150-dd48-4c79-82e2-66625301c586", "comment": "Malware payload (Mirai)", "value": "fbcce9929de0aa630b78a480e19717d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "3a07b406-55e9-48f1-aebd-667c12fc1bc9", "comment": "Malware payload (Mirai)", "value": "720fada1ea49c3768ea4b4326153e560f964d68978a0fb7db10e8aac689983c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "5caada21-9e59-40a7-9f81-07a4d059301c", "comment": "Malware payload (Mirai)", "value": "037a919055e444ead4307339a860a3f9f9e4cdfe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "3ae376b4-932b-4d74-85a4-7431f96c92f1", "comment": "Malware payload (Mirai)", "value": "0133ef09ba536659ebfa2e7e381eb7e55df99d5687fb3cbbd22087cbcf182fbd9c9576970d7fc8d19a9b2aae23bb91e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278127, "uuid": "1de6160d-9473-4e28-afcc-df99a371f173", "value": "T115730948F607D1F1DE0B0D30105BF63F4A31AAA0C565EDAAEF94AF51ED739129016FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278127, "uuid": "c2c4a9e7-d07f-4e15-a698-d5fe60aebdb5", "value": "1536:Tp8A/038R6no3k+rS8BLKIAaEYc5Uw31gOBGUBKQ2tGLr:VXGIKIGKOZv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278127, "uuid": "358e9b23-492e-4885-8a74-cb080dfaa5ff", "value": 78728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278127, "uuid": "25f1c3dc-77a8-46ad-8f3e-69b49200703f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278127, "uuid": "972a8d42-7e59-45c6-a769-30b39cbd551d", "value": "main_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe75a166-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1788278317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278317, "uuid": "5a1107e9-2c22-4958-9fb3-b1a42507da78", "comment": "Malware payload (DDoSAgent)", "value": "72a064fc691c59fa981532a4915d328b", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278317, "uuid": "65eae193-b7de-4a1f-8363-9c979a6af16f", "comment": "Malware payload (DDoSAgent)", "value": "72c10910f098611e04613c664716c5fd275d1f4b8d749409a24487148392ea7a", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278317, "uuid": "095ae765-ab40-47bd-bac3-fb62545ef64c", "comment": "Malware payload (DDoSAgent)", "value": "3331accff833c975dd2a9e3a8861cc75e6748316", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278317, "uuid": "b58b38ba-bc12-42a2-9fde-e70f15b900c6", "comment": "Malware payload (DDoSAgent)", "value": "8baf2dedd78e3e14d7e357041743c1e1d02295ab707236f8efb7f81ed0cf8d947f1c1d753825ee4041650c3e6994332a", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278317, "uuid": "fd69314b-d3a0-4452-a94e-f30f12cb780c", "value": "T18F8628517F98EE1FC69521358AB7C23433E53D0181B424369A62FB1D1EBF2B0992BDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278317, "uuid": "0c87b559-4377-404a-9497-dcb8868c65bd", "value": "49152:tnKfiCMy+vd4c18FGHY5t1Y/mjF8kY4JVBJyHHUt5E6:tTdh183B9zBJynUjE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278317, "uuid": "f020c039-1cce-46e8-af92-8c46c89ca9e2", "value": 8454328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278317, "uuid": "315f37a3-c3ae-47b9-ac04-16887e51c22b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278317, "uuid": "00c3ce95-b44f-4023-95c8-da9d6e8081d8", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e75986-a5bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788236187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788236187, "uuid": "fdda5d3c-31a7-4eb5-b306-6ceadccb4054", "comment": "Malware payload (Mirai)", "value": "d6c4a276a097b85ea427dc165b0be24b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788236187, "uuid": "a3b262c4-6943-4330-8f8e-129f0a2c70c4", "comment": "Malware payload (Mirai)", "value": "7397b8cf285c24e2cb4472a096538782aeb05d9189667bcd4f1798cf76aaee64", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788236187, "uuid": "50d32623-fce2-4299-a883-588229e3285a", "comment": "Malware payload (Mirai)", "value": "660de12784ed426334d6372cf71541c13cfd794e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788236187, "uuid": "0be1518f-6954-4a6e-a3e0-1c444f248fdd", "comment": "Malware payload (Mirai)", "value": "a7eba3d43f3ac15facb96fff710457421d1b4d587f4b296a0eb8be497cbf3e2b506aa32d96c9468d6787b8c3dab797db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788236187, "uuid": "b10ab93b-11aa-413e-9f59-3fe44fafa998", "value": "T1513183DB04205E325112CA9D73B6344C668EE5EB2C8FC3D4E8590EEA928C7CCF562B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788236187, "uuid": "691fd4d7-09d3-4098-99ea-ac9d251d2c21", "value": "24:Jv+NYFuF8FfFIT709z2k1kxJW7+cG4GV/koPAUVapzTjHdAv:kTwhlmxJW7+cJ5oMpzTjHdAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788236187, "uuid": "4d6d6bef-a3da-4bbc-aa2c-d83ae6da10a4", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788236187, "uuid": "50d92917-96c1-4b59-9a93-751e78190215", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788236187, "uuid": "fa24414c-0a73-4a7f-bd9f-97f569d2fae1", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d745010a-a5cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788243462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243462, "uuid": "2662edf3-d164-423e-b015-1af8e43443bb", "comment": "Malware payload (Vidar)", "value": "e3f19d339c743dc1c470530edcb29aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243462, "uuid": "71086f47-6edd-4809-b4bb-e335d3c2c731", "comment": "Malware payload (Vidar)", "value": "739dfb2c4beb22e1423cfe1f192a8de92ffb05a301a3c7dfb2cc136c19b1e9b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243462, "uuid": "a5d5f159-ba70-4615-b6c4-d32ef35b5517", "comment": "Malware payload (Vidar)", "value": "34d794cc3a12aab1d63d98a4b71be28a4e7c4b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243462, "uuid": "8475f78c-c826-487e-ba29-6a58706906fb", "comment": "Malware payload (Vidar)", "value": "7796e486d918c8d1307d165c45eb8cc6806a22292fd9b9b052d9644d70f31823ff86fe25579eaee6996e7397cf14071c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243462, "uuid": "006c20c3-e726-4857-acb4-6ebf0c604071", "value": "T1FB28330A7F859954D59A8F38D5774311763A7C4CC73633AB1EA0A2743E207C2AE7AF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243462, "uuid": "fe8ad3bc-2d5b-41c7-a2c3-9607df448b80", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243462, "uuid": "829fce49-0762-4c44-ab44-43198426f850", "value": "1572864:ptaYbWNzApRM7QSnAmJSIQT8j8JMgvCfHdQ4kv3x4GEFrQTQ6nTKtKVeCwV2f:sc6AZdwjiv7HvREpVkPwAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243462, "uuid": "bbcc9798-482a-4f65-89da-c0e7c8ba19e4", "value": 95517048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243462, "uuid": "c1ba7a4b-6e25-4ca0-8c4d-61f146294e8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243462, "uuid": "ccbc0af2-0e04-4a89-adb3-96736ae5c5c7", "value": "739dfb2c4beb22e1423cfe1f192a8de92ffb05a301a3c7dfb2cc136c19b1e9b4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d78c61-a613-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788274013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274013, "uuid": "84f896cc-796f-4ec0-b54f-8d442615e2a9", "comment": "Malware payload (Vidar)", "value": "482160445562b04353013796cb8c8b39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274013, "uuid": "9dd84e30-f52f-4504-a7a8-076bab63ed54", "comment": "Malware payload (Vidar)", "value": "73e7e841bb0786ebcd2f799eeacac582af70af4e84b32d65f9d4def54d4c2726", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274013, "uuid": "dae93d13-f01d-4a8f-8f06-1611bfa75bf2", "comment": "Malware payload (Vidar)", "value": "5aaf49571fe05c514b2f7befd58638b153710639", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274013, "uuid": "83ec1b72-693b-4c3c-92a2-1588e2cb533c", "comment": "Malware payload (Vidar)", "value": "d6d9d93558ae71669d913b36d0e3b48840128a41bf3227fa6e0ece31b6ba7025859bbba07c246cb8289a153d5165158b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274013, "uuid": "c73b44e3-1629-4e1b-b395-0647cf3040bc", "value": "T134765B07BF9141A8C01BEA39C5B6A253B6717C8D8B3473EB2E6061742E397C16DB9F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274013, "uuid": "a397f5e2-d416-4b99-82bc-1562d3f5282a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274013, "uuid": "edeb2115-22d1-467a-a9f9-c03c997a1fac", "value": "196608:PknGf4auBSVCxEEEiMyB891zVRtFLqf1WT6K:xcU1zVRtFLqf1WT6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788274013, "uuid": "9482f4a1-b448-4e8f-8178-79952e933df3", "value": 7374248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788274013, "uuid": "be2bd8d0-2e3e-4cd0-8ba2-12d3790d7d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274013, "uuid": "acd4a286-5f6e-4be8-ac0c-afa4260b8c01", "value": "73e7e841bb0786ebcd2f799eeacac582af70af4e84b32d65f9d4def54d4c2726.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03522a31-a628-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788282620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282620, "uuid": "a41db821-70a0-4419-b2d2-12ae822a3039", "comment": "Malware payload", "value": "f48e390fad5ed7e4cfd388518af591d5", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282620, "uuid": "ac2b8206-120e-40da-a653-e528c52a4736", "comment": "Malware payload", "value": "75bde56778043cab294fcdb807c953d95292537c662ee58e79053eb8909cc003", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282620, "uuid": "e61a0261-7c18-42cb-a274-acb823cf79bd", "comment": "Malware payload", "value": "4c20ff4cef54bbb62d28b6c5205a919f3ad63638", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282620, "uuid": "b44f7ac0-8532-499e-8590-870da5625ea0", "comment": "Malware payload", "value": "7cf9d288ce92eb39a3f3fecfe05b32433460741aab4a585e39c1cd8b2798c14d588fbc57b2770ed9afbd90129f586b2a", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282620, "uuid": "3f779a02-191c-4db9-b8ee-acf90fe5a195", "value": "T13365CFE658FE6374DB6347B29A969917D661FC3CCA7C2033C624E7B3E9125AE0C50312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282620, "uuid": "ef24095c-760e-4c70-9788-938dcdca8c6c", "value": "24576:pvrVUgsSEi7tx/k3gRUO1eDcjiE1zYr3mzp2zIWGZfXZvlu1YJ+DCK:BrsSbT/kw2geDc2EeTmzpnDdXZAC4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788282620, "uuid": "485ad516-fec8-431c-9bf7-e8d8ad4c5d2a", "value": 1518080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788282620, "uuid": "0d4e1eb2-7505-4419-9f38-b761f60914eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282620, "uuid": "9a67ad32-9c7d-4179-9c46-25dbda3e27cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593afc11-a631-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788286630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286630, "uuid": "067a5da6-fba8-48e5-b310-38263e3dc127", "comment": "Malware payload (Mirai)", "value": "363ac53e36d23c7c3e86fc7fecee77ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286630, "uuid": "ef623a7b-7b0b-4d38-a42a-c4afe40bf3c1", "comment": "Malware payload (Mirai)", "value": "75f62aa417c15742ed6f4610caf34aff93e8f50ed432b884b0f38a4a30030a22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286630, "uuid": "bc8ea8d4-2ef0-478b-b7a4-3f7f61379a2b", "comment": "Malware payload (Mirai)", "value": "3d6d6d776d745efc9fad11318e3d09af12a9661a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286630, "uuid": "6a90bba9-7c47-4d3a-8740-1a9dffe814fc", "comment": "Malware payload (Mirai)", "value": "a0cda9f0a02b02d9117479e7f725c44e799fcd894e061718fcbbb515211cae98127219944ec1eef50ce8950eeebb76ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286630, "uuid": "0ae21b94-a4bc-4df8-bacf-3040147f2e96", "value": "T170741988D2E3E2FEF155D97012257A1B5D3246373093F28AF39DBA7392B614045EEA34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286630, "uuid": "c9e9ce27-b0e8-479a-9ecc-dbacf92069ea", "value": "6144:qMitcZLNus9+upjWzSWaN4nOtzPlK/+drba999:q1mLNWupM4tzPlK/+Jba999", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788286630, "uuid": "ea228c90-960b-47d1-bbb0-cc84c75106a0", "value": 353892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788286630, "uuid": "86d570b7-6a95-475f-b808-7802b7325c67", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286630, "uuid": "57d77b1b-9806-486a-a114-6151ec4178bc", "value": "75f62aa417c15742ed6f4610caf34aff93e8f50ed432b884b0f38a4a30030a22.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741ebb1d-a611-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788272931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788272931, "uuid": "8ce8fffd-51a5-4fce-b2d8-85113e7d2b2e", "comment": "Malware payload (Mirai)", "value": "ab1de29b67632b27c7aa23dc9ca34636", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788272931, "uuid": "9e2eab82-6639-417e-96dd-45aee1411c09", "comment": "Malware payload (Mirai)", "value": "769e41dc93924d70598cca568ef47b041d1c2dbc3050816c65b9f9dc436544de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788272931, "uuid": "4e403007-ce9d-44b8-99b2-2be35c0e001f", "comment": "Malware payload (Mirai)", "value": "20eb98e2f0c89b4fd94be30e5703d5a4dc59c590", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788272931, "uuid": "2882f3b6-9c6e-4c0a-adbe-cfead45f39cf", "comment": "Malware payload (Mirai)", "value": "87d4a3b14ac8d60c3af121b7fae77f94721c1be9af788937f41063b5ae711393ccbb44cc37e86bb8b6e9c20f37712f7b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788272931, "uuid": "40715e2d-be77-4642-89f2-60f32370918b", "value": "T10834BA1A3E228FBEF268C77047F34A31976976D627E2D684E26CD5101F1438D681FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788272931, "uuid": "e83c751a-b6c0-4339-9d58-340ab8043753", "value": "6144:p5n4F842iQbY1dplvtKP41p1J8JG8WYkQsxNenndQ:gF84s+Y41p1J8JG8WYkQsxNenndQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788272931, "uuid": "8c9e34cd-a253-4c75-8b74-ded0e5e8be6a", "value": 246219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788272931, "uuid": "074d36ae-bc14-44c1-9f09-bcb29909d98a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788272931, "uuid": "f073d930-8e66-404b-862e-352bd7519aa0", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2c92f0-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788278127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "bc492509-b7c2-4a07-9e83-e0fde5adbb58", "comment": "Malware payload", "value": "f93573fff32dfee57fb2afca364d40d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "20447139-0287-411d-8920-16ddcb133515", "comment": "Malware payload", "value": "76a3896a95d793d90eaa317f55269f8550be4b2d0cfe96ff536d55297df3c5b2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "ac71b94d-e012-4497-ab06-2da3e17ed5c2", "comment": "Malware payload", "value": "60c88e5c4e613d895b492b73570a322cf342464d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "aba65fd7-0fd7-41c0-bed5-66984bd3e10f", "comment": "Malware payload", "value": "11fcc7ab2237285451e343f8a50c5ccfe0c4066a2cf1748016b21fcaa64e7b12bbfb17924dea78f95f94422848405aab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278127, "uuid": "e496c1f5-2712-4dcc-bccf-68a768e97e34", "value": "T12BF37B6AB64F7C81D2C6D3F8CF974B98353B35A08D5791E17D02232DC8D29EA89E0791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278127, "uuid": "1d37d966-a1e3-49cc-a66e-c7deeb3b768d", "value": "1536:OmTd5MpN7htuC+kYr2wau8KsCx3EGDPVo2h2F5K4h6gEpj1yWVfQWPmFB/LW:OmT0xtUr2waurN/kntVEpjz/iBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278127, "uuid": "c28f679f-1675-4abf-b26a-e222ca32de10", "value": 158016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278127, "uuid": "b40f3334-1de9-45eb-83aa-8ebfe3646c2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278127, "uuid": "74b09df3-4d1a-464f-96ea-83ffaedf3e48", "value": "main_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66840c26-a5c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788238119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788238119, "uuid": "c72e816d-ac93-4ab7-914d-b557583dca76", "comment": "Malware payload (Vidar)", "value": "2bff0fbba2e5fbee4e5b5a9ce2ea707e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788238119, "uuid": "fe67dd62-89eb-424c-99cd-5f72e1aed7ea", "comment": "Malware payload (Vidar)", "value": "774560697fd43c072b6fa4b4719542370b15a3d932a924496af2193ae4e30cfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788238119, "uuid": "d39b295a-af18-4788-8fb1-f78d6cfd9310", "comment": "Malware payload (Vidar)", "value": "162dd07032d4d3a683272b51c4a86271a2a22df1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788238119, "uuid": "94e04c4f-f1f4-4ae1-b516-b37dd43c9f37", "comment": "Malware payload (Vidar)", "value": "18ba048f9a328c3fa30fcea9eab59dfdd7ac45a730db13b3a9481e67c5d5c5d472f4884bb2febba0afec1b14155d3415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788238119, "uuid": "5d8e52d7-3691-4a93-9e20-5a6e17d60410", "value": "T1691833075C91106AD25AA636D87A1552BB74BC4D973133E72F80E7B82E337C14EBAF18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788238119, "uuid": "8c6ceafa-8f2d-4888-8fa0-fd968c59039d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788238119, "uuid": "c01596e3-b102-4e23-81a6-cf3861401f21", "value": "1572864:9QOw6y5oMu8oBV8dyfwFW7pJaTa3dqcYJH+Ij6m509ioh1VhyoxhqWgYfM/:eto7grerEKY/6ma9iQVhywhDg6M/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788238119, "uuid": "0372eadd-357c-4fc9-9bed-c615da5431ae", "value": 89317280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788238119, "uuid": "aa668ccf-1678-4b30-86f8-89be5d730fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788238119, "uuid": "7afe405f-e41a-4d9d-ab75-e0b9ac747825", "value": "774560697fd43c072b6fa4b4719542370b15a3d932a924496af2193ae4e30cfb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d921ac6-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788278128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278128, "uuid": "2ba454c6-60c7-4702-9d01-7ba227878a8b", "comment": "Malware payload (Mirai)", "value": "a0d5ed0f1349271483432bd1a4b0c00f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278128, "uuid": "2e816968-f4aa-4aa5-ab68-5d2a620a0f2b", "comment": "Malware payload (Mirai)", "value": "786cc79edc6bf9d2d473930bfdf385ad9778a82e2663131e608be55678052b18", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278128, "uuid": "8c129467-9fd4-4dbe-9a85-e46a398860ab", "comment": "Malware payload (Mirai)", "value": "76a5bab45fe9a89e5c3a52b42887a0ee53e2ea3b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278128, "uuid": "c2214c23-c7c1-445c-8ae3-d185a9c9cd9a", "comment": "Malware payload (Mirai)", "value": "b53a64b869bc508d315dceb80b14bb0ae7c758cd8d4d675709dbd6d87e5fc9be2fa09376ec747c689cf1674a722744f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278128, "uuid": "7761121a-cc07-4c61-84be-ec5ed1cc9518", "value": "T14104971A6F228F7DF668873447B74E24976C23D627E1D641E1ACC2106E6039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278128, "uuid": "09bc6532-3778-4014-b961-4b24a0192167", "value": "3072:VAWVcBFT3Vb4S+/eOfR0gFZ6rC658hh69rm92F:VAWCBFxb4cuBar58hANm9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278128, "uuid": "0cb85fd2-3485-4e29-8e92-9257272aa06e", "value": 190152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278128, "uuid": "9c25465b-1bcc-45fe-b3a1-a734b6a6ee2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278128, "uuid": "f63b4ccf-98a9-465a-ba4f-39d96b638346", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9becd134-a643-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1788294473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788294473, "uuid": "191a836c-d723-425f-86ed-f8b74ef5a533", "comment": "Malware payload (RemusStealer)", "value": "c2335e7a4aa514be564a97c6cf5cd249", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788294473, "uuid": "cacf9caa-281a-4630-b9b4-31ed371beb4a", "comment": "Malware payload (RemusStealer)", "value": "78de3c26964e83c10f83a7ad3e8399b00efe2702dcf4d27d60cd177cdde517e2", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788294473, "uuid": "a60f178a-86e1-4d34-a7d7-6a93c7527f0e", "comment": "Malware payload (RemusStealer)", "value": "8722a8b5de9279d0a79dce8258ee5908df4d93c5", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788294473, "uuid": "29653907-8751-4d29-b418-d2c783e2ef9c", "comment": "Malware payload (RemusStealer)", "value": "b126e72356edb567f90916eefb0fc0c7f5621c3cbf40478a18ccad8295fdf89d8d1bdf2803301af7307e07d36997a38c", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788294473, "uuid": "98186a4f-ecfe-45e0-b933-5583e15f2a56", "value": "T18505A02AA39270FDC12781B4C2DB6372E533F83E13E05A6A3794DB713E6CC714A59A15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788294473, "uuid": "86b3a1a8-d4ff-4d88-97a6-0701fb09539b", "value": "03cc13f2892a8bb4db3404549c3b67ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788294473, "uuid": "4ca6fe77-fa0c-4efc-b6bb-e4da9cdcdbf1", "value": "12288:OBVL1aQvGI3n409do+A1k3DE50kVsFCmG4+FQ:egQvGQ4qnA1kzE5IDGNFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788294473, "uuid": "f5c019bf-f55a-41cd-94a7-1be36980bb7b", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788294473, "uuid": "fae131bd-29ac-4ca5-8bfd-484712196a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788294473, "uuid": "e85c306d-23d9-4b2b-bcaf-b21396227440", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e32a30-a5e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1788255410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255410, "uuid": "fa40875d-4557-4ce0-93e4-a192509edb1c", "comment": "Malware payload (Gafgyt)", "value": "bbe29ca4384fdd7caf60c1836fbff13b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255410, "uuid": "4b4534e7-3442-4c44-8be0-7470e5f68285", "comment": "Malware payload (Gafgyt)", "value": "7b1cbba56bb80e185cdf2097f5716c31d7e0f88f28ad7220b3b5a2cf73859ec8", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255410, "uuid": "9126b069-8712-42cb-a055-2c23a38d314c", "comment": "Malware payload (Gafgyt)", "value": "a5c07f2bba9b7f2c1a9f04c62ab21bd92c5023b8", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255410, "uuid": "bcf421b5-2ad9-489f-86a3-edee19d14117", "comment": "Malware payload (Gafgyt)", "value": "a6f82af883dd20ea3195e8950bb1ee6cc9281ebf0a77e742fca98d8a5fcaf80406a36a414f16021e261661e827065eee", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255410, "uuid": "859144b2-9c5e-4759-893b-2cd119a4beea", "value": "T1F5D1C1D721A708702DE0D82B72BB5C0475E9A59F40E6AF896EEC3CF951CDD48B0907A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255410, "uuid": "63558e64-7ad8-42ed-bbda-209b135403fd", "value": "96:vvf+srLjrzrHCKxJDUWgyQEol8fHn4El2KxiX1Dl8pPeOKx+mqcl8z:2uGL5l8wEAjDl8pPbzcl8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788255410, "uuid": "edfef5fd-ce3f-40bf-a7ac-5c31bf265f12", "value": 6734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788255410, "uuid": "543dd9ba-7adb-4bd4-bd39-0aff47b83a5c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255410, "uuid": "daf93be1-da1e-4d0c-983b-04dc94e130ca", "value": "handshakebins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49a6a05-a621-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788280019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280019, "uuid": "30f32db8-b3fc-460b-b78a-16da447df6ae", "comment": "Malware payload", "value": "13db421610b79b477c353e270f6bb8ce", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280019, "uuid": "cd1bd9d1-ff75-454c-9cb4-98be59cdd19c", "comment": "Malware payload", "value": "7cea19fbf28115dc8b8cd947d92d7cedcad6b18825f3d52e2340ae558445fce6", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280019, "uuid": "a911c157-3b8d-4338-942f-2ab652966059", "comment": "Malware payload", "value": "7fafc373d912729e57a049cede0d1300f0bd48b6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280019, "uuid": "0fdf052c-8109-42fb-9ece-6683446bc2b8", "comment": "Malware payload", "value": "6f94174e2f05107b1d59dc5b6b5f2c0a6d15b6dd846b3d76f9475729f29409ea60ece32e6715e704cd325086499bbe4e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280019, "uuid": "3e4d0d55-e774-4e73-8de2-92767cd9be60", "value": "T14D77336563B590F6E8F304718B9B41D4B72BBC555B60C6CF4A641A332E731A06A3CEF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280019, "uuid": "b60d17da-317b-4cbc-a343-9b1d8bf08d59", "value": "00dd128d087d2d10c39a58611ccf6407", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280019, "uuid": "e3b53e3a-7c43-44d9-9195-d2deffd569fa", "value": "786432:L5vzd21nbhVEHCYFqEvZIHLOSuXMb8O2PBD+gEwLKbuLz5HMLyRtDUW:L9zM1kvuHKpcF+BDO0mufl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788280019, "uuid": "9be96138-99e2-4cb7-9f7f-a56dfcf2c68b", "value": 34523648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788280019, "uuid": "10493c2a-78c7-4856-9b8f-c2b4f293ee25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280019, "uuid": "e0838e08-57eb-49e8-acd1-6f6e14d32126", "value": "dlllll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb7e6e7-a609-11f1-bd95-42010a9c0009", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1788269595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269595, "uuid": "5e620bb7-c1df-4fd4-9bd4-bfc26768e7d7", "comment": "Malware payload (Adware.Techsnab)", "value": "726ab5cd9bde74a3ad9dcd83eea4ed46", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ZyxStealer", "colour": "#29DE04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269595, "uuid": "f0a9cdd3-b21d-49cf-8d32-ee35df360bce", "comment": "Malware payload (Adware.Techsnab)", "value": "7d2765275888c9a557474e4f0370e5d7b922fce175841001568ffcd77f06da4b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ZyxStealer", "colour": "#29DE04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269595, "uuid": "069ca79f-2f47-4ee5-a487-4ba27464c205", "comment": "Malware payload (Adware.Techsnab)", "value": "7e53eeaf3364cdf0d5e8b7893a8fd5e8a98d8ba0", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ZyxStealer", "colour": "#29DE04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269595, "uuid": "2f80b8e4-5f11-4378-bb95-63e0b6e95e92", "comment": "Malware payload (Adware.Techsnab)", "value": "2d3426b926dbf1a9e35b575328d228564e16bb6c0ea091c96b0f09e4b585e495c6f9b411d89df47255cf3fba1ced87db", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ZyxStealer", "colour": "#29DE04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269595, "uuid": "f8a40501-5965-4638-b71b-d799854679fe", "value": "T1E3D6494BEDA515E9C4AED135CA629553BB703C984B2067D36B90F6342F37BD0AEB9300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269595, "uuid": "ae0fedc5-16e0-4a60-ae54-c2f9a1026a74", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269595, "uuid": "995302ad-f069-424f-899a-8de8b0df956b", "value": "98304:Fm8eT9snWXGpgGGWUOSo9e3SMELr8GBYxobVlq7wE1:E55ASGpgnC92Ev8GLq7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788269595, "uuid": "40752179-4b73-4c88-b313-fec5286d8149", "value": 13445120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788269595, "uuid": "2f429733-cd3e-48c1-8e4b-bce2208a28e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269595, "uuid": "2a9d4910-5c0e-4cee-899f-4bcbd9d8967f", "value": "7d2765275888c9a557474e4f0370e5d7b922fce175841001568ffcd77f06da4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38d44a0-a5cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1788243000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243000, "uuid": "f63bc45a-bd60-4464-bf6b-e8bcc7846d5d", "comment": "Malware payload (PureRAT)", "value": "1ad6ed9bd98c3caf7c4a627e31143600", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243000, "uuid": "f0abd511-f94e-48f2-ba7d-138de3934135", "comment": "Malware payload (PureRAT)", "value": "7df05f3aec6abeac060a5874c8ca9d29addef49f6344c81d12feb40bfa7bedff", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243000, "uuid": "b7f6f2b3-5cf7-4c5e-bc9e-c89644218145", "comment": "Malware payload (PureRAT)", "value": "91e2b94064e715ee947bc9142f7af548b5c48747", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243000, "uuid": "a11d2ec2-e544-415e-b054-7efd9e13865b", "comment": "Malware payload (PureRAT)", "value": "220199d5983d3d1b4462764dbefa450f5707c5ceefd6a8bb491bf65e0d95f066306612e67abb7d8cb57c1452548d40a7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243000, "uuid": "a05ef8f4-3c35-43ec-bcae-b39e93a0de86", "value": "T186E53366BD41C703C7DA12F4B15DAD481362EF08AE617ABA19C6F44F0E71766BC70B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243000, "uuid": "d8ec6ea7-6e2c-433f-944f-8bc5882dbd06", "value": "98304:RC15Nn5BsaWWEL03xDVVjhrrCpVMg6ZU:06g1BrlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243000, "uuid": "07445cec-0c53-42d4-834d-53151bafe3f4", "value": 3190784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243000, "uuid": "bfce92ec-c961-416a-bf6c-6a91bff61040", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243000, "uuid": "11e1752f-e3dc-4ce2-99d7-636b2310d05b", "value": "LWXTSWIR.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f39f9b7-a624-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788280949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280949, "uuid": "aee4d200-b690-425a-8db2-7a5661aad922", "comment": "Malware payload", "value": "fdf67aae8b90adcb883c0e61f3dca6e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280949, "uuid": "b9a280a1-6a97-4af9-a3f4-4bf42de6891f", "comment": "Malware payload", "value": "7e0daac79bbd7694d927481055ff2a959d89e3d303c741be4f06758a0228c819", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280949, "uuid": "4e9042db-300d-476d-a0b7-ee2f8e4b4e4f", "comment": "Malware payload", "value": "bbc0b79709d0708e13f3781d49ab528d30c770a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280949, "uuid": "abdda94e-565f-426f-bf2a-80b0afc85b3e", "comment": "Malware payload", "value": "5c2ce35eef4d80e26d3df9c908e6477f7c7e275528242f0c90164b9c496d7dae79bc047c8b3be7ad38d203ee2cc3a6e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280949, "uuid": "155fc478-a36c-43ff-af50-67453a7dcefe", "value": "T121D64B51FE8B54F6EE030D3104ABB22F23315E058B24EBD3EA547F19F937AA11936259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280949, "uuid": "c61bbb93-f51f-462b-867a-30bb29fadb49", "value": "98304:W1XvlI30hear095juXiOxMDAYSXzG0ng/ZClSH/2aoSXI8gOVEp:WNi30hearKAiAYSX6Cg/glkF4kmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788280949, "uuid": "2744258b-5632-4237-8b11-d174416f175b", "value": 12619960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788280949, "uuid": "64672cfe-c3af-4702-919f-3230dc5a8625", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280949, "uuid": "1385c4b2-ca7a-4c1e-b574-5e339070245d", "value": "bot_linux_x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c1dc19-a619-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788276442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276442, "uuid": "3de459d5-8983-4627-a980-27628513c937", "comment": "Malware payload (ConnectWise)", "value": "b447adf65f6ffedf97ccb61bfeac659b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276442, "uuid": "9ea995de-c82b-4e1b-a2b5-c83e38dbf100", "comment": "Malware payload (ConnectWise)", "value": "7f1bf2b8f4a5119bc13b7ccc9c6d3d243992b51801b3af2ad7a1b52e722d6bfd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276442, "uuid": "8e80ea47-d6c8-4676-9947-608d141cccca", "comment": "Malware payload (ConnectWise)", "value": "2a95954daf5084d88afa3dbba687e0446b2b595f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276442, "uuid": "b0b7ca22-4511-4e28-bcd7-386e02db55d2", "comment": "Malware payload (ConnectWise)", "value": "352774f9ebd5f9a3fc30769b285bbebd359ffb38ed2550400d9001ce20e31048f3e463cdacc9da36103f9bf3532623de", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276442, "uuid": "b1d29f7e-4d28-4de3-afda-2ec4c98ffe1e", "value": "T11F46E101B3D695B6D1BF1638D87A56696734BC048316CBBF5394BD392E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276442, "uuid": "90f3ea44-01d5-4065-99e8-d72aedc2af6d", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276442, "uuid": "945cbf74-a427-4c15-9215-a3c43688e897", "value": "98304:dzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:dhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788276442, "uuid": "fc21a7b7-6254-49b0-b2d2-d8f6bae6cf2a", "value": 5684656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788276442, "uuid": "3d82218b-3e80-452f-845b-939a2543b4ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276442, "uuid": "d0a3adbb-ba06-483f-aa25-5cac403e813d", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d044cd8a-a61c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788277810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277810, "uuid": "b9fdcdfc-fa50-4f99-955d-c232064e621f", "comment": "Malware payload", "value": "3bef0257fe0d507b20f3cec0c34566aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277810, "uuid": "1bb1658c-b647-46a4-9769-6dcb7efca2b2", "comment": "Malware payload", "value": "80880ef3860c9de0661892f1ecd9de2ac49efdc1b0affc4a6f9b5d53e28c5380", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277810, "uuid": "327eecb9-d145-4dd0-b43a-042d5ed5c8c2", "comment": "Malware payload", "value": "b02cbe72fca95e24689702e2c6900b4b73069643", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277810, "uuid": "51246174-f7d4-4121-ac88-1b100cf726a8", "comment": "Malware payload", "value": "a9b23e09396cd9a3ccf5fa800a09aa50d0be749219cd14eda09989e0dfd4d7190dc584d1d035add5f453f2842c26c4e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277810, "uuid": "503f548c-c75e-4cef-9c22-6108a98a8ea0", "value": "T1D8968CB3945224D8E1A9C9B4D11416527DB83C8B573873CBBAC471F65BBABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277810, "uuid": "e7fefe7b-a007-41f5-a414-8ec0203654ed", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQO:cqYUQuVDt0TZE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277810, "uuid": "a2990f92-d706-4291-bbc5-983802dc9264", "value": 9404416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277810, "uuid": "ec8422ca-f2f0-451c-857a-51dd7340c013", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277810, "uuid": "34a54e90-8d60-43e5-b5b8-582657dc5890", "value": "80880ef3860c9de0661892f1ecd9de2ac49efdc1b0affc4a6f9b5d53e28c5380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2d9f73-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788278317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278317, "uuid": "666be223-786d-462d-a033-b774840bc157", "comment": "Malware payload", "value": "434808a5f8e449db03440bb6fe552ec2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278317, "uuid": "70690e3e-c576-4c4a-a829-c42f234f51db", "comment": "Malware payload", "value": "81722c7605e51e025796636e50b478daca07a7dbb6ccf3c07aad74ecc4522843", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278317, "uuid": "b68858b4-6bb2-4000-9058-330e3af99a8d", "comment": "Malware payload", "value": "fe37b555e15d64a4f3e9c2adae2c52e32324fb93", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278317, "uuid": "6e782339-7661-462d-b305-619d77dccbbe", "comment": "Malware payload", "value": "2b8cd0800c21e8d0955dd34823d3465132c701b5a96d272d2c2b9a2dea999df470048a5785d360f9ee0f33b1c2fc15d7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278317, "uuid": "f211dd10-be3e-4db4-97c1-e868dae28d1e", "value": "T1E1762997B9D24942C4E83A37BCBD81C432630EB98B87565B6D15FE383ABE5D90E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278317, "uuid": "5a43d89e-fb0c-4878-b639-60944c832a73", "value": "49152:UttQrG4tuDCDUwv5NlGnTE+Gg8QEgwZJuCl4CsBNk9n4a4S45Ez:UtWtuDA5NlGnTE+Gg8Q2sNk94zEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278317, "uuid": "73580de7-5853-44e2-8ba9-456a68b515d8", "value": 7471288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278317, "uuid": "96eaab5c-471d-4007-96e8-a6482b8dc089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278317, "uuid": "4c682920-01b0-41fb-a397-67e6120c7aa8", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7228606e-a5d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788248017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788248017, "uuid": "b86b38df-e04c-467d-bfd0-adc013aa4d47", "comment": "Malware payload (RemcosRAT)", "value": "f23fa10c058cd653d5d617308b38b9e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788248017, "uuid": "2f440d56-4625-4b7c-bd08-c929c4300814", "comment": "Malware payload (RemcosRAT)", "value": "81ab2267ee0cb4272e3188e39ee7ae5f4ecbe83b10e0ab8b1d0e8257500280da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788248017, "uuid": "2afb0e2b-7d3b-46f5-94cf-9ab7190d8b4b", "comment": "Malware payload (RemcosRAT)", "value": "14651b8645aa8d70e56260e124fb65ab8cdcbbfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788248017, "uuid": "762f7d0e-8164-4b1d-b9f8-8527c121f597", "comment": "Malware payload (RemcosRAT)", "value": "5192dd5ace76c6cfb6144e161718bc86c0ef8a26af3ce04ac0e9d43d3da319cf8c891cf24bd69638d57c1cb6d481dfb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788248017, "uuid": "79a47684-bb56-48b8-af6e-cbca73fd1bdf", "value": "T16EE46D59A39402F8D0B7C135C982952BE7B2BC065571472F03E70E9B2F277A16F3AB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788248017, "uuid": "6c99b8cd-0aef-47a9-a742-6296f61fa8e6", "value": "91e69cff27767212388496ea08379c84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788248017, "uuid": "c6b00689-3188-4f0c-90c5-cc335182eff3", "value": "12288:RIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:25GXkH4nnwitNfuq9wgs3y3V5vgNyo3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788248017, "uuid": "fe0b2086-85cf-4703-a0f5-4f3b6b1abaad", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788248017, "uuid": "f49ca27f-9eaf-4724-9e0b-342e1a0561ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788248017, "uuid": "d1a78a08-8f26-4aa9-a439-310ba2edb6af", "value": "SecuriteInfo.com.Generic.Remcos.BF2649DF.51668116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf694c7-a619-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788276436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276436, "uuid": "e1a8f795-61e1-476a-bf3f-7a7ba1f437f2", "comment": "Malware payload (ConnectWise)", "value": "0aaa765762c465f442780465f50ba8e7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276436, "uuid": "5343062f-1ff5-40a0-beb7-32cdf7b78eea", "comment": "Malware payload (ConnectWise)", "value": "824b7cfe46c0b7867c049cf0e6c7c2599b891c5d4a59367b8e9d14b12354011a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276436, "uuid": "bc583a39-d50a-4528-85a0-0f5ab539a974", "comment": "Malware payload (ConnectWise)", "value": "845c61a963a4cc0dd99478c5da8d3f0cbb1399e1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276436, "uuid": "02c33e5d-768e-4c55-979e-077e9b9e7425", "comment": "Malware payload (ConnectWise)", "value": "bd7e2ef45fef1b63cfba5bed6e72efaef16e4fe0ae093b44a6a0129205fb4b38ca4f3b7a0a828ef3e024c899e29b0b71", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276436, "uuid": "d238b3f4-58ab-4bbb-8ae3-8d3c9165a7e2", "value": "T165646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276436, "uuid": "5b1bf6e9-7184-46cc-8d0a-f7a0cbf59591", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276436, "uuid": "5fb3e89f-ee37-47cc-91e4-8bc4674dfe7e", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:J1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788276436, "uuid": "5f0d70b5-5203-4147-9daf-8b2e3de68608", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788276436, "uuid": "9e8c951f-cbb0-457b-9630-4f48917d86aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276436, "uuid": "80357698-78e9-4fdc-999d-e72f28ecc481", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44d8176-a5d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (STRRAT)", "timestamp": 1788247699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247699, "uuid": "66c3cd4b-8f29-4c99-bcb7-804b2e5f188e", "comment": "Malware payload (STRRAT)", "value": "39f89f71fd1180fd16fc8563dcb7f0c8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247699, "uuid": "4ae688eb-cdb2-4ccd-af19-e13f5f109be9", "comment": "Malware payload (STRRAT)", "value": "84793ff9d0bfbcf1dd2debf129e6d3405fab08d91e7789a78d65414147b764b6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247699, "uuid": "4bc1ea54-476b-4e3d-b223-a432fc6f406f", "comment": "Malware payload (STRRAT)", "value": "87ab34bff72b9a40b626b87c0a20d41a9584b38f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247699, "uuid": "c4754f63-643c-4874-804b-eaccf84de9ee", "comment": "Malware payload (STRRAT)", "value": "ea2e8bc6e8534f037a6bb6928f9a2d4e1fc91e2fb128971ddaac8349da6192b3a374e316fa5114a1e9ff78d71a6bcd4e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247699, "uuid": "4ccb434d-0f80-41e9-9400-78b7ad899f67", "value": "T170051F55B36A098B1B0BAE34341A1D6377B80B60EFCC49C49657EE998C5EFC70359E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247699, "uuid": "dfe05fec-5bde-4307-bd93-875a548dde68", "value": "3072:OJErxy7UMFYMiuC54gWaVmQCiM5nptTRcwlu0Dx7o114bVZrSO5RtRVtGjoxsUze:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788247699, "uuid": "849a414c-1384-4ddf-abfb-f2ee6f4e0c8a", "value": 849496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788247699, "uuid": "2bf0548c-7338-497c-83a0-a5c6f9f9d88c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247699, "uuid": "6d6e83ba-3a38-406e-bd1e-36bee5b0e00c", "value": "REQUEST FOR QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd4ff3b-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788278132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278132, "uuid": "ffcb32a1-fbc9-47f2-871e-4e22be97d797", "comment": "Malware payload (Mirai)", "value": "37ce2710f7182a69599d8a451d26eb92", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278132, "uuid": "af94a442-1cbf-474f-adad-7f47f1fd11d9", "comment": "Malware payload (Mirai)", "value": "8565edabe0ba5cb4c5f9b2937576ee57595baaa8c49bdc56b8a0e3e690bfadfd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278132, "uuid": "075e6d3d-46cb-4fa1-a777-8f880065178f", "comment": "Malware payload (Mirai)", "value": "9b371a6af9e6d871eca732f22da537fbba95545f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278132, "uuid": "2de69226-300d-4003-a23c-a4e294016a7b", "comment": "Malware payload (Mirai)", "value": "d20558b4c20588f2f9a328c1c63f56f6890250c63cab962ac4e868591d677efcff7271028c24c0693d6328ce84dc0b1b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278132, "uuid": "241829a9-7f5f-489e-9439-a1af25f41a45", "value": "T103C36B77C8296F68D255D470B0B18F782F53959282871FBE29B7C2B08443D8DF909BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278132, "uuid": "23c53e37-a15c-418b-951d-161667a58d18", "value": "3072:kL9XECdpSGoA/ho1gb8LF1bhjWspVpFneU:kWCdjoA/G1gb85HyAf5eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278132, "uuid": "fe5c5ce9-6202-4b4a-9e0d-d38857cafe93", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278132, "uuid": "998878f2-b1e0-4cbf-ad5c-795b66d05207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278132, "uuid": "28ba9483-405c-499b-834b-389aedc138ac", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a754ae7-a652-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788300806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300806, "uuid": "b2215868-3cd6-4747-ada8-ab59fac68e68", "comment": "Malware payload (Mirai)", "value": "95b33675dc05887240503061919cf7b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300806, "uuid": "4383c280-040b-460b-a01b-e4b93efd2169", "comment": "Malware payload (Mirai)", "value": "85ef43be0fd87c2d98a1e71f055e376a3b6702b6a5279f84aacda4bc57e9b41a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300806, "uuid": "89c877f5-3e51-4308-8453-63bec3bd41a1", "comment": "Malware payload (Mirai)", "value": "c28e0d914496d3020f45cb768a11961b98e8fe38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788300806, "uuid": "3feaff94-bc08-461f-9581-1d23ba3f1121", "comment": "Malware payload (Mirai)", "value": "ff6d64ffc508100d056ebbfbd2dfbcb648022c1f51c2a594b471a02cbd7e494ca0ab7854b89e777521b2cf9e0cb8b8ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300806, "uuid": "fcf10089-4718-4e58-8946-25fa00d2b225", "value": "T1BD043A46AA818A17C1D31779FA9F42463333A764D3DB73069928AFF43F8679E0E63501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300806, "uuid": "84235e6d-914e-4d10-b7d4-230fa01da59b", "value": "3072:EWfxWR3bV4DWJx2lVgMpkRvYTzaIiULTEHGr0Hx1SmWU2zURygWo/g0M/9VFp:EjV4DWP2lVgMpyczaIiULTt0HKmx2oRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788300806, "uuid": "40c89bb3-4883-4288-b7d2-9daf8d64d3fc", "value": 185746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788300806, "uuid": "39e90fdd-ea71-46a9-b56c-261d573f97e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788300806, "uuid": "4e71b843-a232-404d-9c41-9c8c94bbd840", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53ddf8e-a5b0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788231487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231487, "uuid": "fe8f0a18-779f-4a47-95d7-cf1e59082154", "comment": "Malware payload (Mirai)", "value": "28fbbd59d3b4af6a027e6562b9f94f37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231487, "uuid": "e853cef7-50a5-4723-a2bc-352a0f278b72", "comment": "Malware payload (Mirai)", "value": "8610c817c54d0d1a4435fb8d604106281d43ec98eb1665d176f0467b50e67ca2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231487, "uuid": "6db45ee0-44f8-4fba-b869-14a9ec083102", "comment": "Malware payload (Mirai)", "value": "1f5720a3dc033b56057e40f620d0010444f67a1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231487, "uuid": "c37fbbd5-6d0c-44d0-8e18-c8d4c6d5d560", "comment": "Malware payload (Mirai)", "value": "0daa90e4397e04efc33dfdd5bf35fe6c3f705565e18fbbc5e71b64e1ec2bb79ccd75caed0eef45d4d593b396606a0ae3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231487, "uuid": "c69632ab-cfd9-43fe-9422-2b3b02d8651c", "value": "T1E9934A07F99180FDC456C13803BEBA36DC73F4EE1238B25B6BD0FE252D58D612A19A65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231487, "uuid": "96644ba7-87bc-46ac-96c6-d419c0ed7e78", "value": "1536:ZcSbeuewgVc1UTbH+KWaZV0x3YQtcy+OPr7zGQNoRTNuh2HAyGGL4:ZIuVg8ebeKWDLfPTGQ4TNuOLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788231487, "uuid": "f59bdb90-5052-4fad-a05c-d81b91196b9f", "value": 96880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788231487, "uuid": "c43d9f97-3040-455a-9f1f-afb77bf1fd12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231487, "uuid": "4aebe3f2-5c2e-46a6-8797-91fd618cb449", "value": "8610c817c54d0d1a4435fb8d604106281d43ec98eb1665d176f0467b50e67ca2.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8808cb8c-a5b3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788232592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232592, "uuid": "7fe33efd-20c4-4bb2-bb22-b9c1abb1c7a9", "comment": "Malware payload (Mirai)", "value": "2828d7a489228d5e9c12a8a2879a3a7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232592, "uuid": "028413d6-fe64-4c7f-bd03-a58c8445bbc5", "comment": "Malware payload (Mirai)", "value": "8630ccb0f78e12c7f7a283d49a34ff465c44ec994c874219d5c03bc7caf71abe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232592, "uuid": "8aa6483b-e164-4a67-bcc4-351f8cba580e", "comment": "Malware payload (Mirai)", "value": "47ec193a08582d155894bad63317950a34b56c56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232592, "uuid": "d73f1422-42f3-41b0-b640-72d24a461c2d", "comment": "Malware payload (Mirai)", "value": "a8bf82265cc1f436c1dab0542fa652831080745f65dea6415ce07ecdccd45309e21c6aae2885360acfed183c5f11d819", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232592, "uuid": "d9a49244-e4c2-4eed-afc6-1ae38e29a67e", "value": "T1BAD3ADABF34714A2C85202F003CB9B8D6D235292AE5BD5F73D1E1A37587A1CF1A16BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232592, "uuid": "af9ad158-ab6f-4097-8431-a7842f1a85db", "value": "1536:0K+km4GC9TGWeiNPVp4mdexBxlLiWr3xNKO/gty3bq+/LWU:cO9TGWdNrLdABxwWrr/g2Xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788232592, "uuid": "594b5380-1b9e-4258-b960-cbf8a4af0a19", "value": 132788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788232592, "uuid": "b6e340e9-6490-4e32-bdfa-8b46843b6f52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232592, "uuid": "422fb097-2cb9-4645-8f75-c896ed13fbc6", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d85b086-a5d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1788247660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247660, "uuid": "b51295c8-bd51-4876-ad2d-b5e8848e60b7", "comment": "Malware payload (PhantomStealer)", "value": "a9a3fa27d7a6d5b34304650c989c40f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247660, "uuid": "2b5663a7-670e-45af-beaa-6e1edd47e17a", "comment": "Malware payload (PhantomStealer)", "value": "88833ea2bdc1821342fcd237f3bda1ccaa54707b4edf3acbb36a9c652450724e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247660, "uuid": "c3a502de-b66c-4a03-be7d-4b3a9d67bb21", "comment": "Malware payload (PhantomStealer)", "value": "2379e075d9925e4e23fde6f6859f59ebfb161470", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788247660, "uuid": "41959348-f5d0-4f17-97c6-f1468495ccb9", "comment": "Malware payload (PhantomStealer)", "value": "9f32a3248e34653653fccce5c29f2dffef04d649b373bbb52b540a61ac28caef79bcb33eb364f47292d381cefc093f77", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247660, "uuid": "ae3f4fca-6650-4c36-a1e2-01cefdaaba8f", "value": "T102265572AB426D323760675CD13BE9A497857113A2D6E702306FF1983E9C80F9379BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247660, "uuid": "11f952ec-e9d4-499d-bf19-711b7e11cb72", "value": "98304:rbT6jE34V3ca06iDI2B0nutXbSiAeAFR9EK1cDtH0I0755Ax+MUb6331W4xJ2dx+:rbqhM1b08XGi5CR9EoQtH0I075dMdnxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788247660, "uuid": "2cb0d576-8603-4ebf-b43e-2413494fd6aa", "value": 4448375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788247660, "uuid": "65d29982-6af5-4c28-99fb-b456cad9f1d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788247660, "uuid": "79b19647-1806-4baa-81df-3e402b3d02fc", "value": "Payment Details.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd678a97-a624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788281242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281242, "uuid": "d5d5dd47-dbed-4ec0-8bb4-10021205711c", "comment": "Malware payload (Mirai)", "value": "93b6128d00e4a783051698611a675065", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281242, "uuid": "e00683ed-9e43-4073-891b-ad7bf8c3a102", "comment": "Malware payload (Mirai)", "value": "88df99e463c20091285a58823ac5bc8538618ca83bd510b42b1b879df47854a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281242, "uuid": "8ed9df3e-d328-46a2-adc5-e651f708edd5", "comment": "Malware payload (Mirai)", "value": "fffcde7688b501750822051353b7885f92d2a146", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281242, "uuid": "1534d50f-c9ef-4320-a67a-3fa94a1510dd", "comment": "Malware payload (Mirai)", "value": "22a94a2bf4a4cc4afa8277b2094812a04a0646af556c4608892053f914479461dc1113b7296731fb88508ed7dd967b5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281242, "uuid": "a6311f9b-ed61-4d14-b58b-87e34e7df63f", "value": "T19A840A44B3F1D3CBD254DE7053362E27AB6A863238A7B189614FBB73137317445DAAA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281242, "uuid": "16324acc-1a81-4ae8-aa3f-8844fbf02166", "value": "6144:WwfIhfFADMoEoiNdCAnDPycxbsmGmVL8q6rJKodG8aJFCPKk0J3Vt8K/:WgADqcxFL0JKhPlt8K/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788281242, "uuid": "41616882-11ed-48fc-b3ec-7446331658b0", "value": 392416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788281242, "uuid": "3de143aa-8ba4-4691-a0be-05b958e9ebe6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281242, "uuid": "f2ff359a-a4c5-4186-9b18-275fd3329b5a", "value": "88df99e463c20091285a58823ac5bc8538618ca83bd510b42b1b879df47854a5.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349dd577-a616-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788274972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274972, "uuid": "2ffc0248-1392-4f09-953a-7976df76b405", "comment": "Malware payload (ConnectWise)", "value": "35acc3d3e9cce5acfdfe4e1ac09ad8f0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274972, "uuid": "4461e7ef-a794-4571-8d5d-3d2a165d9686", "comment": "Malware payload (ConnectWise)", "value": "8a08133ee21496243399825b8e4ebbf8f4cb5b0c9def422ff5821c39558d0df8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274972, "uuid": "a32842c6-1756-46d7-93c3-729f0198503a", "comment": "Malware payload (ConnectWise)", "value": "b9677e307c1844992654c9a360d00c10f60ce4b2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274972, "uuid": "e4757eb8-ac2f-4e06-9206-9692e48b55d8", "comment": "Malware payload (ConnectWise)", "value": "aece0ebff485e560c79181540275deccb7940b390da6244ab0bc866ae297e2f0ff4c51ff52fbb81a4d7cd90a8aec84b3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274972, "uuid": "2423f592-c3eb-4e77-a7b8-fa22ea161672", "value": "T1E2646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274972, "uuid": "fa0cf34f-2af7-48c9-a976-7ef5b6f86e9a", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274972, "uuid": "0a470e5e-1a99-4989-bec2-f1f6a195ef99", "value": "6144:9mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9oPJ:41iw7gryNkSV1hy1Z1u2JLa9oPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788274972, "uuid": "8fbe028a-c035-4c00-a41e-3408c9cda59e", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788274972, "uuid": "d76d87e0-346c-4351-90cb-60e99a3e6068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274972, "uuid": "642acec2-63b9-4d23-bece-7112a447914c", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7b1e30-a5c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788239684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788239684, "uuid": "05d9768c-c28a-4b90-9d8d-cf30f971e099", "comment": "Malware payload (Mirai)", "value": "efb11e6c6b2d00aef0c5002cc601846f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788239684, "uuid": "9db6d3f9-9a0b-4305-a457-c8878c49a1d0", "comment": "Malware payload (Mirai)", "value": "8a6f1135fc2c48b4fe2de478e87dc158b78b708c7879ba6a0bca58087434fe27", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788239684, "uuid": "25ba720a-825d-4b8a-b97c-5b7e1c2af2c5", "comment": "Malware payload (Mirai)", "value": "e2cf8a874d193b91a2d06cc7cffd93a19756d95c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788239684, "uuid": "3069bd10-20b2-4f48-b0d7-c101c2462919", "comment": "Malware payload (Mirai)", "value": "fc55d5ebc051e368043cc448efcafbdc70ab4a7f589238c32f4dccb15b92d074391acdf76edae2c98392d6f303976dd9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788239684, "uuid": "312a42a5-b766-4ad9-b896-ff5f02d3c2cd", "value": "T19301CCCD26916147C56CCD08746F8A04964683C6F4BB5E1EEC8868FB9CD5708F069F4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788239684, "uuid": "9e95b0de-d655-481f-9477-8cd91679dbc9", "value": "12:+f22j+lf2oq+lf2UNNIl5zA+lf2d0LKj+lf2TgOs+lf2leC+lf2PON/+lf2nSE+J:q/G1tzNI7fTKGX8bF1qmC/tBTYZEjxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788239684, "uuid": "e6c4742a-ccce-462f-a22b-f7e26a2f0cc3", "value": 825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788239684, "uuid": "af959b8d-a657-4d52-9d64-377bd01ae4d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788239684, "uuid": "33112ed3-77c3-466e-8817-8893bc47b82f", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ba18a8-a5bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1788237610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788237610, "uuid": "10d03b94-d524-4101-9d6a-ceea1b207c94", "comment": "Malware payload (Stealc)", "value": "b7f307ac60038e66cf8951bba64414d4", "object_relation": "md5", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788237610, "uuid": "506f1d93-d95a-465d-9454-acfd8eb5b7b0", "comment": "Malware payload (Stealc)", "value": "8ada7f5b671c1b3fad199826203eb4e5dbd1c6a8cf1791100651ac24358daef4", "object_relation": "sha256", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788237610, "uuid": "01c25886-81e8-4073-a4e5-c671672bba74", "comment": "Malware payload (Stealc)", "value": "9577ed72881b5b4b720737d628bcfc1bb837d132", "object_relation": "sha1", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788237610, "uuid": "71b72732-529d-44ea-b97c-e0598d1256e0", "comment": "Malware payload (Stealc)", "value": "6a4e9b6f1ca1da0af1cdbcd6a402925d07d28d1aef07a45fee4d5eda639d4391b31a0e3bc2b1845f91a72c14e4bd545e", "object_relation": "sha3-384", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788237610, "uuid": "538a8f81-a6de-488e-8112-7dcf6c8d2260", "value": "T13CB52321B7C29073E57A1935AF38A719983C2C611FA6D5CBA3C02E5FAA305C1DB34327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788237610, "uuid": "f409e1e7-fd29-4a51-9d8c-920a130afb70", "value": "c58a6fdd5514cc5114ad09dc07384b11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788237610, "uuid": "cdfc0494-125e-438d-a7cd-8bfd4e864e62", "value": "49152:AToifr9FXth5yR/vTrm4uW0+LH+qvLQGj9HJ7I7Pe8gmLi7SrH:ABrVov+4uvSH+qUCBJ7Ce0ESrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788237610, "uuid": "05a60efe-d202-4d3e-a01e-bcd05be10287", "value": 2468251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788237610, "uuid": "c52bb2ac-dc68-43b1-b6ee-fa2ad938ecb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788237610, "uuid": "a5ff4112-4e70-462c-a389-749573122760", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700daffc-a64f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788299553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299553, "uuid": "fc4a9843-cb29-4de9-b783-6e761452ca68", "comment": "Malware payload (Mirai)", "value": "28c3469fc943ccd97e902da068fef753", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299553, "uuid": "71c13bb0-a1b3-40b7-92ae-8d5efdb7615a", "comment": "Malware payload (Mirai)", "value": "8b8e663ee2b2d946f75fcc5622763afe5a020e994f3b935ec7c0b0f83bcbcf0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299553, "uuid": "3158e622-2d2d-466a-ab9d-6b6f92eeccaf", "comment": "Malware payload (Mirai)", "value": "f7f32aa465868331e01a79406a58e75d33da65e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299553, "uuid": "bb6b0891-53b7-467d-8a61-ea2f8c0f98d3", "comment": "Malware payload (Mirai)", "value": "14c94d175cc3e8d35be8298b04927a03c793e8efcb2d1a7cfec8d1cfe8f4754c9abc54a8d15bd42bfca3e834773653b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299553, "uuid": "04ff8022-0848-4147-97a1-fc5bd12b7b0b", "value": "T1F3E3294AA4A26FFBD095B9756DBB5E34070DF8501B4F1AC6743CAAB0078F5CAB00F664", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299553, "uuid": "899ef682-587c-4c51-8585-aea5c3f2b630", "value": "3072:Xma9Ow8mPTi4kUo3rJ+iRMxGK9ALIG/AvykQX7ePiF/XyXt8dcul2mcPUjlNJ:XmTP3AiyMIG/AvyXV9+t8dc8bcPUjlNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788299553, "uuid": "f2a9867a-4574-4b63-baef-a9cb6a111bb3", "value": 149326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788299553, "uuid": "5b81ff22-c7d9-4770-a99a-52458290ddcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299553, "uuid": "4f98d689-dbee-4a3b-bfb8-6c277047fd32", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fa5076-a5eb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788256647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256647, "uuid": "8cdb9be6-6e73-4037-816f-ed206e4eec4c", "comment": "Malware payload", "value": "f46d33f30e67c1abdc9a7a50df68c7fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256647, "uuid": "c0da6e00-ceae-4760-b2cc-d799d5c274e6", "comment": "Malware payload", "value": "8bca5464bb0df60446a9ac06a9f6d0a4874db1efff2aee79da5cd8606fed5d29", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256647, "uuid": "a677ffd1-871a-41a6-ac1c-e4363358eca9", "comment": "Malware payload", "value": "b04366fcb6c2bfbfe858db3eb7b99889fcb3f9c3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256647, "uuid": "3ffa8d55-5dc7-4425-9be5-3bbf70d9c5ef", "comment": "Malware payload", "value": "1dff38381a9d1ef5b0548d443240da5f8f9299f622e2932abc7c81c878a7dc01473f1321e80f72338d9cf79030209259", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256647, "uuid": "8b718efe-62a6-4deb-8baa-e5a59ed2ee00", "value": "T1D9C27D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256647, "uuid": "9c72fece-4b94-4f87-885d-944a20174a7f", "value": "768:D8vCB+25j6es8R39FYpMSUpi+20qUpi+20YQX:D8l25JRd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788256647, "uuid": "0451a53d-c769-47b4-8f4e-0e986187e595", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788256647, "uuid": "a614fcd7-c570-46dc-96a7-5f9f9736cdc3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256647, "uuid": "3515fed7-b674-4b94-8858-e616d1f49e83", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1e681a-a630-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788286365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286365, "uuid": "8d139c92-96a9-476a-aef6-1bdf70bdb9e6", "comment": "Malware payload (Vidar)", "value": "656f81e9c7baeb3f367c0dc91c4e9822", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286365, "uuid": "12d3b1cc-b670-4039-8c19-83f65ccd7c35", "comment": "Malware payload (Vidar)", "value": "8c22c86461ce15d60338e6050de479d9d65234308156ae9cfdc6f5a1c9d5ce7d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286365, "uuid": "d4c18669-af6d-4073-8173-4586c1acadda", "comment": "Malware payload (Vidar)", "value": "377b1d1a3866aa9d548367472fa42a5908ee7538", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788286365, "uuid": "cc2209fe-fa31-4e4b-ac4e-1c2bd747a802", "comment": "Malware payload (Vidar)", "value": "74f6bab86f1ab9586ba6ee4f1d00114d581378d987b9853d37d8fa7625a9bd36b1d60567ae2bd61292c35276bd257886", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286365, "uuid": "0e208384-0cb9-4d15-8289-e97a22d1f498", "value": "T1A775F0523551FD7D029693B16E1646F0A86ACA40CFDF8556F24DCE88B14EC863AFA3C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286365, "uuid": "f0950d59-6331-46c1-9d51-c4eeef5ae6c6", "value": "12288:z5XExogw0bAiC2ig7BEnVqccxwJGAZ9sLkAtspiL9j9tJeDCu04MJ4W65LuusubJ:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788286365, "uuid": "d6e25902-6963-4a29-9b62-ac855d988e07", "value": 1607433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788286365, "uuid": "5b8220da-99ea-4790-aca4-cb4a67830c80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788286365, "uuid": "9963e090-8d56-4c4f-ac2e-a0f72cb0c75c", "value": "Kath19634_ural3495_fds5412.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb334f13-a5a8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788228061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228061, "uuid": "b7835a96-75e5-45b4-8787-2b61d7ab85e2", "comment": "Malware payload (Vidar)", "value": "91d411d6c94261b62ceef211a58eb7a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228061, "uuid": "f8d74e00-073d-4323-93b1-686b7eaa6cc9", "comment": "Malware payload (Vidar)", "value": "8c91e9ab5fbeb88473034e12ff9feb159fb367353500bdd471a92dc022ba4c21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228061, "uuid": "9588409d-dc6e-4d0b-a3fd-8b75adab5592", "comment": "Malware payload (Vidar)", "value": "8f71cb84ab98d7166316a661f777b455f72f3cc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228061, "uuid": "f7f5cba1-7cd4-4d61-94b0-63e530b24799", "comment": "Malware payload (Vidar)", "value": "89e3679038beaed47078c45feef769dad23ce429ca18f39a428219d0dd067afd23a619aea3fd2b24a7db2a6c58209bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228061, "uuid": "00675e1a-3f6c-4284-b921-b43e2f86b389", "value": "T13B766A07BF9141A8C01AEA39C5B69213B7717C8C8B3473EB2EA065342E397D16DB6F54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228061, "uuid": "6134f6cb-b30c-41c4-ae31-bdc2ff24ed08", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228061, "uuid": "83d829c9-ffa2-4003-b2ae-b62b3a631721", "value": "196608:Ms1ywidS8dI7XWO20z5xlTZbzAXCMLuKqAMQv:7MLuKq2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788228061, "uuid": "4f74b0ed-075d-4324-b9e4-310c1e1d47c3", "value": 7393192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788228061, "uuid": "5b7df842-cd0b-45bd-896a-52b1a277e328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228061, "uuid": "d82c26b9-9b27-4bb7-bce7-f64c9f220a2f", "value": "8c91e9ab5fbeb88473034e12ff9feb159fb367353500bdd471a92dc022ba4c21.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c12c83-a5cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788243136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243136, "uuid": "aac85b72-09f9-4798-86e2-8e54a233ab8a", "comment": "Malware payload", "value": "a87ea6e0f322cbabba4031b5bfb89b35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243136, "uuid": "a6192a27-f5f5-48e9-a392-39e9020caf6c", "comment": "Malware payload", "value": "8eb1e766bcd839dda78ae08909b8437828cbcf6a06e935b2a62d78624a6e93fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243136, "uuid": "561afedb-d117-4f01-b129-70d544bd4786", "comment": "Malware payload", "value": "bd1c3a86645547bed5f65d569207cfbde13b7a5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243136, "uuid": "2d4abbc9-c383-4556-8921-c7e1070901c4", "comment": "Malware payload", "value": "975e070b7e9659b52ceee6a5fa3acdf4bd075d618249cd99ddb6d60392f700e7d67d1efae863a9925e6249b0da99c956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243136, "uuid": "234cb92a-63fe-46b6-bdfc-a08ff15a1c86", "value": "T1B417334AE55004CAF1C59237A482C536D4B6BC6D2BA0D77E8BA43D7539873BC6E32E70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243136, "uuid": "7bf7686d-4ee0-43bc-8ce5-70093cd6f0ee", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243136, "uuid": "f2f49b3b-3a92-4913-aa7a-b487f913a059", "value": "393216:8XujpHE9hpUTLfhJxWJvt0L/dDtN3ZWqDvIJTDAV2VA3LoTomEP5Cn9:8KpHorUTLJL+eJDtN3VTD2eboTomExCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243136, "uuid": "b7b71780-43c0-4e9e-bc68-fd5bde65412f", "value": 19673415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243136, "uuid": "a9fccb13-193c-45ee-9d1a-da4314d953d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243136, "uuid": "37f620a9-6c57-4704-b5ce-0a4789120714", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cac2595-a624-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788280945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280945, "uuid": "d8394aea-6a7d-448d-9096-8af12eeb4cc1", "comment": "Malware payload", "value": "0629e5395ea707f591dfe794c8a45450", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280945, "uuid": "9d41d111-f574-41e4-95ad-49a7997a3d76", "comment": "Malware payload", "value": "8ebd4341557cbc07f22255689f8e0d1332117e17962d5eec8f93329c5399eefb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280945, "uuid": "3a3ef404-9c82-4159-9b27-6e1218852618", "comment": "Malware payload", "value": "b71d16e7d01d6c7176ade01fccb3b9e091ab69e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280945, "uuid": "2adb4173-4482-457e-9481-b376dd14997c", "comment": "Malware payload", "value": "bf5fab56f4c7302a86adba8acb9cc82f7b0d18b5905958c529483156bb1003076338f2d8c6ccc2eb8926f4eb65ea2661", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280945, "uuid": "799d21ba-b112-4660-8de8-4c765f9d82b2", "value": "T112D65B47EC6506E8C5A9D130C67692637B717C495F3023D72B60F3282FB2BE0AA7A754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280945, "uuid": "e26ce0db-8da3-42e6-85d8-12e83dbb2fa9", "value": "98304:fTVYskvTaHoR1HwxcwI8F/37f1HFhyIumJYceKkr+y4gGqEO:fATaI1H2I87SHmJYce0TO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788280945, "uuid": "eb60bbc8-ff47-43a8-b4a7-7d19ec6a1547", "value": 13422776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788280945, "uuid": "1b25277d-4fdc-4587-b30b-38d622f4c36a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280945, "uuid": "b63a40c2-7f82-4d13-b79f-8ac521d45933", "value": "bot_linux_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74be02e-a642-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788294197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788294197, "uuid": "5b1c4efc-f216-40b7-9aaa-1739358f2895", "comment": "Malware payload (Mirai)", "value": "024399b1ef6290f10b062a8fcbd5d1dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788294197, "uuid": "12043ac0-10cf-49bf-aa88-3b22053aedf6", "comment": "Malware payload (Mirai)", "value": "8fc81201abdede0100dfe26b6ce247db56bc160dc57dc24a2cb58c16a8ab55a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788294197, "uuid": "814a699a-dd67-4716-9639-c83de115a0d2", "comment": "Malware payload (Mirai)", "value": "151e777e427a87851402afb75582b1ade13334d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788294197, "uuid": "958729c3-4f36-4119-8401-98bac7331d60", "comment": "Malware payload (Mirai)", "value": "7276722bb65b963d5fac7e4772e377d5e57a8dd891d46eb6d2b6ee4df705efd28e583fad977e5ef40e24b01a55ac2a66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788294197, "uuid": "59a97af5-52aa-4419-ae19-1bb48c9003f4", "value": "T17C455B16B2B370ADC193C039478FD7B2993AF0790212AD7B72899A353F06DA05B19F57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788294197, "uuid": "c19659d9-080e-4e0f-90e2-b0f85510abd8", "value": "24576:SS6/z/Apm8yU9Y4ixEVa6olEssMOgh5oX1gy9m1XcXlyv6tgkEE:u/z/ApmOY4qlEssMOgh5oXQpcXlytkEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788294197, "uuid": "5b0f771d-d3cf-4168-80c8-0ef9b4020794", "value": 1176848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788294197, "uuid": "a92b3dfe-1e6d-4cb7-ba1e-afd2c8505390", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788294197, "uuid": "0fd8350f-e0bb-4ecc-973d-6ea95c3ea82a", "value": "8fc81201abdede0100dfe26b6ce247db56bc160dc57dc24a2cb58c16a8ab55a6.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb99cde-a5d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788245730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245730, "uuid": "9ec4a90c-475c-4012-84e2-5c70a693bd3b", "comment": "Malware payload (Vidar)", "value": "9916e7785c705b3450c9702ac2a4a64d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245730, "uuid": "031e4a01-d50d-4edc-8aff-8ec1b36633b3", "comment": "Malware payload (Vidar)", "value": "9043a7f372c707b8d577229cfaed59ed6df121a85b51112651f532e713e83791", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245730, "uuid": "8679ecb5-c9cf-4410-a9ea-f2806ba837e8", "comment": "Malware payload (Vidar)", "value": "72acb4a00089cf50a3ec730dc672bb148c84970d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245730, "uuid": "3a9a3c29-5aae-434a-a871-989105eaca94", "comment": "Malware payload (Vidar)", "value": "43c78e2f597c00ef5678f44140eb1db8f8f2b4c54f213fb192014eb3c564bdde6ac0bf8ce307433ee58e43523706b5ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245730, "uuid": "6f59886c-a62c-40a6-b2d4-d88ffb757426", "value": "T120E66D1395C9A0A5C496FE3DC17A53A86928B85DC63037B33EA6DFF02E21385DB74B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245730, "uuid": "132b6d8e-a329-46a9-b68e-9c7286758e5a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245730, "uuid": "bfe85780-df5a-4723-b537-01203b453db6", "value": "98304:1CKVSvGAQlmu3Jt6pkxcpQ8NDewi9mlFET4uMQR:1CpvbfOcpz6wi+ET4uMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788245730, "uuid": "6c36ca30-b7df-4779-a93a-7eada7a6385a", "value": 14057848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788245730, "uuid": "7af35901-3ed7-4677-bb50-be806bb8a963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245730, "uuid": "dfd40c09-7b56-4333-87ac-37a0ba4bee7f", "value": "9043a7f372c707b8d577229cfaed59ed6df121a85b51112651f532e713e83791.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d47af64-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788278127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "a672ad76-40b4-4af5-a3c3-d44de724b0be", "comment": "Malware payload (Mirai)", "value": "394d162cce0f48cf2338a7a3641bc224", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "672fb57b-d162-446d-9387-decbaa68bbb1", "comment": "Malware payload (Mirai)", "value": "91403ec7b9139ef9d3bedf0793ea106c0eeb7809cb540c104bc6e3776e1fa430", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "19266b06-1830-40e3-b85d-4dc6e36c2f47", "comment": "Malware payload (Mirai)", "value": "f78ec1571ae30fdc3cfa87133aed680a97e6d6a5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "840ecab2-a30d-43c3-b181-15e269685dd8", "comment": "Malware payload (Mirai)", "value": "d22a94d9cfea474b70dd52e0061c3715a2c83d8c94447dcc2058ddc24ed51fa47f8991e2780020fe07bc821701001a66", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278127, "uuid": "9a3e71cd-5933-4f12-acd6-fa29bfe3cf4e", "value": "T16304D81AAF610FBBDCABDD3702E90B0539CC945722A47B3A3674D524F94B50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278127, "uuid": "063fd1dd-2e0b-43af-bb5a-47d14f2066ba", "value": "3072:dq7uFW8Yxg6usL20ZdVuzPfIG2R35FrI:OuFWU6usi0fVkwR3Xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278127, "uuid": "e3a6754e-b46b-4a72-8386-17a8cdca3a70", "value": 190152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278127, "uuid": "af01204f-ef76-40ea-a6a9-56fe2b3cfe12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278127, "uuid": "7f5c9c6e-4f57-47c8-a123-6b8298f43cbe", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a15187-a656-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788302630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788302630, "uuid": "3d6cffe5-8289-44c4-a46d-285855465b80", "comment": "Malware payload", "value": "cbfdc0774c54d016bf35923d3c5603ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788302630, "uuid": "18d133c4-8aeb-439e-b34b-681e69947ecc", "comment": "Malware payload", "value": "921ae4b0d4344348a744504a68a434bf82e941a3575172be4bf6f929c08b89c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788302630, "uuid": "f723aeb0-f30c-48f2-ac0f-b2c23554ca81", "comment": "Malware payload", "value": "8026788ad7f9ea95083c3e8610b173bf6559f87f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788302630, "uuid": "ef022316-15e0-441b-bb92-a47fa48e276a", "comment": "Malware payload", "value": "0f3847c8b4306b1d88f25b4f77c858de8aebcf00c28afcd004f17bb1177e62a7683019960b325a4b547fcbd8772e28a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788302630, "uuid": "67c6adbc-4020-4f79-8e7b-00e99345b609", "value": "T125369C03BEA588F0C0DAE235C57262817778BC5D473237EB2E20AA393E367D15A75761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788302630, "uuid": "c66cbb54-076f-4c4b-a33e-19aa9b97c5f8", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788302630, "uuid": "023085eb-0142-4e22-8d38-9f4d5ae65d91", "value": "49152:TtJfRMNuG8tTB/s7oaKgG/sdEjGzllIDXeNv8TuqBvjPZ6GAoQF6NJ66z:TZY7saJZqBvixk66z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788302630, "uuid": "56f64fde-dc54-4d69-ac2d-c455ee4a30c3", "value": 5050840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788302630, "uuid": "bbe2f00c-b139-41b2-8ae9-42e0467461e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788302630, "uuid": "e5e5c4c9-b0c0-4301-9103-4404336301fc", "value": "921ae4b0d4344348a744504a68a434bf82e941a3575172be4bf6f929c08b89c6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca834cd-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788278126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278126, "uuid": "99117d57-d048-42ab-b706-2238eb9faa6c", "comment": "Malware payload (Mirai)", "value": "44b67811b5b18d1042b3d2667dca52f4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278126, "uuid": "b6726e70-8511-41ce-8677-21a6919dbcdb", "comment": "Malware payload (Mirai)", "value": "934a03a8f8f9be10b0106cd317fb2ed25e4f1314897c7178f7c2ce2e09e01e24", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278126, "uuid": "d1fca3a1-f7a5-4b23-93a5-3e977bc0b51a", "comment": "Malware payload (Mirai)", "value": "659d453185e71f9709819ae7536dbf66af9837af", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278126, "uuid": "138c8d8c-4c66-4b67-86d5-db03216c6eae", "comment": "Malware payload (Mirai)", "value": "4462d5c15d03a24acd759ee098a60cf959d1a9841e9188fabf020d35b8f28555c151cb7974d4bffd5431583d0435a61f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278126, "uuid": "7ab8372f-fdd2-445a-87b2-ceeb5eb952b9", "value": "T172E30B45F8414B23C6D612BBFB9E428D3B2A17E8D2EF720399216F20378A95F0D37645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278126, "uuid": "f4a1c8a8-54dd-4e8b-8f9b-818a28278a77", "value": "1536:qIf5ivcfhGgvuaGGzzHKK1K1d85AxpSf4V2VRkTlCgrvqcWYjp+oMQlkmwywtsUF:qDaTvd4b85qu4uepCgrCstDgsE7U/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278126, "uuid": "beaf5378-e7d6-42ce-bfd2-671be16f693e", "value": 146176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278126, "uuid": "fc19dbbb-8cb3-4e6b-9852-36e1f9908f08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278126, "uuid": "41778e3f-0340-4e79-a8e8-d67095447173", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22c47da-a609-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788269599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269599, "uuid": "df713624-f8a3-4a8b-8135-1a2a21e1ce98", "comment": "Malware payload", "value": "46eaf848ac5075b4ab85a25040d5e5b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FearStealer", "colour": "#6BA280", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269599, "uuid": "6dedb60b-5053-41a3-aa2b-1d5aa5d5808a", "comment": "Malware payload", "value": "9446ba34a69f008177ce9b95772e3d12f37b7bff5b1528e7c35896e49537ca6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FearStealer", "colour": "#6BA280", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269599, "uuid": "22931041-6bc2-4e9d-b301-2335e1e8e376", "comment": "Malware payload", "value": "fbf8e3f139e113721c821ac3fbe47859dd38e696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FearStealer", "colour": "#6BA280", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269599, "uuid": "be36ffef-12fa-481d-99d9-19fa9a929b03", "comment": "Malware payload", "value": "31ce633b0e29be98bed6c20ab246d843dde9843156b8a983c91315a3afe57f92c213319dbb942b1b04ddb86f43ce0ff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FearStealer", "colour": "#6BA280", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269599, "uuid": "d14680f8-5fa5-45de-9769-7e6dafd70f52", "value": "T1A2358E46B3F801E9E077C274C9565617EBB2B45533309B9F43A08A5A2F23BB19E3D721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269599, "uuid": "1e4a63b1-6973-4a44-90af-43c4647b8550", "value": "0d19b41b2e618c34fc29d5f5c0ace566", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269599, "uuid": "c34466ab-e78c-4b36-a88d-342f03aa7a9f", "value": "24576:3v5jEhbk4aL81+sxg1EmsfiZub09wdl3ZIAOsjp:1N38IoMLZUTdZOsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788269599, "uuid": "d66844e8-aecc-43f4-b92e-a3e12ab8e219", "value": 1132032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788269599, "uuid": "5e55bacd-93b1-4430-9db0-1859b9a0811d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269599, "uuid": "0e45fa2e-a6e7-4a3e-a75b-a75c20293f0b", "value": "9446ba34a69f008177ce9b95772e3d12f37b7bff5b1528e7c35896e49537ca6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef2950b-a634-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788288036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788288036, "uuid": "1415b3c6-be50-47aa-9c2e-9d1b4eaa1930", "comment": "Malware payload", "value": "8ee8e8739059c82b3ff8be68bc0a87ef", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788288036, "uuid": "77c6bd50-c8aa-4e89-b08a-fd193c690deb", "comment": "Malware payload", "value": "9467952bee004db674874989e651da8220cc6d267503d0c6ea39811e1dfc16ec", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788288036, "uuid": "3f239e48-95bf-48e6-8528-95f9d633a163", "comment": "Malware payload", "value": "bef5554ff2b5048e32953ad11c885de730c26eaa", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788288036, "uuid": "6813a2ac-9c98-4992-89da-786e7ec6380f", "comment": "Malware payload", "value": "fde6733657af939583f686017b07dc0f77bc0eebe8faa65d620231577b56a3279885643c698d3a8f32b61238c8974ba0", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788288036, "uuid": "b0eb8c40-8a52-41c7-9684-5b54545e3624", "value": "T1F77558F498BB5366D9564BB2DB9D8417FAF634283E71100FCB20E7E36A124992B1F311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788288036, "uuid": "ca43ec0e-1ac6-49dd-89ee-ceaadd420f03", "value": "24576:0H1zvGyaweeO19GMK0PuwTjZU7K3yJdsmMAU:0H1zey5k1IMKiXerk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788288036, "uuid": "5ea6b51c-cf94-44d1-8aa7-cdb785c2b624", "value": 1572352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788288036, "uuid": "81864ba9-2696-428a-81b9-36e647e19964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788288036, "uuid": "d666c314-eebc-4964-a60d-c5aaa177c34d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcea6b0-a5ea-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1788256174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256174, "uuid": "1b6b5ead-3839-4ddb-95c3-7ed0f4c1cc00", "comment": "Malware payload (AsyncRAT)", "value": "03a7bb983c61495a27eaa983150c6642", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256174, "uuid": "0236d446-a692-45e6-8840-1f8bea7fde2a", "comment": "Malware payload (AsyncRAT)", "value": "97ef870406a1f48080539a324094cdb9eae8f41aeafdc8be86f4c4aaa5a4f14e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256174, "uuid": "367f6bf3-4939-4fc7-8a5c-1d8dc4afb29a", "comment": "Malware payload (AsyncRAT)", "value": "c90f2e3ca471312f4f6293bc98b22c28a2a87349", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256174, "uuid": "8fb86364-9260-41ad-bf98-e6507ae8557e", "comment": "Malware payload (AsyncRAT)", "value": "bd5af902717d4e068683d9dd86d8844e5df98b5506aab9a9799d7098128c888cdb897fa80307768ebe479889d29dca08", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256174, "uuid": "661175cf-26f0-493f-8a44-5c4acfcaec02", "value": "T12B05F1542229CE17C4B65FF50631E2B417796ECAE521D207DFEABEEFB97A7141800382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256174, "uuid": "86372ddd-fde5-4219-8f7c-aa2e193fa75c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256174, "uuid": "94bea5f9-4e3c-4853-8878-17c2f94b4a49", "value": "24576:5nT2gM2WsXmgud5LW6JtUkHP8KOo4i5sMIkOWU:5TvJTluiDsbO/2sJWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788256174, "uuid": "189924bd-5765-4fbd-8b94-f130b5bfdc4b", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788256174, "uuid": "1d997de1-59d2-41e6-8ca1-2f3d627f660a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256174, "uuid": "a81a7ae2-bea5-4242-8e75-8e4ba4caaac5", "value": "SKM_20260901_099009010011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4a5909-a5e9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788255654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255654, "uuid": "0f640782-01ff-4945-bf15-d58f78cb0a9b", "comment": "Malware payload", "value": "ecfb86d16d4ee84fc602b21de4d265bb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255654, "uuid": "5fd08ead-9316-43e4-9ffb-d9dc7c9177fd", "comment": "Malware payload", "value": "983b55de5f43bd9d22d8b972334785f6dc5d704f4e80702c82a03a406c1f6833", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255654, "uuid": "83b7c24e-a82b-4ba8-b0d2-0c2d144c1e47", "comment": "Malware payload", "value": "04275c3074ac89cbdeed407cccc8f94007276b62", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788255654, "uuid": "c9d0a281-1147-4d3c-a5a4-b10c8040d397", "comment": "Malware payload", "value": "d2d78958bbdc18eaa825a706f7b25eb1b07028dd5773b6f3fdc2014cad7d398bfb08710f57a962f8a825acea3418a176", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255654, "uuid": "fcd1c091-846d-44b8-b7cd-6ba976afebb4", "value": "T1FDF044DF15686826644C8D4636D294086444E1CB794F8FC57B5C4C3A89A4E19F375B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255654, "uuid": "55791036-0109-430f-91d6-63a80042d0e8", "value": "6:/Y9PSlUvGQWbY9CDnJjuvY9eQiASX4cuY9YeyOmbuY9JeiN26ifY9f1ivXiJh+Pn:q1GQWLDJj6ASX4cOeyOKakxt9iP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788255654, "uuid": "a4291565-5197-4407-b2b6-1b9bd29c4c67", "value": 608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788255654, "uuid": "cb8390cb-c988-4119-89c2-b36e3e621eb4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788255654, "uuid": "1dcdc046-33e2-4ecc-bdca-fbd8fe7a5c6c", "value": "a7m2qx.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549b2c71-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1788243673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243673, "uuid": "837821fc-5f44-481f-bc26-235f5f56543f", "comment": "Malware payload (AgentTesla)", "value": "57c18e20ddf0d2bd668713233447624f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243673, "uuid": "b608880c-5aad-46a4-805d-a9f4e634bdba", "comment": "Malware payload (AgentTesla)", "value": "984dab51e0e1a8382041df287688039d65e8c15bba5752e0bad1c310312e6e7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243673, "uuid": "3b0f2006-9db9-4c30-8980-d108a1049681", "comment": "Malware payload (AgentTesla)", "value": "eef2b3ddfd5cdd5f92dd093a71f52c4d4e0d5ec9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243673, "uuid": "c3a8d2e9-37af-4ca0-a882-6412e63f88cc", "comment": "Malware payload (AgentTesla)", "value": "a479f3f0a86b6b7c881ba64cf9f96a6aa950d32e1f06278a913a8567472be65a0a19ebb84ce8973b5a28248cf310cc41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243673, "uuid": "09c8b026-bcfb-4878-bf3a-00e81ee26c76", "value": "T10054AB8509B2F231FDF2332ACE9D0D41CC05935664146096B6AF0656EF32AECE61E7F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243673, "uuid": "42d28a43-deed-4f3e-9aaa-0660448e2b23", "value": "1536:JuFbFaDAcgJaaJcsHD72JCqydVilgYBiY+BypWd:DJlC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243673, "uuid": "76f7800e-b8ee-425b-90e2-36d6f0d186de", "value": 301769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243673, "uuid": "3383c7fd-06b5-46b1-aced-1710937bd727", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243673, "uuid": "3c4e9768-fea0-4483-8482-0f178c801332", "value": "2026\ub144 3\ubd84\uae30 \uae09\uc5ec \uad6c\uc870 \uc778\uc0c1,pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42587827-a598-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788220879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220879, "uuid": "ff00738c-b27b-49d2-aab1-dbb9c6440acc", "comment": "Malware payload (Vidar)", "value": "5d7e30af602720a142f2d4f2df0b0ba1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220879, "uuid": "a8f87500-1e71-49b0-b7e9-587ec13181ff", "comment": "Malware payload (Vidar)", "value": "9897c649dedea20a1743fecd392d220e43151d349ed060ac1c7403cdcb60c852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220879, "uuid": "ba4cbe97-5610-4378-bef3-c2ec4dfbe512", "comment": "Malware payload (Vidar)", "value": "c0b04a6f7d0e9ea7ee50dc8bf10763842ef208a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220879, "uuid": "30c356af-363c-4e93-a40a-e059a4de0aa3", "comment": "Malware payload (Vidar)", "value": "1d43e5c73feaaf50da8c0ef4f63b65206fcae7b5db8ba427c90535721ce90e1779b70ea74d5edaf04dfed820a544396c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788220879, "uuid": "033ac1cd-93b6-455a-adc7-9a03af96bba9", "value": "T184765B07BF914198C05AEA39C5B79253B6717C8C8B34B3EB2EA065742E397C12DB5F24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788220879, "uuid": "c00d65a4-49aa-4066-9443-516aef4de775", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788220879, "uuid": "e419bae6-6780-4e2b-a415-b7fe8bb0b109", "value": "196608:iFVySXbsIJgkEAaof+wVgc42zg8jgbLGK:6sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788220879, "uuid": "2fbad15d-49ac-4d54-a926-e83847875dd0", "value": 7425960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788220879, "uuid": "3506515f-42c4-4279-a576-22a2f4752110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788220879, "uuid": "0a2b6210-21b2-4744-a100-f245b537716d", "value": "9897c649dedea20a1743fecd392d220e43151d349ed060ac1c7403cdcb60c852.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac5629a-a63d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788292028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788292028, "uuid": "da222eaf-8fac-4220-9265-c756195b5cf8", "comment": "Malware payload", "value": "caa7c76bacef9c1f69cb50b5dd2ba3d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788292028, "uuid": "9d3bd625-536b-4621-a7b0-04ecef518c75", "comment": "Malware payload", "value": "9a362e54c5fe38a72bf48e3fd7e35cb20e52f85e4e0cfb4b9b152c324714ad50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788292028, "uuid": "308805da-81fb-4429-a0ba-70c8664f6d0f", "comment": "Malware payload", "value": "18d93b62c49e93d7063a1bed3a5abf5266c43dde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788292028, "uuid": "e6332f78-2e87-4a28-80c7-0a3169cde672", "comment": "Malware payload", "value": "fc7222ed80d99828ab54fc3bed1aa5946dd3f247de541c15612740622711a40d828411bdda2908b4bc70b9a8333fbfb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788292028, "uuid": "bfefa934-5c72-4bee-84ed-d0f8c48432a7", "value": "T11CD5235A7EF21D75E876C772CF83F0AEB0283B4586718E977E8D6A008D025909CB5379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788292028, "uuid": "78f2514f-a15c-43a1-abef-6d597b6d130c", "value": "58f4b17816a07f7a36dd14e504d515e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788292028, "uuid": "753f7818-4416-4d93-9ece-eee660d96317", "value": "49152:TtXO7uLd3KrpDRJCyngi1kmX6JwbbNpeoMLPgBwfyDVbqYHBNoJf:VhYr5rCjSkmKJwbbP55wqxn/oJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788292028, "uuid": "5e0f6558-a6bc-4119-8389-4fb6083e4fd0", "value": 2974208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788292028, "uuid": "b4eddbb2-b611-4961-9428-0a70d3047d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788292028, "uuid": "bb27d45f-b413-450c-9af0-d620970a06f2", "value": "9a362e54c5fe38a72bf48e3fd7e35cb20e52f85e4e0cfb4b9b152c324714ad50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cf2e40-a600-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788265571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265571, "uuid": "9659fcd0-87ff-403b-985a-d2ab7bc1cf50", "comment": "Malware payload", "value": "f9214f0ade68f8a4fb9ff1146a1177ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265571, "uuid": "f119a5e0-8d39-46e5-a7e4-48462ef45472", "comment": "Malware payload", "value": "9a60b23dea48bf8ae6db72a845788c7c714c2ac82ba5a6e5a3e4c2833e198d8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265571, "uuid": "56fe0c74-38c0-484b-9e36-aab452b1a1bb", "comment": "Malware payload", "value": "7f9d7fce1213fc7b67e55361bdb88e1790cfee39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788265571, "uuid": "9f680ae0-d989-414e-ab0a-e15b6de9350c", "comment": "Malware payload", "value": "9304da1fbea10eee2ffec9834b6f74e6156b086a14abdb18807f807180fe9c034563c535844099e297883179291f2975", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265571, "uuid": "b1e4d977-cfe6-4f57-8418-b26b6ddd085e", "value": "T1D005BE40B450F17AD4132172647DE73C6A39A6024F214EDBC3D49EE83FB1AD26A366DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265571, "uuid": "933ac935-3b20-48ae-9fc5-3ce39ddf831b", "value": "e8c1bab599d5b913a1ead0e44dbbd660", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265571, "uuid": "001f8e66-b2c2-41d7-b982-2a192523107e", "value": "24576:ruU0ni76ls2WnH4RNKMtm0vgdlgQgJuyOrOk:6U0niPtymhgQgMVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788265571, "uuid": "58c9cb8d-7d5f-4113-8e36-c7399a0b5b8a", "value": 860224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788265571, "uuid": "19630851-8ab8-42d0-b514-0a287d2700d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788265571, "uuid": "d57792f7-ecb0-445c-b06c-4126b87b1490", "value": "notification_helper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336f377b-a648-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788296445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296445, "uuid": "b0936c37-685d-40e9-b681-357234405d62", "comment": "Malware payload (Mirai)", "value": "22d7ae30c34073c0c2dc4126d4e0ea65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296445, "uuid": "f7210041-40b1-48fa-9cc9-f11bc5c01e3d", "comment": "Malware payload (Mirai)", "value": "9b350fa4e59c1296478c88c8526de8ea412640e50f995dce7982b1be40f3f132", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296445, "uuid": "87a0e014-2666-48b9-ab87-bb5df92f3a76", "comment": "Malware payload (Mirai)", "value": "eb52310f90fbc2ff4dbe3c515a1c46a970d5cfae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788296445, "uuid": "8bd8f8a8-cfc5-4109-8011-636313d67201", "comment": "Malware payload (Mirai)", "value": "a8c1195d33abb3737b80d0a8df5d78cb23fdf208fe16f62d30f853796d7dc38eabe9278986f67112c9b4e80ae2eceea9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788296445, "uuid": "34739f98-ca3e-4808-a374-ab9d1bc3920c", "value": "T1CBC34B01BB81D5B3E14316F512D7CF120431F53B1A6B894AF3693CB6BA69184B326FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788296445, "uuid": "2b6f9a3a-9fdd-43ab-9f42-c03f8173da2f", "value": "3072:mh9m3O3S5ltB4FCwuIPXAb1sPoCQk9YJlbj:mhdS/tBuf+1sPPT9YJlbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788296445, "uuid": "614f9f5e-fac1-411c-a529-c920b24c76ed", "value": 128072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788296445, "uuid": "e54262c1-251c-4418-9b40-23ca0f00264b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788296445, "uuid": "6f6f92e1-a469-4282-b4c2-2d0ede1544fc", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa28d010-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788277451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277451, "uuid": "d34bab7b-d275-4b6e-8ebf-fad2dcbf5f8c", "comment": "Malware payload (Mirai)", "value": "85df2f5be30efccaee089cec2f6f4a66", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277451, "uuid": "690b31dc-84ad-4bf3-9e32-436eea01c51a", "comment": "Malware payload (Mirai)", "value": "9b81c8610579aaf75abc4e0fb27facd5d28d8c653529c2a78836db384dc881cb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277451, "uuid": "375d6711-7482-41e3-832b-4a525b4f1d34", "comment": "Malware payload (Mirai)", "value": "6d3206ce23bad17481223de3253a9596361ac1ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277451, "uuid": "bf3abf64-2eab-4f09-83b4-43528ef4ebec", "comment": "Malware payload (Mirai)", "value": "da226a472870874eeae37d46b4435997ee0058d77cad662f3b56633f852a41f813f7f14a86311b91e7e484667d045246", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277451, "uuid": "0cc2fe9c-470a-4374-9ede-2cb5b2504616", "value": "T170E31A45FC514B27C6C662BBFB4E428D372A1768D3EE720399255F21378B96B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277451, "uuid": "ad00bde5-6375-4745-8773-fe1e01018f9b", "value": "1536:R5YG3OxrjodFP448N68JyYekfmRATRU4Vwilu0h9mjTONuXzFc+0OCF9dqrJN0YZ:R5uxPkaBPmR94zlZh96UuXzCVYl6z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277451, "uuid": "a0640537-5771-4b9e-9aa9-088f068ad246", "value": 150196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277451, "uuid": "97410c47-2bb6-4aa8-b3d6-e669296cc1d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277451, "uuid": "ebe956f8-5d89-42b3-8dc7-ed2896b81fbe", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a8bab3-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788277387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277387, "uuid": "0e98cf36-5a28-495e-bf41-51c6586d62c0", "comment": "Malware payload (ConnectWise)", "value": "2039625891228bb5b0553ea9c9139bef", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277387, "uuid": "3a29cb76-3f51-42be-9751-38d2015858d7", "comment": "Malware payload (ConnectWise)", "value": "9b990729e29eb355bd0d5004b73b0ec8e9a659c5577c1c633604424b0290ab12", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277387, "uuid": "ed18be37-8267-4ae9-a47d-65f555c33abf", "comment": "Malware payload (ConnectWise)", "value": "ecc779aa86b8bd3aeb99cee0b57e6b8aede674f6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277387, "uuid": "43683697-1acf-41b1-94d5-f5039590a10b", "comment": "Malware payload (ConnectWise)", "value": "37b107a1b732cbeee836aed5d8760f8f224ad5e00d1df87c359b9c5742b13dd0ae0fd7f265141b6a2a51d80138473e29", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277387, "uuid": "f6143df7-ed25-44c5-a31d-4f33a34c8fa8", "value": "T1A946F141B3D695B5D0BF0638D87A42666A34BC109712C7EF57A4BD292D33BC08E327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277387, "uuid": "0ed0beed-7784-4a24-9696-15915b607a4f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277387, "uuid": "27e90e11-4b18-43ef-a56d-a51aea18635b", "value": "49152:vfmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:8rs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277387, "uuid": "68cf8663-891b-482e-8dde-418e2a4d9a2c", "value": 5656216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277387, "uuid": "9703adab-319d-4c20-9990-067bf18628f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277387, "uuid": "6b69a6a4-a524-483f-bd94-32f26ad7edbe", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285459d4-a5ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1788258201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258201, "uuid": "d004c18f-28f3-44f8-bb8d-cef8885db72b", "comment": "Malware payload (RustyStealer)", "value": "57cc33704c7c92b7deecb9c0e60cefb1", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258201, "uuid": "0c7fd380-2fdc-49cc-9715-59d850d70d69", "comment": "Malware payload (RustyStealer)", "value": "9bccebc3e8a87a2f36ee478a1ffca49b9f62d99b507ba3979cbcf80edd6b92f8", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258201, "uuid": "bcce31dd-abab-461d-919c-87e186c8d96b", "comment": "Malware payload (RustyStealer)", "value": "bb6b175498c66d275da4ff69a3bb10f5cb04705e", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258201, "uuid": "4a02b8e1-af09-4c54-883b-e7ca318b32a1", "comment": "Malware payload (RustyStealer)", "value": "a83f949c119b1c590203f9326417134900f06414e78ddbf37a3c2f6978ed3171b14803e3a8e7c8e598fa87cc4ff467d1", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788258201, "uuid": "533e2d82-952f-4269-b275-a00f757c6f41", "value": "T179363302B76065F4F457C5349B448A45A63178E29F326AFF07F44A312F52AE29F38B39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788258201, "uuid": "b1414904-0ecc-4bfc-bb5e-423e897233d2", "value": "445b5d7e1f41e6e3b4399900a10bd0e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788258201, "uuid": "9f4c4082-7247-4c40-895c-50a9235f1eb9", "value": "98304:TGNUBxjeNWXE8Lvxx/dluc0ir/B8cvhgOa4q8HbPcqx6QzbNzfwy1K:g2QWU8LvflluN6Bn65ePtt/Nzf91K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788258201, "uuid": "52a92bf3-4fbe-4422-8133-2fde33c2a01a", "value": 5107640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788258201, "uuid": "04c2a48e-ef85-4511-87f7-cf980dc9e0a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788258201, "uuid": "5b2431d8-2883-44e0-a7e5-e4642b27c06e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64080617-a632-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788287078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788287078, "uuid": "b06b6529-4bb5-4b93-bae7-c8eff360afde", "comment": "Malware payload", "value": "8c16245e6a1e867ddd93f7830cb9de7a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788287078, "uuid": "fdadcf12-3302-4cca-83fe-eb746fd72c0c", "comment": "Malware payload", "value": "9bf42d5fd9335f773e6d796ec3f999177c6421374a976c733567b6825896a3e7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788287078, "uuid": "8abd41ab-7475-4ac9-ba0f-8aaa7f5022e6", "comment": "Malware payload", "value": "43c9ca42d1edc85607a8caea059b49e68131abfc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788287078, "uuid": "12204827-6ab0-48b6-b215-0b0921fdfc1c", "comment": "Malware payload", "value": "6b320a3a1ab059d5806d383fcfe93edaa15bd731f337d0d094b7bf0719b725bd851b8ce1363cb175efef5494185bedb3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788287078, "uuid": "6d654fd1-2a51-411e-ad83-efb190fcfb8f", "value": "T1A1573365360005B5E13F07359A67D191C2EBFE381350C594A330BA9F7EB9DC906FA2AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788287078, "uuid": "334f25ab-0705-41c2-a5d6-4e4a94df80c6", "value": "786432:gUKq7EumABFJxtP6vWXUhRfgna4Il0zGaGG:gL8XzDIWefgna9uGaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788287078, "uuid": "80f02015-584c-4cd2-9efe-00ece96e95b8", "value": 28311552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788287078, "uuid": "d5e569ec-7b10-4f73-9c2c-ea5d739e28ab", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788287078, "uuid": "2c178ead-9487-4dd0-ac02-32af3a36f9e2", "value": "\u7f51\u4e91\u901a\u8baf\u5ba2\u6237\u7aef.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d3917b-a614-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788274189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274189, "uuid": "d13b9fb2-dc8c-4aa3-a85e-682c17f27348", "comment": "Malware payload (ConnectWise)", "value": "197ed2bc6ef75a651b97e89f56b19454", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274189, "uuid": "41015e99-46f5-4327-8791-eb69745eacfd", "comment": "Malware payload (ConnectWise)", "value": "9c0bdd1100a65e228418043c7eb4ff435b305d71f4f138d9909c9da2d84e3581", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274189, "uuid": "c81ccd75-f4f9-4f62-8a90-ddd1495445a8", "comment": "Malware payload (ConnectWise)", "value": "6424fc12ebf4c389bee76406a07fa2db2919289f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274189, "uuid": "31a1248b-d149-45bc-8878-82ab7a2d404d", "comment": "Malware payload (ConnectWise)", "value": "3537943bc87125f521a0cceea4d88218c6fef7cd1e17c8b4daa9e62505155ce0737a3c88bd71c965e342a3814f5af9f6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274189, "uuid": "4ea0367d-7c08-4117-a1e2-17202db86ffb", "value": "T17F46E111B3D995B9D4BF063CD87A82A99A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274189, "uuid": "965f7e03-b616-442e-96ba-4f3b3e1aadc5", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274189, "uuid": "bd5a53a7-e44d-4df1-be7c-69697200df00", "value": "49152:0EEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:9Es6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788274189, "uuid": "7c72b459-23bd-48da-a37f-05dacdd4d57a", "value": 5622112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788274189, "uuid": "d594bcca-3fa3-40ae-90b0-9f48560c7aa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274189, "uuid": "c1432353-7f6b-4141-b50f-ca38dfdbe801", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55efa5cf-a608-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788269015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269015, "uuid": "9212004c-5475-43a1-a5be-118f2022c2a9", "comment": "Malware payload", "value": "964ea7de1ba6a4742446da46e0093269", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269015, "uuid": "3dcd99f5-8086-41bf-861d-b970fc19a112", "comment": "Malware payload", "value": "9cc0d76c4bcc01397c73ecd8dc86fed8573dccb019e90be670fad822aaa48eb1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269015, "uuid": "810d74a2-ed0d-4d43-9d71-1a1dafa9d30f", "comment": "Malware payload", "value": "ac3099aefc4eec0f9ded45e73dc99277e60ac777", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269015, "uuid": "3db7de8a-a3dc-4d0c-bd94-1630e18eb808", "comment": "Malware payload", "value": "30037b85f8337ffff531afa908748afed6a6611f5cded9a0c830854bb17df8d4bdb20f7c4d9a2241eb8d4c9c900aa2f1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269015, "uuid": "d881f015-f403-4234-bf52-2dc3f27b59df", "value": "T1B2F05C4184A04D19527416142EC0FA055A9AEB8753496D4872AB50B90FC47C1CECF4BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269015, "uuid": "53d29c9c-cce9-4292-bd18-56b3a4e62734", "value": "12:qTp0JYyg9193R5qsPW4rVofW7dqAEd2QL:0p0JYt9v3RvPW4rVofQ7E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788269015, "uuid": "760a4161-78c7-4157-bf36-0fa15bcd2199", "value": 446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788269015, "uuid": "4c34f726-3a57-4f1f-a262-7b6e39fb45af", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269015, "uuid": "23ca8cf7-1b75-4684-9030-4563be5d5598", "value": "goodthingsforbestpersonforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9598752-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788277450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277450, "uuid": "f40db4cf-57b7-4604-8633-2f552bc4b309", "comment": "Malware payload (Mirai)", "value": "8c6dd2b4f5122dadee94b2f48d5592eb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277450, "uuid": "2cee8391-8328-45b8-8d4c-8dad104fb4ff", "comment": "Malware payload (Mirai)", "value": "9d73fc3ab23895bb1cd231c1397db384c4021930f069c56b78c7cee0eda303db", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277450, "uuid": "b06b4235-da55-414e-84b7-809cffbb3841", "comment": "Malware payload (Mirai)", "value": "6f5b5b51a16e2eb398d7e1a56eeb83b5a02db775", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277450, "uuid": "abf06f1c-8df2-449d-ab79-d78335451aea", "comment": "Malware payload (Mirai)", "value": "af1ae3e7db2673bc50e500d5ae27ce851604d7d4a83bb1797d3015f6896177edb86a6ebe09932f1e6417d694f1bac767", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277450, "uuid": "13a79881-ea93-42e4-b1d9-755a1e4b7f80", "value": "T1BE14A81E2E228F7DF268873047F78A25976D23D627E1D684D2ACC1145F6039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277450, "uuid": "f163b844-c5e6-4007-a307-11e026771e88", "value": "3072:H1RhruUqK7B9sWF+oEpEZxPeYqpNmtpAd0:H1Rhr57lAEZYYqatQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277450, "uuid": "9d4656c9-7e27-4f7b-93da-3734a239cba7", "value": 194680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277450, "uuid": "51d1a57e-e973-4cca-816c-c9a716e0ed56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277450, "uuid": "0fe5a6ba-7d6e-452d-848b-c55c61e060e5", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9808f0d-a64b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788298012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788298012, "uuid": "bceac644-e032-4148-9116-e7c858643ca4", "comment": "Malware payload", "value": "94d965bff0f1ae361f128206885b3b2a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788298012, "uuid": "3c03a0fe-7235-4097-ad48-d6166e9a4eb7", "comment": "Malware payload", "value": "9d78d3425f030dc288aa4836fcd8506008365233ce3345d3724bf598bede6228", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788298012, "uuid": "2a2538e7-5cfa-409b-8c3a-a8f95a86842e", "comment": "Malware payload", "value": "4bea1beed74037ab241d8c3f66afc503fb7b8e83", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788298012, "uuid": "e925ba7d-bf9d-4ce7-9196-5b6f5d8cf4c8", "comment": "Malware payload", "value": "ed00f23a8a68d850a3208e3f2b6254c1c229deaf487586252dc03083c399159ae37c99a01a026249fc792d4c4fa5276e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788298012, "uuid": "f00688ce-61ef-4d95-97e5-493c716d394f", "value": "T1EBC27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3CB19C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788298012, "uuid": "95387270-ab8f-45ea-8981-4c49fc795b72", "value": "768:RG8vCB+25j6es8Rh09FYpMSUpi+20qUpi+20YQX:RG8l25JhSd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788298012, "uuid": "c5a262c3-6217-497a-84e8-c9dddc4b9c4e", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788298012, "uuid": "8f419ad5-f39c-467d-b2f2-b61c701d4d4e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788298012, "uuid": "7127c054-3257-4a52-8aca-fe65969c9dc5", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06213497-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1788243541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243541, "uuid": "8c4f2e0c-0ad8-4f03-87ed-5bd592ad101c", "comment": "Malware payload (Formbook)", "value": "0bf6ba27f5f4bcb92b84f1b7f15c6f03", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243541, "uuid": "6c864097-66c2-4861-831e-e85af4159219", "comment": "Malware payload (Formbook)", "value": "9ebfd6e5ceffe8c53d9d315d4643b1a664b76f3543cd6e9b7a0555cb665e1395", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243541, "uuid": "bad2c2c2-2cc0-470f-b2b1-033404231d11", "comment": "Malware payload (Formbook)", "value": "ee2fca67dce89ddd9b5e60ed40f1109f06e51d49", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243541, "uuid": "b93ab96f-84e2-40e1-b0c1-90d1d0c68bb8", "comment": "Malware payload (Formbook)", "value": "4ae483e1fd43a28ceb6688ee014c1c6b4fb859ac2d8704b0996c7658a7c50e129ad5187c0145a4f870ebead9e9f66877", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243541, "uuid": "832e7a0d-f8b6-4848-8fee-c86bce873398", "value": "T168E301258E35BEE08BB9B2681942FD4711F40EE36F317049CB1699E631A4F75AF7620C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243541, "uuid": "dddfb24c-61ec-454a-bb58-e6a773863870", "value": "3072:MBuuSq4RagxGq1y6BuGWoZq5/tzNFEf+es7kY:MBuW4RRxGRK8oU/tzNFQ+NkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243541, "uuid": "2eca3df1-89c8-4e85-9202-520ab649e56c", "value": 145481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243541, "uuid": "2ccecbba-b3df-4b01-a0ba-508e1f6a6091", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243541, "uuid": "35774b21-0892-4038-804d-826831064b98", "value": "Remittance_Advice.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1932f66-a63a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788290724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290724, "uuid": "b2eb1f8f-9d38-4e91-95b6-e8637db73d7e", "comment": "Malware payload", "value": "2ca2f30c961ddb2f2c462ee267dccbb2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290724, "uuid": "eb66c52a-668e-479c-8cbe-b9eeb1e05a38", "comment": "Malware payload", "value": "9ecda8119716ad4a113788fc50589e068f078be02423b6b0859fc5f1f29d5cda", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290724, "uuid": "b54f45c4-8d4a-4e46-bbfe-4b123efc1f0e", "comment": "Malware payload", "value": "a43292190bc541927f0dd55d7f45348b99b48920", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290724, "uuid": "04b1ad9c-89e4-44d0-9b18-4ea543d72273", "comment": "Malware payload", "value": "c835817b3f3facf71a85ed8765cf63a0cceb3c00f824c1f3005da72e690983356bc75f79e8ad8719a24ef3dc31157a0f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290724, "uuid": "6b973e23-3c5d-47ca-a7cb-f65546c9dc5a", "value": "T19127236EFB8095ABF8BA863749B18771E5074DA64F4382C72815733C68731E44F16EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290724, "uuid": "4f4becef-b886-4435-a2f9-a83eb374d40b", "value": "393216:TKxXQ8VfFRCoQ2o2zF+RimUk9gmdXCbCC7+s9wStgOE+xJ:TKxXHVjCodlk9/+CkGTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788290724, "uuid": "aea0e5ba-7857-454f-bb68-9b272e654852", "value": 20901009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788290724, "uuid": "827a01ac-6a41-4a03-82fd-9bf136791f73", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290724, "uuid": "f9ee3763-0b3b-447c-a988-c9ecbfa148f6", "value": "Tiktok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d1ee7d-a5f9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1788262656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788262656, "uuid": "5e9d98d1-d2ec-4142-bc2f-7c80c9ab5e70", "comment": "Malware payload (RemusStealer)", "value": "db679fa6f7c2a5d8d1ef42e8b7be946e", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788262656, "uuid": "2905e5dd-5f62-4d3e-bf8b-541ac092dee0", "comment": "Malware payload (RemusStealer)", "value": "9ef65179f70432f0a665ac922a6b78c494997128df69ac8da1b72bde28050bb4", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788262656, "uuid": "27630594-cd36-450a-992e-e90024eb5799", "comment": "Malware payload (RemusStealer)", "value": "19dab20d880984ab6ecac5f57a98d92e3e08a1f9", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788262656, "uuid": "4496ceb7-a228-4da2-a237-397b8a6bed1b", "comment": "Malware payload (RemusStealer)", "value": "954b091af407928250f62975f33e8b71833b6be0cceb0ce3ed41c1740020a75110d554502fb561b243e9837907a22bbd", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788262656, "uuid": "8e6d6158-17d0-4f2e-9a85-afae86edda37", "value": "T1CD648D15F7A914F9EA77923CC9524506EA727C524760DACF03A00AAA3F237E09E3F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788262656, "uuid": "eed4cdf8-0e4e-4c8a-8b02-c3f32304bb00", "value": "60420083cbef850f46902f930a3679de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788262656, "uuid": "273c7d79-b59c-462c-8438-9014216c9a0e", "value": "3072:zuAxjQBELkLjkdRcnU6s1OB/N8MdRsr5xBP5LKDmVb9CeNHsjHvUMKMeTHHHOFKI:zrxoc1u18aClHgSjaIH/5C/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788262656, "uuid": "c54ee938-7ea9-4799-88a4-5620f36a23ae", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788262656, "uuid": "90594ede-9ad5-45f8-b66b-b83ebb4b7b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788262656, "uuid": "3745302c-eb9f-4a70-8cca-0f5670a3c60e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a851e6-a656-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788302468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788302468, "uuid": "2140d1c2-66b6-4ff9-b407-558ae03662b3", "comment": "Malware payload (Mirai)", "value": "59f06b656afad5b8ac0a2f8321dbf839", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788302468, "uuid": "8fc0e2d2-b375-48b1-8e37-3d6cb096c086", "comment": "Malware payload (Mirai)", "value": "9f55da59b17b2279c84367b88a25db30de0727ccfccc11535057fb9bcc89d194", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788302468, "uuid": "5bc8cb3b-d2b5-416a-b4d9-ead57961e889", "comment": "Malware payload (Mirai)", "value": "187940c8b3e73180a2227a96ed9bcd47e0b083ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788302468, "uuid": "598deddd-8b6e-418c-ac27-07b9d574643e", "comment": "Malware payload (Mirai)", "value": "ad77cdb66597aff5eae6727aaa392a49c6062e42facc2b46d51e801bb100587076e84659e1e524d9bd68df5ec6e3cac7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788302468, "uuid": "006b2a29-812d-48b1-9cd0-730c9a43af9f", "value": "T18F141D6AAB615FB7EC1ECE3702DA0512114C965D12EA1F6FB674C828E38BD4F48E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788302468, "uuid": "110980ff-5f38-4843-96a7-96c8787956b4", "value": "3072:ilhxUM6B7IzVH0+FWF5vKIlgdW9sm+E4jS0Nd+r8J:iDxT6KzVHVI5vKIVsmB4jS0Nd+r8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788302468, "uuid": "3059ba17-0f0e-497b-8ff1-71be480435dc", "value": 203872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788302468, "uuid": "82c1e8d0-2453-4bdc-a4c0-9c726ddabe02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788302468, "uuid": "b984423e-091b-4680-a266-c958bbd029ff", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8418672-a606-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788268348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788268348, "uuid": "a944a130-7aa6-4149-a93d-6db806ea704f", "comment": "Malware payload (Mirai)", "value": "c8b95b36b51a8f01f323a96845460044", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788268348, "uuid": "058a6ad9-1175-4785-94be-e13b762b1d41", "comment": "Malware payload (Mirai)", "value": "9f9377b0c5943b6b4e67ca8d9f8fb8f25fe8a9cd08917e9cf749fbd8813f5ad0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788268348, "uuid": "b21027de-1cda-47e6-83d9-7ce37a43198c", "comment": "Malware payload (Mirai)", "value": "dfb6aee7d425c8d6b443ef27d07d83457130eeba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788268348, "uuid": "dfe1fc7f-85db-416e-bcf4-16c5bd7c311d", "comment": "Malware payload (Mirai)", "value": "fb5a79890cde9a6e8c447e0b0fd4131195b169db402ada1c953304855d624778f26fe9faea2d9105547dbf250ad0268d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788268348, "uuid": "4bfccfa7-a55e-4335-9a9c-ab21467e5988", "value": "T16B53016B97536C50D26A063B37644E0749CF2A7CB46EF5252E310F79FAB214B236C21B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788268348, "uuid": "66422fe1-2173-4ac6-a0f4-b3ac7de4f10a", "value": "1536:nDLITez4LI0PZFZ2gE7UGpjL6qXYBLGe51IQTuxKA:nDkTsspZFZ2gOUG2qwLj1zSxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788268348, "uuid": "201252c9-1e1f-44d9-853a-b8a1be454574", "value": 62516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788268348, "uuid": "6c584f8f-3f9a-465d-8ae8-a634eb37e9ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788268348, "uuid": "9a08a601-0aca-45de-8c61-7a62bb4b6218", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1dd61ea-a65d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788305730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788305730, "uuid": "dd83c893-3229-44d8-ab6a-54ffb3dadc97", "comment": "Malware payload", "value": "91fdcaabfc774a9026bdc39bd3d2f69d", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788305730, "uuid": "c0625173-1ce9-4430-818b-e212eb01a58a", "comment": "Malware payload", "value": "a0df2239d79f25e184bc5f6eefa7130bd01d8a5dc59b7ffbfb84c7b676c2a2e1", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788305730, "uuid": "d27ec2e6-156b-4b4c-9d09-395e9b0c5052", "comment": "Malware payload", "value": "411959d76bd7b01504a95517f98bb76b06275cf4", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788305730, "uuid": "0a4288f3-fde6-4012-8382-9ea490b0a9f0", "comment": "Malware payload", "value": "74bb5d68231022421634fe0e9d875bcd140e59e3c20fc63a27a6554a4c77d41f154f66c042e7fe7c5cf4d63b34619ec9", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788305730, "uuid": "26f7e036-6afb-4629-b8c8-9fd9e28bf9f3", "value": "T146964947EC6549E8C1A9D23486329162BB71BC485B3123D72BA0F7782F77BD06EB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788305730, "uuid": "3ebe3161-960d-48ae-8596-15adc1c9e62b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788305730, "uuid": "5a33434b-b7f2-4341-912f-01a95a40b736", "value": "98304:rvNBqOiYI72kEdNMyCuiozJ7d+ryklsdoEn:r1BSYI73EdN/BdJ+ryklkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788305730, "uuid": "e1c63269-7e98-43cc-a187-a847deecf811", "value": 8768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788305730, "uuid": "b56472b7-0a49-4a7c-8520-a2fbf2a47e17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788305730, "uuid": "8970a740-e25b-4b8d-98b1-d9b4cba9b3bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bdd5bb-a628-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788282648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282648, "uuid": "60a694aa-4f53-46cd-9b11-2a8b20f5f29e", "comment": "Malware payload (ConnectWise)", "value": "e1c72b55cff7273081c3d672f5f1cacd", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282648, "uuid": "71d9f47f-0238-4172-9257-9128c982ea99", "comment": "Malware payload (ConnectWise)", "value": "a107ca6f200ff774013557aec838a976d9425b1faabd65d8289e2ab71f648c3c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282648, "uuid": "cac3e336-788a-4b30-acfd-1cbaf4f76f21", "comment": "Malware payload (ConnectWise)", "value": "538ffcd09c1f1b1bdbd3351acf560e2a2208635b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282648, "uuid": "4cbd8da1-255b-4942-9712-0066667dbe33", "comment": "Malware payload (ConnectWise)", "value": "1c2e581195cbda2bcffbc825fbe31800f56a317bcb29c218e36d27c7c180dbe007fc5db9dd71f97387bb9262867f6937", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282648, "uuid": "e78aecd7-7286-496e-b284-d030c1b3e6f4", "value": "T16046E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282648, "uuid": "283fff1e-2d7f-4aab-a5c1-ff237c71b441", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282648, "uuid": "f694482e-fa30-4f2d-b461-bd0546f1fb1d", "value": "98304:szIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:shfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788282648, "uuid": "23809606-badb-4bd0-8724-5ae8db555930", "value": 5644152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788282648, "uuid": "f45a7abf-6daa-43ea-a0b7-da0de4989d96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282648, "uuid": "1de0cce2-f206-498e-a208-6038ea477dff", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7279f6f6-a5fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1788263050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788263050, "uuid": "846679ab-9daa-4ae8-89f8-da8c11e52141", "comment": "Malware payload (Stealc)", "value": "fbcdc675ffc69cace3615ba1261763a9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788263050, "uuid": "11bfebd5-f3c7-4414-bb1d-cb6ae5de112c", "comment": "Malware payload (Stealc)", "value": "a3b92ad72cd1a4b1be8718057d90026d2c0b07d04c8b8ae8ab8ab2b6c29fd895", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788263050, "uuid": "99662178-0388-4f56-9721-1fa52bfb04dc", "comment": "Malware payload (Stealc)", "value": "fcb64ae6a0ec8a25d91461cbd7d1921e26005bfd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788263050, "uuid": "73b1aabe-d080-44f7-b06e-c932d0763d4f", "comment": "Malware payload (Stealc)", "value": "61e4afe6013d4ab065ffb49ac4f2695a45795f25a3310852c95578b161630465226871bad0be645e58fdd9366cb1722a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788263050, "uuid": "f27b1d07-d0df-47b4-89b6-82abbecd61e5", "value": "T14EA523871AD448DBE83127358AF1E3825A22BC51677ACD6F6019BE4F3F632D93132752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788263050, "uuid": "e149c6bb-0a56-422e-be89-97c0de2c688f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788263050, "uuid": "415b69d6-dfdb-4b5a-a53d-1c218cb11f6a", "value": "49152:rJ35ajEmTTEQ+5s86ex7yQJy59SYiz9Yv:XaomTTLnVeJBZxYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788263050, "uuid": "ad80c69c-bb24-4f1a-9a63-c14a61a169d3", "value": 2145280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788263050, "uuid": "ea171862-29ce-41b2-aa37-34c8a20bab93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788263050, "uuid": "08d57361-4915-4fe7-91a1-ef2499e7eef0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c097ff87-a64f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788299688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299688, "uuid": "642151db-f6ad-4f2c-ad2a-645837d954ab", "comment": "Malware payload (Mirai)", "value": "386307fb503ad57bc5440055e0a86428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299688, "uuid": "e59bf150-9653-4361-82ee-be83f6684097", "comment": "Malware payload (Mirai)", "value": "a52f1911e4a5f078d789fab74a0b727d05a8ac4fb670a33c9d8bcf387bf5b33c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299688, "uuid": "8208beb4-0089-48c7-8b5f-5db58855e5c6", "comment": "Malware payload (Mirai)", "value": "a6f3554cfbd0dd7a172041d74f02341f5b6b36c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299688, "uuid": "a5ef000e-d3f7-4343-a5cd-2761ed5adff5", "comment": "Malware payload (Mirai)", "value": "e690e761bceb47b98c19f4e8ee61e5b0046a3508274675e9b2c6e44e13b679b989063a9a7194f9713ab8cf41815f37a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299688, "uuid": "60c5428f-2c80-4829-b862-f679668d9e5d", "value": "T16DE31893FC01EEBAF40BD63A49C70A297734EB564B43162673177967A9361C12C23F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299688, "uuid": "7925d5cd-cafc-40e7-ad47-f0f439b96b38", "value": "3072:3XLxT01DMJtpLUX+Flo78j6l3BaVm/unN8ufPE2wKflGJ:nmMJtlUuq46lRatnN8ufPE2wKflGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788299688, "uuid": "54405a18-4cae-4944-83e9-8b60f64e64e8", "value": 150876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788299688, "uuid": "c63a726a-d009-4aed-82ba-d84d2cc03a04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299688, "uuid": "690eaf8c-12bb-4175-bf9e-3262cfee98c5", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bc26d7-a5db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788249872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249872, "uuid": "27be244b-2314-41d6-9714-26bbb32801ab", "comment": "Malware payload (Mirai)", "value": "81f2836539b20cd25cafb08fd237663c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249872, "uuid": "b4c8c4d2-a8f9-4a5a-8860-57313b05b9af", "comment": "Malware payload (Mirai)", "value": "a6e01966f86d7bd03d8b68552ca8051cc3c5e541480ecbf243e6943c99c2b752", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249872, "uuid": "01efea70-c26f-46c7-8ed3-5f0c40dfe232", "comment": "Malware payload (Mirai)", "value": "cd898abc71b3540ae0fb26514432b8cd07196f08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249872, "uuid": "1578b08d-fff5-4fb3-92d6-4772ca502b71", "comment": "Malware payload (Mirai)", "value": "a73fc965c45b9cd47985a34d4406513c7069930550d1952c174016a901416f4f56999d4aae0ca9b6e3e650625411a5e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249872, "uuid": "253f3916-6a5c-40de-b4f4-293569dd0987", "value": "T14FA317917CF3A156C3C3963FFB4F920933126297C3CD7522F91D5A642FCA11A86B6981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249872, "uuid": "fdce7dc1-3372-40d0-beb3-1711647550dc", "value": "3072:MD4ph8XtaBv7gj8Q/wP+pIkw1DzcJ1EssMZc/T03ImIys61X2h5o:MMph8XtaBv7gjB/wmpxmzcEssMOjh5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788249872, "uuid": "b35ef0d6-8f48-4b70-8d19-9d07f8db5c0d", "value": 101812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788249872, "uuid": "6d2eccba-6d8d-4660-a95b-04f50f96a582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249872, "uuid": "64093e49-563c-4b75-b051-08eb71de5115", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5240b89a-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788243669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243669, "uuid": "150f9c5a-031c-4113-979c-6b883962169f", "comment": "Malware payload", "value": "75e14f33a2f16d0c270361ce88161074", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243669, "uuid": "4b4380d6-bd19-47b0-85d4-ab9d70426340", "comment": "Malware payload", "value": "a732d13931542877b1cd313043418cabe9871f2705b652fe738bdf9daf168d11", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243669, "uuid": "89b028ba-b2a7-4b17-8279-f96cb1a0cdcb", "comment": "Malware payload", "value": "df3a52ad50b4d82692052d6db2533dcf1fcb0477", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243669, "uuid": "259f34b1-9f93-44bb-9a19-f0f4a363208e", "comment": "Malware payload", "value": "7d5647c384c107c6f96bb347606234e287317d30097c6b5f2d59d2b4effbcbc35f6b56cd060f1e78b97a2206beadfd7d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243669, "uuid": "c7c57e90-f800-4b02-b6b7-42c496dae103", "value": "T1C1775115CB1F96DFFED04882607D61020997F45BCBFDAA43339516EA0D2D580ABAAF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243669, "uuid": "aebf2f8b-ca92-4a1f-9650-80956ff1d94a", "value": "3072:OnPwiqQ9+06kEmR9UbBQBhddZKrL260ey9cl0Dxt0ZlycB/9KLr/lgXjA3H6NU4D:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243669, "uuid": "af4c9790-a5e0-478d-9049-a31ec1b6e70e", "value": 34125284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243669, "uuid": "9ec5d1be-d6dc-45b9-acb3-26e600601220", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243669, "uuid": "54bb142b-490e-457a-ac13-42b52f8106a8", "value": "PO 240390.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012a151d-a617-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788275315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275315, "uuid": "9196419a-67ba-47cb-9f73-14284b3ba42a", "comment": "Malware payload", "value": "e545b7351e2dd38458e3d858c7d97f05", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275315, "uuid": "dd913e58-57a5-4b23-9a6f-fa61e7cd0b9f", "comment": "Malware payload", "value": "a80a119a3eae1cc0eb0a310f0f54c33b632a2a3501788bdb362f3e3b9c0b14ef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275315, "uuid": "3e01df23-52d3-4daa-9c5d-13eadd17fceb", "comment": "Malware payload", "value": "82298e50da9c2aaaa9576278dfde506d2e893bbd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275315, "uuid": "a5faaaf4-1007-4e74-90c4-fa5b7682a653", "comment": "Malware payload", "value": "d323b1cbe09ba33eccc9253813143ec5321e2cb4a917ffcd140f694a89f440adddc7e4524c5b7c1f1fd9490ead8d45ec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788275315, "uuid": "dfac51db-a8bb-4369-b8d7-828698134cbe", "value": "T1EAC27C956A867C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788275315, "uuid": "149ad9de-c16d-45b9-97cc-f7c96b03de4f", "value": "768:M2q8vCB+25j6es8Rz9FYpMSUpi+20qUpi+20YQX:ML8l25J1d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788275315, "uuid": "e51bc037-dcf8-4fe4-921b-65ac9c2b7709", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788275315, "uuid": "098c3b33-ec3e-4430-a7b9-2190367306c0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788275315, "uuid": "7d4540b0-ee41-4608-8240-792b50d06406", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75711b0d-a621-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788279805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279805, "uuid": "d5208062-cf33-4021-909d-6414fb7a0cd8", "comment": "Malware payload (Mirai)", "value": "5116812ebf7d518f7776a1500a26296c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279805, "uuid": "50656ba6-9bea-4735-a5b4-85fa8fb577d3", "comment": "Malware payload (Mirai)", "value": "a8cf4abd8656d72f7cdadd488f26a316b0beea80b2e53831b87630aa72da5ac6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279805, "uuid": "13a98cc8-0850-48ae-882e-2a554ba5238b", "comment": "Malware payload (Mirai)", "value": "e1339b954ec669e2c6dd58c3d641a5b9b3274452", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279805, "uuid": "155ec438-5c9c-4b39-84bd-4e7e39da0f35", "comment": "Malware payload (Mirai)", "value": "54fa05e7992a5dc1fe4681809e76b29d17164189cfd5786a700ccbb3c70620f2f81a84ed52f8b1dac2d2171dab52ddc6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279805, "uuid": "bb48c1e3-ac08-4857-975d-cc0d3e066405", "value": "T18604084AF842CE51F58015F9FB4D83C83F1313EBC2FA74029D195BB46B97A5A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279805, "uuid": "356482c8-5a2a-4dd8-a660-531da30bfbfa", "value": "3072:V9IIVb9zYPPNddBSBTmNpsAzxkvL8b3fs+7hIj4G10fuk7j8RAwFUqM:V9IIh9z8PNddBSBaNaKIj4PfDj82wFU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788279805, "uuid": "0c3202a5-1535-42e6-a9d7-02fa8a493e0d", "value": 190088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788279805, "uuid": "362f0f7d-407b-4328-b194-939521ff531b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279805, "uuid": "66652f4b-f550-477a-8c1a-dd586721277b", "value": "kushnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a959ab11-a635-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788288482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788288482, "uuid": "1ab658a3-0919-4ce4-add3-bdb599bab072", "comment": "Malware payload (Mirai)", "value": "281e13d1303356e0a87041fc19854ae9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788288482, "uuid": "0bb3a67e-6567-4908-ad74-ad6c0d512d3d", "comment": "Malware payload (Mirai)", "value": "a9f09a07b91e48105ed9ea1a02596e2b6d049f37587a06e8e77346fe4faf68af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788288482, "uuid": "10b2f70a-a7d9-4b75-9d45-2a691f7b8438", "comment": "Malware payload (Mirai)", "value": "7d87f34d7cbc7a4562307f97f54d3e148dd9bb56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788288482, "uuid": "3e260fa6-5cec-4f4f-89e0-e869ffe4eb82", "comment": "Malware payload (Mirai)", "value": "fad103541a3aa17c4660de6558ccc0ec9e215c5e062e6c593d01247c127e444a8a63f26f63aedcf923076ab9b5621def", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788288482, "uuid": "ac20362b-7669-44f0-aebc-784998da9ed0", "value": "T152E31397CB9912FBC09367784A611B502D560FC49C02E0061DCAF3E64A7B2FA78C97E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788288482, "uuid": "e440cb5f-e1b6-4b1d-be80-ae7e17d32042", "value": "3072:1olj1/wvBzIHbR/WeoIREFYEOaWCeoNSgGnwjWn4WboDDVWGoPuB0cI0VF:1imUVPEJO7CeyLHOGXIGoPVcIqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788288482, "uuid": "cc08ce29-e8d1-4dda-a3cd-7c1a0b246716", "value": 147764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788288482, "uuid": "52919cf9-0ec5-4178-a3a5-6208f66ce696", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788288482, "uuid": "69120abf-596d-4a67-bf41-43db35fb4bfd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173285b9-a622-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788280077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280077, "uuid": "61d70114-6c03-4ecb-9390-5b670ae3d960", "comment": "Malware payload", "value": "53fb45b1a78f7f4e06917a7133b6ce9f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280077, "uuid": "bf20b688-e776-427e-baa6-9f2298b92cf1", "comment": "Malware payload", "value": "aace810f71a318ff0bfa589a0b607b7327a20806477957cdf93c6ecf3700e729", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280077, "uuid": "8670c0f0-79ec-4b13-b9ce-25b21654858a", "comment": "Malware payload", "value": "1fbdae4b7117315794b319582b8093230fbddb9d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280077, "uuid": "2e3acb44-87ad-4b99-ac2f-4c1c0ec72ef2", "comment": "Malware payload", "value": "24a5de790dce9b55d422b2862cc34c112d9996b65319e41cd7bb7bfc8f5ffc0fb84386ea4c9a82c89c15f1b1fa4bc3cb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280077, "uuid": "450cf704-1647-4219-b51c-9c993933279a", "value": "T1E1873B43F8921DE4D4EAC571D126815BBAB23C291B3C23DB1AA1F7301F3ABD06A76751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280077, "uuid": "65503a42-6743-4b43-8e45-9fe361b29291", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280077, "uuid": "1fed630f-0813-4f82-8ded-62969875ad5f", "value": "393216:GEYYAt/E7ssNDbSz4Kog8CMEJZnTqtLR:GEfAtJsNDy4KomJZnTeLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788280077, "uuid": "a2b87eb9-6c9c-4b28-8340-2b5d7e0ce3d0", "value": 36746240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788280077, "uuid": "9e781e84-1683-4039-8eb3-ebe4742a88d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280077, "uuid": "1d610c45-9843-4631-921c-ee24e310d5e9", "value": "185.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0c07f4-a619-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788276459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276459, "uuid": "b3e4d965-2785-48ea-bd68-2564a11801f0", "comment": "Malware payload (ConnectWise)", "value": "34f5320ea74055f3db0ce0a88ad95da2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276459, "uuid": "668b1964-3b80-42ec-a9d9-221f242b41e8", "comment": "Malware payload (ConnectWise)", "value": "ab60f3ec1be09c16aa13f171c153f75a032557a33877470784b540bd04cbcb52", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276459, "uuid": "62ce142a-de5e-476b-882d-77675718372f", "comment": "Malware payload (ConnectWise)", "value": "5a42efcf2bb1b824e4375d2ec9c3db63781ca74a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276459, "uuid": "fb1c2b74-6dc0-471c-87b1-f231a9254e25", "comment": "Malware payload (ConnectWise)", "value": "d41c019f918b6be996c7882cb035bc3a9b6b2d2af1bb29e9dc387c652b7eb11071d1260b099533a47cf28ee68f860f57", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276459, "uuid": "66c1432d-78ea-4a48-aadd-a77ee02f8d22", "value": "T1F5646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276459, "uuid": "9ac90a1c-bf57-4e53-a685-d7dae4f3f746", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276459, "uuid": "6ac156fa-f2b6-4887-8e80-cb68844a0926", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:p1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788276459, "uuid": "543c3b6e-e224-4752-8101-7f39b784f7d7", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788276459, "uuid": "cc3409eb-d2e6-46a6-a302-3774b0009997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276459, "uuid": "a1e81a3b-f17a-4b6e-a6bc-c596593dbdbd", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d497b14-a621-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788279819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279819, "uuid": "544bbab3-1117-48c6-aae2-a9bf1f018ef2", "comment": "Malware payload (Mirai)", "value": "a924449d4745f578e5b0d070b60c63fb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279819, "uuid": "5a482d32-3969-4cf1-a8ca-3305914e9044", "comment": "Malware payload (Mirai)", "value": "ac16f91590f8aaee12a19b19afb9f490779d7307fcb3c6a34a3844f34f4584cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279819, "uuid": "98b7c5e1-0922-4e96-9958-9175a85fdd4e", "comment": "Malware payload (Mirai)", "value": "45bc9b72f7f2db36438a6f2902c297812a9fc789", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279819, "uuid": "60280dc0-7e4a-445e-9a9d-b70f0504a6db", "comment": "Malware payload (Mirai)", "value": "35c2d070b48f089c2769006ca4c739e5a8ba2bcdfacf2bf09711fd1521061ac80c6cf3e7b5c9712ef33167dbd174d82d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279819, "uuid": "3495317a-0311-4127-a109-b137633f53be", "value": "T1E6256C2AB2B3B17CD007C03447DBCAA25531B07525327D7F26C59A353EA6DE12369B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279819, "uuid": "fd1f2622-96cf-4f58-913e-e231d409e8a9", "value": "12288:C5VojM+pNgQ8NSgGOMDsHdTHZxC0Va2oWdh+NDjc0S3KmKmVXrhC81BayckFt/1E:C5V4M+pNgtSnOMDQVFoIQtcuEXrhC8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788279819, "uuid": "cbbe500a-124b-4410-8911-7dfdd7ffa876", "value": 1038656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788279819, "uuid": "2a2b44d8-e8a2-4d08-adfe-51702ce6a6fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279819, "uuid": "07e95981-9b42-4294-93ca-532ada33a288", "value": "kushnet.x64-test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4497bf1e-a64b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788297762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297762, "uuid": "91e7060a-67ed-4ba0-9ff4-1d9f5084a82a", "comment": "Malware payload (Mirai)", "value": "7e5d50c9837262148cb6add193727ff9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297762, "uuid": "afea518a-7eec-4af2-9e69-0458bd8a653e", "comment": "Malware payload (Mirai)", "value": "ac7942ba8d1d88a14a6d70d975fce9c88b82c159dae4636101727584832360c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297762, "uuid": "ae348a60-9d4d-48a2-8ec0-c772c6aa9a42", "comment": "Malware payload (Mirai)", "value": "a19c085ba7f1c48c59dd24e6365c309337772d85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297762, "uuid": "c342be5b-237d-4f82-bc14-3ed4ba4c723d", "comment": "Malware payload (Mirai)", "value": "2bf49570974c7b057ce3dff0877de1b7710632be1656598e535be5623364b14f9c65e33991e8740aea708452cc6562da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297762, "uuid": "e67c62c8-b5ca-459d-a364-bcfb58f33140", "value": "T1B3E312CC49A49697CAF55230A8DC127FCB097951AA69C35DA3A8CFC4E711703B4EC2EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297762, "uuid": "8ba3d28f-8ef1-4166-97f4-8c8d31a253b8", "value": "3072:aEv0oEdx4Mos3hkPBaKBVmCae3xrb9RCoxqvdttw5FLk4VlXBFtfx5BVrcemLH1a:a4MLipaKBYCaixrbPdYwC4zRF5bbka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788297762, "uuid": "c306619d-01eb-4a80-8b60-0ee125b877a3", "value": 149776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788297762, "uuid": "42a94daf-0111-49a7-bff3-c5892a88daee", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297762, "uuid": "e10762f1-c308-4833-baf5-44e8ad670372", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb6a162-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1788243577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243577, "uuid": "2075b621-515d-46d9-9ccd-e985d73b6bb6", "comment": "Malware payload (Formbook)", "value": "e3588eea4c91251891eb52ce99489c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243577, "uuid": "e603f9ab-fa50-444a-a6f2-832de33f390f", "comment": "Malware payload (Formbook)", "value": "ae8a1e6cd66929b78a7f4b98911d04650346cefc046eb60f2bfc85eba95686f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243577, "uuid": "f0705693-bf92-428f-a6f4-04fde6949af6", "comment": "Malware payload (Formbook)", "value": "e94464c2c8cd298ab5288de6206f0cd2f9482b90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243577, "uuid": "300e2ba2-2b7d-43f1-9c7f-b0d024143015", "comment": "Malware payload (Formbook)", "value": "275d300c08e89209535c4bca317980f46785c7b09c80545af96cc58f7cb308a8cdfe08d537fff5bbc3695b49b34f33fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243577, "uuid": "bb275fcd-1f03-447d-9340-e9c6cf5ee004", "value": "T12F350254238DD906C6A74BF00D70D3B96BB89E49E911C2039FF9FEEBB56D6593804382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243577, "uuid": "c1095d54-6c91-4fa8-a8c8-0fed22c03dfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243577, "uuid": "af9768d7-d33a-4741-8dcc-bd8fa64f9d60", "value": "24576:j2uUNuA6gK47/D9GLpPR6r/hkUX9b322DS/g/JLJgiW6asdAQ:iuUggK4sd562UtpG/CJtxSqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243577, "uuid": "1ef24e74-8232-4940-b1cc-dc32d1b9b07e", "value": 1122304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243577, "uuid": "755bd80b-aa77-4f17-bd66-b01503b54c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243577, "uuid": "1108e9d4-2648-4d08-ae8c-96547c715ccc", "value": "adcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3099bb84-a61f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788278831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278831, "uuid": "9fc548f7-12c8-40cd-97a4-e814f1f07781", "comment": "Malware payload", "value": "0cd5cf376078614be753b048ef06edd5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278831, "uuid": "b784ef99-4cf1-4c63-841c-639dd43a9c58", "comment": "Malware payload", "value": "b01168b6a5517bc4491a2f0420def87e8ad4267c3662c498016eca1e37dca80a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278831, "uuid": "a686e89c-ad68-494b-bc53-fb359345398d", "comment": "Malware payload", "value": "1159d3a849eac8e14296f87697dd1b4cbd83c8f6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278831, "uuid": "f32aac71-a385-4693-b761-56c27cc700e2", "comment": "Malware payload", "value": "43e361743df3548c412c693ffc984a0c000467b825308c4c25244a79e9c7c99c46b7d488ce4401ad19bd4dc5589042c3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278831, "uuid": "a29324a5-ac0c-4f2f-9b79-9ff0ad8e423f", "value": "T118D48C59B25802ECD36BC6F8D9E24523E731B8053B60DF9F23D099E52F239615B3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278831, "uuid": "0a77dbca-40d7-4853-8d4c-b525eb8e7381", "value": "484b8ecd1e4c494850f0d942c72c11b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278831, "uuid": "c83010a4-a6f0-4e44-a8a9-51146def5cb4", "value": "12288:VzcYgauUoVP+0T583kRWRX1UOjPXCjZ3w:qYgaKPrTe3kwUSPXy5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278831, "uuid": "58994bb0-bf49-4541-837a-48645f0f94a5", "value": 646347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278831, "uuid": "43ced50a-d397-44b7-b5ca-574f4c280482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278831, "uuid": "4d0caf43-7e19-4cc5-9967-92caa2a93a20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e8d021-a638-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788289730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788289730, "uuid": "b123e66f-a939-4e50-95f0-e98d18c571bf", "comment": "Malware payload", "value": "56529d9bb1eca98804bb312c99af34e1", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788289730, "uuid": "d0abd447-f54b-487c-8ab4-62e15bad6ccb", "comment": "Malware payload", "value": "b02b8e6feac8c1474f6676b24528567fab2048dcb362037ee9f9c05b1b592a3c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788289730, "uuid": "490bd93e-9afa-4b33-aab8-22428e343b52", "comment": "Malware payload", "value": "a4d13581644f0208d8382ecda079e1a992769fe4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788289730, "uuid": "bb28effc-3709-496a-ad37-38a1d43dc8d5", "comment": "Malware payload", "value": "b230a1a39bfdc18bfab2f80db4998351d8f18436440b4d970324624049f4f27f2a80dd288b511e75c8e623586e73b4b6", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788289730, "uuid": "550bdadc-e67d-47da-8d58-fb2a68806d20", "value": "T14535E03C44C424A0D35C9FF34D4A1B1ACD76238B5A4B672A7E35A1560DCFA8706A27FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788289730, "uuid": "648ef676-6bd3-42b7-a919-87154b5e8215", "value": "24576:ekQwU8gIhNQrAHqD8YiN6HK/CLdLcBVPdARo6Sx7/:pxUyQAHjYimK/Wc666a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788289730, "uuid": "0110920b-dd5b-47c3-b695-a093fc9b0b0b", "value": 1119250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788289730, "uuid": "fe6a5546-3388-4550-9e90-0328f6451f71", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788289730, "uuid": "a39fcb83-38a5-4644-9a80-0aaef424c85a", "value": "TikTok18+.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213c78b0-a61e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788278376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278376, "uuid": "b1340ee6-07ef-4f15-bde5-2f938a272646", "comment": "Malware payload", "value": "5594178ee4e2d1b5d83607aecf713d36", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278376, "uuid": "ceb97ce9-969e-4a04-a681-55e1214761a1", "comment": "Malware payload", "value": "b0b6efad5e373b5450697060b39af80ca6c51d7e310bffa3bd85d4809a36e8a8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278376, "uuid": "589056c1-811e-4d92-98dc-4122420d911c", "comment": "Malware payload", "value": "2e0b381400799c80f1d4ac1057d9d713a8482141", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278376, "uuid": "8d46c797-8d93-4db7-a740-cfdfeccbdf68", "comment": "Malware payload", "value": "cc7c1a0020d00be42743b352cda0ef2b68ab3d5830923bb5d08946c07e59674ede77cb3b5118d0e3e8380338fcd3f628", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278376, "uuid": "a171afee-2a37-46f2-8476-82f13daa93bf", "value": "T115217BE5FA708D63F2CF502CAC5A14018BCF4D2B57281E56748F6818B77CE2AB45A731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278376, "uuid": "7589e730-6abe-4a36-a84e-9197d604c3f0", "value": "24:4D4O2Hsn9NIEZ8s6iSecy9fRVsSe7r3mK6N7gJCkK6+j:4D4/a3IESlyCS8zmrN7Nkrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278376, "uuid": "3f8c9ff8-702a-4150-9473-91e226e8e3f5", "value": 1359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278376, "uuid": "f31b9629-869d-4393-9268-bd84b9a6e4b9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278376, "uuid": "fa9bc42e-8e40-4ba9-a738-2c1f6a1b1dfa", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f269f44a-a5c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788242219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788242219, "uuid": "1e273a66-9bcf-4fb8-acf2-61c160b28623", "comment": "Malware payload (ConnectWise)", "value": "9f14cbbbcc39cd0cfe493a06c4420a63", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788242219, "uuid": "7e7e8d16-64db-491a-b029-91513f72bc1f", "comment": "Malware payload (ConnectWise)", "value": "b0fd6e0a4bea2502d98173fffd5fb8d35c1987d141d3f77df929a5253e9201b5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788242219, "uuid": "2537642c-c164-4065-b1c1-c308ce310cba", "comment": "Malware payload (ConnectWise)", "value": "2cad9d994b5262ad078b075fc16d65d78be16309", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788242219, "uuid": "f4709144-c76d-45ba-93a8-dbdfa52fcb36", "comment": "Malware payload (ConnectWise)", "value": "fd14d06c0866a6a111ada1e9d1f077ce3a81c3cff1a3640e35a0f5c1841622bdb145808e27d8f288e64b213fa5a95a48", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788242219, "uuid": "103d0ff6-5b63-4816-81a1-f1b9cebfa0e1", "value": "T1BB46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788242219, "uuid": "85f8eada-74d7-4255-9d0a-0c7866862983", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788242219, "uuid": "7d827005-8c49-446c-b3f5-791d37cb6eaa", "value": "98304:SzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ShfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788242219, "uuid": "16af8abd-6be6-499b-b896-bef131df07bc", "value": 5641520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788242219, "uuid": "ac37eea5-4cc0-495f-afc8-de9effe25b83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788242219, "uuid": "b52d25c2-67d5-41b2-ac7d-98327698f0b7", "value": "9f14cbbbcc39cd0cfe493a06c4420a63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbac9e02-a611-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788273159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788273159, "uuid": "d1ae5f9a-7033-405b-9440-49f266946347", "comment": "Malware payload", "value": "b3dfa586f802fc9d760b65d3994df7b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788273159, "uuid": "73454618-9287-434e-8ee1-73bb791e3801", "comment": "Malware payload", "value": "b283c948471e258d3351271ed8cbb13475dc27fad1f1b4eab3f40a1780a1c8fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788273159, "uuid": "307e512a-5bd1-4925-9e90-750c64095d09", "comment": "Malware payload", "value": "866c0cc306a594efbb35074878c66daf01d0fef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788273159, "uuid": "31182d29-a226-444e-9e18-89454e821e6e", "comment": "Malware payload", "value": "056d1e42cc71652d88860da553f58b202f86f9f8bf6cb3a0ed5f798ea906d1359f7917c9632b977c4f7d92adee5fa33e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788273159, "uuid": "4e8daf86-9eac-4658-b4ff-566c63678c17", "value": "T11BD523CA74F61AB5C43BC3B68F93E87E705CB750AA668E67B6CC75009D125642C3A370", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788273159, "uuid": "9b329449-1bf3-445f-8317-e289b635b806", "value": "fe230628262faec735b6f015758b7519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788273159, "uuid": "f1f57e7b-9d49-4748-80d3-c57ad12b0788", "value": "49152:34Yx2psN/1IOnnpUny+0I/ZH5fNOCybvtA2zaxnxwpTAkyLx:oYxEs1IWnpyy+00HqCybiWil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788273159, "uuid": "5d8666f9-3be0-42ce-8853-6838f4b9d401", "value": 2950656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788273159, "uuid": "50993609-683f-4cf1-b15c-ab8666be8ed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788273159, "uuid": "adc5195e-4453-4105-86cb-52cc4392bdad", "value": "b283c948471e258d3351271ed8cbb13475dc27fad1f1b4eab3f40a1780a1c8fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb45c8d-a5fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788264280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264280, "uuid": "332f222a-fab5-4754-b13f-e370021801f9", "comment": "Malware payload", "value": "77a6cd7fe393fbfba0a38b58ad223c45", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264280, "uuid": "0c9a131a-8f0a-4374-b66a-3e079f294c3c", "comment": "Malware payload", "value": "b36708f463e7939128f67b29a933f3a32fb83c207f90172f5070899000387821", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264280, "uuid": "1bcf8e6b-148c-4039-928f-0cdf240b8827", "comment": "Malware payload", "value": "b26b75084e85ba66fa2e7b58aad8bdc37c960070", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264280, "uuid": "5918a985-2008-4114-a749-659699346662", "comment": "Malware payload", "value": "889dfdd990da8b826e03c16558610b8991b7029872fa98314d751c98a058fa64a107ecab11607358fbff4d2f5edc78d3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264280, "uuid": "fd8d9c96-97bc-471a-acc4-3ec6f4194a68", "value": "T17EF044DF1568682664488D4636D294086444E1CB794F8FC57B5C4C3A89A4E19F275B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264280, "uuid": "e037ad03-98e3-48ea-a8dc-8f0f7001969e", "value": "6:/Y9PSlUyFAGQWbY9CDnJjuvY9eQiASX4cuY9YeyOmbuY9JeiN26ifY9f1ivXiJhy:q1GQWLDJj6ASX4cOeyOKakxt9iP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788264280, "uuid": "21e41ea9-6f5d-4bba-8416-108c39e8b8d4", "value": 609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788264280, "uuid": "0fb30a9a-a073-469c-ae4a-0894c6f07b87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264280, "uuid": "27f92f14-9777-441f-bccc-45a05dca39b9", "value": "a7m2qx.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42af371-a5cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1788243028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243028, "uuid": "a6aa5d88-f490-4bd4-9df8-bee9fc818883", "comment": "Malware payload (Formbook)", "value": "ea238a9cac378b4e47078e80aad1a548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243028, "uuid": "eceb20bc-ad55-43af-a766-da0b332e8679", "comment": "Malware payload (Formbook)", "value": "b4b38e1c2c99174f61ed28ee6651e492eb699ccb387433a0cf3861a73967706b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243028, "uuid": "5a5a8c49-9b22-47f6-84c5-516573182f7c", "comment": "Malware payload (Formbook)", "value": "0a8baf797d313ee79658083081f15a93f408136d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243028, "uuid": "dddc07c6-f92d-440f-9fd5-cb4b69a1480e", "comment": "Malware payload (Formbook)", "value": "a8ba076f3dc8b7363d497aad9e079db71f4f473dcd1497269941ceb0e258b04e73d3a8c14b77e390a758ee38b75bfe06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243028, "uuid": "78f2a3d1-d579-4f31-b8eb-8f57b27b1653", "value": "T1053502542209C903C0960EB45972FAF82B549EE9E812D313EFFE7EEFF9398652845351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243028, "uuid": "ce3660ad-ac77-4baf-ba87-97d8c6baccff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243028, "uuid": "4dac7a8c-99b0-4f3c-9e72-37f1b74ff90d", "value": "24576:NKAr2gM2WsX3zeO4ZWVnV/31+OqRvNIpzM2dVcy3EEp1AcY8Xzb4ctZHy8:pvJTsZMnH+OqRvNbwVNxXY8Xzb4ct9y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243028, "uuid": "01ba3ad0-713e-46af-9b6a-f87f50570130", "value": 1118720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243028, "uuid": "6588a94d-143a-437c-863c-48bb06e9781b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243028, "uuid": "7e88a209-5195-499d-80ce-9a9762a4d804", "value": "PO#330226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6d23a1-a5f3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788260248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788260248, "uuid": "62801496-7e6a-4c28-b787-2065e0e96a78", "comment": "Malware payload", "value": "fb66a42ca526909d3e91517c52a10050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788260248, "uuid": "11c7332b-0484-414d-9197-b7ff48cea40f", "comment": "Malware payload", "value": "b4d60147a359fe8b230d70da0f155e813bb517eb716ccd3baa70e68e4b63c7d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788260248, "uuid": "26e151ae-5446-4c30-a392-2cf760d59b2e", "comment": "Malware payload", "value": "000842d23330d95dbb3dc2f72508225c86ad82ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788260248, "uuid": "0ba048cc-1a1d-4bee-b187-e0630b5702c5", "comment": "Malware payload", "value": "7f0423943bb465bdc893ca481d0d4ffe2770f94c08eeb6edeca7686b78e6a8c345c407d6fd13a5c5c0e6a7b4585ddcd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788260248, "uuid": "5f5d8552-828b-412f-ad43-a400c95e7ab1", "value": "T1A2D52284FCAB4CB8F833C77313D3A47DB029BB494A618C8762D967506D526287D3A778", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788260248, "uuid": "8d540f11-271a-45ae-a59e-ad6e1eb4a02a", "value": "5a2ed47d8c6c6433dbc831d38c92042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788260248, "uuid": "faa540fa-e7e9-406b-ac16-b34108e42169", "value": "49152:8JXlVGKs1gmyPPYbpJ1J4G3gnQhRnTQbk8g3iFo2vCeCggPptKnFFp8dn1KH5jp+:85zQ1CAbpTvwnQTZ3v0uun/+d1K5jyjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788260248, "uuid": "a68309b0-77f5-4ae9-8873-72d7580fae07", "value": 2986496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788260248, "uuid": "da95afee-1fa0-4d0e-ae9b-502802b25093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788260248, "uuid": "59531d6b-b7fc-4c66-b5ae-92194e54dbac", "value": "b4d60147a359fe8b230d70da0f155e813bb517eb716ccd3baa70e68e4b63c7d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3a1664-a5aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1788228598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228598, "uuid": "edb8689c-40b1-4993-842d-52292b4097ef", "comment": "Malware payload (Stealc)", "value": "ed0a74cd8e6aad0c48d0558eb32ce0ae", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228598, "uuid": "c4918299-9e32-4076-b630-0ff09d73801d", "comment": "Malware payload (Stealc)", "value": "b57e4c2581991afbd8c89d3dc89f48fbdcc38446d18bc5f1b8f8472f49c86456", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228598, "uuid": "11d6b38f-5233-4286-8c17-ef8627152040", "comment": "Malware payload (Stealc)", "value": "894061a1d992fa0f851bc0447fd1e91afd416e13", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788228598, "uuid": "9c179409-e400-44eb-8ade-301660e578ca", "comment": "Malware payload (Stealc)", "value": "debe81695548d42ccf4f47af197bdc53334517b7a25e280e7cd2a61b34629e7663d00898a0436a9a5091debdf41a5e86", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228598, "uuid": "2bcb0649-2eae-439f-89ff-5ff1f194c0af", "value": "T17CD6335A93E009FDF47BE1788E520D01C772BC550B62A64F17A4B9B61EB32E18F36B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228598, "uuid": "751ac944-f9f7-4c27-ab48-6265e01ddc91", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228598, "uuid": "cc2f7470-b3b5-4b62-abf8-50ad10aac54d", "value": "393216:zKNOc51KP6oEkTx/mlGEERFDUo7Q3tEkTB5jT3BTqgk5:mNOcaCkVOlG1RpUos9EkTT9TqV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788228598, "uuid": "63fd74d6-2714-4721-82e1-81c8b7426df6", "value": 13642184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788228598, "uuid": "cd335497-f16d-4072-893a-a71eaac3bec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788228598, "uuid": "4cb1b5c8-08ac-42bb-a416-03aaaad3e666", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919b5af3-a629-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788283289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788283289, "uuid": "d10af231-6f15-4e67-9252-d3703ff38455", "comment": "Malware payload", "value": "ce6ffc714b25ad5fd04b3da3fb32dfb2", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788283289, "uuid": "5ef2ad93-89c3-4947-b92b-474ce629880e", "comment": "Malware payload", "value": "b5b2d129b425e4c3c1faf8c00146317643356fd2c8cbe84931c70ac9a9492db6", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788283289, "uuid": "3273faff-52af-4be0-907d-f93d049b8daf", "comment": "Malware payload", "value": "5a6327f026621ad2726df4e3c4d6aa279299c73d", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788283289, "uuid": "131cec45-1b64-4fd5-8e07-e6f1b7d8fb93", "comment": "Malware payload", "value": "6bcdbb4de1320a97f6ae5cd1c1f707fe5f0dbef7cd02fc012ac8307252bafe800e9d7c104720e6fa0420b92b4683b41d", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788283289, "uuid": "a62abd26-a96d-42d2-b456-24cd0dbe2609", "value": "T155141212BDF5DDE2FC6A83311B4F1771A77BBD065AD7A30B2290897078932D09D9A10D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788283289, "uuid": "8eed89b4-173a-481f-888b-892cd36f2908", "value": "3072:bpZSNxmG/RZu1HYW/NgwSoyJxzrrpXgFSaTk5d6kqJo8I/4HxzB1w+oeohcklc:batZuKW/NgxzX5mTk5tizB1ieohcklc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788283289, "uuid": "e749bd75-98d8-489a-9345-f4080b26073d", "value": 202841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788283289, "uuid": "92572c0a-d069-47e3-9937-728611251090", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788283289, "uuid": "d0a9ad15-d04b-4bac-b123-6383c8159821", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4218c10e-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1788243642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243642, "uuid": "ed7952db-3751-4eac-b5d8-661d6e124ff6", "comment": "Malware payload (LxBaseRAT)", "value": "ac7b301d17a5a8a3220cf08da1734013", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243642, "uuid": "14a61b60-7b08-48bf-aa69-21839f79de27", "comment": "Malware payload (LxBaseRAT)", "value": "b5d7baf333ad7124fece0a773ee5315465573e5b872d4fe41fd8b49e9266577c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243642, "uuid": "164f15a2-75f2-41e7-80cb-c92c3025fd54", "comment": "Malware payload (LxBaseRAT)", "value": "aa59acc6194ad8cca79e5ed2e5b5e9a3b45e1eab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243642, "uuid": "23b0421f-4141-49be-a32b-214ac52d2621", "comment": "Malware payload (LxBaseRAT)", "value": "fd5f16c8084d91d24f04337771b4cfc581fd7e4da9e4da440fe0fb8ceda74ca86f8e59865a97f8a10ad5e837ede0037b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243642, "uuid": "6af69d91-2464-41c6-b72b-9e27a3995e99", "value": "T167252301C3549A784BF8637819FF2A5E5EA991142232F8FD8E97F0E497EDB01113B4AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243642, "uuid": "b85f38e7-83aa-4aba-867e-399abb358ffa", "value": "24576:tp8HOAmNzU19CuUoDqOBb55/BQ6p6+EC1wQ51OUaWc:tp8HXxSTOFb4Q51E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243642, "uuid": "143a0c26-cb09-48ef-ad4a-f3c244d1146b", "value": 1005103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243642, "uuid": "6fd5b61d-6d79-4f9e-8b88-5f2c9178b511", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243642, "uuid": "bc1ecffd-58b2-4148-a8f5-69f1506ec324", "value": "\u0422\u041e\u041e \u00abSaruzhan KZ\u00bb_Order_180094001092026_xlsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266ec017-a5a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1788226415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788226415, "uuid": "fc889d0f-927c-40c2-959a-c555feab4fac", "comment": "Malware payload (ACRStealer)", "value": "d45dc255d9d01adb6756c104e989d6d9", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788226415, "uuid": "363fbb0c-2682-4a5c-8f9a-8180bae9eef8", "comment": "Malware payload (ACRStealer)", "value": "b646d2987f0f0a0c7416eb4f6c5edf2f7faa088bbc57877cc48e8a463d497739", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788226415, "uuid": "145b5815-399f-4399-9ae7-c301e0ad5b64", "comment": "Malware payload (ACRStealer)", "value": "72ad987d04733238978c5b6eb9bf704f628969be", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788226415, "uuid": "8bfd4d4a-35da-4df3-ba9a-f4efb5c5a3c1", "comment": "Malware payload (ACRStealer)", "value": "55e2f50b72bf2f2615b4b6943d7515c74c979dddeb126f080181769717ee167c2b08d3dc716223b366e2202ef46a3652", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788226415, "uuid": "0cfb9fdf-31d9-4285-9655-160d8e095986", "value": "T1AD95231167F4C0BAD4E74F7189F40613F331BDD11B3097CF2AA5A98A1B22F98A63535A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788226415, "uuid": "e0b78855-efe1-4ad0-b7a6-7d480518b55e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788226415, "uuid": "10a9ad99-937a-4358-853e-27ba25cd68e5", "value": "49152:yZ2AwyOX+f0ViW2STOdD8n0ywQEiaCQn7HDzunKo:bE0+TglKiaCQnTen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788226415, "uuid": "ac0c39b8-7f44-43e5-8d2e-d58543d30fa5", "value": 2008576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788226415, "uuid": "6fe72654-742f-4a34-b858-ba6b48da58a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788226415, "uuid": "8c196d42-0ad9-4346-a7b2-e63bf2ff89ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9a0256-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1788278319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278319, "uuid": "f230c50b-3278-4e95-8cd4-6134b92600d5", "comment": "Malware payload (DDoSAgent)", "value": "073e3d2a52ef9dd2221da4939b8403f1", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278319, "uuid": "fbdc7170-807b-49db-95ea-6090d3e71767", "comment": "Malware payload (DDoSAgent)", "value": "b75025837c6e4c451b1a793ca7ba2877f026b0a3900eaf5d7b27837e87cf3ff3", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278319, "uuid": "597b5a69-2d35-45ba-9603-81697034a877", "comment": "Malware payload (DDoSAgent)", "value": "2ac7d5fa96a26022daf206f922be15d9ec6befae", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278319, "uuid": "27fe1233-b910-41b4-9314-8123a485965d", "comment": "Malware payload (DDoSAgent)", "value": "9e54269b942e523f9df230242be0e9135e0e8bdf3cd0a17bef95502f6e0e1792878c53373bd55739aaa64471e858f938", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278319, "uuid": "35dae660-bcfa-42d1-b7b9-bbac0e3a3d6b", "value": "T1F3763942F6496FE5C924493385E34E712772AD542B319B52EB04F2BEACB73060F16F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278319, "uuid": "e30af579-89db-489e-b0ac-63003318c191", "value": "49152:5wcl4WZ4dyCt/2SL5XM4CHLKiNy6rvISzu7TNrljzVyIMP5EB:Gcl4WZ8yCZBL5XhC46HutZJIEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278319, "uuid": "ecf6e0a7-9e7d-4e9a-be51-83b325e4659e", "value": 7471288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278319, "uuid": "0f1f8d2e-5bba-4791-a23f-5a1a216f1692", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278319, "uuid": "38b01843-c0b4-40b3-a6d2-3f1485064d41", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d7348f-a61c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788277464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277464, "uuid": "62e51b0c-dad6-4dd9-9552-6f246bc9e89e", "comment": "Malware payload (Mirai)", "value": "099747bf245bfc8285448f9fd07882f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277464, "uuid": "c1d3c4ba-aeaa-4359-9b20-d144f360851e", "comment": "Malware payload (Mirai)", "value": "b7fe13d9b94fc0c9b77595756f26764c23624dfa8df2d273727fcfd1c8f13b6d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277464, "uuid": "e6ea0d01-636d-4f0a-a131-701e31a72829", "comment": "Malware payload (Mirai)", "value": "c0f9655deb2ffd9aea7741ed3919af94681bcd6f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277464, "uuid": "4ee0d06b-5231-4452-afa6-23389c566933", "comment": "Malware payload (Mirai)", "value": "08d95c03ce88b649f0808a5e460d2dbe7bb97c107c906b93bc1d7e31ff752cd64add89e591cde132ecff55ad4a0f710f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277464, "uuid": "530095d2-596d-4834-81b4-07d25013c221", "value": "T18F0197D1FCA0817BB84C8328EA948040598E1C7F48E43A1D70FE9E6A3B2C8382469733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277464, "uuid": "518a7bcf-3599-4950-b16f-c5ccf9a495cd", "value": "12:z6PiLUUVHU8WEVHGWGzSYZ3LV9gfLlitzuvzuzJXkWAXp0HzNlQQ7zNlU5uG:WP8UUXzgzSYpLSKzuvzuz5kWAX+HRlBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277464, "uuid": "f10d33c5-0201-4723-8360-98c3d2ba3bd4", "value": 712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277464, "uuid": "dc44c522-a6ff-4d4d-aa73-23054d2236e3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277464, "uuid": "173ccce8-c500-4c44-97b8-1de24a54b617", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4b6f28-a5bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788237002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788237002, "uuid": "ce8e322a-3627-4796-9ef7-199d587eec9d", "comment": "Malware payload", "value": "c5f84de99312955e298fd47bb1e3f1fa", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788237002, "uuid": "5257d3c1-7da7-4f0f-9120-ae59e6471bd8", "comment": "Malware payload", "value": "b8b9654b57a0445ea1f5645d0f6063df790448dea4d5ae27d502a2b136bb8da1", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788237002, "uuid": "6bb06bfc-5f37-4836-b501-29eb87bf1d42", "comment": "Malware payload", "value": "73f969a2cbff7f6184192566500acdc32f0b3777", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788237002, "uuid": "4bfa8be5-ce65-4fbd-9d09-09cf3d87ff66", "comment": "Malware payload", "value": "01c945570b6eedbf581e1aa0b116c2b4aefa1f0a2516ec4d33877daf4b0727406db1b69871ee0196373621e0fca84ac4", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788237002, "uuid": "8c94429c-6301-4671-a361-95651ae10643", "value": "T112547D16B7A914FDED77813CC9421906EA727C5607A0DACF03A04A963F276E09E7F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788237002, "uuid": "2e0e21a6-42c0-4836-8296-31c409d6f150", "value": "395117ec633a907592db538201fb8168", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788237002, "uuid": "e470dda3-4654-4c65-b2d7-f371836b94b7", "value": "6144:WsNfmj2A6875JAVmQFa64neI2KM2YL8//uoz:WUNAPAVjA7dcL8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788237002, "uuid": "53fc524a-0130-42bc-9ef7-9fe9123bc439", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788237002, "uuid": "50681c6a-49ff-4775-9eea-cdc9df2095f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788237002, "uuid": "bea3c7af-aadc-494b-9d20-b096d580daec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d917b8-a5af-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788230978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788230978, "uuid": "5d8bcac8-0b57-43a1-8274-97164e540c73", "comment": "Malware payload (Mirai)", "value": "201de3aba2d22990974ebd89284e325d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788230978, "uuid": "c52a86e2-b740-49ef-8648-e2e088e68c0b", "comment": "Malware payload (Mirai)", "value": "b96706b34eff4a7301245feaf1b7f6e869977daaa9cc5f27822bd679ee1f472b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788230978, "uuid": "2eb79bed-9332-432b-b028-044a0858c5da", "comment": "Malware payload (Mirai)", "value": "f2e6407287dc19f722b6af715b59d1cb155c5b28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788230978, "uuid": "690ee394-cb94-4a95-918c-c03043be29ef", "comment": "Malware payload (Mirai)", "value": "e3587b367e960fe85abc1f80d01758740648f49c19d6055fcf313723b74c7885495493c6fdfd329754d490e109d25d90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788230978, "uuid": "51ac2164-5495-4cb2-bb70-dad632129182", "value": "T117939E62C8654D94C66140F071A8EE3A5B33C0C052877FF766AAC6B5A49BECDF805BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788230978, "uuid": "7a1d0365-e13d-434e-b676-6f147561b2d2", "value": "1536:vn/5q7QbHT30D9d8DA/KDJuT7FEsOQCT3ELa8GyBjzH:vYgHTob8DAiDCisOQW8Pdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788230978, "uuid": "d4ad1055-a851-4a11-a75b-65060b597311", "value": 91864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788230978, "uuid": "495a7736-ebe1-468e-9bfb-058fce2e3c8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788230978, "uuid": "424ceede-3c81-4671-bf2f-f74270255e1d", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5137a6-a5cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788243469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243469, "uuid": "e7e74550-88a2-48a6-8961-921320a18c52", "comment": "Malware payload (Vidar)", "value": "00429fee15a3aad1fe341c044b41ecd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243469, "uuid": "60b036d5-e585-4da7-8e68-2998a6754e93", "comment": "Malware payload (Vidar)", "value": "baccd5727990f699dd2aef46794f14205e7ba63a881a953ef7111e9cee40a23b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243469, "uuid": "6c0d7b2b-ce71-455d-8ae6-422d246f7351", "comment": "Malware payload (Vidar)", "value": "7929e1239454dc9d8883f516711f074d6cfbffd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243469, "uuid": "7c841a48-8688-4f7d-a973-e350a1a3f19d", "comment": "Malware payload (Vidar)", "value": "d930adb18838cbe5b1beb3364de37292f19e8b9f74103c5866e8b66e5a1266c9034cf2fb8a4165b6a3b74d38128dc065", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243469, "uuid": "ba5b80ae-dcf0-4f24-a0be-bf7d46ce18a1", "value": "T1DC28330B7E859958E59A9F39C1764321763A7C4CC73533AB1EA0A2343E317C26D7AF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243469, "uuid": "f4f6ac8d-e9fa-4f73-8bca-6f748461e764", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243469, "uuid": "94bd3e70-3006-44ad-8790-35f48228cae6", "value": "1572864:ptaYbWcDYZYSBbVUfmRtmit2RxrAAFLeTFjJnZYQqKjlNKv6HSQ494Vuutl8DjDx:ixJWuPeAES5FCQlBNIo1h4utyDjDFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243469, "uuid": "e459544b-86aa-4dd5-a941-46af419c20af", "value": 99711352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243469, "uuid": "72b290ef-6f90-4e85-9c65-32a2d7efc71f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243469, "uuid": "16b1f692-47ec-4cf7-afcf-a3cb8fc73b55", "value": "baccd5727990f699dd2aef46794f14205e7ba63a881a953ef7111e9cee40a23b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0db6cfc-a5ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788258108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258108, "uuid": "b6d00e98-3e85-4445-b181-32070b3a7887", "comment": "Malware payload (Mirai)", "value": "03015cb4c79f81fb3abd46fe4ea43e6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258108, "uuid": "62dd582e-d637-4537-9fbd-4ff308b1adaa", "comment": "Malware payload (Mirai)", "value": "bb08fd9ce1f3508bc30a33646aeb66df3024e5c7da843cabd09ed19ae07bd8d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258108, "uuid": "8d3982ec-4f3c-4863-a015-bef12dcd9f6e", "comment": "Malware payload (Mirai)", "value": "45252a6840a334f5765adfa1be152469985b653a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258108, "uuid": "f1a46f26-3fde-4b2d-961a-2c9319c42ca1", "comment": "Malware payload (Mirai)", "value": "b9267b890f5a245f568c5a626c9c5ac74aa5755b071f6519c866107487dc59d5972d493be5d378d5a3f36ef4a8569d7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788258108, "uuid": "2400abb7-643f-424a-af14-8e58a6086c38", "value": "T1CAC30840F944876BC3D327BBE78E439D37366A6497D733116938BDB42B81B992E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788258108, "uuid": "812f9ccd-21c3-41fd-8e3d-816c0ee47ce9", "value": "3072:O5QeE7Ylk17KFFcaCj6u0Xmqg8FmZJTQ3dbV59gA:QFFdi6xXmqmZJTQ3dbV59gA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788258108, "uuid": "39bee3ba-479d-4b99-aedd-0f484d47293e", "value": 121461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788258108, "uuid": "44450dd7-ff5b-48af-957d-4b0a4fea0663", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788258108, "uuid": "dd1cf7d0-c420-43a7-bd73-4c4c2f9c2905", "value": "telnetd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f6f11a-a5d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1788245849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245849, "uuid": "d9a95710-4415-49ad-abc6-5a66503d664b", "comment": "Malware payload (Formbook)", "value": "f039b4fd32d47ae406e42f2e01d4bd19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245849, "uuid": "38d9dea5-99d1-4cc0-bad0-bedc0f7b5ba6", "comment": "Malware payload (Formbook)", "value": "bb0e7d8f68274b32a12a3907fe52d5f1beae19a3ba1bd2c0a23cbbcf57fca2bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245849, "uuid": "57ba26b7-f7ae-4449-9734-c8a7202acedd", "comment": "Malware payload (Formbook)", "value": "dc5157f32f7cc5740eba516bec0bb6c365688e51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788245849, "uuid": "68335780-d0f3-4a12-87a0-3a3a69d5c77d", "comment": "Malware payload (Formbook)", "value": "39e82c20f93ae88bf31c55f1dee5d336e97ac86523684b310a89c7656bd1380a1274ab3eb4d32e06f4c6d7c69277f548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245849, "uuid": "0acbeb82-e520-421d-b35c-0d36e39e41cd", "value": "T1D83502142229CE03C4764FF44971F2F82B796E99E522D2139FEA7DDFB93AB142815342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245849, "uuid": "da01c662-5a3f-441a-a852-ff53ca05e735", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245849, "uuid": "5e82eda4-1fe7-4e5a-849b-4a6a3fb559e2", "value": "24576:aBJ2gM2WsXqD+UMtE43RsNH4kSyrVm6sTM5/F9lSERL8c:aPvJTeA+csNYkSyrcvM5zlSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788245849, "uuid": "52f906e2-53f1-4df4-873c-1542f2bc654e", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788245849, "uuid": "e32c7d64-e124-483f-9e3f-f3201ef4ebbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788245849, "uuid": "9b09b501-349e-4231-a496-af2dffb3f5a1", "value": "Scanned payment copy............pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f427a727-a627-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788282595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282595, "uuid": "7c435f0e-2fa4-4ba3-9d6a-4cef45d46f53", "comment": "Malware payload", "value": "d86ec1cd7c8ea5e4d24c00504cd7886c", "object_relation": "md5", "Tag": [ { "name": "Disco", "colour": "#343F62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282595, "uuid": "147ad492-f60c-41fd-a795-e4eb1893921a", "comment": "Malware payload", "value": "bcfeaa131dec311db8747460e7f1911d010f7313b3ec639e47835c2f7cbc5794", "object_relation": "sha256", "Tag": [ { "name": "Disco", "colour": "#343F62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282595, "uuid": "33e0501e-1cba-4d9c-9e65-d91a5132c433", "comment": "Malware payload", "value": "339dc5d273494971db2451ea2a4b65aea40a1e0a", "object_relation": "sha1", "Tag": [ { "name": "Disco", "colour": "#343F62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282595, "uuid": "096d69ad-8ecb-40f5-a281-46ac0d29b8c5", "comment": "Malware payload", "value": "13d0ce9c4028e6e2e1a60ae48d67f10ce279711c717a231127a42c13c1fd8b81fe3a0085578440813faa920fdf829b2a", "object_relation": "sha3-384", "Tag": [ { "name": "Disco", "colour": "#343F62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282595, "uuid": "47613f8a-02f4-4ddc-bf35-4c7f44b2344d", "value": "T171A63348D2C01CABE893A17D9AB3C555E6D2F9251736CCEF179153392F73290483EAAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282595, "uuid": "226af36e-b944-478a-b4b6-80bd1c6628dd", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282595, "uuid": "81468bf9-c7a0-47cf-a55c-1ebfa3b68f78", "value": "196608:FXLKzCWrsW4gXyTntTFqq8N3tF486A+OMTDHsGXRr3pXFByE7E:5LKzbrGtZq5XC86A+73HsGXRD7B8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788282595, "uuid": "921ecfbf-a904-488d-8311-bb5ce117bff1", "value": 9634306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788282595, "uuid": "583fc318-fe1c-4877-80f9-8f56cc4786c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282595, "uuid": "efa6863d-9488-42d8-83f0-05c9ba3c7ad5", "value": "baba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e7b3ab-a5b3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788232778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232778, "uuid": "cf18116d-26b8-4ac0-9b44-b714050e9eda", "comment": "Malware payload (Vidar)", "value": "e7915a6bc8875365dd0faf15f25aab41", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232778, "uuid": "985e35cb-3ecd-4239-80bf-48f4895651b3", "comment": "Malware payload (Vidar)", "value": "bd7245522ba1de1a91f39588b5a9bd7d5fe947accaa0af28af138935b415e36d", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232778, "uuid": "2be742ac-3634-487b-a7e5-03aef886bfd7", "comment": "Malware payload (Vidar)", "value": "b61a9f87bb852c8a4cd44300c154f0de2612383e", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788232778, "uuid": "3179eb0c-0b5a-473c-9a63-c5729b0cc877", "comment": "Malware payload (Vidar)", "value": "6c42d4b87981ecfdf6fdfd2ad5480d88fec15d10f1fe7708b9c34206aa3115a56093c059de0f4b6348a621b96e15cd27", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232778, "uuid": "5cc5fa9e-7398-47de-a95f-e149f1ddad74", "value": "T197264903BD9508F9C19AA73189B74252BB74BC4C4B3133E32E60AAB82F767D15E35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232778, "uuid": "311907ab-1a40-4c9e-85a7-9524af20dcd4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232778, "uuid": "8f852e8d-5c7b-4a0b-8397-a825bc65eb03", "value": "49152:wKnLG56cO0iAdicM2h/W3vCU+EWaerfNSpQRbsqBzu7lorp1JN8ck:wf/9luvd+EWZNSpcbBygn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788232778, "uuid": "59a797a3-7fb2-4e97-862b-a23969f59132", "value": 4601712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788232778, "uuid": "cbbc5f0b-06a2-47dc-ab2b-168c161fddc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788232778, "uuid": "5ca170b4-2555-4407-8c2c-1fef8eb13601", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8f6b5a-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788243661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243661, "uuid": "01430b0e-a65e-405c-aebf-1a57b5f3fca8", "comment": "Malware payload (RemcosRAT)", "value": "1b9994a8fe7c583d591b7b5264b165f8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243661, "uuid": "7e3a767b-8969-436b-aaec-f1d189dda534", "comment": "Malware payload (RemcosRAT)", "value": "bdd4269fdc07428cc31699c536f502b5688053d7e5e47258795155304fb51790", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243661, "uuid": "b5901ff0-a2be-4c29-9d81-d32f80e0fd07", "comment": "Malware payload (RemcosRAT)", "value": "cd802f107f3434175d4aaef2e516e30661d0d9e2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243661, "uuid": "7e5c1e6d-b203-45df-bdb0-9476fdd57485", "comment": "Malware payload (RemcosRAT)", "value": "b5d2e39b1d603982034739b10cf6055cd2719bb766732181437753a20a53bd2a818eefa9f220e85478888297096ef481", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243661, "uuid": "bd690da3-aaf5-4e00-80bd-cd2e33bc1c81", "value": "T1DF36D8A1238DBA160A057E06D41C165C0F9ED4364AE3F9E8B1EF17DC4F1B45A3AC1E6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243661, "uuid": "6987a2d7-c7a4-428a-89fd-939ba16cd37d", "value": "12288:2LWFpIUi5k16nQBzV2IDFIqiv1Bx9DLNWPDMRJx/HAQ7jN98ApO+wzsD/nKbLDDS:Qdnk4vL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243661, "uuid": "0a420ef2-fc75-4816-a3e1-8c92bdb3ee1d", "value": 5201431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243661, "uuid": "30b8e007-d679-42b0-bd8f-eb24e28ed997", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243661, "uuid": "f139f8f3-2d4c-426a-89ca-0f6a5a1efb0e", "value": "Payment Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee15983-a632-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788287257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788287257, "uuid": "f55974e3-93f2-4729-9594-dbcbc002a500", "comment": "Malware payload", "value": "be31c5af4b0d0b8cc4e784eb739ece78", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788287257, "uuid": "74868bb4-0b0c-44ca-aa4d-ecae0813eff1", "comment": "Malware payload", "value": "c1202a1501f1f6cedec89fcd1904cee6fbfc6ca41ed12bb6dabdb047e37ee022", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788287257, "uuid": "0096278b-d460-4d79-82f5-4198b05a63a7", "comment": "Malware payload", "value": "a1912a4efd6b74e115e4deabe5476d515a362da5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788287257, "uuid": "6797adb2-8b94-4cf7-ae8c-b2be8f6c604e", "comment": "Malware payload", "value": "68da4a2339c04928243ac346ab48a50c4ff49a2c03958fb9e05a2af95767d6e021aa340ac19364df6bd52d33b2aea21f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788287257, "uuid": "ce9345cd-51d0-4ef5-8901-a9177c611c34", "value": "T148960157FB88A97AC4F3833609766325250B9C218B539297A904723C79F76D05FCAECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788287257, "uuid": "77684b7b-299a-43d4-a164-b2ca5d447233", "value": "196608:EcEyINJrBwLmebhFXvBwS/nZeWGgku08/KpcmC:wyINJ+DFfBwmntGQWZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788287257, "uuid": "f69ce7f9-efad-457e-94e1-371f99daf372", "value": 8895750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788287257, "uuid": "1c529139-4923-4ada-8704-77dc89c54a69", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788287257, "uuid": "4e8df1ed-3019-4968-8317-27ccccc7f108", "value": "OP61BfIKeJ65Cp5tyYSjThUQsaGPv2BY_mParivahan_6_.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d6db51-a620-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788279454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279454, "uuid": "5251d465-d1a5-4c77-b8e6-ec8ef8b2bcc0", "comment": "Malware payload", "value": "6887bce8ba65832f93289fc26fed236e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279454, "uuid": "5fd340a2-fa29-435d-bcde-7b17e422998c", "comment": "Malware payload", "value": "c1b4df4b8777b899c2f673dcf2eed88e113058ea49ce127eb3a4fdff5ed0c8eb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279454, "uuid": "07b33a39-e064-49ce-ab28-5d4c6a2258cd", "comment": "Malware payload", "value": "2f0a89e5b46ba3a5417fdae8017125eae80e499a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279454, "uuid": "9641b2ea-6cb2-4f28-b2e0-1213de02e037", "comment": "Malware payload", "value": "eb4e4c2243d5823f3a643ca26234ea62458b8cd632f58ed26b727eba45d86f1c4071ae3e7490af6b95a97ffe1fdd1a15", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279454, "uuid": "d7e30501-ef3c-4b9f-a7ff-b04e6b1cc91c", "value": "T1C3A302A095DC88F6C7B3023FF8B572C437C3D8E50AAA3567660CA6E1BAD99414B0670D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279454, "uuid": "76c7ba82-f1af-4a0a-ae0e-aa275504ae65", "value": "1536:Z82ZBgSvQdAF6WQ6RZCCrsZs3i+RXCu92gqpE0brBDSkK3ZUSoV+fg/sYqXkgwWM:Z8a6FvcZCxoXl4jK0brBDFKOrH0YqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788279454, "uuid": "a66c7881-ff39-4ad2-b0bf-916a1f6affa7", "value": 102173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788279454, "uuid": "a4d5a9a0-795a-479c-95ba-84c9a6f1cf92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279454, "uuid": "ba941df8-21ca-447d-96cc-b4df8216705b", "value": "ntb.armv4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a8aa50-a5dd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788250627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250627, "uuid": "38a9ace8-5870-43d8-b006-0f8742ff2fb7", "comment": "Malware payload (Mirai)", "value": "167256adc778e020909e58b6bba5440e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250627, "uuid": "cc13123b-7923-4216-af4b-3a26df320c6c", "comment": "Malware payload (Mirai)", "value": "c1ed7ea05c4f1b6ccbbffc079021a2606b5f4e5b54e497d262e35aee0fa2211e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250627, "uuid": "07114102-8a74-4eee-a1d6-70d138775421", "comment": "Malware payload (Mirai)", "value": "255aaf8eff20342c2aae48f74331b3958811ec89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250627, "uuid": "dcb97bf5-58de-4e82-80cd-f6fc26857671", "comment": "Malware payload (Mirai)", "value": "946cd6991421aa8fd6a01eac6b8b2e5d60d9da70dc45f1889e103c46d614679e74c3f5a8734285f365cc3639caf558d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250627, "uuid": "6a2a8c53-a6a6-49a3-a442-1be5908da3f9", "value": "T1112449D3FC51E8BAF84BE73B89474405B130B66301819A33721F757BAF2A09546B7E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250627, "uuid": "a0218351-94ef-4f6c-a4ac-cfbe46c1768c", "value": "6144:GPutTb7jm+bBGrVLIkyrVwlEssMOjh5ohn:GPuM+bTSEssMOjh5ohn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788250627, "uuid": "4a94489a-6ae5-42a4-824a-3d8c43c75f03", "value": 217068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788250627, "uuid": "e91cf736-8cbf-42fe-bf66-6819cd9ef0f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250627, "uuid": "8fd77ba0-5395-40d9-b259-3803bb17d599", "value": "c1ed7ea05c4f1b6ccbbffc079021a2606b5f4e5b54e497d262e35aee0fa2211e.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacc7f62-a60a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788270124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270124, "uuid": "9c4e70fb-807f-45f6-a4a4-547aad24208f", "comment": "Malware payload", "value": "3b27755ba200ac7eade2561628dfefbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270124, "uuid": "bfda681a-d679-4418-af47-71566ad886f3", "comment": "Malware payload", "value": "c2386f4fecbfb9217d86b6d7960310c7194f7367b2418f1498bd59fcd2ac6eb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270124, "uuid": "b0112fae-19d5-444e-80dd-c434522ed748", "comment": "Malware payload", "value": "52801fde62efadf83f1d255a1da68a02a1211b88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270124, "uuid": "1b0ed8d1-d93e-4815-a616-1817d3e2f89c", "comment": "Malware payload", "value": "ffafc652c22646916445032a4edfa800c753ca1b83f2d6bd43976de47608a6217a8f10c9040398c91c56d75d8ac0c15f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270124, "uuid": "bf96b73a-b54e-47bc-8549-276903ec9c1d", "value": "T1F2D523D275F205F9D86BC7B29F86F4BD716973868B608D0BFECD18508E12694103A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270124, "uuid": "2faf4823-5a1d-4130-b9b9-fcbded2c63e2", "value": "58f4b17816a07f7a36dd14e504d515e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270124, "uuid": "fdcb57fe-7581-4257-a4f6-6b8c26c07d66", "value": "49152:62puUyTbXBCv/v1adr9YVx0+AWnP+vvlWHrfl+7yMif44w1bfDy7SDxeOM:62psbXBCvH+ruVxdA0KlWLfl+7yFfPaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788270124, "uuid": "537b858a-da3e-47de-8976-395ab4004332", "value": 2899456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788270124, "uuid": "925ea86e-dba1-4bde-83d1-2be006e3ef88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270124, "uuid": "5ea19429-d895-4b04-a3f2-caffac6b341c", "value": "c2386f4fecbfb9217d86b6d7960310c7194f7367b2418f1498bd59fcd2ac6eb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c0bd9a-a5e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788254258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254258, "uuid": "60068c2a-d730-44b8-b479-6155e9fef8d6", "comment": "Malware payload (Mirai)", "value": "1be8dffb100d2ce45037b57f629383b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254258, "uuid": "983989cf-f0f9-4a91-a575-7dc1e2c971ca", "comment": "Malware payload (Mirai)", "value": "c2cf2c3930067406b2dbf45b6c7ea112c5d47f8234ca4d498cee13f1c115a35e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254258, "uuid": "474c7090-c507-4a61-b967-75011874bb6e", "comment": "Malware payload (Mirai)", "value": "b0da1b16b922cdbec475622781766f9c6965dbaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254258, "uuid": "537f6a15-ba54-4deb-8943-8028cfd16931", "comment": "Malware payload (Mirai)", "value": "0b7d9324cb694baa20884f790c25cce37ae80baadd8293430f63c775a4b296119f65608868851967d8b8d059c895096e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788254258, "uuid": "774d4529-4ef2-4106-b560-ae7aac5dd6da", "value": "T164E36CC169E3E0F1E66345B9476F931A8732E4370119DA11FB2E69396F02010E7BB7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788254258, "uuid": "a3c46522-5507-4541-ac3e-b6ebe6392b18", "value": "3072:DLHorxYMp6AQimzAr4quHgHSDchMLZPEwVpJ1EssMZc/T03ImIys61X2h5oSM:3+xZpxQim9yhM9MwVJEssMOjh5oSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788254258, "uuid": "b7d83c6d-b914-4bbe-86ff-75d986829b83", "value": 152876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788254258, "uuid": "c9bd71d7-010e-4efb-a204-bb6208e15e71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788254258, "uuid": "e6dbb343-d1ca-4090-b06a-d7313aa6199f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f5a26e-a63b-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1788290846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290846, "uuid": "10c50d21-aff2-499f-bd8c-de8c6819e303", "comment": "Malware payload (CoinMiner)", "value": "e8a5cf6d161981974fbac563bacf6b40", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290846, "uuid": "2d1f7ac7-e2ee-439d-8a4b-d6d16a40b2e1", "comment": "Malware payload (CoinMiner)", "value": "c3291f11a31a8574a725402f364a5ad332836782c6e2b57cca19f670e82eff9d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290846, "uuid": "3d8cd71c-522b-40b0-b85e-0ec098bb9e36", "comment": "Malware payload (CoinMiner)", "value": "088167b1ccaff235cf8095f54bd07339057a4a11", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290846, "uuid": "1269d28d-7f77-48e2-af68-8fc8538ec7d0", "comment": "Malware payload (CoinMiner)", "value": "8d59327bdd827a716cbfecdfc5f22dd1c08a10c2806dcf6c73e9b75cf138a6f04734438599ceb44cf543e940b61cb9f2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290846, "uuid": "47a798f5-7e3f-4554-aed8-4f03f1d40b8b", "value": "T126363389A9CBC9B4E447C3F95193617DF23E779944A4FC0B3ADC69508E6BE0809BDB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290846, "uuid": "f4d0fb70-2199-4bcb-b4a8-5ab890df0908", "value": "949ec789a5933fb6051c9013a550fb57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290846, "uuid": "173dcdd8-135a-4d98-beb6-7dccdc261c5e", "value": "98304:+3EWhWy+P8LAwdcdih4I2LBbJvc3njbshYIQq2tFgc6ys0SlxpHLgFUShdrWPgMy:h1DkLTdx2LBbJv20erX6D0SPpHL8ZYHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788290846, "uuid": "ffcdb107-e7f6-44c7-bf37-2cf9abc01d45", "value": 5305856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788290846, "uuid": "2d3d936b-f3ef-448d-831d-ec8255f0279a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290846, "uuid": "a1ef5adf-83ac-4c7a-8b4f-1160ddafdda8", "value": "c3291f11a31a8574a725402f364a5ad332836782c6e2b57cca19f670e82eff9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4864f73-a640-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788293279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788293279, "uuid": "5b5f4069-3e9b-4120-9f17-f10058732d4a", "comment": "Malware payload", "value": "d2b6020fff86044a4c3b229a3af9807c", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788293279, "uuid": "10b86650-9f19-4f37-95d4-5a5be6a596e5", "comment": "Malware payload", "value": "c3b75a86f2ba1e087a983534bc576392ff43d3b1eb309ae2b7f50c7a01a8114d", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788293279, "uuid": "beeb3ee9-9ac6-40a7-be89-e47ba92ce44f", "comment": "Malware payload", "value": "0f358366052b1bb3b02a741ceff93d3d85166e54", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788293279, "uuid": "1420c03f-68b2-4445-baf6-d5c46994edeb", "comment": "Malware payload", "value": "4b45b286dedc157bf099b0ffbfef2de1249d067af595e10715138f142b020a2d6936b8eb96c1f9131f78350baf6fb1b3", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788293279, "uuid": "9f783c83-aafb-40e0-b714-a3f71bd68de1", "value": "T1EF667B0B3E9081A5E05E963585BB5252AB34BC4C9F7673D32E80B2341F763D47BBAB44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788293279, "uuid": "1219cbe5-b159-44c0-974e-80c7654f6f43", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788293279, "uuid": "9ac0f8e0-0fee-4aa1-b5ad-c1c98a79f5e9", "value": "98304:mq/hpfWK5rYyOeGnNvOlw373E6h9TTSiz:mqJp1BYyOeGQ491z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788293279, "uuid": "d73805bd-400f-4e20-ac08-658dc841b16a", "value": 7034288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788293279, "uuid": "ae8d1463-6df2-46b6-9791-04643917b603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788293279, "uuid": "4ee73395-08b6-4e97-98b2-c4536dc3cbf6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40b2bd6-a617-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788275669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275669, "uuid": "389f28e0-d01f-442f-b59e-0a04f16571a5", "comment": "Malware payload", "value": "8649c2ce118b3c8de77182050cd5e1a4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275669, "uuid": "1f1836d9-2509-4306-ac3a-3325c0622dd0", "comment": "Malware payload", "value": "c3f622013096327f7f23a976d13df5e7c01d42c7dcaf514f95fa318e17d70428", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275669, "uuid": "b70e9d61-2f83-4bd6-a8c7-2cdc9ee7728a", "comment": "Malware payload", "value": "46401941e52ac000580f6f0ac81f960b38132854", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275669, "uuid": "8e1484f9-b81c-47d4-bae0-015f8e5619d2", "comment": "Malware payload", "value": "570a2c7f9ba01d86c72f11e6c66c8a4254e521ab1cf03eb4fc1072a5dc0cff481c5e87de533fe83f0de66828c386525f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788275669, "uuid": "677add4b-94f9-48a9-9f3b-71bfefa77a57", "value": "T1E5235C512A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AA9D910972D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788275669, "uuid": "c5d3a126-a26c-4fc2-b5ac-21b767af8ab0", "value": "768:mQFWzZx569GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Bkzxcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788275669, "uuid": "fc06538d-cbf2-4695-8298-51a4eb3b7e5a", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788275669, "uuid": "81fcc0ee-92ca-4c2e-a2aa-53266026aaa9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788275669, "uuid": "b43dfcee-3316-439c-b43c-fe550477485d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77ef032-a5b6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788233987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788233987, "uuid": "64d555ef-b8db-41c1-a0f5-95bd72b884dd", "comment": "Malware payload (Mirai)", "value": "29c583af94d4743bf06a82ba99046bdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788233987, "uuid": "7ea9a249-3f8e-4390-a729-ac0710d958ff", "comment": "Malware payload (Mirai)", "value": "c40e58e9eda2d0a753c5a6bce142b758d437d2878f5ae39d8486824881261128", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788233987, "uuid": "385fd7f2-7b59-46d7-82b4-53619f0045fa", "comment": "Malware payload (Mirai)", "value": "2bf5b7754c4ed8dc31522f3c5a36a4a28d88e746", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788233987, "uuid": "403bb3bc-75da-4623-b834-f5f3baeb7c8e", "comment": "Malware payload (Mirai)", "value": "9f579de6573f17c8445290246393413106f68e952d587e013743d0905c9c403eaca6c2c0d6ecea6b536db2ed5791d9e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788233987, "uuid": "72a22a99-2000-4b5d-b88b-536ce1a243fa", "value": "T1F7C3B74E6F319F7DFAA8C23487B39F21975923E623E1C585E1ACD6011D6034E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788233987, "uuid": "a4a49c93-4d95-49d6-b093-4b7c7b1550ec", "value": "1536:AiIjetocXg/vXtUEwNdX56FpyRd7xK43vQN2fTmmr13woGeH8sYm5yXel9rNi:ACDOyRd9K43vQN2fTmmJ3woomLDrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788233987, "uuid": "0dc22f4f-a0c0-4385-a461-ef84edf12d6f", "value": 127320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788233987, "uuid": "74d89fcd-6b3f-426a-8b77-05e0fc3f15ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788233987, "uuid": "28d1d968-3608-44ba-bdfe-853442b1fdbb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0da58d7-a5e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788252391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788252391, "uuid": "de9b06fc-8f62-4798-a52c-4c8b7d99b06f", "comment": "Malware payload (Mirai)", "value": "bace9cd940e17697ca91416a350b332b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788252391, "uuid": "d7b4995b-c349-4456-88ff-726ec94b8e18", "comment": "Malware payload (Mirai)", "value": "c458e443759ea633cde8929b4337726136675141d82251158f973f54008e20ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788252391, "uuid": "64da9a00-ee74-4ef6-bf8e-18c821b56bd5", "comment": "Malware payload (Mirai)", "value": "8ef07c8492192aa12094e9bba0129732d7ffd3e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788252391, "uuid": "f1a03fe5-c487-4f7b-a9d0-967de09ed200", "comment": "Malware payload (Mirai)", "value": "384d99de01fd6dd128206d6c463237ae647dcc5f474b0ae0823ac25012578e91f2f4e08c1064130be2bb811618b5c032", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788252391, "uuid": "eb09509c-e10c-4201-a076-1e9c3a34e793", "value": "T157D32900F5508767C2D213BAFB9E429D33336B6497DB33255924ABB82BC1BDD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788252391, "uuid": "df7bc4be-a754-4a5b-a1f0-e1fbe5e6d69c", "value": "3072:LKMGa5gzy3yafxxO+beacORDSgycKoUaq5AOLD4I93Gm8QT+Tc1ip:hNfPO8eacaHKTaqp1Gm8QT+A1ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788252391, "uuid": "86c4d602-c11d-41b1-97fe-01a6354ed032", "value": 132978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788252391, "uuid": "b348ad57-05c9-4a41-b455-42f5ed543437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788252391, "uuid": "9b11e1d4-ce93-44f5-bfda-90d4df9df2d7", "value": "kworker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1942193c-a5ee-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788257746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788257746, "uuid": "42f693ac-5462-4e6e-b11e-7530a32b81a3", "comment": "Malware payload", "value": "c04d7cd96749a76a6287067a411930ec", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788257746, "uuid": "3254e76e-9de4-42b8-a1f5-8bb5cf3f579e", "comment": "Malware payload", "value": "c4626706a2f76494126dfd71450d7fec653d231384234ea142a3970a7cb50b60", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788257746, "uuid": "5379c9cf-10f0-4e69-8b3f-08f61ea99c3c", "comment": "Malware payload", "value": "755ddcec8f0b842544ef8bdd775e3c0330ce9490", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788257746, "uuid": "e7cd24be-3943-4b27-87c1-5551b109b5ad", "comment": "Malware payload", "value": "8538f1cd75350fcc03ca7ec7e952d881595c16d87e2ca598031e12b8ec0191987814d8527f49da8dfd64afc3fb71aca7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788257746, "uuid": "d166f4ab-f595-4286-9bb2-612d04178a97", "value": "T1E4F05C4198A04929523016146EC1FA095E9AEA874389AD4D76EA60B90FC47C1CDDF87C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788257746, "uuid": "ccf1badb-d6d2-4827-ac63-cd082af44240", "value": "6:qTIuJzhqIwGiY63fAbplilAl3t11/+SR0AqIbR2AWHwlUUV4LKTjawlNdF0NAEdZ:qTp0JYyg9193R5qsPWNUVBdqAEd2QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788257746, "uuid": "e5708221-20e5-486b-9c24-18ebb7b409c9", "value": 446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788257746, "uuid": "263a850d-6e22-42fd-a6fb-a7e98706bbca", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788257746, "uuid": "96e16aa3-faee-4a5d-8b2a-10567648edb7", "value": "goodthingsforbestpersonforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d0075b-a5ea-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788256185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256185, "uuid": "10ee8764-b25e-42a4-9164-e4efe83bc514", "comment": "Malware payload", "value": "43c12e8d79ac6e9242ae301391ba4b31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256185, "uuid": "af9817bf-385e-4874-a847-f3fca697a7ca", "comment": "Malware payload", "value": "c51c121f3b387a7c38efdc406fb1be58a08bf95c49753091d4fd3b965008a3c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256185, "uuid": "69177a98-3a7a-4409-99c3-aff67d4970fd", "comment": "Malware payload", "value": "867c85aeea59de88c0a439a0efa5fef68f2b459a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256185, "uuid": "f914e058-fbfb-4f55-ba74-ace19a2e57ab", "comment": "Malware payload", "value": "a801a0ba3ca611e16d500c6cae4a2ba1bc42bf167aabd034246d6b47d46bbaa816b036839ddb33e0f7418e1fae30a598", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256185, "uuid": "7f7d7592-bb13-4cec-afc3-97611dfa429d", "value": "T12234BE25B8C1C032D9B3583009E9DB759ABCB9701F6948CBB39C5B7A8F203D1573966B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256185, "uuid": "8334d2f9-14a1-4039-adb8-30513f7281b8", "value": "d58a5f60cd55ea4c221235206b8f9974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256185, "uuid": "f38b2725-7e47-48d4-a5fc-c35f9a4b0bc4", "value": "6144:UUERgualkYXbjYZcn8dKct2I+UrfapDMPz4qYpvOoKgs/G:iPopnmgUrXUhGgsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788256185, "uuid": "3c5ec862-c3f8-47b8-bf01-e49882689f31", "value": 249096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788256185, "uuid": "7eeb5575-a00a-4c0f-b603-e03edc4de8ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256185, "uuid": "3a940ec6-dc1e-47d3-bfb4-a181aeb2285d", "value": "library.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94bdf8a4-a5d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788248075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788248075, "uuid": "2920e036-3fb3-4578-9e02-b8112db84a9c", "comment": "Malware payload (Vidar)", "value": "473a89208292a810486865506ce96e12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788248075, "uuid": "fadd84e6-fc46-41c5-a25e-10a98e7b26e9", "comment": "Malware payload (Vidar)", "value": "c5f6f113d981f1a5f1fed15558d381d1b3a4042b2e60ae3bf554c9a96f1a89df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788248075, "uuid": "17a8f858-179d-4033-9268-739fc073651b", "comment": "Malware payload (Vidar)", "value": "a41b6a3892c931c6f628ebce194b256168c125c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788248075, "uuid": "8c1c7b3c-4bf9-4d69-8dcd-3bbc90b42477", "comment": "Malware payload (Vidar)", "value": "d654a6df5915466027c12547bcb4e99c9fc3d3ed4afc0cc26c9be6b3ca2bfd0547df613650b5d941dcd29c53600a2238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788248075, "uuid": "026cc784-7f55-402b-90b4-dc01204034f9", "value": "T108966B0BBB51A1A5C095EE34C2764211A6743C4DC33937FB1EA1EA742F267C2AEB5F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788248075, "uuid": "42ac2f0b-6876-4d13-82f9-d4f242d6a2d2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788248075, "uuid": "4fb946bd-46de-402f-b1a2-3852c306d0d3", "value": "49152:WsB7F98dX4ASHS+Y7ST8Aot2kg2Sufmryob63CzJlG+NyCDirz1QQOpmkqgt9u5l:WaA2b2FmGQJFN/DOyBm9gt9CqUqQpF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788248075, "uuid": "ae7e2326-3786-4348-b33f-64dbc0ba1f21", "value": 9112960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788248075, "uuid": "b6420141-45da-4213-87b0-8ac2ab1bd8cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788248075, "uuid": "c65aee8c-8082-4950-9061-bf4896a67f76", "value": "c5f6f113d981f1a5f1fed15558d381d1b3a4042b2e60ae3bf554c9a96f1a89df.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647042c0-a598-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788220936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220936, "uuid": "e63d6230-13d2-48b7-8c51-62066691c652", "comment": "Malware payload (Mirai)", "value": "9f680fd891ea359bf379cc5580710233", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220936, "uuid": "0f87ac63-4b98-4ce8-ad2f-546da0574484", "comment": "Malware payload (Mirai)", "value": "c6b8b6530e5e43df058648b4004b66aa992cdbfdadc879a4ffe8f56f2c8dc63c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220936, "uuid": "bfc08ade-59ec-4b17-b374-ddeec8a62ca1", "comment": "Malware payload (Mirai)", "value": "136282a2faa07b3b6111877648a8d4ab3499ec2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220936, "uuid": "8789df9a-caf3-43e9-869c-9278443e135b", "comment": "Malware payload (Mirai)", "value": "de4320184f443776b379ff03913a48e47d1472b30b4fbf46499b397abe10f2de331231e64fd912e19f070829f7318e44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788220936, "uuid": "7925883e-eaf7-48d8-a1b6-05805ec08c55", "value": "T1E3836CD9F683C4F5E81308701037FF36EA72C6FB7268E647D3A85976DC62502A502A9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788220936, "uuid": "ccfa6b4a-9e2d-4513-8c59-8baed31cec3f", "value": "1536:Aw2r81ElKcYDmOwYPX/M7IV4SbAgvvXBVFAAtSqyWCT:MdQDaTY//MsCSUgXxVoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788220936, "uuid": "1eb94151-bf78-4362-840c-1cc3061bcc37", "value": 87636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788220936, "uuid": "f672ee13-16e5-47df-b0e2-65acef1eb179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788220936, "uuid": "cac44407-d560-4a37-90d6-461cc54693a8", "value": "c6b8b6530e5e43df058648b4004b66aa992cdbfdadc879a4ffe8f56f2c8dc63c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d56c0d1-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788278128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278128, "uuid": "ad13ba48-ab68-444d-9ea3-50d41abea132", "comment": "Malware payload (Mirai)", "value": "bbbc9a9cea529b079dd471c072084e76", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278128, "uuid": "bceb0ecb-65b5-4540-8cd9-d2128b95b9e1", "comment": "Malware payload (Mirai)", "value": "c6d3361a826b08c4e737948a6d7bea4d44539185c3ccc5c456418ce4706397a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278128, "uuid": "cf0266d0-d5d3-416a-841a-fee92d19cb55", "comment": "Malware payload (Mirai)", "value": "1043bd7b5980e68be6d1dd3efde6b1429ea18c2b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278128, "uuid": "757eaa96-9c0a-46e0-acd5-6d8fdeacbc48", "comment": "Malware payload (Mirai)", "value": "7a56a8cd3731088fb6f22b18190072d3d27c2d22c934882b336527543776fbaaf179c5a8f6f1a0aab1329e3efebacb9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278128, "uuid": "52035938-6cf8-4912-b534-e0ed23de7d3c", "value": "T11B735C49F343D1F1D94705B0106BFB3A6B31AE610215DD2BEBE4FB72ADB16825016A6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278128, "uuid": "b720d4e6-840b-4953-aed9-52b72139214a", "value": "1536:8t1fLfHf3sJzDAE08FtcShzZlnLpS81EPRxFUj31gOFQIWuQ2IFr:8rT/5E4ElLgQKOkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278128, "uuid": "c65bf541-5be8-4556-80fa-28afd3fa6a1d", "value": 74632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278128, "uuid": "e23549af-6e6f-44f2-9d99-d8dce01bb125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278128, "uuid": "b56f5da5-9128-4e33-b467-4b4b26acf58d", "value": "main_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5893e6-a5db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788249918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249918, "uuid": "fd5ab4a4-e6ad-423e-a656-c144a8e27972", "comment": "Malware payload (Vidar)", "value": "6aa6d5b82ddc1dde86b8c685b99c3b89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249918, "uuid": "9bdc8749-2e5f-4708-b642-226f221c9bfc", "comment": "Malware payload (Vidar)", "value": "c7681c2c63f0d4b98e3e708a7997f0fd0dcd180eec6c94aa769c7568488f5433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249918, "uuid": "98172f1a-be5e-42a3-826c-9062cb914753", "comment": "Malware payload (Vidar)", "value": "6eb90a40a226ba995c8eb7e869ab47db78990c6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249918, "uuid": "57a4d861-b53b-4f48-a91f-4cadc5807f62", "comment": "Malware payload (Vidar)", "value": "31b932c730a1e4a79dd84ddfefd040e16d58414b8de2e4adf88e01446f2500407ba8fb609d136401b882d9b9c9660277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249918, "uuid": "ececb107-706b-4cea-bd43-b152ecbae121", "value": "T1C028334B7F859964D5A68F38C1764221763A7C48C73533AF2EA1A6743E313C16DBAF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249918, "uuid": "d4ff7dad-2e9f-459b-b5a2-4c9ef59c3d7f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249918, "uuid": "cf3334a0-e91e-4b03-8347-a5b7dc09804b", "value": "1572864:ptaYbWxLxzU9Fdi+wurLn+hvckeywC19Dh1ibFne90DETOfyRyu1BJpYJc:mJU9O+xrL+eNE1Ca3TOA1BJp6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788249918, "uuid": "ea3be2ed-5a42-4ab5-9ab4-4beee619a5a4", "value": 96565624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788249918, "uuid": "5e552476-54dd-49fa-ad2d-4893c46a355d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249918, "uuid": "8e207526-6b79-4dea-b0d6-42960e761705", "value": "c7681c2c63f0d4b98e3e708a7997f0fd0dcd180eec6c94aa769c7568488f5433.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4db36bc-a5db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788249901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249901, "uuid": "260052d5-9ac9-47a6-8da6-9191e50dad49", "comment": "Malware payload (Vidar)", "value": "a4d13e782a2f1fe7f59d6c60539908de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249901, "uuid": "4a29dede-7c37-49c9-9125-75f48abb32b2", "comment": "Malware payload (Vidar)", "value": "c786b057d8f4e1d2c73916a51a48928eacd151b2a46b2f3c4ebcf497401f1190", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249901, "uuid": "3de16f78-153e-4a4e-8a2f-865198506b83", "comment": "Malware payload (Vidar)", "value": "b791dab52b7e881ebdc039c6523cd1efccefa130", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788249901, "uuid": "47c309e9-ca94-4311-a314-ec48403d20dd", "comment": "Malware payload (Vidar)", "value": "c1626e68dee369d9b67779955148a2377a2ccbc94628c48db86cee03617b45733d6869b103bb1731eb5ccd8941be2b3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249901, "uuid": "ce79d221-9611-40e3-80d2-8622ba25ae20", "value": "T1E32833567E859864D5AA8F398277422176397C4CC73633BB6E90A2343F317C26D7AF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249901, "uuid": "be9e4255-f729-4cd6-936c-5b58bcbefc84", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249901, "uuid": "820dd5a9-1fcf-4259-919e-f6d4ae202e18", "value": "1572864:ptaYbW/XCNObnWw41YswKTUg+M4pa+sVaXyqvtUaIXDq7cjYSef53zNORR0+l8Mu:2yYDWwiYshTt+Pp1soXyqqaIzqwYV53/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788249901, "uuid": "7f1b4d28-884b-431a-a973-3693f1c8a813", "value": 95517048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788249901, "uuid": "6d654247-bb9a-49ec-9326-02eb61e85d64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788249901, "uuid": "b29a929c-e712-4b52-9a4d-a9a30e4b33de", "value": "c786b057d8f4e1d2c73916a51a48928eacd151b2a46b2f3c4ebcf497401f1190.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d5a7af-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788243546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243546, "uuid": "eaac36e0-e16b-4043-ae22-9cecf9efdc84", "comment": "Malware payload", "value": "c62ecf9cc7766a5516163add570bff31", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243546, "uuid": "b067f77b-43f5-4d72-b845-ef28c831431d", "comment": "Malware payload", "value": "c86aa51632a82ae28d0312d0b7b22b1ddabeab50e5b7a2012fbd7bd3d80971f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243546, "uuid": "58653ecb-a45b-4967-b677-db7cd5ea5990", "comment": "Malware payload", "value": "1a3bd1727d63bb61fbecd0541f3b255cdb9dfaa5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243546, "uuid": "4f2a1123-3ff5-485a-bbae-9ad7b345105e", "comment": "Malware payload", "value": "f454cdc08cae4db622b6354da0fc7eab9356e3e4d2ca603f757e34c8a46338fef02a62448979774956f805fd1d8de9d7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243546, "uuid": "6cdaa0b8-3668-4d40-a8f2-14a1ccc70044", "value": "T1466467C8772556657266E3EDF2EE1811FB244126385B4EE7B0AF40652F72822D4CBCF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243546, "uuid": "c2ab3cd4-a69b-4fdb-a786-7e3d8e9b3572", "value": "768:wDO6gjhhhgjj9eMZcdKX1yqM7+QRWilmrSrnRThRrIrSRTDde51ykIOoP4IQLxe0:4ghgfoMZcyIiI7NO7gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243546, "uuid": "68974c27-1d41-4456-bc0e-3169b0b399d0", "value": 318230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243546, "uuid": "98795138-a8cb-4dc0-a092-b4c02e6c2895", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243546, "uuid": "f7e856f7-858b-4060-acb4-253f417ac626", "value": "Comprobante de pago BANORTE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b4d448-a598-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788220931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220931, "uuid": "e51b0d27-44a7-420d-94ff-7ac71c658348", "comment": "Malware payload (Mirai)", "value": "19c420396cccb8801119f3602eab2f4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220931, "uuid": "9bc9289f-b01c-406c-a21e-ceba34f049dc", "comment": "Malware payload (Mirai)", "value": "c8fd41ba910705bc0a13ec8ccabbc13bd0217a6f0ba5f37f2ca45c63b89cc033", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220931, "uuid": "62345b5a-6bd9-450c-9531-8dc446816a0c", "comment": "Malware payload (Mirai)", "value": "eaad697aede9678f233aeca1696d7c5c0a598332", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788220931, "uuid": "58676297-30cf-41be-ad1f-f3550a6ddf8c", "comment": "Malware payload (Mirai)", "value": "258193b0153c4098197c1ef4f549bec5818f95c341cad43f19b78a94b3330e7c715e50e9060f876cec38aae83dd27646", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788220931, "uuid": "7042206e-0365-4a36-9be8-f09f21d77d64", "value": "T120A35B02B34C0A43C2971DF1393F27D6CBBBD9D122E4BA85791E8B459271E37194AED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788220931, "uuid": "ec7a6337-b6cb-49e6-80c0-1c3156b29432", "value": "1536:HTLl6+R1Y6RooF9AUeBWxA9BiuIomQxgrHs3Mh40477j44ypqyzStlI:Hl5s6RooFJxY75xgrHyMh1GByMHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788220931, "uuid": "09a13d0d-af46-4ed9-aa32-e9f21580b05f", "value": 100160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788220931, "uuid": "5db2e0d8-1f83-4c0a-bd3a-ded1f2332974", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788220931, "uuid": "34c49f2d-5bfa-471b-88e6-05a257a72b49", "value": "c8fd41ba910705bc0a13ec8ccabbc13bd0217a6f0ba5f37f2ca45c63b89cc033.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8290d4-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1788278316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278316, "uuid": "04509000-3c50-414b-90ff-55c27a7f17fe", "comment": "Malware payload (DDoSAgent)", "value": "336c16a6cb705c02b203cca6605bb491", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278316, "uuid": "16f51bf0-8e45-4e97-9289-6d74a6e60db1", "comment": "Malware payload (DDoSAgent)", "value": "ca144e29fddb1470ea6f8713249af3f0c979b6af572d9cc2944e1e665af024c6", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278316, "uuid": "b3f927b1-bcf4-4839-8a9f-38880c62f615", "comment": "Malware payload (DDoSAgent)", "value": "123f623578b5845642d21e725835d4ca8c350aac", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278316, "uuid": "d45434da-52ad-4ffb-9393-3258900b7c7e", "comment": "Malware payload (DDoSAgent)", "value": "6f1a7156e1447f4a97337838038bf6c5f221552b45d45cdfdea07d251efc50c19d45a41f7fa158de381c2739161c8304", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278316, "uuid": "8f201ed3-ae44-4995-87cd-a7c93677c307", "value": "T1D6764A13FCA515A8C4AAD534CA729223BA717C885B3133D32F90F7682F76BD06A79750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278316, "uuid": "dad95604-a82f-4a7d-9b2f-8bcf596e15e6", "value": "98304:IeZw9gr6cYPP1j13zabWLEpu2wsi3ugYEu:Ijd331xzanXU3Du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278316, "uuid": "cd1053f9-1c71-4955-97cb-ac1f42860b04", "value": 7643320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278316, "uuid": "5ec18f44-8af6-4cc0-9f7a-d315e1352dac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278316, "uuid": "ab9748f6-f7ed-464b-b4c9-da5e293dfc49", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b510a5-a609-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788269584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269584, "uuid": "cab21e6e-66e8-46dc-8ffc-098e9ec94c4c", "comment": "Malware payload", "value": "d12bfb41c0405c520327505c63454e79", "object_relation": "md5", "Tag": [ { "name": "AkhassatStealer", "colour": "#8EE929", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269584, "uuid": "a88f04a1-70a2-4ab0-937f-a10c31309d4b", "comment": "Malware payload", "value": "cb7f2a33362fc87c3417b1112647acf88d53991eb73a0c39a1343fe9e97f98c0", "object_relation": "sha256", "Tag": [ { "name": "AkhassatStealer", "colour": "#8EE929", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269584, "uuid": "bb4e30fd-4443-48ce-a30f-79f8c1ba8ba1", "comment": "Malware payload", "value": "3533ec0ac0147567419bfab8ef6ce4256783169b", "object_relation": "sha1", "Tag": [ { "name": "AkhassatStealer", "colour": "#8EE929", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269584, "uuid": "f722fc8a-daab-4623-830a-933d95e5c897", "comment": "Malware payload", "value": "4a81b4dc9a021e2ef0e2ac06826fd5e573886d1588c0a1ecfa58563661f207f74b8edca89076aed3207bd201ac9f3977", "object_relation": "sha3-384", "Tag": [ { "name": "AkhassatStealer", "colour": "#8EE929", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269584, "uuid": "8766e021-e0a1-4e13-9b87-ba9b6f06c148", "value": "T1EC558E46B7B400F8C157C1B4C9155A0BEBB2780617B4A7DB46D08A6AAF63FE11E7E334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269584, "uuid": "9aefde72-c001-418a-875d-b1b0145c88c6", "value": "01d9e97168674ef602479abb6c063781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269584, "uuid": "226bcd3b-fbeb-487f-804a-7339bf1a80d8", "value": "24576:dUxhBEGJlQbRh7sKkWD5v9LkVa2r/2FyTwWeuP3WsVtbBurRID6S76sZBvTOJCc4:pGI95v9LkVa42+UufWsVDuSNZoCcPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788269584, "uuid": "f69e5ca3-cd7c-4e3b-ac14-2e58ee5ee783", "value": 1388544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788269584, "uuid": "5fecb149-8c20-43c3-a19e-c60c02420a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269584, "uuid": "f1981d19-742e-42d9-99db-3b702688536c", "value": "cb7f2a33362fc87c3417b1112647acf88d53991eb73a0c39a1343fe9e97f98c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd386346-a5cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1788243472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243472, "uuid": "f6552483-c334-4b74-83f0-69a8c32bfc57", "comment": "Malware payload (Formbook)", "value": "80071bd9a0e255717d6819d08839761a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243472, "uuid": "545ae7ff-7f9b-4e8b-8314-f137e16794bf", "comment": "Malware payload (Formbook)", "value": "cbd191b91c6fcc3ef7700ae5457d30f4968d1f78242f188ac16adea77b153f0b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243472, "uuid": "05f4572e-7501-449e-9d41-49e6f6b68c40", "comment": "Malware payload (Formbook)", "value": "eccd2356ade7d417251a2fddbb267da78b233969", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243472, "uuid": "12d02c86-ce4c-40a0-8890-ea9ad957545e", "comment": "Malware payload (Formbook)", "value": "4d543ce42751cd2e1b203c42521e2c0ac0de0a76b65c5187e761350c96cb096bd51ce52d19253293430c9b70b3b14464", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243472, "uuid": "384c48aa-464d-4a78-bf4e-8f6db4c13843", "value": "T1B4920E05589238849373677B631BA8D0F7BB176B0144494BB8BCB8819FF2D1DCED49BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243472, "uuid": "90902733-6b82-4487-bf93-8a5c8af14d74", "value": "384:5UIheQKVDiUi/PeNkyvNAedmy2BQ0EpSgQrC37n8wZn/2VJ2156656BkTMcB43xt:eIheQ2DiUi/PeNJvNAedr2BQjYgQrC3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243472, "uuid": "67399e5f-bd92-410e-ba34-8cc57a8a273f", "value": 20937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243472, "uuid": "ab119dd6-305c-4d4f-803c-d4462a479d59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243472, "uuid": "c2b462ec-3217-4ac1-ae1f-9962b6c8bdcf", "value": "RFP-000000189836 (AA-26125-MLNG) 01092026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92b5169-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788278308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278308, "uuid": "900b6c0c-1d26-41e0-a927-bde6e5c5abfc", "comment": "Malware payload", "value": "3373c77f19d8c373d72ad6aa83fbbe32", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278308, "uuid": "98d5c884-71ff-488b-807d-e3fe4ed13e55", "comment": "Malware payload", "value": "cda6d571a59b48b3756dc5171103e1a10433226a62e8d901b1b5c1430df00a68", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278308, "uuid": "90b15953-7562-4096-b4d2-656ad8621c67", "comment": "Malware payload", "value": "46b3682cdfc5ac3101f4e1ad84fd10479002b980", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278308, "uuid": "2fa5ff6c-be29-4a2a-9a5e-6ad9aaba8509", "comment": "Malware payload", "value": "1c6f137e896fe526e60948767617866662a3551b7b39061c8be4e22e479cd91733ad96c1259cece428ba3b2183aa3bdc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278308, "uuid": "3f1d1508-624a-43a2-9353-c8f78bec9733", "value": "T122C27D966A967C44BEC94A3E4CBE2B1D6DF5C3D1324942AC3D4B3C719C11FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278308, "uuid": "d95908cc-03d6-4d75-b49f-9d582adf24e8", "value": "768:g8vCB+25j6es8Ry9FYpMSUpi+20qUpi+20YQX:g8l25JUd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278308, "uuid": "6ded0fc3-6894-4168-b758-ff7d45f1beee", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278308, "uuid": "c1f5ca59-0485-4a56-a1bf-2f4f2ea5b451", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278308, "uuid": "a5333f71-b7d0-4940-b2d3-02ffdd7abdec", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88546296-a627-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788282414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282414, "uuid": "cf7b5d4b-157a-42be-bb35-38333779d824", "comment": "Malware payload", "value": "2f7d55644e69de50622323848fb3f837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282414, "uuid": "c32575dc-271c-4a2e-8158-07b171f924f2", "comment": "Malware payload", "value": "ceedf7563caa830f856d8da877da9834ab35ffeacc38df1d7df87485682bf6f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282414, "uuid": "5b76e0c2-c96a-49f7-bcf1-e8324f3f0bf5", "comment": "Malware payload", "value": "70275aeefb8903fac8258b5860c5b43b6b2681f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282414, "uuid": "1f6a847c-f23b-430d-8686-4d6ed2fc3aeb", "comment": "Malware payload", "value": "34e7ad18ee3b9212c028b956eccd23788aa6a3dc4175dcb1de606265ec5bbce687d2e0bc1f1df2b1bb7099b07eafa068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282414, "uuid": "ca31d1f9-63d4-446b-9972-b9b2263609e4", "value": "T18BD7237D62E26BE8855F0F0497863BDD06D0D596DEED0A0A9DEE1C002F30E22879D57B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282414, "uuid": "471fce8c-4c3b-4b87-91a8-eb6f6d81ea0b", "value": "1c82e3db30b9e8cb0366f2d2f2e891ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282414, "uuid": "ed3330e5-fa54-47e1-a8ae-4d6a78eda722", "value": "786432:cAqwWdfQWRD5+zKFTqev1WVxp92mj/ExMMCXt069n037kZSWSqc4qCXISZ/Jymp:tXO4sxn1WnJjcdCt0687aH5qCXI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788282414, "uuid": "b4e7cc07-ecbb-4e7e-971d-0a6f1c9b26ed", "value": 58225152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788282414, "uuid": "1da48834-e2d1-4f59-9a50-47eaa9fff21c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282414, "uuid": "d2942419-72dc-4cd7-8766-42d889298896", "value": "Danilhex-Valhex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2fb608-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788243603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243603, "uuid": "2be352a5-56f9-4fc6-844e-f951302e0317", "comment": "Malware payload", "value": "4c9c3abcaf6c1d2fc174a19e59f88ba9", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243603, "uuid": "19deb4dc-0bd8-4c79-a415-b4e4c47e348d", "comment": "Malware payload", "value": "cf448d2569f935b69074d7df8398d8552b1d294210c7dd818fe202945687bfe8", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243603, "uuid": "41393f5a-80b7-4bc8-a606-920751229cb3", "comment": "Malware payload", "value": "e9d9884590ecff201e4984cc580f904c3cad8a5c", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243603, "uuid": "764edf00-8ed2-4c1f-9f42-a47729b747a1", "comment": "Malware payload", "value": "efa34c1d03a87835e5f5b9d4ff621f916b986cc677e92e4ccb8980eee2aa3be3c38b07317b389a73676abb398b953f8f", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243603, "uuid": "b4cfa341-6887-464b-aa51-3a96894d094f", "value": "T1EBA39B682640C483ABC62710F8D7BED4E1647AE6FDDC4F8050244B51D69EEE79C90B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243603, "uuid": "20af8947-8aed-46b6-a2ec-a7fc95ff18c6", "value": "1536:ri270g/Wjji/rOqzl4z34YN3oatM/xlToq4gc2975gDOq7754tAw9JF05xXbWtoO:1hv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243603, "uuid": "186b0c0c-a2ea-45dc-9045-f208619e8e4d", "value": 101207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243603, "uuid": "66160649-b1fd-4510-8c9e-c9349edcaadc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243603, "uuid": "53206ab5-3f43-40a2-90af-fd58e5b5e627", "value": "F\u0130YAT TEKL\u0130F\u0130 HK. FORMU 6003045029 Teknik \u015eartnamesi PO 3362 2026 032.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a218e8-a628-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788282698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282698, "uuid": "d5c59d01-37b8-4999-bab6-91021c3451ef", "comment": "Malware payload (Vidar)", "value": "85087b7cb903189814893d0e7813d409", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282698, "uuid": "a591b1d0-e0e6-4cb0-8c46-30257850f104", "comment": "Malware payload (Vidar)", "value": "cfb8b2516dc22e5d7ed8f141882f1525a62224321a77b5316731f49c7d0da1ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282698, "uuid": "e3b27544-3e9e-4b79-8bf0-b9d73b104770", "comment": "Malware payload (Vidar)", "value": "c35ee5c7cefdd5b48af11b734b3897a84514d3b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282698, "uuid": "3a25f71e-a249-4cf8-8153-7e2b40b6d217", "comment": "Malware payload (Vidar)", "value": "47b15fe219df577ffea8692745c82d7971ae18cc1d146790f9d0d83955ef91a9cfc6190cf547e5e24507002df77b2652", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282698, "uuid": "bc40f06f-da2b-4b6a-ad92-3ca48ce6fc89", "value": "T100F649077B8A42E1C59ADA39C07B5721BB35BC4CCB3437A72E5061B02F653D2AE75B48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282698, "uuid": "daa24d0f-532e-426a-aad2-4e828a88f869", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282698, "uuid": "3c1c9ad9-37b0-4068-8eca-bb48980b366d", "value": "98304:X09stb9oj+Rjvuo7rx5XL2gk0Z1xFQ43S7sLG3qUL:XeI97rx5XL2gk07x+x3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788282698, "uuid": "e453f957-48a6-4ead-ba96-36352fc55b54", "value": 15963512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788282698, "uuid": "86bb2ef5-df82-45e8-934d-68275f4b7932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282698, "uuid": "c42b5012-4ef2-40ba-bfe2-f4be49f3f133", "value": "cfb8b2516dc22e5d7ed8f141882f1525a62224321a77b5316731f49c7d0da1ad.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81b45f0-a5b0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788231438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231438, "uuid": "a9f5d53a-2b62-4657-b436-10c151fd25d5", "comment": "Malware payload (Mirai)", "value": "b933dcd32ac11efcf198c15a710d229c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231438, "uuid": "76ce4b01-b5ca-495c-a751-22898f23506f", "comment": "Malware payload (Mirai)", "value": "d060ee9b0fbd1f2c3067ed1ea0c105deaa1985e78a04fc89b599841433d52b9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231438, "uuid": "f89dfcc3-bec9-47f0-b281-7ed004ee2cc7", "comment": "Malware payload (Mirai)", "value": "ab4e51784796be677d72ec7d781bbffe4326939b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788231438, "uuid": "99db3fbe-7777-4cff-a914-5822f1a93fc0", "comment": "Malware payload (Mirai)", "value": "f20bf0d9669e036a220ea25f90aa2b3fcabce2e6095811fe875f5161da13ba870da859bcf7ab3e25033e4b5acbb6493b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231438, "uuid": "4a0e9c61-534e-4135-9594-43eba940b0e7", "value": "T1CFC3F84DBF611EB7D86FDC3705AA2B4228CD555721A93B75B170C928B20B24F19E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231438, "uuid": "fc543dee-b718-4ce7-94c6-45c1b0dfe7d8", "value": "1536:1SmmcugIHP1HGCaISAH1psOZeKP77GGYWs9R6TePcPQzvZSYtC3Wp2kAuk6PGy4u:1rmTgsP1HGCd9ebmeBzvLN3PHir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788231438, "uuid": "546179f9-6b5a-43e3-8a7b-65df876c0cfd", "value": 129160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788231438, "uuid": "12d1b9d7-8455-4b22-9d25-a6f799e55a56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788231438, "uuid": "a1d09394-a6cc-47b1-872a-c108de06dee6", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183c0c79-a64f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788299406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299406, "uuid": "80eb433d-f82b-4dcc-af02-c4b447ad002a", "comment": "Malware payload (Mirai)", "value": "2dccf71c46e0de992276c7bcd0fe16b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299406, "uuid": "982780f6-a9b3-4adc-b4d3-a8955e6aeee4", "comment": "Malware payload (Mirai)", "value": "d1ebe6c654f0fc5e3b42ec77b4cf2d87dd74b5b63c1ffc1d5e5a6d2cb0359fb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299406, "uuid": "dff36152-fc13-42ec-a2e1-9a1fc769f9c0", "comment": "Malware payload (Mirai)", "value": "dea7237752b523d25c77ea808677381cb068ff66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788299406, "uuid": "f75978f8-0bbb-4d8c-bc44-e0bc123feb1f", "comment": "Malware payload (Mirai)", "value": "6e252f248dc9766f1e1776ddfaa70dc7e3824bf691d5dcf0a3fdcb327e34f5b2ef6d79e142d661f68a1ccd0c2a5e9a3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299406, "uuid": "113cab6f-988f-4a88-82f6-5c5f4fa89099", "value": "T13B04F808D965673FC7E263FEEB4A428D33370B58A7D7332199342A752BC67986D39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299406, "uuid": "62ff9559-1646-4a89-8680-e9044ec53614", "value": "3072:wp77dSw7XJJDTqd8R+HafNvFWN0V38HCo1BWl+kHQKZM:i77dp7z9R0a1vi0VgCo1BWrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788299406, "uuid": "4b2c37eb-dce7-4cfc-a91b-b90f47712a39", "value": 180556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788299406, "uuid": "ba13f607-02d1-438a-8095-bf956b00699b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788299406, "uuid": "7ab93444-5a7c-4402-980c-039bea844021", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1cab74-a5cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1788243447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243447, "uuid": "cd12fdc8-792d-4f1d-8ef6-df14ebbfbed2", "comment": "Malware payload (DarkTortilla)", "value": "6b058559a54275746bfc645d5c5214d0", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243447, "uuid": "4185e638-67ca-4d38-909c-4d096a577953", "comment": "Malware payload (DarkTortilla)", "value": "d2a4ad1db761a3776160317ba0325d100e65d2baea62d52effee899ab5d355a8", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243447, "uuid": "bc5e887e-ad32-48b7-857b-7b31a6adabfe", "comment": "Malware payload (DarkTortilla)", "value": "46cb66556e0b2b44df79d815fc27cd65859d759d", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243447, "uuid": "456e6a96-20c0-421f-a804-2d136e435af8", "comment": "Malware payload (DarkTortilla)", "value": "e2459dc4977febe552e19760a2f88e1afc186b417c8413ad959c49d30f0824deb078fba3dea1600b98623b8e01b5d92e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243447, "uuid": "d2a9c457-3e41-4434-b64c-8b0957c9f8d8", "value": "T10E45F02112D99F59F5BF97348875501887F3BC46DF31D7EE3E8C18EA3A22A818661723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243447, "uuid": "69eb3eac-c034-4ed8-95f5-8a3369544580", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243447, "uuid": "0ed3d33e-d9ec-47a7-b6b2-73f76ca7247b", "value": "24576:4cUAtPa6ObJ+SAmkqkX7YhQzi5IO7WL4iAJR:HXPalESAmyWQzmHWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243447, "uuid": "ae65bc9d-1462-4767-974e-24db2d0c25f2", "value": 1242624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243447, "uuid": "a0071b6e-9ac1-4d2b-b0d8-6bf1ad0c67f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243447, "uuid": "60865810-2fd5-4e2b-9cb4-27ef0370b538", "value": "invoice and packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4811a440-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788243652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243652, "uuid": "a7f7cd80-e9ef-4840-8c95-6398c474e95d", "comment": "Malware payload", "value": "f7d7d0c72af93650cd410a7d03055a93", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243652, "uuid": "bb07da16-2696-47d8-a322-06e2c34f377a", "comment": "Malware payload", "value": "d5d5d9b07a2f376e6965ba65f3c2e244ffd31ebc3142832b4c65727cafb40ac4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243652, "uuid": "00870345-a388-4d7c-b5b0-e58e7f361737", "comment": "Malware payload", "value": "75dc511ea2445657ad529f1c1f3724d0b0f186d1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243652, "uuid": "a04450e3-fbbf-4fc2-bd1b-2019ac87a35d", "comment": "Malware payload", "value": "c644b479565614f89f0f0121b4b2ffebe900dd33299c2bbb477dc76ff4e5722a4193ebfa5006f4f626993a6ea291a4bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243652, "uuid": "73afac7d-73c4-40d1-b041-fd175fbde999", "value": "T17A920E05589238449373677B631BA8D0F7BB076B0144494BB8BCB8819FF2D1DCEE59BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243652, "uuid": "e0447891-9a70-4255-8567-fc65f0d12cde", "value": "384:5UIheQKVDiUi/PeNkyvNAedmy2BQ0EpSgQrC37n8wZn/2VJ21j6656BkTMcB43xP:eIheQ2DiUi/PeNJvNAedr2BQjYgQrC3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243652, "uuid": "f18db98b-be3f-419a-9beb-6d5895067e23", "value": 20913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243652, "uuid": "a14ebee3-9eb5-4f6b-9466-965f13e55c41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243652, "uuid": "f90c3466-2b6b-44de-9cbf-51e2b53b5d2c", "value": "01-09-slip pembayaran_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d244a59-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788278127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "222379d1-ce71-472f-9da2-f31f6f63ba02", "comment": "Malware payload (Mirai)", "value": "4846e0012ef7313b067054fd21b1cdbf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "50948035-57ef-419f-bbb6-ceb3a925b2e9", "comment": "Malware payload (Mirai)", "value": "d5f123e391785d3a44332175605e7068d7a6bbe1d0b3120a3e3bf794c6c77b76", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "497548f4-008a-47d5-ba43-6d5d375cf6b9", "comment": "Malware payload (Mirai)", "value": "bba4a8b5e6a4d40cc661ca7fd0182f44d3dbfcdb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278127, "uuid": "21b5753d-6a53-473d-9758-ba897fdc1097", "comment": "Malware payload (Mirai)", "value": "52233db30993fb889893bdc79c0e5e73433f01602419cc4628f9acd20394baaddecafa6a388ffd8ac7a26e1ec2fabe1d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278127, "uuid": "ba0b2839-01e7-47db-8be0-48b2cdf92cd1", "value": "T1F2D30941F8414B17C6D612BBFB9D428D3B2A17E8D3EF720399216F64378685B0E3B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278127, "uuid": "62a0182f-ff0a-49e0-b465-eeb6aec837ad", "value": "3072:EByQHgwPKWdnRWW8a4WqkLEPvB+l4jmF7U:EIKFX/V4WdLEHB9jmF7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278127, "uuid": "80d33adb-cb67-4e8a-9993-31577f92b5a6", "value": 142112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278127, "uuid": "d4b26a1a-6626-4432-b643-6734458b2dfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278127, "uuid": "fede5dc0-712c-4722-b45d-2167f7b70830", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f36e862-a59a-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1788221706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788221706, "uuid": "2b534adb-2167-4923-988f-926c32de8141", "comment": "Malware payload (NanoCore)", "value": "33970f0d2d3ba1f4d505dec41eb157e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788221706, "uuid": "34d48d13-1325-42bb-9c5f-e932c2d4b2df", "comment": "Malware payload (NanoCore)", "value": "d70fc0b690b491762a0f861cd129786e9e54c4a79dff6f7bd0b3a14c90b6ec24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788221706, "uuid": "c37dda21-a247-438f-bc75-5e0d90611450", "comment": "Malware payload (NanoCore)", "value": "05985936885fb7a0e70f4ea74aa5049695879952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788221706, "uuid": "d9a3c6f4-f36e-476b-8d57-9874e4d25ce7", "comment": "Malware payload (NanoCore)", "value": "3396522b9a6ae8c28d1d578413a3e9df3ca3623ae3d2269acc2b1f3f907292283bb10a93aca9eb9e4e88c7745ed4abfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788221706, "uuid": "ecb6730a-2cb4-4180-91c1-1da572d7b9b7", "value": "T13414CF2677A84A2FE2DE85B9611201538378C2E3DDC3F3EE18D855B39B663E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788221706, "uuid": "75974542-c1ac-4759-a838-4f9e42f59cdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788221706, "uuid": "cb51bd15-4547-4967-833e-436cc910c165", "value": "6144:MLV6Bta6dtJmakIM50uvImfVqflRj0vsg:MLV6BtpmklkGlt0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788221706, "uuid": "7cf55ce6-0f56-4f3e-8651-820205f136e1", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788221706, "uuid": "76e940da-7a10-4256-b573-539559d128ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788221706, "uuid": "2c495f27-11ce-41c9-bf2f-cd52b2193cdb", "value": "33970F0D2D3BA1F4D505DEC41EB157E6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd6878a-a60a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788270154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270154, "uuid": "e2dcf0c2-5787-46fb-9972-b40e2a8c5620", "comment": "Malware payload (Mirai)", "value": "2821c944caadf40a9e7bdda14970ff10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270154, "uuid": "dd074b61-300f-45c8-a489-74f29ba885c4", "comment": "Malware payload (Mirai)", "value": "d7d525ea073c80ee42ea93cc24008ec13007d5f7a10d52f30d789a7fa6e625e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270154, "uuid": "d34dcbc2-0332-4990-8d02-b225b13d948d", "comment": "Malware payload (Mirai)", "value": "d819b2a40eb0d2d00d93de424ef4b046763c80f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270154, "uuid": "63a5408e-b5d7-482e-bd7a-660b00f24373", "comment": "Malware payload (Mirai)", "value": "dcade6b51624f2ffa9e261e1fa4ccc34a2f52fe37c139285844c69acb5c3260bb19919b222a473d9562becd861408160", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270154, "uuid": "a88289ef-35f3-4ce7-8c77-e7974a5c8789", "value": "T18712B454F8C59916DEF43939FA7D158C3392C3F8F7BA7002C94C8A2637956254F2A82B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270154, "uuid": "43765f84-7e8e-4bd1-bbc5-c2c73d2bc114", "value": "192:3GCy+riXihw3ppJ2l/6xJxmKe6ZGGRgtKOWtByZ:24r0ihplyJxMSgtK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788270154, "uuid": "317efb89-0a86-434a-ae53-7ccdb9d9b968", "value": 9884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788270154, "uuid": "5f1ca381-b1cf-4d81-81dd-29a3ba54d25f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270154, "uuid": "e9ccd229-2bfb-4040-9629-e91fbf19d62e", "value": "AGbot.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d110681c-a5e4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788253760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788253760, "uuid": "fb84c23e-8a72-4a33-be84-4d3d76556c0d", "comment": "Malware payload", "value": "666bc7946a90c9dcc8577e4eb183cddb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788253760, "uuid": "64b09455-1f1d-49bc-9083-8fb5fda0a191", "comment": "Malware payload", "value": "d7e00109f11ab1320bd9f521460f52c5ce02968dbde854eb7d3bb999ccfef1a5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788253760, "uuid": "dc2eee19-d8ba-4719-981b-f85b3c3c6974", "comment": "Malware payload", "value": "555bb5e4d4bb499c0dcf71c5cb89bb75e804b1d5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788253760, "uuid": "add050c4-9569-4999-9a24-a600c4b2a8e0", "comment": "Malware payload", "value": "ef95806d3951032b431b88642810621780139c3acdb35a80a6f06c07177f7c8a9a73e173afa058995d2251fdad0b3b2c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788253760, "uuid": "82c9957b-9587-4c0e-a528-7aff04e8c735", "value": "T109236C661A857C24AA98D4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5A69D910871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788253760, "uuid": "88701991-54a8-4707-8831-ecccbe0e3715", "value": "768:AXRWNGxVq9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Ulxpcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788253760, "uuid": "2ef502d8-454c-404f-818c-c73b38286cf7", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788253760, "uuid": "fc3f220f-8ef9-483d-8673-033af93d6935", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788253760, "uuid": "b5455e46-56bf-4d79-b996-1441ee2f732e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690622e4-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788243707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243707, "uuid": "00824cfb-f4f4-49b8-96e7-e959f29841e7", "comment": "Malware payload (RemcosRAT)", "value": "c81190ee57884c75a9a7bbb269c58d27", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243707, "uuid": "d2469fab-164c-4a8c-901c-7de73649a517", "comment": "Malware payload (RemcosRAT)", "value": "d8739a18c93585e07e7f0993abd67fb75417fee70b078544262f754307539d51", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243707, "uuid": "0e348e75-cf31-45f3-bb1c-0f0872c3787d", "comment": "Malware payload (RemcosRAT)", "value": "bac2949b49c5829f5c99d0b574f5eb7fb2c6a39d", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243707, "uuid": "776a909b-eb3f-4704-9bb2-7fbb4bc04801", "comment": "Malware payload (RemcosRAT)", "value": "fd7f70b0b46de389dee64b7d8c560618a4034508b1e9f2c55771a036411556048fdbc9b90eeebe17cd553256f08f3e7a", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243707, "uuid": "0a721d51-4368-4d18-aba9-3bf560bb3be0", "value": "T175674E821FB46B79BB65C92A03A33F90C57191F98FBBBC196C34DC30C99D9C258C495A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243707, "uuid": "e9bd2567-403d-4bd8-9366-c1598c566207", "value": "3072:PyAhVXJnKqswwWSE8vo31zfzpeX8Aa6BKwIm0Tjxh4ZJ39/kuiU/qf/bm5au16uV:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243707, "uuid": "0e139a42-4d17-4686-9c24-ef09ef07fb01", "value": 32269310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243707, "uuid": "013b0145-f912-4d5a-8981-9faaf009631b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243707, "uuid": "74970fef-1c4e-46c0-89a8-b710cc24919c", "value": "FedEx docx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491ce7b2-a5c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788241935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788241935, "uuid": "61010476-f7b2-4c5e-a58d-e799e8c73687", "comment": "Malware payload (Mirai)", "value": "9ff88a27b162ed212cd6169d715d1479", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788241935, "uuid": "f19f4ae5-3795-4204-a238-ee57b570a5d9", "comment": "Malware payload (Mirai)", "value": "d97782cbbe27b84e57e235673707f5914e8c36f8dcb84cea4d817e877828d9a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788241935, "uuid": "d55ea729-564b-4626-8a86-d2ec18dd46b6", "comment": "Malware payload (Mirai)", "value": "6a8a52af6f372de5ecc68b9b23556762e6a0805c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788241935, "uuid": "0fed25ae-a760-41a3-925e-de61d011a48a", "comment": "Malware payload (Mirai)", "value": "df6c3a56eae196a455f5f4303d68bc3be8ffa0fba5799b220015b4e2aebd0ca6e83eff81dd5c05945f407b7dcbc3c1e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788241935, "uuid": "a858e690-8bdb-4b84-9bd8-be9b82d9f067", "value": "T1B0935B215CF3B152C6D3943F979F421AF166250B0188C61EBC2E5C6E7F462A0B7BB6E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788241935, "uuid": "c4be9054-ed36-4958-a29e-2157b1ba3053", "value": "1536:ZTdFOESZLnJmlpVgmpJCwhpNoi2q4mzjZoQfB4rIJ1EssMZcywT03ImIys61XQuv:qn4lprrdtB40J1EssMZc/T03ImIys61Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788241935, "uuid": "07d4313c-b6af-465e-b2ac-eea6a64c5063", "value": 96872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788241935, "uuid": "c9db015a-2a00-4c14-b8e3-d643b79337fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788241935, "uuid": "17cb5f40-8ea5-42f6-a9d8-98c3592e6a12", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92763e2a-a60c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788270835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270835, "uuid": "177d3f87-8366-4f9a-b5ca-fcd2371e2371", "comment": "Malware payload", "value": "11f2654eaa478f496bd11ae12a81847c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270835, "uuid": "15fcd95b-8421-44c2-b49a-28603d9f5f9a", "comment": "Malware payload", "value": "da90247945835112b069398bdd98dafb34a5493279aae7a6d611668ef658d776", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270835, "uuid": "df0cdc18-9c54-44b2-a7e4-cb92bfb8b300", "comment": "Malware payload", "value": "50ed878e91619f6d7cf7c65acb72bd46f864bc44", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788270835, "uuid": "39986cd6-8c61-4fe1-9b81-2dab250fe658", "comment": "Malware payload", "value": "191bec3ca34ce6f3d8bb0f3875618c9d3d00e4f6a6c39dcf0e222dc7ba3b43c90fccc57779e7915abc94f45c3a5cbd07", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270835, "uuid": "95889bc1-bc0f-4d9a-aeca-a4dec00255f2", "value": "T1D1C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270835, "uuid": "ac54fd6d-9cc6-4628-b518-949b44ffa421", "value": "768:O8vCB+25j6es8R769FYpMSUpi+20qUpi+20YQX:O8l25J7sd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788270835, "uuid": "627d0c79-51e9-45d2-ab5e-40f532dd2eef", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788270835, "uuid": "1a95f8cd-59e1-4265-95ad-aa0fbdf0fb0c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788270835, "uuid": "81338dba-4234-43ab-ac1f-150dc46e6921", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8118089-a621-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1788279998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279998, "uuid": "97fb42e5-2b81-420b-8b87-19ad7e06287f", "comment": "Malware payload (DarkTortilla)", "value": "19da4519118795ad48070ae0fd4190bc", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279998, "uuid": "a8b6a2e1-ada7-4d04-b827-97c8a3452323", "comment": "Malware payload (DarkTortilla)", "value": "db25d1a378f932e8e6afd0ad46e0181a68310ab9e7a6e204ed7609e302082a39", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279998, "uuid": "ddeadb47-1bb9-452d-bf99-cc3ee3223a2b", "comment": "Malware payload (DarkTortilla)", "value": "265f486b74be610d8e16874a7ae4083b2edf4b89", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788279998, "uuid": "a7b6dc76-4324-4be2-9f9e-caa719ef1895", "comment": "Malware payload (DarkTortilla)", "value": "3c4f8bbc8e9ee3777a26e3337245bbaeed3d1d4e15cb838ea92e329c8ae95b4b59cf9e64dbc015281b7a87e6ca906542", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279998, "uuid": "e6752c9f-c221-41c1-ad66-ae553837aab1", "value": "T10835F11623885F54E5BF9B3844B5500507F3FC05DF22EBEE7A5C6DAE3A31A808552B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279998, "uuid": "7e4367bc-f4f4-4380-91cf-4b151bb0aef4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279998, "uuid": "48910ae3-9b7c-4b3a-85be-021c91aeaa6e", "value": "24576:SE/JyxwU+snmwBL5x7dmJhQzi5IO70L49:SE/JDULnhL5JqQzmH0Lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788279998, "uuid": "50b1ac58-8645-4069-8599-d74f2062ea3f", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788279998, "uuid": "31b81e97-452a-4028-8481-86fe4d461d12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788279998, "uuid": "ac0e1b75-4164-49b2-849e-64b486508eab", "value": "invoice and packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fac435-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1788243589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243589, "uuid": "e248fb95-02b1-4883-9742-d1c3c5376866", "comment": "Malware payload (XWorm)", "value": "5f25c6017a12bed9e7b3431549b553a0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243589, "uuid": "10aeb9c9-085b-4b9c-8e09-9519c1c21328", "comment": "Malware payload (XWorm)", "value": "dba9c332a989ee2ca9180ac52a758cb4ae8b0f490f126387d494794f439248e4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243589, "uuid": "231fc4ab-2a86-462d-8159-d82b20b59fff", "comment": "Malware payload (XWorm)", "value": "be23000bf1a1cd8df3cb649ddf01c4929e669149", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243589, "uuid": "998d476f-72d5-4583-8ddc-084a84c7956b", "comment": "Malware payload (XWorm)", "value": "973298688863f1c60269394f35ef9570df9f82085b1ead2572f3599141aa994f8c06d1a5893bab3d045809ab1ca2c425", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243589, "uuid": "da488e07-e77f-4b08-84d9-d6208447fe69", "value": "T19214F15333D05EA0C3A95DC4909FFE8FB6D33020AB09E48D5A79FDE62E1E796503191A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243589, "uuid": "400523e5-71f5-402b-be3f-afb249af6237", "value": "6144:wtXoaxn99T++FIE0gwxGMkFQ/Yp96VkcHtko2:wt4axn99K+FBGiFL96VkcHtko2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243589, "uuid": "d6336692-9df7-4a7b-b72f-823ee33822ba", "value": 205928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243589, "uuid": "6e8a2c3a-7b1d-4cae-8862-95cb324d5427", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243589, "uuid": "028deff2-7a2a-414e-a8e2-ce182059ca3b", "value": "bank details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d35da30-a61f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788278798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278798, "uuid": "c95749bf-0cd4-408b-8a4a-076f4d3989f6", "comment": "Malware payload", "value": "97693ec38d172ce0a80197d1206c853d", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278798, "uuid": "580cc4ae-70fd-4531-90a2-b2455613eecc", "comment": "Malware payload", "value": "dbf4af10eec48904a43f4043b0b39fe211070630d796e910d454d8364a979825", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278798, "uuid": "8f58cbd4-d9eb-4b0d-9701-8894d48560ae", "comment": "Malware payload", "value": "402f6101f6554841cea2ed61b395ae115e53f20c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278798, "uuid": "3c01e413-33fb-4a7a-bc87-369926ac7cdc", "comment": "Malware payload", "value": "2ec715aa041ca407187518dfd6eae904a7b1ac02fb925b4be0cf1519d8cf0c91d40b82a5b3f1aca4f3b058d5de28dd7b", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278798, "uuid": "e6f5ba3c-c446-4611-9cdd-7eb8f436b987", "value": "T13775AFE754B92372F6923B3186C19407C62535277EBF6073C5E42BBBBE908B95C81386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278798, "uuid": "27519325-804b-4a8f-bec0-8131f20f10b6", "value": "24576:COsiqnJI0xjZyo6h3PQ6FiVCNi7QvB8vtpmXNCAR4ABiaBq266:Th3PQ6FqCE6B8vceE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278798, "uuid": "d51d9c12-3e2b-49a4-82b3-fde415779fe6", "value": 1605120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278798, "uuid": "9ae43dc6-effa-463f-a85b-56304d188bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278798, "uuid": "9c94212c-a16b-44ed-bdd2-d5b22d6084ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76925714-a5bb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788235999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788235999, "uuid": "1a7549b0-8a07-480b-a316-ee5d66bb9f36", "comment": "Malware payload", "value": "37a985ef811d6776f715b550f1ba7057", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788235999, "uuid": "e3a3e885-b370-46e1-abdb-5332269f26e5", "comment": "Malware payload", "value": "dc07a6610471441482aa3261e1f5b49078f97be9177774de2abd569b62889f7b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788235999, "uuid": "f0a1f33e-bf79-466b-88bb-7687b3188aa6", "comment": "Malware payload", "value": "2e9a7cba03a063faccdfae45c6e01737bee201c7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788235999, "uuid": "5da94339-e6dc-48f4-8363-33ebb14b1266", "comment": "Malware payload", "value": "9f468bab8dd0d789be12b7a8766969f0ed10a63ad0f306b097091bbe09f19939a458709825215a82cac98365b262fb78", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788235999, "uuid": "2c0b9074-3ffb-4c31-a6f7-a99152644f56", "value": "T1E3C27E966E867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788235999, "uuid": "3f1e6ece-f945-46c7-a188-6ea44f12a7e7", "value": "768:28vCB+25j6es8R6y9FYpMSUpi+20qUpi+20YQX:28l25Jxd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788235999, "uuid": "c182e663-adf8-4222-8633-c0dffcbf5ed8", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788235999, "uuid": "2b6480d4-ac7d-43c3-9616-3e941030aa1a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788235999, "uuid": "6663a7e0-b4bb-467e-8f30-727ab8b0c7bb", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c9bc35-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1788243587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243587, "uuid": "4abf7758-bdb8-4154-9bd6-ba54b5cc41dc", "comment": "Malware payload (RemcosRAT)", "value": "0f3f82ae8071027fbe1872aaf2430c7d", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243587, "uuid": "583b0c8b-aba6-4bee-b9d9-024591c6d2cc", "comment": "Malware payload (RemcosRAT)", "value": "dd1ad88c179c424cf1b09cc313e28b99e4cc642b3d68c9dbf6298390c55beae0", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243587, "uuid": "7e9a756d-548f-4452-8dd2-47ac47504e2e", "comment": "Malware payload (RemcosRAT)", "value": "f70ec8a5f542d6ddb5e7f59b4c6e212e6642cd6b", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243587, "uuid": "8a56c847-de24-4748-afb1-6c7a0d01a8cc", "comment": "Malware payload (RemcosRAT)", "value": "d48666b05c5e892e27c463db88edcb6b5c19b696d799dc05a50362b6292fdc4f46c3450f770e4a833edaebc6ca5f6e94", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243587, "uuid": "616373ce-48b4-4353-96f2-2ee3f590de36", "value": "T10BD301280C1C692D041CDCD6685381652FF92B74F5AF3F69EB6B724763F909E2916C0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243587, "uuid": "6113561a-a15e-42b6-bfdd-c8dd8b2f0f63", "value": "3072:E+mnBLBLY4HEyfgzHidPkmE23c+m9mKq8X9ddiTeeprdETwaOx1:E+2vktzHidMmEl+m8KquzdiTeYrdETwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243587, "uuid": "c6f977d9-4d94-4683-8667-2c0bdf5ad473", "value": 142796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243587, "uuid": "231b73c4-5b52-4298-b258-c26958f414ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243587, "uuid": "d2ff02df-cf59-466f-8e05-a3700efb941f", "value": "IMage31-08-2026-cotizacion_114040_png.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d1426b-a624-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788281155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281155, "uuid": "e7142a6d-6e81-459c-b2d2-a2a7fd3402af", "comment": "Malware payload", "value": "e7703e62047ac06368a8fc7630a695d1", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281155, "uuid": "21fc45d7-1de3-4046-833e-fae810311e7d", "comment": "Malware payload", "value": "ddda44e346e881a897901b9a8b81e5dffaab01d85544f7aac7a71650b3adad4e", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281155, "uuid": "062ae670-644e-43ae-8892-21229c5af5f0", "comment": "Malware payload", "value": "a2bce9e7aff80c19c07e52d5c886552962380ad4", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281155, "uuid": "09db242e-334a-4104-a4e9-f042efe9ac93", "comment": "Malware payload", "value": "a211a18dc6b77aa6135094fd7ffeb324134d7356b00f90ba9ea94e00f3820815702ae9706a7510e13ace53a6f2b1b0c4", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281155, "uuid": "3d4d9842-b1c3-443a-a97d-b19429539bf8", "value": "T1EE665B077E5901A5C59AD639D5BA9223BB31BC0CD73233E72E40A6342F317D17ABAB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281155, "uuid": "58cb518d-8bb3-445d-9c40-cc82aae99686", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281155, "uuid": "f060fe61-a3a7-4505-aa70-d016d8d56443", "value": "49152:1tKwE4KYAoLIodRoXFMOieWsVSQlY20d6kCUva35rGaVf830BGDgwQJseceA48fy:1MfGdcqmSjArGaKEIDjisece9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788281155, "uuid": "5c95ac94-2f07-4284-b130-4950a51a6a25", "value": 6622144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788281155, "uuid": "382c38ef-2149-41e3-8dd6-97c1e92f382e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281155, "uuid": "df8ee205-1515-49a7-9f25-042602708f55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3dd0f5-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788277455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277455, "uuid": "b4216dee-5017-4afa-a08e-a44abf10f8d5", "comment": "Malware payload (Mirai)", "value": "8403d694e74c923bce38a6023b8e33cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277455, "uuid": "0a3af0ed-d1e8-4475-87e6-4cd7bd409a99", "comment": "Malware payload (Mirai)", "value": "ddf5eb36a93c0ee878d1919f564158f4e69742a01df455ed6fbfb823ee3fa55e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277455, "uuid": "792b8471-652d-4e6c-80bc-9fe666a5471d", "comment": "Malware payload (Mirai)", "value": "833031d1759503a58786fb3da75a31e4688f7123", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277455, "uuid": "0c3cfcfa-25b0-401b-92f1-5b150a270088", "comment": "Malware payload (Mirai)", "value": "c978f92786e1f250db54614f7ea837fa1a19d6779f0ce0bbe6ee16f1293f0987cf0c0731a5d6500f8293d3db815b4138", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277455, "uuid": "14503dd9-e2a7-44a5-b9af-686c4451db99", "value": "T1A6E33B05731C0A47E2A32EF43A3F27E0D3EFDA4125E4E644645FAB8A9271D325586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277455, "uuid": "c2b249c2-55e0-49dd-a9eb-9e8669ff4c02", "value": "3072:ogjiCsSqVmVbq0AxHhsNUZhIynj/d2LvH+:lNs0bq0AxBsNUZhIynjlMvH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277455, "uuid": "33ddc9a6-a186-4964-b2d7-e52200558e66", "value": 154408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277455, "uuid": "a47b8b1b-39c0-4ed6-9381-ab163bda77de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277455, "uuid": "e3f512f1-7f16-41c9-acad-c7537f7bcc85", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed1d13f-a626-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788282183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282183, "uuid": "4d0fd2d0-36ea-498b-88d1-ea443f1e59e5", "comment": "Malware payload", "value": "436a5af7a20296b3f8c4f80d4972c37f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282183, "uuid": "40976ff4-d1c3-40e4-8f81-1550fde828a6", "comment": "Malware payload", "value": "de96826e222c8e9927b271c01ee6f13b25eedb28da40adb6dec7e8fbdb4355d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282183, "uuid": "4a08a55d-a562-4fe5-b574-f7c8aad03c5d", "comment": "Malware payload", "value": "3ab8ee19bc003fc51ab11cad2e57554370a875aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282183, "uuid": "99508e12-2710-42cb-9d37-dda1301fcb91", "comment": "Malware payload", "value": "2f9bc1fa0dc8b4aad42cf548aeea4dd1e462e85d0203463f6dbb4271102dfac6e8b2b800b19614d39c075e67838096c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282183, "uuid": "4338d3c4-0d96-42dd-bc73-1a166709fc31", "value": "T18BE522957D9279B6F033C3A35A8360BD702A3B5587B48E5E73C8AF006D6281C6C7B719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282183, "uuid": "abc7d801-4edc-4cb8-a1ba-6a650e587311", "value": "5a2ed47d8c6c6433dbc831d38c92042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282183, "uuid": "105dd678-7e3d-4a99-8919-b8b6eda913f5", "value": "49152:xx7XN8ud6USmH5uBDN9nyfpELdCeApmcbHPCDk1A+HUXUSsfGRGBFfDpXYN5O:xxvdJ5QJByG0FAoHKZESMnPDlYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788282183, "uuid": "aafe7eec-e363-40bd-b289-53cc3a0a1cd6", "value": 3040256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788282183, "uuid": "334e031d-7d3f-4f5f-be22-1670fc3f111b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282183, "uuid": "75a3c489-036a-4053-8567-f475518ec3bb", "value": "de96826e222c8e9927b271c01ee6f13b25eedb28da40adb6dec7e8fbdb4355d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91818bac-a5dd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788250647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250647, "uuid": "42b50e3b-0909-4eb1-900c-c2776915d0e5", "comment": "Malware payload (Mirai)", "value": "3d1e17b3bcdb939c0c40439d2b98fe3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250647, "uuid": "e960f7bb-7430-4077-b00b-b58b553c8309", "comment": "Malware payload (Mirai)", "value": "e05b053ee41a0b57fe6cd215ced5c6e44796f64c4767e16a50abd544c1731e8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250647, "uuid": "935678f3-3784-45a7-ad41-d7f9342cfe63", "comment": "Malware payload (Mirai)", "value": "052a82f41f10e045182d8ad38a2d4f45bbb38946", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788250647, "uuid": "129852ef-8cc1-409d-ac73-622aea3392f1", "comment": "Malware payload (Mirai)", "value": "69410a692c4b7c2806cc41022d42c6aa3e446687a6548a253f36cc8fc73d2adf2c564181bc1754aaa761889a4f38f6b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250647, "uuid": "1fd2453c-5461-4aa5-924a-8355c3a057cd", "value": "T1A6344B52AAD28A13C1D3177AF7DF41063323A66693DB7302F91CABB43F8625E4E63501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250647, "uuid": "15b3922e-0d60-45d1-b6c7-8e638b6d1dcd", "value": "6144:m+zFKOWa+hGEBVUhQdzfgyaXZ7ldXY6mqoCSuIEssMOjh5oYSn//M/9NLY:nFKOWa+hGEBVUhQBfgyaXZ7ld1HKEssC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788250647, "uuid": "438e60b2-bc4a-4371-9dc0-f161a078ebdf", "value": 232010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788250647, "uuid": "2b0b6ab3-c57e-400f-802f-f04471baf5a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788250647, "uuid": "53bc02b0-7f9e-4ede-ae8c-18e55a5ff814", "value": "e05b053ee41a0b57fe6cd215ced5c6e44796f64c4767e16a50abd544c1731e8f.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35efab4-a5cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788243483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243483, "uuid": "a9640c45-6b6c-4f21-8681-fff407c97c2b", "comment": "Malware payload (Vidar)", "value": "ef7014e792ebdf22b3289d519bacccb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243483, "uuid": "7b1e69b5-42cd-4b9b-ada3-0df7584f2af6", "comment": "Malware payload (Vidar)", "value": "e08b639bd8b9256256f42bdf65704d90c905bb950e6e9bf1b7c973e49350a438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243483, "uuid": "4103cbe9-8b09-472d-bb2e-08e38861f7ce", "comment": "Malware payload (Vidar)", "value": "4ae16ad565ca5471438e3e47ba75625142dcefdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243483, "uuid": "fee4a71f-d498-47a8-8255-62c43e5879dc", "comment": "Malware payload (Vidar)", "value": "16fed0c217c1da54c6f8e76456a6931e604c72cf1c37d5f4c3945376a9a26cd2570eccd950488b2b7c6a50f48239d08c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243483, "uuid": "97070de4-31a2-4174-9d01-d46757a68961", "value": "T16318334A7E859954D59A8F38C177421176397C4CC73633AB2EA0A2743F317C2ADBAF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243483, "uuid": "ea4a819c-e7c3-43c6-bc3b-5fbfa15cf034", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243483, "uuid": "f0da34af-5e9a-461f-a10e-270c87695fb5", "value": "1572864:ptaYbWJzJEy1woUgZuHg6GE4bM5liTUYvybkCj/bjkRSiFBI4G7tJ:KzJEewoU6r6N4b5AYabkebQ8iFe4Gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243483, "uuid": "f6831ce3-8a97-4a74-9853-f6ea9d261c3e", "value": 92371320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243483, "uuid": "23adc2d8-c495-4f93-b20d-a60fd0640e6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243483, "uuid": "50ad40b3-5c15-4fd2-9d23-e35ba11d3107", "value": "e08b639bd8b9256256f42bdf65704d90c905bb950e6e9bf1b7c973e49350a438.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409dcee9-a603-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1788266832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788266832, "uuid": "74a088a7-70a0-401e-96d0-21791e42504c", "comment": "Malware payload (CoinMiner)", "value": "040b65e7b991e772aac124dd1664dcc1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788266832, "uuid": "f1c2f841-c467-4f2c-8f4d-9aa8048732ff", "comment": "Malware payload (CoinMiner)", "value": "e30cb7c91bfab4c261e8bb3f183a5df5b6957e5ebd22d754c2d13fffdb9d9eee", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788266832, "uuid": "24ba056c-5e78-41eb-95a8-27635716dd69", "comment": "Malware payload (CoinMiner)", "value": "b7c2d058ae105e65cec9c0d90d0e8550b00ae26c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788266832, "uuid": "478054f4-c03d-4100-9e04-5d96ccdf6610", "comment": "Malware payload (CoinMiner)", "value": "c1766952b0312b3706e461e775106f04f6bcbb70b3230ed2c5c5f8bf901baefac69b3c21fc9543766edc7c5a1da0222a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788266832, "uuid": "55ec91dc-8eb8-494e-8f48-ae07a6483958", "value": "T12046336797910094E0321FBE6CEB18A14D737CD97B2D129F1580BB9B1DF37E226A071A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788266832, "uuid": "a8089ced-fda8-44e6-943b-0da9e7e63950", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788266832, "uuid": "e18c7bc1-7ee9-4720-ba62-bfb793bd3a9d", "value": "98304:S48axesGEKDlNgTlH7lHrwURUIQYtuwNK7fXZWp+6E9Zgghpmmsym:SO1GEKPgTNRHr4I5uwNK7xWr4WEpmm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788266832, "uuid": "020bbf44-3db7-47ac-86a2-c6c9e8ac0b97", "value": 5681664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788266832, "uuid": "af8a94d9-040a-4fb4-8b7e-76c9deabcf2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788266832, "uuid": "d9d9dba6-8e58-4b84-ae83-93f8d5ba3623", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe2c2b3-a623-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788280890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280890, "uuid": "c2b4881d-40e9-45ee-8c3c-70516c44c75d", "comment": "Malware payload", "value": "4d454002a3ed4d44dcee1c83f329fcec", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280890, "uuid": "f0a4cb11-7b42-4a40-8f7b-84a1a38cdda5", "comment": "Malware payload", "value": "e4fae98c77604d952ec2b3d42f83744bb94ece922eef5af44272c5a53be4fa09", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280890, "uuid": "257600bd-e989-43ff-9f68-cb526bed6962", "comment": "Malware payload", "value": "3de3cd3e9994c9682231b122a298fbbca282a06c", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280890, "uuid": "8d404a65-f23d-4310-983e-4e90725c2387", "comment": "Malware payload", "value": "52e53aeae84ab94d4d6f763c55be2637b9ef989f5a5df53a339e851f547f5e323c8a79a557fae3bfa8ab2b2387d6b4d5", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280890, "uuid": "95e52dc3-17a1-434e-9823-c73ebaa7b5f2", "value": "T1200633259DA9C3CA7EC4FF73BEB988ED5198E890C8D4006785EE255BC6F414B30A746C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280890, "uuid": "afd89784-96f1-4e8b-a9bf-e0256724a69a", "value": "98304:XlRqXC3oCfzygFs2Bl8hJaFZ75JW4irf6+AA0YC9SuwZ:XbSC3oC7drqan75E4irf6eXuwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788280890, "uuid": "aca2d520-bdfa-474a-b311-d34274078df6", "value": 3858160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788280890, "uuid": "4de0cd2e-d65b-482f-9183-09c86a2ae5db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280890, "uuid": "e8b8a9e0-b38f-4fcf-9ee5-9ea15fab8b2a", "value": "bot_linux_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1cd318-a5ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788258211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258211, "uuid": "5a87d80e-75c8-4ad9-9fac-34a1df6dd3f2", "comment": "Malware payload (Mirai)", "value": "da1169fde28ee7e80ae7ad16ad63abaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258211, "uuid": "de0c5134-64f6-48b1-aad2-4667bb0e1052", "comment": "Malware payload (Mirai)", "value": "e569bc71f0382c6903e015a666de01079ad417de117e68818fe0f83cfdc0f16b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258211, "uuid": "6c64527c-4c9d-409d-a38d-4f91d62305b1", "comment": "Malware payload (Mirai)", "value": "b5ce567d2420fb616230013cad11141c660956a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788258211, "uuid": "4a4ca127-56ae-4739-a75e-0b28b1922004", "comment": "Malware payload (Mirai)", "value": "88f48e5acb2686ac1d107bf97ff84b1674c3674c1e9eaea129110e10f44dabc90e561a13d507f6b2feb8659fe2053aa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788258211, "uuid": "687ac17d-8dae-44f2-aad9-0f2be3b7771a", "value": "T1BF145C1278E290F9C997C139CB9F901AD532F40B1124B21B779DBE762F4EE3067AD684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788258211, "uuid": "c75b94e5-e171-488b-a500-6d121b9c2fd0", "value": "3072:e1AmROtnAPVqt/8FtZtglAQx/FW39kzlpw8l6kyHbRR80J1EssMZc/T03ImIys6X:e1AZ9ba2ZnlLERRdEssMOjh5oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788258211, "uuid": "413b3217-2d16-46bb-a861-abe05cfc2be4", "value": 208904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788258211, "uuid": "f43a7a50-6b54-4c4e-8a26-5bfcd017d5f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788258211, "uuid": "1e477253-62fe-4d45-ad70-eb530d8de47b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84a8ee3-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788277448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277448, "uuid": "442dad24-5f3c-4edc-bc53-968cafe631e0", "comment": "Malware payload (Mirai)", "value": "15115ce1c5c57676975f0184884dcd62", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277448, "uuid": "b9aaa309-7222-409f-b47d-c8e3a24ec39d", "comment": "Malware payload (Mirai)", "value": "e625653c34a5654fd79a7a81f77c436ecf0099a6229e7d528e61018ece8b51d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277448, "uuid": "c69097ac-8bea-43b5-a248-3e4921d057a3", "comment": "Malware payload (Mirai)", "value": "5325f0c4a7acf854dab2fa341a7455cef99bb548", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277448, "uuid": "f48a32f9-95ca-4694-8db9-4b453570c565", "comment": "Malware payload (Mirai)", "value": "dd3ba676683ffe7df865008fa9dc0d1ecc1a53c04c4685a75824e097a942b0834ddcbdf922840287ef6896b12dcda851", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277448, "uuid": "01505520-7c70-4628-bde5-1d183d5f9680", "value": "T179F31856F9819B16D6D111BEFE1E128E33131B38E2DE72039D246B70778A9BB0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277448, "uuid": "183d04a9-63d9-47e4-aa63-8e249c6f3cd6", "value": "3072:WEYtii0YUBkG/0XLimdiJkSsVaovkALBJwaawKxv:lYii0Y+H0XmmZSYatSRaw0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277448, "uuid": "a175fff7-804c-487a-b4dc-92bb403e2e25", "value": 162648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277448, "uuid": "7af76282-7230-49cf-8fb5-dc52b894a559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277448, "uuid": "fd7ff7a1-c7a6-4177-9e33-70077bee3ca0", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589df589-a61a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788276751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276751, "uuid": "5fa4a8ce-d66e-4115-bbed-e3ccb7a8844e", "comment": "Malware payload (Mirai)", "value": "0cac109fb61e05a802ed23bbce087840", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276751, "uuid": "3e7459ed-2460-4fdf-9d6a-dca8bbb2941f", "comment": "Malware payload (Mirai)", "value": "e71b85aa1fbd20c5d096a3132221006854306ab55f0be9209ec15cc77659d116", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276751, "uuid": "8c795e5a-5496-448a-8748-3a7980af4056", "comment": "Malware payload (Mirai)", "value": "10fecbe0cb3e5fe6c47f7b5505fd5d8a8b9bcf0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276751, "uuid": "66cc0c4e-c74e-4808-bd31-1bf470cc3025", "comment": "Malware payload (Mirai)", "value": "b6062804dd794347fd3f2726903f260f1cea0d8ff04db21e71a1e89c689475f9136c10a1c3ce8982f55811a477a34797", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276751, "uuid": "8af8ef02-5aeb-482f-9d50-acbb5f3630cd", "value": "T11884E888E1E1E7DAD1D4EA75B319780E3A230736B0D73146A51DFE3223EB1590AFD921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276751, "uuid": "60ac4ad1-3db1-41c6-a73e-025926321bfe", "value": "6144:Pb9vBEvJuIfpKtc70R0i7suIuLAdwzt8glu4UHga93JoDnnnn:p4JuIfpwcQyi7sONpl5Da93Jo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788276751, "uuid": "69efdf6c-8e56-42e4-bc31-a7ef1d5a22bb", "value": 372056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788276751, "uuid": "be835f34-17c1-434e-a1df-3742263f7f5a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276751, "uuid": "4f16b3aa-5915-46b6-bd0f-aeaf0e9c892b", "value": "e71b85aa1fbd20c5d096a3132221006854306ab55f0be9209ec15cc77659d116.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038f23c4-a5e7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788254704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254704, "uuid": "eb370680-2965-4748-9ef5-6314243d4cfb", "comment": "Malware payload", "value": "3637eac665ec51b262a0bd3bde776040", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254704, "uuid": "d210112b-4730-4cac-b47c-634639dcc412", "comment": "Malware payload", "value": "e7d2e346a91b10580fb69fe296574f306bea1eaff25bf08af2de2e603c07bb0d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254704, "uuid": "1a96cb8c-55b5-44fe-aae5-6e83f699c8fb", "comment": "Malware payload", "value": "a4eae3a8a724e8132bfd0066cdae1ec66b771772", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254704, "uuid": "98131b59-d33b-4fd7-be72-dde288a9ffd7", "comment": "Malware payload", "value": "5e5dde00fdc0d2f7b524ff66d63b77b121ed09b0ca2095d1a17a1f51e71e2ae2284fcc58ffcf01784b1e46809828362b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788254704, "uuid": "652df3d0-7958-4e0d-a706-1aea99527ccd", "value": "T114235C551A857C24AE98C8361C7E2F0CB9AD43E6325452EE7FCB3CF28C4A6ADD105B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788254704, "uuid": "5eafb3bd-4437-4ebc-9f59-cfae9d1d7585", "value": "768:sl+H9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:a+wcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788254704, "uuid": "0793b632-bfbd-466d-9a02-49b67fb154f9", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788254704, "uuid": "7fadffaf-f1d8-49c5-a204-b352871f5ceb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788254704, "uuid": "bd84bb03-f5a7-4d19-ba60-172b71d43a2e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6ac19b-a5fc-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1788263976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788263976, "uuid": "234e63df-6d7f-4b6a-8a21-738ec3c962a7", "comment": "Malware payload (XWorm)", "value": "3ef284d34290f2f784e12e005c1698b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788263976, "uuid": "e6343cd5-86b9-4073-b910-66f42dde04ee", "comment": "Malware payload (XWorm)", "value": "eac9fafb8e19bb12618199b48c79fb94cab8e447b09973b1443464a3f13ea5ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788263976, "uuid": "fddfbc8a-944c-451f-853c-feb56c21c6cd", "comment": "Malware payload (XWorm)", "value": "40390bff40cfeb3b8149a1d87cdb7659962c47b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788263976, "uuid": "653dcbc3-033e-4f39-99ed-a0bbbd452ee7", "comment": "Malware payload (XWorm)", "value": "8313d044b30182a4556aee628a6252f4c194835df078e5264690a871f528d3ec661a32514be58b1629596081e4d31637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788263976, "uuid": "d743cb19-a29e-47d7-b5f7-5b762ad5c9e8", "value": "T117D46D6432708664CBB94B3A99678104673C9485EAFFC60635F71DBCACC3BD649093BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788263976, "uuid": "f3f1f4cd-491c-4ed7-90b9-a94a1d021b2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788263976, "uuid": "022d0ab5-247e-4b15-b912-a26c8b46b4f5", "value": "6144:QhrdjxCqw91ilHK3rsjv5+MZm4zWXDB2/8k2FU9fX+XgkKqOWQkXBx6/mKPrUhQC:mxQeLrAXf8PNBEf24pH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788263976, "uuid": "a7a61959-35f6-4499-be97-99c7060d2495", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788263976, "uuid": "2a71746f-2d08-4cb5-8236-29d79ec6c494", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788263976, "uuid": "795ce2b9-28da-4321-97a7-e3b6154f1fcb", "value": "OC_265108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee622358-a649-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788297188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297188, "uuid": "b74c8ec9-03a0-4799-98eb-b0784470d314", "comment": "Malware payload (Mirai)", "value": "cacf9494edf806afabcb0a4009e4519f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297188, "uuid": "71af78df-d4c4-4bb2-961d-eb2c4b6268cf", "comment": "Malware payload (Mirai)", "value": "ead146ff50c9b98cfb9bedb664830f5340d5f56f95f8ee7a05b04859d1b1ef2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297188, "uuid": "1c6609a8-f6d5-46aa-9dbf-ff5668d7dc9d", "comment": "Malware payload (Mirai)", "value": "d4030e43936413607f6fb3b0f2120ba143f05470", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788297188, "uuid": "9fb891f7-ad26-4b93-a4cc-131cca4b727c", "comment": "Malware payload (Mirai)", "value": "592282743333611154a47a0c046aaa2fe4553a1014e87e582c311c54ceee4ce2bdd43ff17a6062259c8549c1dd084b16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297188, "uuid": "09359707-68c2-4dba-be10-086b18e6ca3a", "value": "T18F742B88A2F5FBDEE259FD3983017C0B6C2987367483758560AEF96313B71850AF9D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297188, "uuid": "655340d0-85b2-4af1-a693-f9541454585a", "value": "6144:5nVPOpX7RQvjhGHH/6z5dvRbQilGiBDPVRpwAvDviKL:+pajE+5rHlH+qDvi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788297188, "uuid": "b5e2752e-88cd-4fb1-b830-f5582d72a870", "value": 367272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788297188, "uuid": "f35f1463-6c17-4f15-81b0-6bd95a90419d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788297188, "uuid": "8181d7e8-7a75-4e87-9de4-6dd1fdf0d654", "value": "ead146ff50c9b98cfb9bedb664830f5340d5f56f95f8ee7a05b04859d1b1ef2c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6747466a-a618-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788275916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275916, "uuid": "68e410d3-bdeb-4b70-a242-a6042ec71b32", "comment": "Malware payload (ConnectWise)", "value": "1ebec16cffc54789aa985cceacfb88b2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275916, "uuid": "f59e07f0-3d53-4ef1-9d66-76f55bcfdb59", "comment": "Malware payload (ConnectWise)", "value": "eb528aa89ce0be235916b527d94ad25c2325d243e23b96da856c4292b0d6527c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275916, "uuid": "5ee46441-df31-415b-a546-58b6337a2cae", "comment": "Malware payload (ConnectWise)", "value": "6d289dc74162f8b5ba887578f209e57b328cc640", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788275916, "uuid": "ff9b844d-6b1a-4661-83ee-196df49bcd33", "comment": "Malware payload (ConnectWise)", "value": "31e1275e58382000cadec68f99f0a9ba2ae17926e5a3f5eb26a8ec0e24a1018c62c1505f461f7fbb5d69a240ee12e827", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788275916, "uuid": "e5c42676-6a44-48ad-8455-e0836e80299d", "value": "T13C836C43B5D18475E9720E3118B1D9B45A3FBE110E648EAF3398426E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788275916, "uuid": "2127a2ee-8b79-4833-bf4d-d0aeb1083b61", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788275916, "uuid": "37933c73-0e30-4800-8766-0313634abb7c", "value": "1536:qxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYv7nJV:4enkyfPAwiMq0RqRfbaWZJYYvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788275916, "uuid": "0345489b-3408-453a-a0a2-64b558c3d7d7", "value": 83168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788275916, "uuid": "1dc3a7d7-9e4e-4ac4-840d-a52b4a6996fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788275916, "uuid": "c0f8bbf2-f832-40b6-8b13-273568da81f8", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6ebd91-a613-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788274019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274019, "uuid": "52367909-900b-47f8-b0cc-af75d045d180", "comment": "Malware payload (Vidar)", "value": "36fdf6ce9390cb8a246d22e3edd7f1a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274019, "uuid": "1af721fb-9ace-469a-ab71-9cc77e8e3ed9", "comment": "Malware payload (Vidar)", "value": "ebcedb12d86801de120b4d681702f46af46fbcee129b00ca1ba64b93aa859869", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274019, "uuid": "09e73839-db75-4459-a159-eb0640b73ebb", "comment": "Malware payload (Vidar)", "value": "3ccb1621f6f3001a18f572f7a6cd1bb1e3706bff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274019, "uuid": "61ccf138-fc8b-4941-88d9-40d79beca7c9", "comment": "Malware payload (Vidar)", "value": "ddb1edf72c631f5b59fddd770285e27efce525a927887db486f28af09b257427d87e9878c2557806a4f581209b8171db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274019, "uuid": "868cbd68-d024-481b-9db1-748ecf4684e7", "value": "T132967C077A059094D196DE38C0B60A45A234BC8D873537EB3FA1AEB47F61BC2A736F54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274019, "uuid": "476de4ad-56fb-4262-a83d-23ebfdcff22d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274019, "uuid": "36d20806-f6ad-4b6f-b477-5fb23e81530c", "value": "98304:eyXRHIgOmBag1b9dMFqlzSPob5sIezEdF:eyXRHIgOmBaO9d3l5yU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788274019, "uuid": "6a3536fb-193b-45f7-8b21-e3c14ca9351f", "value": 9371056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788274019, "uuid": "aaaa480e-18e7-4a08-9d33-9e85f39c4fd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274019, "uuid": "45b8459b-722a-464a-a660-98a61f1096fb", "value": "ebcedb12d86801de120b4d681702f46af46fbcee129b00ca1ba64b93aa859869.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635225f8-a5bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788235966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788235966, "uuid": "3e40ce2d-c94a-461f-b3da-0ec9774d7200", "comment": "Malware payload (Vidar)", "value": "c81586b06b76ab3cc5a746f1add767d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788235966, "uuid": "3b59a361-fc94-4d22-bb4b-b8bec15a07b8", "comment": "Malware payload (Vidar)", "value": "ed36bed1b59a5608984b00f914b2f9e4a98790f2f181cbb89f31f3d1a6531ed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788235966, "uuid": "d79af0f3-2fb6-4188-8a54-4908355dbc04", "comment": "Malware payload (Vidar)", "value": "1eddb1e08c9ac334bd7d40799230e94a883a2b1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788235966, "uuid": "4f8e1827-41f4-45f8-a0b7-79a239bfffb3", "comment": "Malware payload (Vidar)", "value": "0225216004df233f6345fb8a74c8efb41a8428da4e6c37e10836df7e809a585efd82b15c63bb3411af5d446c8157f237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788235966, "uuid": "2ea57faa-be16-4311-9434-9788b8cf64a5", "value": "T1FF366A03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788235966, "uuid": "8495e238-d069-4689-85e7-90fed1eaa877", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788235966, "uuid": "7cf1abbf-00df-49fe-9fa6-804a5324e43f", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaai:uc3XND1aJrCOki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788235966, "uuid": "d2bcf0f9-d30d-4e97-991c-0606f3f72f13", "value": 5000819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788235966, "uuid": "33d72c45-786c-48ff-94fc-53a428cad75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788235966, "uuid": "c4c614a3-3937-43d3-92d2-16bf7c21e713", "value": "ed36bed1b59a5608984b00f914b2f9e4a98790f2f181cbb89f31f3d1a6531ed4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6bd315-a5cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1788243528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243528, "uuid": "d06b0a0f-d756-4e88-a964-9fc6423447ed", "comment": "Malware payload (MassLogger)", "value": "97c39f9988d1891d725e8cb91c0119ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243528, "uuid": "6de17b4f-b4cb-4be9-8fef-ea3896fe0296", "comment": "Malware payload (MassLogger)", "value": "ed6166d40bfb64e02f83447d5cc38b10170ff68839d64f21e6292c33446af706", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243528, "uuid": "45d513e4-7928-4cea-acaf-a6674a5f95cd", "comment": "Malware payload (MassLogger)", "value": "2d7350badfeb6d9b7e4b039e5d4b448d87df3ba2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243528, "uuid": "8ac7593f-241d-4570-bb6e-1dbb87618e23", "comment": "Malware payload (MassLogger)", "value": "8b0642cf4af71ef09f3d318f0a4d206bb1457f6e1ecfd2e22f88477d6d7a766cddd05fba10767c3cbd74d22dae431caf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243528, "uuid": "9c679542-0f8f-48cd-a848-d9be202f4a27", "value": "T1E256C6B882445EB679AC271CC2357B008579B58B1B64EB9F3978237737B17025ACECE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243528, "uuid": "21f9e963-8762-4c79-8417-5d623c9fc51e", "value": "98304:+n05KeqgyKjC4wcKdR2AbjcCNxAT6CyVwQtIcncSLN4vnpT6CyVwQtIcncSLN4vC:G5btzATjHCnc3pTjHCnc305btzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243528, "uuid": "67d0cb22-6147-43f1-b6cd-f301a488844a", "value": 5969701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243528, "uuid": "12744004-82ef-49b6-bd1d-15418c64409f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243528, "uuid": "ccc29008-4f89-4ca8-9c14-fe632353564f", "value": "orden de compra..JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f319e323-a5eb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788256823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256823, "uuid": "4f0cb410-893f-4e5c-ada2-eb18292b384f", "comment": "Malware payload", "value": "f4cc864707752a3871a9a9f975d54e62", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256823, "uuid": "31ba387d-8527-4f0f-b67c-3933352f740c", "comment": "Malware payload", "value": "ee21103e55b74ca44ed386396e2af64e864a563adf4e4481bd88d318c0d0b595", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256823, "uuid": "9d4f75d9-0259-4855-a5e2-f2b87c35fffe", "comment": "Malware payload", "value": "3b7225b0205ff56f01f7e565fc3496127860d233", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256823, "uuid": "992e0db8-5968-4f2e-9655-75ab1cbf585a", "comment": "Malware payload", "value": "fe67e4832132236f4b9db412e1c78edef8d89c62e08cb7013a7fee2fe7ac42678c808386eef59d9f632e9c5f2e22b082", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256823, "uuid": "53e32f91-44a3-4a73-9576-8f4969c2ffbc", "value": "T19FF0908F252CA827740C8E4636D294046440F2CB7A5FCF847B589C2ACCE4A0DB279BB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256823, "uuid": "67f8f6d4-544c-4c07-83de-65bc62b839d5", "value": "6:SAY9PSlUvGyAY9CDnJjuJY9eQiASXdAY9YeyOHY9JeiN26gY9f1ivXiJh+Pn:41Gy2DJjcASXueyOdkxL9iP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788256823, "uuid": "51df0975-3112-4dbb-8091-bf251cf6f727", "value": 560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788256823, "uuid": "9403789e-aa82-4df0-82f2-2d2b15a75574", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256823, "uuid": "4e442944-eb8a-4330-955b-6f87401bf1f5", "value": "c8r3nv.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5da877-a614-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788274180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274180, "uuid": "762277fa-9c31-4832-b2eb-853f4c5452de", "comment": "Malware payload (ConnectWise)", "value": "a52f6b90d9719b42f115c4423a92270b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274180, "uuid": "403ad92f-a6c8-4346-b1f9-be4e6773d17c", "comment": "Malware payload (ConnectWise)", "value": "ef3319b4d353374ac156b9d9f736d08e16b1467e6a99dced82133ebfd22492df", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274180, "uuid": "5a915dcd-5cb3-4d16-a792-5c30fb17c40c", "comment": "Malware payload (ConnectWise)", "value": "d6530bdf615c53d2061afa647a8c2a89241c8b68", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788274180, "uuid": "cb303d35-f1be-4b30-af48-5abf6dc80860", "comment": "Malware payload (ConnectWise)", "value": "93fe17f91f9dd04f7ef2bb30efd9be94b651376d079714290230407ccfd63f7e774aff65a4ac7a13ae4a4e73ca4940ac", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274180, "uuid": "540a458f-52b6-42c0-a733-0eb9725999b4", "value": "T132836C43B5D18476E9720E3118B1D9B4593FBE110E648EAF7398822E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274180, "uuid": "30b8f2cb-a19e-4596-b9e0-c11184a4bfef", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274180, "uuid": "85166cfb-d9f6-403b-b12a-d3347f636f46", "value": "1536:SxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYx7FJR:wenkyfPAwiMq0RqRfbaWZJYYxXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788274180, "uuid": "d801de1e-e19a-406a-8780-e620b68aa1ef", "value": 83176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788274180, "uuid": "876ade8b-0131-475c-9b80-458253e6013c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788274180, "uuid": "59260aed-4903-437d-8f7c-3c7e66056816", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c38970-a624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788281303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281303, "uuid": "1798491e-cf99-4905-8bae-7d0afa30acea", "comment": "Malware payload (Mirai)", "value": "7056dd6b0e2615f5bdcc1ca409678877", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281303, "uuid": "68abe787-f752-41a6-8485-2dd88467d49f", "comment": "Malware payload (Mirai)", "value": "efe4b2bde00226b766d22e362e3f6f92866f0605668b5855871e5cd59754bf34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281303, "uuid": "2da75c39-63ff-446e-a310-edd72e21724c", "comment": "Malware payload (Mirai)", "value": "d7ea7e7db234507f45d8794b7fa6df6087aaaf8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281303, "uuid": "b7994e26-61b9-4e45-a66e-767dac2d3f07", "comment": "Malware payload (Mirai)", "value": "95ad7ee1aa4e2998060ee7a42affe47c82dd5f129cf172a3910631eb08c9eaf16bd4c0efd8a89ac4ccabf32546356aea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281303, "uuid": "e539b8e9-06c5-45d8-82f3-294523ac506d", "value": "T1AA74094892F2E2FDE198DA305316BC1BAD3275363077724E729EE97313B665046EDB20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281303, "uuid": "0b0f6848-447a-4926-a8c6-77e519e3c524", "value": "6144:cdxoKSR9FJKZj5JtwnZyEFkWRECt7Hqkf9O9Ua9wO:oxdtwZy4kwECJHz9O9Ua9wO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788281303, "uuid": "a92f9a74-be8e-4baf-8477-07d8fab8955b", "value": 367304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788281303, "uuid": "480447ac-93dc-4221-90dc-67dbbc5e79f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281303, "uuid": "0e4abbb9-e434-401e-86ef-8faca6398893", "value": "2460779da84d2d3b3a190d90b27c6f9f124f0bd3bd0b886543c725e8b7719583.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccba8c32-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1788277375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277375, "uuid": "b272f3ab-4c6a-47bb-8ec9-5abb97dbd94e", "comment": "Malware payload (ConnectWise)", "value": "f3be624df3fdcc60326de1a09512627e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277375, "uuid": "0bc5377e-fd6f-4393-adf5-313eb053c1dd", "comment": "Malware payload (ConnectWise)", "value": "f0885b5368aa0855c6b151fdcf53476c30f00e4075085c8781fd9236a657c087", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277375, "uuid": "ebd35d72-9e96-48e7-86c4-08338228d1a2", "comment": "Malware payload (ConnectWise)", "value": "570976b27739b2ca2aaa20217c57224a15d33a00", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277375, "uuid": "7eaf2e6a-aed1-4eb4-b611-0eca021e3dc8", "comment": "Malware payload (ConnectWise)", "value": "75b4a0873f79c8eafdcbd9bf6860b7e016c113a346df49504b16271143f06391b1eec785c91fceba04c40f0579123773", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277375, "uuid": "eb31dddc-ee6d-4d6c-bf4f-1fc0fb2b63d0", "value": "T19B646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277375, "uuid": "1de40af1-54f5-452c-b7bc-363102d8e868", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277375, "uuid": "e1a5c02b-63a4-4a5d-8f4c-1394c775ebba", "value": "6144:lmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9YPy:Q1iw7gryNkSV1hy1Z1u2JLa9YPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277375, "uuid": "988b4ae1-ab7e-4bc5-ad20-646673095abf", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277375, "uuid": "bc9c0fa9-8b7d-47db-9915-d0aba74241ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277375, "uuid": "fe56a6f2-a87f-4064-9916-f2c622ca434e", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309b8f49-a5af-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788230727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788230727, "uuid": "312f304c-910f-42db-bf32-534afe3e0aed", "comment": "Malware payload (Mirai)", "value": "92ec460aff5fd5c976514fd52149d7a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788230727, "uuid": "47d6b95e-7b08-4811-aadf-537203b88e76", "comment": "Malware payload (Mirai)", "value": "f14759a0828bcafe4e63de7b1e50b6952c98eec8d7515c3cb6ff77d21aff4ebe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788230727, "uuid": "da30eb33-265b-4473-82b4-bf0295cd62ed", "comment": "Malware payload (Mirai)", "value": "34d5130957d575366c9ea29f1d5f9e3d64b65cbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788230727, "uuid": "2c8980c5-b491-4b58-bf10-7d68217f66d9", "comment": "Malware payload (Mirai)", "value": "da1a5482a96138b5a9878fabd0aaf332dd33d071c46a198ded801ebed46ebe2dd69173e6d066574844b29b616ea5efcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788230727, "uuid": "9e50616a-5025-427f-b8b3-0b4d13cc8f11", "value": "T146B32A96F9818B11D5C516BAFA1E618D331307F8E3DE7213AE209F3567CA91B0E7B841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788230727, "uuid": "935cf972-be62-4617-a7e0-65f887010f42", "value": "3072:nqJWaAePmJqjOGB+n+V5MXqVgzOSJ2P8TcPSdYDspyw7wZa3D0rUWJ+n58Rn:PqjOGB+n+V5MXqVgzOSJ2P8TcPSdYDOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788230727, "uuid": "7f16198f-6e6a-4383-8227-1e4d3a388d41", "value": 108240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788230727, "uuid": "f28317dc-7b7a-40a6-ab7c-3438e6f06c07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788230727, "uuid": "8b0b8f09-1b12-461e-961a-1fa34b06d516", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc54748-a5d7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788248223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788248223, "uuid": "471733ec-f673-454c-b6f5-20e1bcbc854e", "comment": "Malware payload", "value": "c0d469328206f0b5bb3a6818d52f96b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788248223, "uuid": "f2a8f850-438f-4a89-bfde-32a14b3273c9", "comment": "Malware payload", "value": "f19f87f68c3fb31be74233580ae8cc6821a1f8432e7981a73034e8969ff49196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788248223, "uuid": "955bd106-3efb-4bcd-aa96-c4ea1650dec7", "comment": "Malware payload", "value": "b9ed8ea27a2f61c342421064d75f2c9f6ecc6af5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788248223, "uuid": "45942228-2f7a-445f-ae0b-11e91bd5cfb2", "comment": "Malware payload", "value": "6f04a6658b0663347fc49b27362e6f118234c4420dff16a22e9bf1ca5ae97cef845a29d1b7264e63ef9575a802fc098e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788248223, "uuid": "666a8af6-0fe6-4cff-aa90-e88c8ca6d31d", "value": "T13FD522E5A9B71A75C837C7B28FC1F43EB13937508B255E0BF6CE5E409912854683AB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788248223, "uuid": "22a0a9be-7a8f-411d-8998-39f9cc0e2c5a", "value": "58f4b17816a07f7a36dd14e504d515e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788248223, "uuid": "d5c3db4f-3f06-407a-aa65-63d1ab9a01ba", "value": "49152:HSnuo/29jYkKXK3irjWx9///GLqOv4wQ5xzFhTWK3Mh3tU:HqelYLXK3ivjqOwwQLFhtMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788248223, "uuid": "9a2c0111-16b9-4b5f-abfa-bc5f4b40fddf", "value": 2886144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788248223, "uuid": "204f30f6-edd6-4e49-bbc0-6fbd5c095360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788248223, "uuid": "bdcf63cd-94a9-40e7-85c6-2bf80ca92a07", "value": "f19f87f68c3fb31be74233580ae8cc6821a1f8432e7981a73034e8969ff49196.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc3734a-a612-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1788273353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788273353, "uuid": "77cf2f60-63f4-4f5c-8a4f-cf34476e3e80", "comment": "Malware payload (ValleyRAT)", "value": "7a9f9db7040244be744f56c0e393ebc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788273353, "uuid": "f5c64932-bf29-4c1e-9f45-db232ce75639", "comment": "Malware payload (ValleyRAT)", "value": "f314815983f17a6fb664189048f88211f7108efcd2b655e218506e358312d98c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788273353, "uuid": "a30942b1-dc96-4d11-b8c9-79cd1b51d6f8", "comment": "Malware payload (ValleyRAT)", "value": "84d97716c5d58727f02b7c3d42f9c935965a4ff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788273353, "uuid": "9963fb5f-5970-4f8b-b42e-77511268bce9", "comment": "Malware payload (ValleyRAT)", "value": "738245570e640c3c90719132c74d5ac0b87b99bc325f3c3fb5f53e2e64a9ed2e857f0c572a40465fa3d3736cba349978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788273353, "uuid": "76591eed-f3ca-43fc-b61b-27e38696098c", "value": "T1F7A4182BF6AA6BFCC247D034CB8767717631BC980220396E5A95D7313E74A601B2E75C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788273353, "uuid": "aa87fc33-5824-49ad-9dab-73bf7222829e", "value": "12eaf13b907241a21df8b0807ec296a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788273353, "uuid": "c3b49478-1a74-4f2b-99f3-69b86a6265ac", "value": "12288:bCw6Ws863fZvauMdxIvIATwxkWNnAE3nXwgHr:bH6Ws8EfZvauqHAir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788273353, "uuid": "18303f6d-cc94-4f44-821d-9ac44248e1b6", "value": 485208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788273353, "uuid": "2f3fbd1a-527f-4cdf-a6d9-cf84918706d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788273353, "uuid": "4d026761-8e58-488b-b056-15a2dbd035fd", "value": "2026.09.01\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65255a82-a656-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1788302541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788302541, "uuid": "ea6961b8-320f-4bf9-8a2a-384bf53be000", "comment": "Malware payload (AgentTesla)", "value": "148e99089ecbe9cffadddd4f8f0114b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788302541, "uuid": "520d8d34-4e0a-4f34-8587-ef1fc2a58d1c", "comment": "Malware payload (AgentTesla)", "value": "f43019ee4884c1c23ff804808fdb30691b151eb4a7ae6521d6757fde03a32833", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788302541, "uuid": "9898dde8-e7af-4b08-abd4-fe838c5690ab", "comment": "Malware payload (AgentTesla)", "value": "70cacfdb8e224c1f19eb529de04ca2ef4c0aa24e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788302541, "uuid": "078e44d4-20ea-4f5a-b157-622c40c1c9dd", "comment": "Malware payload (AgentTesla)", "value": "7a721746d8d4d2ff04427b87db63cc50910595d8d559403150d81de48b185696a008b690a37da1062c5bbb2f594f65aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788302541, "uuid": "ef294527-fb92-421c-8a28-7b2ebfad9816", "value": "T1FFF47D6536608664CBB94B3A59638104673C5086ABFFC7023AF71DBCACC3BD649493B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788302541, "uuid": "d8828c63-a894-4f38-bf53-d389bcd336c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788302541, "uuid": "168eee76-3863-4a4d-a76f-40e48ea3871c", "value": "6144:yxR3GVtv6Ktq1ilHK3rsjv5+MZm4zWXDB2/8k2FU9fX+XgkKqOWQkXBx6/mKPrUT:cRheROAb3Em5ll/UTG5ygAoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788302541, "uuid": "504e94d9-d1a1-47c1-ba8f-8e50690015b7", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788302541, "uuid": "ac11e976-74f3-41f7-9118-faa211eff4e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788302541, "uuid": "81d23dd9-76e5-4cb0-b4d9-e8ec87fa1ecf", "value": "Lista de productos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e29285-a5eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788256538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256538, "uuid": "18ca5c15-cde5-4cb9-975c-8b86166b9a77", "comment": "Malware payload (Mirai)", "value": "5d8d90a9142aa3f4d43fb02c0ce9c3a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256538, "uuid": "c8ff72f3-467f-4339-9408-30e5ebd680e5", "comment": "Malware payload (Mirai)", "value": "f6393dcbcfee887795b9d00f1337dc795bd42a9b9920ea1bb0a297243e9144f7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256538, "uuid": "c2389a50-4f5f-408d-b451-faaa42ae24fd", "comment": "Malware payload (Mirai)", "value": "483403fe3e3eae0beb48c324ae22d97cf9bd65ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788256538, "uuid": "19f17f9c-4340-4d51-b0bf-62764c496192", "comment": "Malware payload (Mirai)", "value": "73f5929bf18fd3ac50549d2158ff72c92040522c9f68a4e6d2fbc499f4026247195cf85aa7e0ac890444c00a12a711ed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256538, "uuid": "873d2a7e-4eb0-48d1-b8b9-f6ca7ef3464d", "value": "T1D431A1DF40645F301042C98EB3B2344D799DA1FB29AFD7C1D9580DA9928878CF252B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256538, "uuid": "e3c3b7ea-99ef-4744-9ded-9754c2505f57", "value": "24:Fmjp1XM4T8N1gJgAgglQ5DyxZm3pFx0H5HdDRdjN:FmjpK4AHsBgT5DyjiWp1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788256538, "uuid": "6f0286b8-ae40-40fe-94f5-34dd418f9c8a", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788256538, "uuid": "502f1826-142a-4a53-98d7-8a95f7be575e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788256538, "uuid": "fe8a617c-7be8-4df1-a672-397a5fb49c5a", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7231fcf-a609-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788269608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269608, "uuid": "1275756b-ad78-4519-9007-f55ce9086931", "comment": "Malware payload", "value": "965fb4bbfa08337910d43881b161e7f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OpnKeyRansomware", "colour": "#D30F34", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269608, "uuid": "74ef17f9-5f1d-4378-aca2-279bfcdafb5b", "comment": "Malware payload", "value": "f65ad9d7dbd48baebb28ac6415f15f09279db1039cfe9e2dc58147baf1620412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OpnKeyRansomware", "colour": "#D30F34", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269608, "uuid": "39567f2a-c6e4-4e72-b0f8-192544fc5b27", "comment": "Malware payload", "value": "66a40894079dfb592653c87b6487836222936104", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OpnKeyRansomware", "colour": "#D30F34", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788269608, "uuid": "6f0a7646-1f7d-4be2-810b-68cf8806e587", "comment": "Malware payload", "value": "5dddbee6569f3a36a4065e48ec3e7f9d12213c597cf1cdfcae9f23c5a0651dd65194aec87361e53fee8abe016b31e2ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OpnKeyRansomware", "colour": "#D30F34", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269608, "uuid": "79aac5c1-230b-467f-893a-e41119719276", "value": "T1D736AEA9B57C00D5D4AA91B9C2895227E731B82507B017CF1E7486F61FA3BE42FBE740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269608, "uuid": "c0c26814-a3d8-4ed8-92ad-335b0068e70d", "value": "1671767f84704e84f4ad5b7dc40c672a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269608, "uuid": "5ae0a859-dc59-40cf-92cb-616cea69edbd", "value": "49152:IxVwASOpGtlqNVCXXxA0X8YfmX3EX2rIyqw4dwW3NLbKQiEHov1bPPT3qM/JJPCY:YbHi8qwohYT3z4n+oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788269608, "uuid": "3b47bb8f-4959-4e47-9776-26b89aa60dad", "value": 4974592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788269608, "uuid": "cea0956e-6838-43d9-80e4-f83e943e13f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788269608, "uuid": "5852798f-fda6-4291-b61d-8a2a6e8a2830", "value": "f65ad9d7dbd48baebb28ac6415f15f09279db1039cfe9e2dc58147baf1620412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a1e797-a624-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788280913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280913, "uuid": "4027d1c4-75a8-4775-b548-6c63486a812b", "comment": "Malware payload", "value": "63f1b7db1b67964b61b560910ca96793", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280913, "uuid": "ef6dc3d1-5f84-468f-a652-9c6ed64e6b90", "comment": "Malware payload", "value": "f69edeeabed57cde46630459b12577c97ab13cf1bcd0c6f35bdcf5c6ff84cb7e", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280913, "uuid": "ca1a95b8-b801-45d5-84d1-3ffe439bbcec", "comment": "Malware payload", "value": "ec0d5a0617ff16cf1d6931438c13f1f8d7cdac93", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788280913, "uuid": "67dc4e9f-5bca-4814-98b8-ba6fec422dfc", "comment": "Malware payload", "value": "b76b9974cf609870ce7e5b4bd654baa89127b2acb7689a0c6532f0c9ab04f2d589600cd6e34045c8a1a59c2fbe9d6cea", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280913, "uuid": "832188b8-265a-4470-832a-3f8937310c8c", "value": "T14FF733C2B67B414ED111647FA3145A7FF60ECA30C64F7D9286AFD6AAF114E103628A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280913, "uuid": "8d13c0c0-7c29-467f-9169-5666f871e587", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280913, "uuid": "96d402da-b5bf-4ef8-84da-20b5f55d38a9", "value": "1572864:vejOYfd0irJoitt1+mbzEJE7jc1eaGTvXLy5YeG8+OqdYgS7:v4l0irJV/1jAJ4YwdXm5Yj8+vdpS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788280913, "uuid": "2190b179-7ee2-4077-abc7-cfc1dbb28a79", "value": 72600275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788280913, "uuid": "c30b9d9c-d626-4b7e-8f05-227bda8cf500", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788280913, "uuid": "b538c0e5-2d60-4571-9558-29838c28b349", "value": "Glacier.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cac22a7-a5cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1788243632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243632, "uuid": "60acdd73-5c2a-4c50-9120-c33364213535", "comment": "Malware payload (PureLogsStealer)", "value": "133268bf617be9158581da05d19d89cf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243632, "uuid": "fc73b9bf-09fd-4871-bdb2-d856bd032637", "comment": "Malware payload (PureLogsStealer)", "value": "f790288eea5e388872bb98138bd050fbd08a8d371deebb6be12f62cc45585cd8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243632, "uuid": "e1fcafa4-0829-4a22-963a-2681df51049b", "comment": "Malware payload (PureLogsStealer)", "value": "f7e457957534729e4639730dc6c261a7e77647b2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788243632, "uuid": "589c8728-1a52-47de-9484-2ae79c959635", "comment": "Malware payload (PureLogsStealer)", "value": "c493f650f1d9cfbc542b1a5982c4e64922d28e48f71328ad24091487dac1a4723bd3c7bb96060827431f54b9bea12e12", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243632, "uuid": "9633f613-3e20-45d8-9541-a6bb2b04af0e", "value": "T17DE3123BCAABFEE9D775B4C25D002D2D65865F03E672AE9A8F0A04D39341454DF0978C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243632, "uuid": "beacf6d3-da91-4821-8faa-911687881656", "value": "3072:B+J4axq1h3IaaRRVhWCpwofMmJJwAP9p/YqPTyH4JaklN:QG/xk3htwoEfA1pwAE8DlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788243632, "uuid": "6a1c2a8b-3bff-49c8-9661-7ae5b9ba43da", "value": 144521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788243632, "uuid": "fa4c45da-c782-46ba-88da-bf66d56b5303", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788243632, "uuid": "96c1de48-8d50-4f0a-898f-b95df58101c6", "value": "Order N\u00b0 21648004.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2eef3d-a633-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788287714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788287714, "uuid": "5952ff25-4623-4ee8-af6a-4935bfcba227", "comment": "Malware payload", "value": "6d0a446f28f2c74438a6f653842e567e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788287714, "uuid": "2a8a98f5-5a3c-4821-a586-0a14424bd3fe", "comment": "Malware payload", "value": "f80f8214cf32d0fef1cae4efd394216672e840fede150008cfad52de228aee0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788287714, "uuid": "e55cee4d-e53b-40d6-b893-1d09f8e0564d", "comment": "Malware payload", "value": "548b42d1acf75ae53b5b38ea84b665c249cb4ccf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788287714, "uuid": "eb34b746-e35d-4b06-b269-d76fc997d666", "comment": "Malware payload", "value": "95d51e4a6952e3bd32f5f9d9c30c64e7af0818576aa5cd840e0c2d2602755711f1a4b4717d951aa6c729b67a5d188dc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788287714, "uuid": "bdaea110-e43c-47fb-abf1-5d92b9805a28", "value": "T19EF65A07BE8641E0D59ADA35C0BB2721BB35BC4CCB3477AB2E9061B02F653D16EB5B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788287714, "uuid": "5a56bdfe-cd5a-4d6e-b2dd-90b31374bd85", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788287714, "uuid": "7569d8f7-8e1c-4d7f-af42-4cb6876aec13", "value": "98304:ZMNVivUzQ7qpS8Im3YBD/4VUtWduX+HM7XPdB3F5yzxU9b:ZMVivUE7qpH13YDxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788287714, "uuid": "ee642aa7-7c21-4bdc-a0fc-322c963e0d90", "value": 15676792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788287714, "uuid": "30fe0a1b-3421-4936-a2ae-05eb15a61dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788287714, "uuid": "ea00b632-8f48-4a0a-be39-c431acc3cc9e", "value": "f80f8214cf32d0fef1cae4efd394216672e840fede150008cfad52de228aee0c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd4c2da-a639-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788290342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290342, "uuid": "0dcc2488-76c8-4625-be6d-5d2e7a7b4378", "comment": "Malware payload", "value": "c3bb065761470a2b1f98211900b2676c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290342, "uuid": "af34f30c-3bf6-46df-a796-402575d73bc7", "comment": "Malware payload", "value": "f84154829462767e464f41dd63d1513547e728eced3af90a6561f1e7e1611723", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290342, "uuid": "b70131d7-96ea-448b-912b-e0ac08d603e0", "comment": "Malware payload", "value": "217cd2e3bf4970025d8c2b8032cc2afd7105b97e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290342, "uuid": "bb700094-d7a1-4572-b4f7-c9a41389ebe3", "comment": "Malware payload", "value": "a8bd8828c1f1705c82328c996072c46beac85e71fa0aa3d3bc91b447eef704cc5a5c51356cce6a58880e35cf471b9954", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290342, "uuid": "f93c63d7-5445-412e-a25e-a6ce743cf8c0", "value": "T13B27239AFB859AABC8F6863309F16A71110B9CA58F4796C76C00733C69775F50F06EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290342, "uuid": "4b3ad8fb-265d-4b08-9746-62b66c0893f8", "value": "393216:041eahKVcj9iJpySr4JU0UIoK0TTgPXYsns/E067+33Qvj:041eah4cjUpDr4JUmNGgXhoMo3Qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788290342, "uuid": "855d5ff7-e909-4caf-9886-bf1ca3158afb", "value": 20925234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788290342, "uuid": "604c4fef-45ec-4d49-8758-74e99a369c9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290342, "uuid": "3f4c00fe-ab28-4418-a10d-7db3a52691f8", "value": "Tiktok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b937d2a1-a639-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788290227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290227, "uuid": "50b89217-aa04-42a4-8dd5-7e1d4006992c", "comment": "Malware payload", "value": "fa58a57efee91e83fb37d7d4f9edf92f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290227, "uuid": "7fbbc6d1-7825-41be-aa70-7dbdbaa409eb", "comment": "Malware payload", "value": "f885885e1abba77b387706cba13aa51ab632b4d525b8e78c16db0f4ad6396a4e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290227, "uuid": "78c7f8e1-9eb0-4c4e-bac5-3e2e751188da", "comment": "Malware payload", "value": "34666840b8745e033778782ed18b0b315060dc4d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788290227, "uuid": "5682a609-b497-43ed-aada-86d21222d395", "comment": "Malware payload", "value": "f907f7e9c0ed0ff1271f2f11e34b62141d2c282e38d89568bf7c0b405be51fdffc6b8ed033e790b94d52f68f6db3ce4b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290227, "uuid": "9a90d026-14e8-4fc6-861b-71a5850f6d53", "value": "T163372387FB88592BC4F753B645761721154B4E228B47DBC7AD54323C28BB6D02F8EAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290227, "uuid": "1a708ce1-fd06-46b4-846e-2f95332c37bc", "value": "393216:M6W4Pq67mpqNQ3o7+bYsGi1/nEToPkTXsKI9DEtVj5EIfWmjnWl7yWbpZT/Q:o4J7oY7+bYRSqosDWDEfj5CpVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788290227, "uuid": "51042015-6016-4a59-a6ff-260c0a27268f", "value": 24502036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788290227, "uuid": "05a5b831-e04f-4dc1-989c-23962eb7f8a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788290227, "uuid": "ef6aeb77-3daa-4c38-b271-06a5aa0872a9", "value": "release.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b6c226-a626-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788281987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281987, "uuid": "8b245fe4-d6f6-401b-864a-50f331911804", "comment": "Malware payload (Vidar)", "value": "7275fbbbc01e2f395abfc108fee9b84d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281987, "uuid": "45b0005f-cc9d-42b2-bf5b-4a82bce6b174", "comment": "Malware payload (Vidar)", "value": "f940197516c5a27c882ce2154aefeaaf81879f9e4ae2949d6303aad45c68ecca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281987, "uuid": "ba7328de-4778-45d2-a69a-fd4e637db7f9", "comment": "Malware payload (Vidar)", "value": "453e4abf84dec9adae935ce8694f06fe6432ecb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281987, "uuid": "4913fc0c-a244-4bd1-bbab-ba15b24fe258", "comment": "Malware payload (Vidar)", "value": "ef0a193fcdc2b994c7d04034a97314ee90c09662c2c6e7a5f9bfde47fd9b5870172ac22ad677dec94d3889f6581751b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KILLAV", "colour": "#242D8F", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281987, "uuid": "2ad5d6ba-341a-4170-b9fb-a83209bbe3e5", "value": "T136278E03BC4559E4C49B5938A2BA2712F730B486DB3937DB2F1066381F3A7E26DB9714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281987, "uuid": "31916e95-fbfe-4bb7-a3de-a9a899f81744", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281987, "uuid": "0af3ed92-ca0d-426f-9201-96dfc0ea2be8", "value": "98304:13IvojvtVpCcUJ1ajYzvh0hs3AZyNSNTyeUA:d0obtVAmY4NTyeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788281987, "uuid": "1fea6c08-0dc3-4c96-956f-1143f2f5d0e9", "value": 21483968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788281987, "uuid": "e0b6aa83-10a3-4b85-a7df-36e5bb952036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281987, "uuid": "159e89e1-4b29-45b1-9397-a8a76837a295", "value": "LatestVersionV1.3.9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4a2400-a5e5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788254133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254133, "uuid": "4c14a44f-5528-4bae-bcea-05b80ef1ed6a", "comment": "Malware payload", "value": "446e4db1d44b3a8f702c9e4eddeea0f5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254133, "uuid": "c21d0ce7-32f8-4349-ac28-e448bbf5829b", "comment": "Malware payload", "value": "fa226e734c4a029b0f6fe05cae563aa2510e9beb2ae6100cea6b7f0b2745089f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254133, "uuid": "e9d99d32-7456-4ddf-a1bf-008b85cb7e39", "comment": "Malware payload", "value": "b9aff234c6c03c9fa649369e736255d9089c9390", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788254133, "uuid": "738b4010-146f-42c8-9a33-45974fb80b1e", "comment": "Malware payload", "value": "b620634bde4e299243791b5385bae226b99239a4a646bb6bc8896b8932b1af08d1fc97624956ea8b17084e832b3b5843", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788254133, "uuid": "dfbf6fc5-1e7b-4064-aea1-fc1f0fea577b", "value": "T1FD236C6516857C14AE98C4365C7F2F0CB9AD43E6314492EE7FCE3CF28C4A6AD9208B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788254133, "uuid": "e9f2c189-0007-4634-b46e-0d637a3d0d59", "value": "768:yr9NyXsZztCH9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:cHusZBcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788254133, "uuid": "2b6952f3-7c98-4770-9b30-da7dbd4aa3bc", "value": 50075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788254133, "uuid": "646afec0-3878-4942-baed-4c1d4f7fd03a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788254133, "uuid": "0ca0d500-29c4-48a9-80dc-a226e10f662c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e79811b-a5e3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1788253192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788253192, "uuid": "7ddd4e53-8967-4228-8dfe-547d35166cc2", "comment": "Malware payload (Formbook)", "value": "42cd21e5119193f0b631f87d9c87e36c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788253192, "uuid": "e4d1ce58-0a70-4271-b7d3-eff0e6e32626", "comment": "Malware payload (Formbook)", "value": "fa40373e5a9d2462d48caca66c22f98e65cebe0fe05f81dce42eae9476526673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788253192, "uuid": "0f49786b-ba8b-42da-b2b3-4af9d9f6b819", "comment": "Malware payload (Formbook)", "value": "b1cc51fda64aca3e4919435f10175cd782d0e68a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788253192, "uuid": "edf7a0ca-80e2-4181-a298-15df36afbd35", "comment": "Malware payload (Formbook)", "value": "908bbcdfc5517ed459a2b49730c568afbd136de96cd4adf54913e6850647cc7ad5485b1f58db6f5e75d1250be4584682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788253192, "uuid": "36851c5c-9f9f-4dce-b33b-9b816987933c", "value": "T10F3501142219CE07C4765FF40971E2F41B795E89EA22C313EFEABEEFB57A7101855282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788253192, "uuid": "92f42f2f-5559-4040-9e08-0e6f5204b6a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788253192, "uuid": "28caa0e8-31cc-49c1-bb09-b9a895471f2d", "value": "24576:MG8I1h6LHEbw9Ht/+66Tz5tXx5BHKmIl7+2gM2WsX:MrltmHTz5FBKJcvJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788253192, "uuid": "9ae4020a-1e31-44c4-b479-e5eed2a67488", "value": 1144832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788253192, "uuid": "e432ce71-7c4f-43ab-be17-39c5add36639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788253192, "uuid": "7fb2025e-6513-4a97-86dd-a47253d95b6e", "value": "Invoice No. 1563029253.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c818743-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788278126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278126, "uuid": "c0ff608a-ecdf-463f-9a36-de94ef11e8fb", "comment": "Malware payload", "value": "f1c5a9fbb4bb9bca665852c78d494690", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278126, "uuid": "a50a02ee-1e23-408a-9deb-c9876e865363", "comment": "Malware payload", "value": "faf7b6b701818a31d8b259567ea2580164c4a1ead0b383bee5d9ba9c64f68045", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278126, "uuid": "7fac54f5-ef63-4b2b-bb7f-c0b753918d30", "comment": "Malware payload", "value": "08cf946b593fc2c99f0136921de1814fc231ab8f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278126, "uuid": "7de9ca04-7ce3-4b8f-a130-1da2b0326d64", "comment": "Malware payload", "value": "177c75b0618124d3fa04ee890a67dfae0d7bacf26eb357fd4f35d32e2ce0385d50941e430ef612967d1dd96d84efc00a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278126, "uuid": "87288b93-6b65-44c1-b38b-90e44ad5a383", "value": "T14351D5E572600B3A14E18A0972F74E44E83485D73CDD87A8EDED895B2B354A87D89B0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278126, "uuid": "1dfc74cf-026d-4178-b997-a8d1d4aa1933", "value": "24:FmJHOm6ZAgUgnguge1gACt8nNAB8jJaA8/G/o0AoTCbTAuhY3+uA7eV9sAaPaaaT:Ub6JxD5oXeVmSN03q9Q7bo1KXDwZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278126, "uuid": "8363b99b-b4f7-4999-91b5-7e6025a6edf5", "value": 3002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278126, "uuid": "6669ccb1-ef53-4ac9-b08d-1cc8df0cadc0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278126, "uuid": "ec73f74f-fab3-4421-866c-61715416f59f", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911275c6-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788278134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278134, "uuid": "a1f5093f-ba9c-48bd-b3a1-6653684de74c", "comment": "Malware payload (Mirai)", "value": "869ce287097c0bfcb179ced3e14b5209", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278134, "uuid": "e8b47112-7403-47b4-8f1f-532d693a0b8e", "comment": "Malware payload (Mirai)", "value": "fb03717b3be4508a8bdcdf97a43d37e71f9db3b785dbdc108d7fea6c7f00b2c1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278134, "uuid": "4e2ccd0d-542c-4a3c-bf65-daa168c573b8", "comment": "Malware payload (Mirai)", "value": "4ca9a2f98acbba126e17bf2a8d99d85b03644cdd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278134, "uuid": "79c921fd-5b05-4d83-8082-a85a64421d20", "comment": "Malware payload (Mirai)", "value": "1381894f6558bdf4bd6da12860b565d1a1a2d52102e3ec5106e8b17e1f07887aeb99770fc0e54d0a1ab0ddbaa3270593", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278134, "uuid": "0382d3b5-277c-4835-951b-e1a800f99869", "value": "T1A8F33987F900DAFEF80BE33A44530905B530B7E211921B376257797BED3A1991973E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278134, "uuid": "af910f77-069f-40ee-8369-c49bb7b8bfdc", "value": "3072:283fgNU84mnrjajbYp+jDmi2VfjbiGLsifpFkyw/BFu:2RrjajspmmiULsibkywZFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278134, "uuid": "3cadf8ea-a9dd-4a74-a249-4fba6307d603", "value": 161984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278134, "uuid": "842f5958-bc6d-4a9a-adc8-d08763c598ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278134, "uuid": "4ecf9dcd-09ee-4b53-ae64-06703ba6c886", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa1befb-a624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788281237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281237, "uuid": "03a86f37-8434-4755-a328-c06dab34cccf", "comment": "Malware payload (Mirai)", "value": "99cd0784c66f09fc653df0def4552090", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281237, "uuid": "95e0b336-32fa-4c1f-9d5b-00130e8fc7bc", "comment": "Malware payload (Mirai)", "value": "fb2be06e8c352f3b3cdddeeff114d9567ccb9f4ba68f3c702699f5c8bfb8df3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281237, "uuid": "101082c7-7a92-4f47-bcb2-99557f78c491", "comment": "Malware payload (Mirai)", "value": "06e2e6096299ec66d76af71bc368f64e8c539446", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788281237, "uuid": "cda286ad-db8b-4012-bfc9-177395dd8092", "comment": "Malware payload (Mirai)", "value": "19645ee93bf0c05887af81f72412c019be94031a856e9c9f4539693ddf2706939f2ed69876f655a08ba918f78088a96c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281237, "uuid": "39580a86-354a-4d1b-80c2-d1e8d0de2a4c", "value": "T1F2742C8862F5FBDEE25AFE3983017C0B6C2987327483758561AEF56313B71850AF9D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281237, "uuid": "35856c29-a5a4-48d1-ad4a-133e7810f5e7", "value": "6144:vOzsPOpX7RQsjhGHH/6z5dvRbQilGiBDPVRpwAvvTik:QpNjE+5rHlH+qvTik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788281237, "uuid": "c0206dc3-4754-4ed5-8e61-d1a0ec52faff", "value": 367272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788281237, "uuid": "13237aea-8410-474d-b205-4d86bf366d0e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788281237, "uuid": "c71f8eae-f3f5-4665-880d-a0a63b0396ba", "value": "fb2be06e8c352f3b3cdddeeff114d9567ccb9f4ba68f3c702699f5c8bfb8df3b.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65aac123-a64c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788298247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788298247, "uuid": "df03bcbd-7e14-4190-8c9b-f09b681f1da0", "comment": "Malware payload", "value": "2e4445508f60172afed97abca6b22b38", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788298247, "uuid": "63e7fecc-b14c-454e-af62-e1d20d5ac28b", "comment": "Malware payload", "value": "fb72ce24396d58ca38a10fa06e1e995223ab204a58446a4caacb3ca8f8a106c3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788298247, "uuid": "d725910d-7152-47f6-9e17-2490b835b041", "comment": "Malware payload", "value": "5f1521a9f2bb75cb0f0e69c91a9ae514b4ca6500", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788298247, "uuid": "a4cd54b8-1b24-4c59-b940-62087835d955", "comment": "Malware payload", "value": "afe568d691066825768641f89d2333d2cb5d161584ab07347a9d187ae476485ed4801c87bb49b577e83cd1558216971c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788298247, "uuid": "77a49d72-6065-47dd-9082-db784e9e96d0", "value": "T1BC515DC517620AB53C53ADC377AF8C447488AAFE68C29E59B9ED34E4494ECCAF084753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788298247, "uuid": "3832b2ec-65c0-44d4-936a-a33debe10894", "value": "24:pKQTKti8X3WZVdvVBRSQ8uAvDX71bH+uXs:pKQOzXG/xVSQ1AvP1bH+u8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788298247, "uuid": "629f7118-12a1-4382-acc4-4f7072742687", "value": 2670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788298247, "uuid": "b0894054-137a-4048-ab12-55eb25d2a86a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788298247, "uuid": "1597cc8d-cc72-454c-b046-c139b0a54f87", "value": "lll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4159417b-a628-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788282725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282725, "uuid": "34692c3e-5ebe-48cd-80da-1b34202b1de5", "comment": "Malware payload", "value": "bbfc4f7b5328a3d188703d18dfee5407", "object_relation": "md5", "Tag": [ { "name": "badur", "colour": "#A35924", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "multi", "colour": "#CC8B64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282725, "uuid": "0b390c7d-7f61-4fa2-af38-a13cfbdd4aa0", "comment": "Malware payload", "value": "fb8a82d843199bbfa0367265ccf883c602101886d78b4bdb71b2668552aed831", "object_relation": "sha256", "Tag": [ { "name": "badur", "colour": "#A35924", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "multi", "colour": "#CC8B64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282725, "uuid": "68a52aa3-c6f0-4a73-8412-63d48448d609", "comment": "Malware payload", "value": "e5cc4cc2fab108758443e85ece1f4a48ad7de98d", "object_relation": "sha1", "Tag": [ { "name": "badur", "colour": "#A35924", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "multi", "colour": "#CC8B64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788282725, "uuid": "377ddd4c-56ff-4231-9264-5a30891ab94f", "comment": "Malware payload", "value": "93ce85722116e64ad0a6923e03f56f8217e2b2580d0c35c82b6fbdf3d64b87f25d4dd8f5071ebf2af364f07007fbed55", "object_relation": "sha3-384", "Tag": [ { "name": "badur", "colour": "#A35924", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "multi", "colour": "#CC8B64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282725, "uuid": "ea5aeb5a-09f3-405e-9d91-ea72e1bde82b", "value": "T13107AD43F66280F8C16AC175835A6232FB21BC4907357AEB5BE44B213E66FD06B3DB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282725, "uuid": "838dd2d8-5096-4636-892c-a77a55a61f60", "value": "804e342a58a1166c435b0c33b9fcc94a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282725, "uuid": "989d3565-8308-4837-8816-c3916201b6d5", "value": "393216:nq5WsCI4rAyKKeFOLIYfzA4/pW1zCkq1gQ3M:q5WsCI4l9sY7b/pW51GQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788282725, "uuid": "e3fbc4d8-7a31-4208-8d19-6bf702e9dc9d", "value": 17352192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788282725, "uuid": "989bf005-a010-416f-bca1-4b27e8327c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788282725, "uuid": "5c813566-cf53-42e0-bdb0-0ea14014fb42", "value": "Nexomia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d52c2d-a619-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788276469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276469, "uuid": "9f8a3508-7c99-470b-b80b-2b71f1999171", "comment": "Malware payload", "value": "f9c9675e02190e6df7d376d5b6a61e48", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276469, "uuid": "7b299a02-5453-4318-ab82-9081e119f44f", "comment": "Malware payload", "value": "fd54e12a3dde03c477c48d8f8d4d070bc691cf386154f0df5b42e3c561450538", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276469, "uuid": "96bb58d5-a8e5-4ffa-b1dc-0486a0e2b0ba", "comment": "Malware payload", "value": "e3d114fdbb3ed84d3d0f3d89a42405f7b44cc2f4", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788276469, "uuid": "6036b224-d1a8-4e78-8034-300fedfd38df", "comment": "Malware payload", "value": "1343cfc54fc3edba2f5f140760bb6fe15d7b88b709a626f0f8ee23e90c8806308831a1852952a7b2b8537ca649de9514", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276469, "uuid": "464678e6-9029-4b56-ac7a-ff3285f6bc8f", "value": "T1A546E111B3D695B6D1BF1638D87A52656774BC048312CBBF5394BD392E32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276469, "uuid": "33714dac-8809-40b0-bd76-29dfa2d23a4f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276469, "uuid": "8bc5f793-075e-4162-b541-ee3d51baa235", "value": "98304:UzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:UhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788276469, "uuid": "01b63990-1c03-4d07-a6ce-f1e434d7a12f", "value": 5721648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788276469, "uuid": "9bf8b67a-9a86-4497-9984-c71b56c106a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788276469, "uuid": "905cceac-e160-4b6b-9650-ae92cc4e9559", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8dc5a10-a61b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1788277449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277449, "uuid": "58451521-7c3a-4924-8569-068e71c0db6e", "comment": "Malware payload (Mirai)", "value": "a41f82355fe1b609eba66006669e0a78", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277449, "uuid": "ee003e45-4344-4f74-8fc1-f8ef0731cae8", "comment": "Malware payload (Mirai)", "value": "fd7cc3808de64a00bd5b6d6c78d6a0355647193b1b92814a5f235bfd7ee0a8db", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277449, "uuid": "903126ca-267f-4bb0-8421-5c139f57ecb1", "comment": "Malware payload (Mirai)", "value": "7dda2eda1c8b713d88c8dffdcdf98af6dac5352b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788277449, "uuid": "02e8e120-0859-4549-af20-5d29ceb7b472", "comment": "Malware payload (Mirai)", "value": "6b3387a43e77ebc8f7266c9e5977817179c070c249782657a4c4606a568816c27be3e70802ba7c69f230d0ede520e5e3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277449, "uuid": "4e21eb18-ba83-44c1-87d7-4c2da37ffbdd", "value": "T151141B46EA418B13C4D62BBAFADF424533339754D3EB730695286BB43B877AA4F23501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277449, "uuid": "6ad6ce6f-ca37-4097-85ec-52c48c6952c4", "value": "6144:tb/4aMySbWkAcaTeS9xv7WJKE+YE5M/RVJvLhu:tElWkAcaqS9xv7toEi/BDhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788277449, "uuid": "a6c9e2a9-9655-4d33-84ca-231271a96446", "value": 208729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788277449, "uuid": "aff9f874-2313-4c65-82f7-b1e8993ae07c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788277449, "uuid": "4507c2ae-f586-4c75-8237-1ab39bc21617", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb54ebff-a61d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1788278312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278312, "uuid": "05a7b339-e9b5-43b7-807d-238c4dacce86", "comment": "Malware payload", "value": "6db30fc76a12a80ed817538ecd249b71", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278312, "uuid": "e8f4dcd6-d7fa-4dcb-8821-26f9d50c78e7", "comment": "Malware payload", "value": "fda5ad2c019dd092098833c9715c7dd0a11fbb36086e0d6cf6d28b94747b348f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278312, "uuid": "1e0916ff-6a43-4153-bab2-3e66c543d300", "comment": "Malware payload", "value": "7c8f5e36ce978e28e1819f1b91d442b83ee80b7b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788278312, "uuid": "b415f029-5824-4b9f-bfa7-5ab31284c322", "comment": "Malware payload", "value": "e7ee58ca1661013e0e33881eefaba05e1528689c565d50f6e2d06d18d4b872b4560184722d1562b45169700cc3b100b4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278312, "uuid": "6a492852-42a3-481f-8504-a37cd9574f01", "value": "T19A668C46BC5DA473D9C9B6351FA71290333ABC049F82C7276A14B77CE9F23588F126A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278312, "uuid": "767102e9-de86-4d2a-a6be-bdd451dc17c9", "value": "49152:xleT8yO7KUDcpxK+VOc0Id/lYl+R5kgKukxWWJ3NmoMP5E1:xlK8ylUDcpHVOc0Ixu+R5s9wE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788278312, "uuid": "63ead798-644e-4335-a693-462e60017639", "value": 7078072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788278312, "uuid": "2bd55a4c-31ae-460d-9783-a9e27c543e8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788278312, "uuid": "df0b7347-ee14-4fd3-b4b8-7787ccb04566", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2603cd4d-a5fd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1788264210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264210, "uuid": "3b00e655-78ee-4e77-b121-953e8a68c519", "comment": "Malware payload (Vidar)", "value": "4155c1a19ad80777f4dcb1dfe994b1a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264210, "uuid": "bcc84250-ee06-48dd-b89a-f695cc19a361", "comment": "Malware payload (Vidar)", "value": "fe63eabfc2f3a00dcd860858be31ecad76ef657f9811fad182439fb17a22adf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264210, "uuid": "30d781fd-ff00-4cea-912c-7ba10e96f447", "comment": "Malware payload (Vidar)", "value": "9c109e7b72f7c820e784dc71abcefd914e68721b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1788264210, "uuid": "77dc2c50-143c-48bb-b839-43776cc47452", "comment": "Malware payload (Vidar)", "value": "d385e8e726deb0005050b430703c707c0ba2910b8cf9f8aba9bd63e34d67ae4d707d5648a6fbfb636cc432b79acf2c67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264210, "uuid": "bf0de8ef-a7eb-40ab-b81d-860b30038a50", "value": "T1C8967C077B4494A4D1A9EE3984A60A51B134BC8D873537EB3FA1BEB43F21BD15636F80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264210, "uuid": "9663073e-3ad4-4356-a27e-657c9f49c0b7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264210, "uuid": "e7073621-d609-4da4-ba55-b3c6dfccf8bb", "value": "49152:vxv7quk1r+F3nXQkMZHk3nSXrAYYZPO18Bkd0R3DHyEc5Wr6BfazmCZ/nwUyI:vpgFRxXrA+0R3DHyDw2fatmVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1788264210, "uuid": "806458c7-e85c-4e30-8e7e-7c20c0bc9818", "value": 9311664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1788264210, "uuid": "6bb0389c-842e-4e8b-99ce-3e500ca6a6fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1788264210, "uuid": "c54e296a-590c-4296-85ec-c4c3792500a3", "value": "fe63eabfc2f3a00dcd860858be31ecad76ef657f9811fad182439fb17a22adf5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }