{ "Event": { "published": true, "date": "2026-03-04", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-04", "timestamp": 1772668982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8cf15c80-6ff1-43b2-97d6-09e77d28f3c9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed020b79-1810-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772659640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659640, "uuid": "c3569222-06a6-49ca-b725-3c4c0b6718b6", "comment": "Malware payload (Mirai)", "value": "2a3e0466db599df09f0ba0c49909cbea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659640, "uuid": "754c7465-c315-41c4-949e-9bd7146cbdde", "comment": "Malware payload (Mirai)", "value": "00773221363989c5ff036647918a21b7672238c66edd556ac35f810e36207c3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659640, "uuid": "e2458fb2-2695-43e2-b8e3-1affa387faa6", "comment": "Malware payload (Mirai)", "value": "30ad018f7a42e5d2653da4f45c8ae845fab20c4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659640, "uuid": "0f2b266e-f12b-43bf-9873-71392dc3e637", "comment": "Malware payload (Mirai)", "value": "009074cddfcf5d83ccb506efd3ab5b94c52e8ffc0a416659ee19e10a42d953fc738d3880fac821854de97ffd58d596ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772659640, "uuid": "cda2feba-969e-4f56-b07b-e4531ba11ff7", "value": "T1D7C3E70AFB110FF7E8AFCD370AA91B0529CC654B12B57B367534C828B58B64B19E3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772659640, "uuid": "83adfe34-5529-4a32-9cb2-72efcb19aab7", "value": "1536:d1k0vOLYrTdXZoCy63+rlRGpBsO/gYamBU4DMUFeZ7k4TNloJtc18Zd/cMApyz:dS0vOLYrTdyCyXGc6dDMMe0u2N1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772659640, "uuid": "83a51740-fd76-4725-bdbd-c2644ed9055a", "value": 122564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772659640, "uuid": "c332f2b4-1195-484e-b61e-8844c8a2a8bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772659640, "uuid": "a510582c-1614-4baa-b6d5-16d9022f19ca", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5879acd5-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654666, "uuid": "8c113b73-7bd3-473c-a575-b28057f4c0ba", "comment": "Malware payload (Mirai)", "value": "a7243100213fba708f537201af94ab8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654666, "uuid": "a4030cdd-e95c-4bbf-ab39-08cf99b1e815", "comment": "Malware payload (Mirai)", "value": "00c26aaaaef4651efd92186989a0446815529cdc66fcd54331ff3ce456b5da52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654666, "uuid": "8d167bac-ee27-4908-a614-f9957ac95fe5", "comment": "Malware payload (Mirai)", "value": "3282a78a711f1716006c4d5e98020e46136770e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654666, "uuid": "9d2f6239-8a6a-4e68-9c37-316bde4b931c", "comment": "Malware payload (Mirai)", "value": "12d4d0e8c8d42190d8c4a505ccb10911513df22264a728e8e415c42aeaaadebe6d6c4cf9fb8730f05f94cdab8841568b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654666, "uuid": "ef9ae76c-cba6-4a60-a926-ea27b5c6acd9", "value": "T18C33F707F84285FDC556C13417BABA3AE83671EE133CB6A777E4BB222842E615D0DD48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654666, "uuid": "f62d5d35-b74d-4d2d-809f-7d42d8a725a7", "value": "1536:gfHlPDdJaEcLAeF9TUDWog1HHcw/0QkiuVn4P:yHlPZMEcTFZ2A1HHcE0hVn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654666, "uuid": "41247143-faf7-4e57-9edf-6f8aa19ce5e4", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654666, "uuid": "b113fb02-2bfe-4500-8a6e-1c9e90ba22f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654666, "uuid": "321acd4d-19b2-465b-9e14-395fd6a8cb82", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166d7edf-17d3-11f1-a769-42010a9c0008", "comment": "Malware payload (AteraAgent)", "timestamp": 1772633080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633080, "uuid": "20a19e66-6541-4751-92f7-8536cb4b93e6", "comment": "Malware payload (AteraAgent)", "value": "7a8faaf3833eae62a1b9c9fc4d3045c2", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633080, "uuid": "e4be74fa-2b64-4b53-b436-964b85214091", "comment": "Malware payload (AteraAgent)", "value": "021adeb5d95fc40ed0df1cb0901794dfcf71ab07a1933bd0eaaf8182b48485e9", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633080, "uuid": "34f8f140-c2dd-4f50-add5-ac5032370414", "comment": "Malware payload (AteraAgent)", "value": "6934b8203d1ad1649a57ec5fd3a2dd279d48e567", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633080, "uuid": "f2ae489c-ed9e-4133-9f66-0602004a7ea6", "comment": "Malware payload (AteraAgent)", "value": "4a4719acdc4b41d67f48db0ed79fd0784027f1bac8e638799dfe94a04db74d00b02ebca3d144beaf84aa970cbd622805", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633080, "uuid": "3831b574-40ce-4b1d-8a54-ee9a3b74440c", "value": "T120862318FBE009AEE5778276C56A8520EA327C8D3720C54F47A4B6295F3B7A075BF701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633080, "uuid": "28048ac5-d4a5-44db-af94-54e4703ece53", "value": "196608:6W/FKmnGYLnWgziirlb4/ieF3GrAfedpvCs3md8r:lKqGYLpZreF3G82yc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633080, "uuid": "ee193138-8e17-48e4-837d-880d3df1f108", "value": 8601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633080, "uuid": "24d0fb00-ab0d-4bf9-b494-f5faa005f6b4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633080, "uuid": "1186ebdb-3dd2-4e26-8d78-62e5fdc76a80", "value": "viewinvite.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb7335e-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602840, "uuid": "3ee0af3c-5f30-4d64-ba65-a0841aaf38c4", "comment": "Malware payload (Mirai)", "value": "64c0ff4a2508cd3f9b4fb82bdc3e219f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602840, "uuid": "19a58479-3025-4e6e-ae5d-716f415c1048", "comment": "Malware payload (Mirai)", "value": "02be60715017c1712c7c09583945cb73908293fa876015e92620c9f031ebbfe7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602840, "uuid": "a08b6257-9820-47ce-9927-6fb6869edc8c", "comment": "Malware payload (Mirai)", "value": "3f0a3687eda5899068bbe5ae5c1bb8ffb886dd25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602840, "uuid": "a368782b-438b-49ec-84cd-cd92fa69aa36", "comment": "Malware payload (Mirai)", "value": "32e2b5e1f10db1ca54fde51e3b75b676a6801294fce94a4828f074a8f67b9b87009efacb49fe42d1d7ade9e148a6c11e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602840, "uuid": "e305ca9e-6af9-4372-9e33-67688aa76529", "value": "T1FF043A45BC919B27C6D112BBFB5E418D372A27A8C2EF7203DD215F21378A85B0E77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602840, "uuid": "5afd75c9-0687-47bc-9dc8-6cc55707c619", "value": "3072:U/R3seLb8d2i8mlVQdPCH64PSypzCfGJRtFHtPk:yR3h6H8m/G6H64P1zaURftc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602840, "uuid": "f21f4844-244b-42d9-be21-fc984a1511e6", "value": 183008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602840, "uuid": "23e612a0-9902-43c6-b5ec-60aa58ab97f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602840, "uuid": "c25f6b3d-8838-419e-8a4b-b356abf3dc2e", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5457c7ef-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625453, "uuid": "9c6a65c0-6793-45bf-805e-06305adbf7b2", "comment": "Malware payload", "value": "7ca8c7aab3f69734a2c4b1a67c37e98a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625453, "uuid": "27ecb22c-6548-4e4f-945b-e7a7224505ed", "comment": "Malware payload", "value": "035d742b56e49418bacce4819bd49d20ca498daa6dc6ee8ac81b72b6cbd54f3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625453, "uuid": "272f10d2-e3c0-494b-aa8d-203169ef2a8c", "comment": "Malware payload", "value": "c59d1cad64980920a738042737c36a64cd9eb711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625453, "uuid": "40a5e5b4-0782-4530-894b-206a4282af04", "comment": "Malware payload", "value": "5e2f7a18e9977fe0d6a66d7cd3432862d5cb9cd74def2e5717f6bba08fb0698fecbeaaf599eab34d1463b4af9aa292fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625453, "uuid": "c93c1c25-37ea-4df1-8805-0fcf6f3906cb", "value": "T19414AD04177D7616CAFF8A3950615330C6BFAE6E2EA1D7475D44B04CAE733B20E126AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625453, "uuid": "bb3b8fd3-039e-4e2d-a532-35dbf308ce74", "value": "3072:YgR7ZVGb2pxxhwKXUiX0AyWED3aOzmJIvX6lvT5WAAo:YgR7ZcbwxxhsBDqQmuvX6t1Ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625453, "uuid": "5cc6196b-05e7-4ab2-b8b7-858679a59967", "value": 207664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625453, "uuid": "d59e8d96-f4fe-4477-8d76-7f380e20a3c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625453, "uuid": "b9ae6be0-f8b4-4448-895f-773ea4824314", "value": "035d742b56e49418bacce4819bd49d20ca498daa6dc6ee8ac81b72b6cbd54f3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f26a5e6-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654597, "uuid": "c0122392-8e64-4ee1-a285-3597b64a2906", "comment": "Malware payload (Mirai)", "value": "e90e7d168ad87ac8b23aa653d86a430b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654597, "uuid": "4523021a-4708-4be5-b8e5-9451b16d9a26", "comment": "Malware payload (Mirai)", "value": "03d5d80870290b6264740f068b95827135f47fd6e5529c94269820194bb2c518", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654597, "uuid": "d9c7594c-241d-4ae1-bb62-1ef0cfa164e8", "comment": "Malware payload (Mirai)", "value": "c6106faf83a53d62006ec3fa65076fcb2ef5b2aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654597, "uuid": "4da9aa8a-0347-4698-8de8-a0e519bc336a", "comment": "Malware payload (Mirai)", "value": "9a5617251ec540660382bd2f34d5aebe2559f58146aa1c141c09d7062e65dc71fb28105d3af72248636505269ad16085", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654597, "uuid": "e7937906-70ec-4350-b0f7-243fd4219aac", "value": "T1BCA2E0BDFB20C1CCE442847E199B2A6B065FF8A647D4420E9A05D1C701C39DE949EEF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654597, "uuid": "28484448-2e07-41f9-853d-af28176c3b53", "value": "384:jDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chJTNifHhBJhpExUC03uhHB3QJmRx+p:jDZ5Dw7RjFjcU+O24sDSNifHhrhpEguM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654597, "uuid": "3c6d7411-32ed-42b0-af43-43f1881d36b0", "value": 23252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654597, "uuid": "e559b1a1-4f02-407a-a233-e4f27aa7e918", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654597, "uuid": "e86baec4-dec5-45b8-9348-8495d40f5a63", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078ee282-17c5-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772627042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627042, "uuid": "7e98ebe3-5234-42d8-8b7a-2e67663d77bc", "comment": "Malware payload (QuasarRAT)", "value": "f82fe05a5aaa207effd01e82a30fde4f", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627042, "uuid": "3c86aee1-9741-430a-90f2-83314f432495", "comment": "Malware payload (QuasarRAT)", "value": "05b34b01b200c4ac7a707c576eca50c9c4cb1e095750dcaa7bd4e0c0fa0aeb02", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627042, "uuid": "c11374f4-cab6-4a0b-8465-8df906d9687c", "comment": "Malware payload (QuasarRAT)", "value": "f46ad8c00f34e228658eb63b0b0a8d17d7d220f2", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627042, "uuid": "58103632-922b-4932-b2ea-432c53b249f8", "comment": "Malware payload (QuasarRAT)", "value": "44308eafcd90e2796d76ced7c54c92303963fdae9af2ad3e6f9893cf36c18a5d49a93867fad21d2991484dc9f81d6e56", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627042, "uuid": "b7254986-2869-470f-aa3b-0fdbb3bb394c", "value": "T13876332B58FCF86A2FD245515CB2164F7A844B6F5BF371E27306DCB081BA70A28B9135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627042, "uuid": "d35707a8-8dd7-42c9-a6b2-66a59532ae9e", "value": "196608:hVfgaiuLVOvzSrio4/V040nCUBGE2bd+m7mJgeR:hFQvzSry/V0jx2Em7ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627042, "uuid": "cb1afdae-952d-4130-8f43-2d956690ab45", "value": 7435928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627042, "uuid": "e3090f37-a705-42f0-9e17-41ebd92c2587", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627042, "uuid": "3fe8d732-0823-43e6-855b-5bc0f1b8bee1", "value": "drive-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef9ca3d-17b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772619861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619861, "uuid": "aa65ddbe-eae7-497f-a130-82040cd7c26f", "comment": "Malware payload", "value": "c753860a6ad654da8f4cc05217e0dc6c", "object_relation": "md5", "Tag": [ { "name": "Astro-Bright-LTD", "colour": "#65023F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619861, "uuid": "254b4664-6a6e-4258-bb14-868e520d1bf2", "comment": "Malware payload", "value": "08da2fefbd4708fce4b5548c044678c468af412c20066840ed816aa5b8bc6a87", "object_relation": "sha256", "Tag": [ { "name": "Astro-Bright-LTD", "colour": "#65023F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619861, "uuid": "e5c4b2cb-0068-46c6-b05a-0af7e591f680", "comment": "Malware payload", "value": "075dd03fbfb8211da9923e2c7ff553d63111596d", "object_relation": "sha1", "Tag": [ { "name": "Astro-Bright-LTD", "colour": "#65023F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619861, "uuid": "810229b8-5fb7-471d-8b16-ce8de2517dac", "comment": "Malware payload", "value": "046b8dbacb77f0de067d96467158ec79f744f5fd97c6dbec20cf895ba6d5a99b88c7d52cc4c096af53ea730040f8f852", "object_relation": "sha3-384", "Tag": [ { "name": "Astro-Bright-LTD", "colour": "#65023F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619861, "uuid": "797e9cc1-3f88-4e2c-b11b-cb3ceafb298a", "value": "T1C9B3CE893BBE5573DA7F4FB9607481428A32AB1BB552C75E08C461EC6E5339206123FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619861, "uuid": "37dccd84-982d-4ef1-bf1f-3218d40301df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619861, "uuid": "f8ddf464-3d74-471d-a9de-a02d2e9d9556", "value": "3072:hwzOhGZvqIq0Z7SvFVYLsL7GPdOoNQvYHQd2V6:WSWDq0s4S7GPdOWs2V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772619861, "uuid": "13ea3bcd-77b7-4397-8626-7806bcdaa75e", "value": 118008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772619861, "uuid": "2ad5c156-f59f-4138-b821-a67bf8c5ea0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619861, "uuid": "693debf1-0026-4dd5-b21b-30c98ea9e96b", "value": "08da2fefbd4708fce4b5548c044678c468af412c20066840ed816aa5b8bc6a87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccba1b7b-178d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gunra)", "timestamp": 1772603321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603321, "uuid": "3366c16c-ceec-45e1-aa04-c83c437d5431", "comment": "Malware payload (Gunra)", "value": "136e0bf4e5fe4d4249fe9570153a0b97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603321, "uuid": "b06fd70f-5244-4e5b-94b4-20d01100540e", "comment": "Malware payload (Gunra)", "value": "0909ecc86f8a89831c9c229de91b829aba6cb54685a2478f89cc04376b13488e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603321, "uuid": "dd604f10-1028-4813-9312-618f13217b8e", "comment": "Malware payload (Gunra)", "value": "333b88066da20c147309a52b8db07379f7da9d6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603321, "uuid": "3545daa7-ec48-4544-bab9-b226faee5e44", "comment": "Malware payload (Gunra)", "value": "dc5f4b494d8d04366e142923214879c05df5682a92b39cf960329f7f617290d6c213ce22ffd65b60484387f61fb7819d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603321, "uuid": "98589e70-c92b-453c-8f09-052635d00ddf", "value": "T15C930856F880DB21C6D4267AFB4E428873230F78D3E972028D15AF3467FB95A4F3A546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603321, "uuid": "ac4d521d-3b53-4293-9d97-98a596e0df41", "value": "1536:+hOGz7PU6wsLc8cJrV/JtvUCcuOC9Cy4ZP1C2v+wZq1XS+C6ios1WCiaON0O+KOW:+hz7PKsLc8cJrFJAC9aZ42v+BhS+C7of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772603321, "uuid": "678f56b5-7152-480b-9d5c-efe2cd52eab9", "value": 95892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772603321, "uuid": "87ee3820-7494-4793-bd9c-bf56e7f656ae", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603321, "uuid": "776577a6-5076-4eef-857f-eda350ec70c4", "value": "build_Od5Qq_F4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f92d1f6-17b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620667, "uuid": "cccc4407-e989-4c3f-b807-27e3ffbd960d", "comment": "Malware payload", "value": "ce3fda17b9c740b5158b86efafd45e87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620667, "uuid": "ff803fad-1470-47df-b1da-58c22da5296a", "comment": "Malware payload", "value": "0937a3594dbec19fcc3341db1333b19f9656a45b3195867fa0a885e3ebd02e80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620667, "uuid": "9240cb71-1044-46d6-9efa-ac64b515fc6a", "comment": "Malware payload", "value": "d962b9e6b18064aed75401ab177e319ef51b3622", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620667, "uuid": "9d65f830-ee24-4c22-816a-65ebae7ac225", "comment": "Malware payload", "value": "00ecd0344bedc29e14a9444b697fedd189b7905d00dea7e87242a40ea439bdffdbe1dd9876aa7347e2491ff1ebe77391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620667, "uuid": "3954d11b-5e3d-4c29-bb3b-84de312c7002", "value": "T19A97338873722A96DD06A17648F01E9EC1C9789A36B5878B3FBD07270DDB0DCFE64614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620667, "uuid": "86a5bd80-5f90-4f5d-a984-13ccd54f6ed1", "value": "c005b4cd3ff755ef7b24e8e7196f0aef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620667, "uuid": "5bef64df-b999-4a37-8b55-a5d586c41c3d", "value": "786432:pFlUR1Oo5W8T0TXMb89rRQ766fG4mio7fs893X5W+b1J6oYlTYTHBohsGDG6Cnq3:pEWo5W5TcqwfGHXn91QnaTaD8nDLKrCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620667, "uuid": "b49d4362-6462-4fa4-ac74-d9bb85582d40", "value": 42714048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620667, "uuid": "af8e8329-585f-4d82-9b0f-1fc89f468ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620667, "uuid": "1659bb6d-7b9d-4d44-9145-c9947cc408fa", "value": "0937a3594dbec19fcc3341db1333b19f9656a45b3195867fa0a885e3ebd02e80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b62e639-17c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772624901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624901, "uuid": "6d828c71-9f87-43ce-bcf5-6324086f7394", "comment": "Malware payload", "value": "48849d56104dc8bf61e8433321bdd4af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624901, "uuid": "92f42748-2705-4ad2-adf1-33ff8e072079", "comment": "Malware payload", "value": "0a11983b15d1fcf62e637cb7c2ad185baf8cb124a7973ce616e25000fe64bb3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624901, "uuid": "c94ed333-c2d1-46a8-a783-d79ae7e71476", "comment": "Malware payload", "value": "84472749a9062d6e4483919c056f9d676ed18f1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624901, "uuid": "bff60906-483e-4969-a0d0-60ce6366cdc3", "comment": "Malware payload", "value": "3fe311ea20f47594a6c53a38c1e747eef1ef7451821274b2b1e532116a312efa19f3688b1ca6715c7bc6330df0b28fad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624901, "uuid": "4c461cad-83c9-4f38-9c46-f8efb253f9fd", "value": "T16C8401D012EC84D2CDBBCF36D0A62E429EB4A672B9A1D182D48545797E45F038F7137E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624901, "uuid": "5c117e44-4816-4410-a026-cda11cd56ac6", "value": "6144:EMcDz4cOwijkzDzZsBS99NIdnYu7/3MfRUTgO/Gi0IJ4lci2V42JwQnPPefunI:uD1F7yYa/3MfR/Oedlci2fJwUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772624901, "uuid": "9181dd85-c5f3-4624-9398-66bd29dcbcb4", "value": 388392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772624901, "uuid": "d1645277-5511-4b53-ae16-fba01d41616a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624901, "uuid": "2ca2935e-4176-456c-890f-10d302243fa3", "value": "0a11983b15d1fcf62e637cb7c2ad185baf8cb124a7973ce616e25000fe64bb3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843285a5-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625533, "uuid": "a441ad72-20cc-43d7-bf97-0631b6dd228b", "comment": "Malware payload", "value": "28b5b225cff77c49e47c88eece6d8f6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625533, "uuid": "3c63b167-0989-419b-a13b-008aad8558a2", "comment": "Malware payload", "value": "0ac92a1d215b2921cf0e41274ad7def4f6f2df988747a6d361fb58e67fd8890f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625533, "uuid": "2151f15a-6117-44e6-9eb7-dd280865abba", "comment": "Malware payload", "value": "55c582d090ead3a3825fa19eca4c5debae84b24e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625533, "uuid": "6d77e38a-1c06-42ac-bc74-5557b284c93e", "comment": "Malware payload", "value": "7f97829436aacb056eaeeac8dd3e34fed77bdfecd2b49cdf6e49f17ac8804d192f4b914e6ce402ecc32ba36162c075c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625533, "uuid": "08ef884e-8e44-44e3-90fa-a8e1d70a0435", "value": "T1CDF65B07AC9149E4C8AD8630896297667B70BC584F3127C73B60F67C2FB7BD06A7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625533, "uuid": "2e63010b-228b-4cf6-92ce-e779a30120d1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625533, "uuid": "58c31dc7-a6b9-4b82-a37c-0ce3828193b8", "value": "196608:egzDYWgN6Ftt/yv72evi4B1zkYgBQAaC2MbmSq:MN6bt/yHHzkTqA521", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625533, "uuid": "0abff30d-40c3-45b1-8036-d6556f87936b", "value": 16206128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625533, "uuid": "fd0c4cd5-8c6b-4f20-9b64-9d5d73f1cc7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625533, "uuid": "3b0bef77-c0b2-4d20-8893-6665ca7b4945", "value": "0ac92a1d215b2921cf0e41274ad7def4f6f2df988747a6d361fb58e67fd8890f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b730f1-17e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772639172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772639172, "uuid": "b1b93f9b-22b3-4b98-8a38-bf2fb45f7239", "comment": "Malware payload (Smoke Loader)", "value": "53da8bea71bfe1b72632e354166437fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke", "colour": "#98B1F1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772639172, "uuid": "3eb168fa-00ef-4302-9631-ead54fb81b86", "comment": "Malware payload (Smoke Loader)", "value": "0b06c6a25000addde175277b2d157d5bca4ab95cbfe3d984f1dba2ecefa3a4cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke", "colour": "#98B1F1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772639172, "uuid": "63216afe-3fb5-40e1-9c61-cdf2180e31fe", "comment": "Malware payload (Smoke Loader)", "value": "21d606a2eb1867c45a77181ecfc4acd7eb9c5130", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke", "colour": "#98B1F1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772639172, "uuid": "c49f4428-e1a6-4276-8770-3a6d9f3be830", "comment": "Malware payload (Smoke Loader)", "value": "b35e77af38ac39427de67de52eb0a228e115391823d693160cd088f6b4adb0cf412433550b4fe7e248e58b994dc29f13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke", "colour": "#98B1F1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772639172, "uuid": "4c11c9d0-00aa-4a0d-9f4b-2d39439e00b9", "value": "T15523E1978CF8AD60C4C98975CD92D267E3EB25C31DD3168CF32A9D224495FDA933DA80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772639172, "uuid": "acb1766e-2df8-433e-9776-1ae5232842b5", "value": "768:HnX3jtMYOlOOVfY3SCUTt6DgmUEEm63bd28P4QsOmrA:HX3BMYEfePcBvp35XPXms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772639172, "uuid": "24dd89ae-1698-4c11-a0ba-95c140a8ff5b", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772639172, "uuid": "7174a056-ae37-4837-be47-acbc4be6e9f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772639172, "uuid": "7ee7a229-0db6-4b75-be7b-08f5e19503a8", "value": "0b06c6a25000addde175277b2d157d5bca4ab95cbfe3d984f1dba2ecefa3a4cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f2aedb-17b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772619851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619851, "uuid": "af5a85ad-5ebd-4ba2-ad8a-bf0710762b0f", "comment": "Malware payload", "value": "b6c5b9ea469cb955f37ab9bc5699b84c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619851, "uuid": "3071cfa2-4895-41b1-9d72-13924278bd5a", "comment": "Malware payload", "value": "0c7f34b67d42c0e0ef8750b93d2279cbb16137110bf267c8569d1b801c366188", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619851, "uuid": "55cc49b8-0ca5-4168-85f7-5228a36c0e29", "comment": "Malware payload", "value": "75245900bfdf89bd4603643dfac360a8175ded85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619851, "uuid": "fe7f4794-bdbe-46eb-8d50-58ae18a4cbfb", "comment": "Malware payload", "value": "30b5c3d57f832ad0e9b50d8932d8adcef529cabcecc699fae712e97c17e80744870d54b52a85a879381b575cde26535f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619851, "uuid": "3eff137c-799b-4552-b713-00075879b9b4", "value": "T131358E01B754950CFA26FE74D0A2D3C243F5FC26A66ACB3F24B5349B5FE628F5811292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619851, "uuid": "d5894d45-d8fa-4895-84a5-68d0a0d58fab", "value": "24576:jLWcoBHhL/ktqJ4WcoBHhL/ktWUcox6C7CV/1coZM7JVz7cohps5nVx:jRWW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772619851, "uuid": "52ff85ae-188a-4e96-a588-a2a59b9d0cf6", "value": 1063120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772619851, "uuid": "99befcb4-6eef-43f6-8520-4f07b702896b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619851, "uuid": "5532d7f8-7981-47f6-8b6c-b075c4069bf6", "value": "0c7f34b67d42c0e0ef8750b93d2279cbb16137110bf267c8569d1b801c366188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fdc03a-17c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772624996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624996, "uuid": "4977bd28-b947-465d-88ec-738840c6f338", "comment": "Malware payload", "value": "13a6edd9c1ab6cb2961a4b3bdda4a655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LONG-SOUND-LTD", "colour": "#B89FFE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624996, "uuid": "a6c29efc-84f7-4d35-978c-f03e7bec155b", "comment": "Malware payload", "value": "0f76f6a9f7c2575f9312953d37b51a8e1a7cc38a0758e272deef25bd6593306e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LONG-SOUND-LTD", "colour": "#B89FFE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624996, "uuid": "9f661551-75f4-438c-9b8b-4124c03ba255", "comment": "Malware payload", "value": "5160b586b1a9a75ed881001b3ef776ddd60ab4f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LONG-SOUND-LTD", "colour": "#B89FFE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624996, "uuid": "3ae5c4c3-ac99-4fae-b00c-9d86f88b85df", "comment": "Malware payload", "value": "f6084f23b7a31663e28e1d39389f66b4b83b50b65bc3318df81abcf080d966bfff2031ac70ee2fa27e7b25bb350d948d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LONG-SOUND-LTD", "colour": "#B89FFE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624996, "uuid": "d9827e0d-4526-4815-9f53-d41a928bc728", "value": "T1EBD3CFD39ED80DD3FB3A5A72E0B65107C333524D84EC995EBCED584A0FB13904257AA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624996, "uuid": "7806cbec-12b5-4331-b262-843398ed7b90", "value": "1536:YfCmXMxvGfds0vZ1jeavGi0nUcxUwfUAZEfq/pdlhnc3HfMQ5auc:bmoGy0TKavGDUcxU1fqpdlSv50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772624996, "uuid": "8ad74388-08a6-421e-b73c-693e919e08d6", "value": 133408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772624996, "uuid": "3845783a-24f4-40b0-ba43-7a5a95d3560a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624996, "uuid": "e663d0d9-54c1-409b-9156-ed8aa1f4b09b", "value": "0f76f6a9f7c2575f9312953d37b51a8e1a7cc38a0758e272deef25bd6593306e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb1a630-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654596, "uuid": "e231f55d-8ed8-4c2f-91c2-055f6b3de131", "comment": "Malware payload (Mirai)", "value": "47a56efd670f2fdb46323b48649bf8f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654596, "uuid": "abaf012d-dc7b-4f09-8d39-1fa75530ab18", "comment": "Malware payload (Mirai)", "value": "0fdf537ce38948bdb109c721770df788580d6903ea5c6ae78ea7baa2b7d98ded", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654596, "uuid": "e24ce46c-e4d5-436d-b882-47c56a84dc0f", "comment": "Malware payload (Mirai)", "value": "f3c79e922f34126a8626ad4dccec80e3b8511909", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654596, "uuid": "5b62b0b8-7ea5-41c4-8ade-f92a6715eada", "comment": "Malware payload (Mirai)", "value": "d4959eef692810c9bd245ab5c9b201633aacf184fb0cfcffb53f58cff2786df5db69c8744b68e7dddb7b40837ee0e990", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654596, "uuid": "aebaf95d-9be4-4087-b402-4489721c1b96", "value": "T11963951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654596, "uuid": "27f6fbbb-2e91-488b-a1a9-0712ae5c3676", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatA6:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzRL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654596, "uuid": "971627ad-04d5-4805-9550-37096405ad01", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654596, "uuid": "90269924-3afb-4454-b83a-f32e9fd727ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654596, "uuid": "d56048bb-ad88-462f-aeeb-4b17ddda6cd3", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807b961f-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602764, "uuid": "e71a8e0f-4654-4538-a081-01257c196fb4", "comment": "Malware payload (Mirai)", "value": "eec9a5792909b25b9a8335ce64283b2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602764, "uuid": "6c013dce-1d81-432d-b8a9-59723126b765", "comment": "Malware payload (Mirai)", "value": "1125504e43d71fda2847358618fb2e67c03788a845ad1c973afdba6edf779837", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602764, "uuid": "8a14359f-bc3e-4dc1-aace-d2e1260ccb2b", "comment": "Malware payload (Mirai)", "value": "94c90be374dd09f5acca6a669affc2db4181cebf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602764, "uuid": "5724c336-f39a-4618-a550-d883c09813c3", "comment": "Malware payload (Mirai)", "value": "8b1bd62601d09f22f11d8bcd22cfd78788fef033dc543e8e0c212cc4da50905e3dda07665171a7e1444be7af22bfe1c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602764, "uuid": "ed4d2138-07c2-44c8-adca-e55e97fb1cfb", "value": "T1D963029E0CA8ECB2D9AE5E7710DD366DF9142185352A5FED55078C80AFBA403F62613C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602764, "uuid": "162437ca-7841-46d0-ad22-687899e4c2b2", "value": "1536:+hkh2Dp/RSm8h+5s0y8Rl2/ffaxBTBGpPvd1hrIljo9q4:/A/Sb+SaxlBMTZUjo44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602764, "uuid": "ab5f99e2-f870-41eb-ac54-6d8f0e8b5f6c", "value": 73228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602764, "uuid": "a7158db9-246c-4eb9-af11-7dfbd9f3edc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602764, "uuid": "8ed42dcc-e936-4ee8-81ce-76599392888e", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dafc241-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654594, "uuid": "29c58ecf-269a-4daf-9071-fa8f02186503", "comment": "Malware payload (Mirai)", "value": "0bd95c3bd90f53962d7dbac34a9882cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654594, "uuid": "8a20bbde-ee53-41ec-a9a8-3e2bfdb48a40", "comment": "Malware payload (Mirai)", "value": "137d858db6a6b8e06f2c76ddf509b94325cbccf628f43893d9c3fedc42ef698d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654594, "uuid": "5ff5040e-bb37-4730-9915-305eff23e6da", "comment": "Malware payload (Mirai)", "value": "19046260dda9000d44a143e4816a2aec60f2bcd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654594, "uuid": "0ba18e2a-004e-4e4d-83b7-eda91f9ff38d", "comment": "Malware payload (Mirai)", "value": "034de0e8a49b024dc9fec7006ccff11829fb6f579d4cbd9d01376a2e2727d2371a0095604c84249b594a2cf76905a0dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654594, "uuid": "b282ce74-0fc5-48a3-892f-eb8a0a7c99e7", "value": "T1C2A2E11072A32D66E3DD2C3DC96E8357F9A60BFC90F6327679415520C94D20A3E39A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654594, "uuid": "09af6b24-3d23-4365-a885-e13bc3f73bf9", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjaJhymdGUop5hj:UvQn4j+ZO5fKAlxIs3Uozl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654594, "uuid": "26c7e5e8-5c4e-432a-ab75-e85b377a46c7", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654594, "uuid": "8c73c068-92ba-4409-bf76-31792f2ce392", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654594, "uuid": "887797bb-f821-4e67-a67b-e5eb9a435faf", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5edc2c-17d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772633063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633063, "uuid": "d56e13ba-5cad-41e1-b745-9fe40e4b3c99", "comment": "Malware payload (Mirai)", "value": "20b18dbf703fa2ddf0709fa4eb89af31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633063, "uuid": "2ff1fc1c-16d7-4931-9e8a-e6b7549be627", "comment": "Malware payload (Mirai)", "value": "146207854b2ea3765cae136f8bac667847dc445e01e19bc020215165abda7071", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633063, "uuid": "950cc42e-d7e8-4a7f-acca-74eff179503b", "comment": "Malware payload (Mirai)", "value": "ba31766dbc5247a139a73303561ee15e3c64d830", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633063, "uuid": "5fb2fe38-ad49-43ca-ace8-d4bd9d1c1b4d", "comment": "Malware payload (Mirai)", "value": "c985390cd948befde9af977fc5b7edc52ad728af1b594c2d0992aad43c6bd339cabade381c80606a325e494abd5b2ea3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633063, "uuid": "2547c557-b134-4c28-8dbd-210723cc883a", "value": "T100935B02B3180E47D1A74DF0263F2BD193BEA6D021F4F689651F9B86A672D331486FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633063, "uuid": "4263f4a4-bcb9-4354-8a81-66dd9933ef57", "value": "1536:Wbwt0agjkg0W1Tjarc5xedAIXfFTlvutyozw5V4OW/FfEY6W+NalPNTJGKNISV3Y:rNCkUT3xYfaPLdlpJicNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633063, "uuid": "61f4fc05-609a-4cdc-b28d-47ee66caac17", "value": 93196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633063, "uuid": "af86bd27-0719-41eb-9f38-a90f12f8f1c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633063, "uuid": "4bb29686-53e5-40ca-9d81-07ce456c6db8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68aff85d-17b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620763, "uuid": "f0de1287-7b70-4330-91b6-e8b9df8c3b79", "comment": "Malware payload", "value": "02ba30736de6a2749db1d6ce79c93365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620763, "uuid": "39767f7c-2f48-4298-974a-b2bd84819a9d", "comment": "Malware payload", "value": "1570f05cfa7581ca2f1123f09b15ffea002ec9749a30bfc961e78bff21a7b4cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620763, "uuid": "a9c46ee2-c6e8-49a3-a10b-aa46e6dad716", "comment": "Malware payload", "value": "0b4608431fd8020df12e19a1ce21267412c49f3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620763, "uuid": "13512a80-2e88-4ac0-8a52-145883b56dfe", "comment": "Malware payload", "value": "f64c232fe27dc7abc007d2708713715f893cff486d89199d8ac8f81ded7c69a9f86200f441fe45d804ba67b31bd285ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620763, "uuid": "1599abb4-ef65-4912-b015-73bbc0d5e8bd", "value": "T1B7258D01B750A51CFA27FD78D0E2E2C243F1FC216A6ACB3F54B5355B5FA628F6811292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620763, "uuid": "5b9f516d-fafe-4c46-8480-0d5826045ca6", "value": "24576:WxWcoBHhL/ktOV4WcoBHhL/ktk8DiIIUcox/mS8V81coZMMZVwccohSUJYVb:ASWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620763, "uuid": "d71b6b23-ecb5-4613-84bf-e42c46cad2f0", "value": 1019600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620763, "uuid": "d1f93650-f214-4e78-8078-e4818ebd97ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620763, "uuid": "0097a6bd-b854-44c2-a14b-1770cdee6323", "value": "1570f05cfa7581ca2f1123f09b15ffea002ec9749a30bfc961e78bff21a7b4cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d093fe69-17d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772634681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634681, "uuid": "62da4966-195a-48d4-83a1-bb007d8ba51b", "comment": "Malware payload (Mirai)", "value": "333af95a75400bec82bdeab4d5e017c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634681, "uuid": "e7127271-8677-4665-9c08-e7fa6b3196ba", "comment": "Malware payload (Mirai)", "value": "16764f477883f5acfb2b8ae12e7ddcb3294502a03e0af500906b8fd1f44c95c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634681, "uuid": "cfc5b207-353c-4c91-a367-9c57603556f3", "comment": "Malware payload (Mirai)", "value": "294d8a5ff438e79b06482f85b3788d2fd12b4449", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634681, "uuid": "9c0d8313-773f-4897-bf55-ac62890fb34c", "comment": "Malware payload (Mirai)", "value": "d7f1b76674755ecbabfc07ba31f653a7512861e49b5353bcd07b0081258a9f7e7bbc23afc7c1a7c9e64ed505924b7744", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634681, "uuid": "2017dc74-7401-417e-a725-eb44777cda1e", "value": "T129C3B71E6E219FBDF769823047B78F25A75933D627E1C582E16DD2001E6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634681, "uuid": "60029ca1-a178-4967-bc14-763321b8b61b", "value": "1536:25XtwJBiYJPl60bY8EE7hLpCpcn74bpWEsLQB+el301+mKMUpaVZ:zxPllboEdLGcn7eWnyc4mTRVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772634681, "uuid": "ef1f0b8b-246c-495c-a3de-c6d3bcff9180", "value": 122116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772634681, "uuid": "2c1345d7-44f4-499d-9438-1e7e7a84c15f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634681, "uuid": "c72e798f-4255-4da1-b85a-70c89d9d3c42", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0f96b2-17dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772637094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637094, "uuid": "a499b1f0-750e-4225-8ac8-954d40e9ec49", "comment": "Malware payload (Mirai)", "value": "669ff368956c12a4e452e595d5f4a94a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637094, "uuid": "a3b27ae5-127a-41e0-a3fb-6949ea67f10a", "comment": "Malware payload (Mirai)", "value": "178af0819b61fd9e916c793a53e322058d3195ede90267ae32f2523ead08ec74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637094, "uuid": "84434e9d-b53d-4d2c-b299-c0fbb6aa1b49", "comment": "Malware payload (Mirai)", "value": "fe6e9af41c267fb79529d920c1fd0534e546a23c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637094, "uuid": "5641e1dc-8d5e-477e-9337-bd86f881a3cf", "comment": "Malware payload (Mirai)", "value": "423eb18ce9282709cf9ddccc4c98c57b1230f808840112f43e6825daca3fb4696e476cd1be8f254eae4fe6dffcd68875", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637094, "uuid": "37df8239-74bd-4290-aa68-f4c985599ad4", "value": "T1EB530261731A7A4221A228F6E69D82CD076F9ABCFCFE15CEDD04816C6BC025516F734A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637094, "uuid": "9362c558-0653-445d-8373-413716fd0a4f", "value": "1536:xGVRmKwcheDh6ny2r3MguPdY3L4wdtEuc0RzX:oTbeDh6n/czSdP+qT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772637094, "uuid": "fca44fda-3e17-495e-9f9c-eeb0695fe753", "value": 63592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772637094, "uuid": "45553e4b-4b20-4da3-a35c-0a07f24875c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637094, "uuid": "20cb39a3-d281-4bbc-916c-c706c4dce85d", "value": "Polar.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6dccfb-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654595, "uuid": "51128518-fa16-43a5-b33f-94f04f868e77", "comment": "Malware payload (Mirai)", "value": "d5ad7ebb8a74c3f21eb746470722fa26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654595, "uuid": "96cbf993-0163-4507-a25d-b08aa98317fa", "comment": "Malware payload (Mirai)", "value": "17953fb0a29c7bd863838a48223bfbcab105e5f99eca0b5ab0b1783e739952da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654595, "uuid": "2464a402-9918-4b0a-a4f1-fc70c83c7e43", "comment": "Malware payload (Mirai)", "value": "d17778daff83d29b535fce805ba590a92d3a3395", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654595, "uuid": "29f0ec37-8866-42f8-a1dc-59abbe3e9ed6", "comment": "Malware payload (Mirai)", "value": "b0d40f3cfa726cbebd24427ebb634d6e18540f36683217f446272a04c51235affb8f1a4748b41beedbb7d63695f80015", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654595, "uuid": "3a26820c-6f09-43d2-9a63-999218c2b6d8", "value": "T104A2D0247F1DE98FCD37B27887E5E5C692907D60D3DCC9866781C11FABA36846834E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654595, "uuid": "9ce44c19-a26c-40af-9a69-4e615cd503ec", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtelSyY:798o08kxofBE+ZkXaT47C2EpitcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654595, "uuid": "ab6b4b9f-c824-4c1c-a0d8-bc327a625023", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654595, "uuid": "529ea050-9486-4dc2-9ba8-8327c32174f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654595, "uuid": "373e9820-46a0-4a5c-8d29-2812699a3743", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bddb43-17c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627944, "uuid": "41f970f0-2752-40b8-ae55-edc3de145929", "comment": "Malware payload", "value": "fa6b76378314b736213db8f7a75ae015", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627944, "uuid": "91083383-2e9f-4b5c-bfb0-4c601a3bf32e", "comment": "Malware payload", "value": "18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627944, "uuid": "6900b226-3e70-493e-a710-fbafc4dd9681", "comment": "Malware payload", "value": "f5abc3414d1f6ba83a4819ce3a74a9b9b265f2d7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627944, "uuid": "00dd57ca-aaa2-4a5d-b434-2f68c1497496", "comment": "Malware payload", "value": "a9b826427eff6cf426c0a4b1cfc9aa058dcc5fad19609e4f558a43ca7e3769b03ed6dd240e83baeafe2055ee9bac39fa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627944, "uuid": "3c8c2762-7bf5-4530-b5cb-d2c20d51448d", "value": "T1993633BB863290C9D56AC434CD5C76882075493F42A23E2BBF164E22D7AF3D78F52709", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627944, "uuid": "547eff1d-5748-4766-a837-4c467b110fc4", "value": "98304:7ceYO7g8U0rtcXmsFBaQS7V1nFoeueKWA5CI4tuGbedUZv9jD4XKLSA:7c1OrtrKmNRNFoeuUA5CIzTGvFDgKGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627944, "uuid": "74ff91df-7e36-4f9b-898b-f3414d4c23f6", "value": 5064980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627944, "uuid": "19daa52a-5af5-4e49-a5c1-85997df33281", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627944, "uuid": "2d41e39a-f9a7-47d9-ae1c-ae3d04c66767", "value": "screenshot.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120f084e-17ca-11f1-a769-42010a9c0008", "comment": "Malware payload (UmbralStealer)", "timestamp": 1772629207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772629207, "uuid": "c4336f78-d2b9-451d-b455-d6adeed06302", "comment": "Malware payload (UmbralStealer)", "value": "c0b1b8ce6854bb601b36d0d9bc07ef61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772629207, "uuid": "dc4083ad-eb52-4f80-bde3-71e3125655ed", "comment": "Malware payload (UmbralStealer)", "value": "19130e674d477a13cba71e486128954ed3bc031a7e49cc95ee6cf9fb3b8616fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772629207, "uuid": "0b70c258-c915-4267-83cf-e1f51b6db7b3", "comment": "Malware payload (UmbralStealer)", "value": "90e1c2748a92e554bceba1b108206eeb9d90109a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772629207, "uuid": "fc5062f5-5954-44f7-ad0e-574414027180", "comment": "Malware payload (UmbralStealer)", "value": "875db92207d4319d2d2a25e4793d54c1a8b1778a366f549be375d1576671f9c5c25b901567646d6db769497411c911db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772629207, "uuid": "c49977a3-195c-417c-ab2e-081d5876c8e8", "value": "T165448E4533B8CB12E25F8FBCE571449F8BB1F107ED0AF78E1D8899E81851B41E849A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772629207, "uuid": "7d122602-98d2-4d0f-b2f4-9648ade1272b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772629207, "uuid": "58743ebc-7024-444a-8f14-de0d36b9ff20", "value": "6144:K4oZoAeVHPtHgTIAaZgCwDx7axHU0unC28ejI8P7:xoZyHPvWCwjXCsIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772629207, "uuid": "662f7d4b-9281-46fe-8f11-2cee95dc8e52", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772629207, "uuid": "47a78416-9f54-499f-a213-95dbdccd390c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772629207, "uuid": "923ce778-864c-401a-bd0e-47ff0dcfd562", "value": "SB300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdb4bfe-17b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620339, "uuid": "6b1c95b7-1f38-446d-9dd4-ca754fbf1d0b", "comment": "Malware payload", "value": "adf5d1b73c0c0788c09b3b24d76ab372", "object_relation": "md5", "Tag": [ { "name": "pw-847629461", "colour": "#1743EF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620339, "uuid": "46e6fb3d-fe43-4c7d-a370-424a804b09cb", "comment": "Malware payload", "value": "19940a2f7d55fd0401bf7b477f54c2c354f2175de539e24072108a59b68cef4c", "object_relation": "sha256", "Tag": [ { "name": "pw-847629461", "colour": "#1743EF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620339, "uuid": "d55a0e4d-5198-4c85-af33-1ba7329ac4a3", "comment": "Malware payload", "value": "d62c7bc41f852e907028062ab63452d02df47f24", "object_relation": "sha1", "Tag": [ { "name": "pw-847629461", "colour": "#1743EF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620339, "uuid": "f72342eb-db4b-4a29-9e10-725430029894", "comment": "Malware payload", "value": "57a3381de09cf870a683869b5749d552a8c8dd97bc466e85585bb39fa68a55ac9732e6c41eccac562edb099bc85eab15", "object_relation": "sha3-384", "Tag": [ { "name": "pw-847629461", "colour": "#1743EF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620339, "uuid": "a15d4887-93e2-432b-b5da-96a823c585cd", "value": "T169B633EEE0C91DD2FECA08EA475CDA689CDFF5FA18A405325F765F29A4D88507634083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620339, "uuid": "e99236a6-d2df-496d-a461-1c96ce86c2f5", "value": "196608:2kNShkFQHteBKcH8BiJFXlFvtApkwLamwSVCHWmcRSlE7TYoAtPMkisIYFjD2P62:2MShJHteocmg5hn+xRmcglYMVtNIqJ7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620339, "uuid": "f1e2041d-6675-484f-b6b3-b6c3a234a755", "value": 10983634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620339, "uuid": "3a7197cb-205b-4656-a76f-53efc24b58d6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620339, "uuid": "a3531ba2-4c15-4f96-a534-97bf2f60db9d", "value": "Xerox_Scan_Doc_PDF_04.03.2026.pdf_839.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692748d9-17b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772619905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619905, "uuid": "e8bc7f5a-ec80-4ff9-8421-6e81c0c93880", "comment": "Malware payload", "value": "190ad5f75531979539c1169af9e23a57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619905, "uuid": "c4fc2365-f54d-4277-a33f-f1afe3052e24", "comment": "Malware payload", "value": "1bc91bf4370ba12bd1d01cb3598185e9ad018f5d457bdd6b67dbb4b9f6135c23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619905, "uuid": "b51815f1-b408-407a-b00a-f1a70d45b8a7", "comment": "Malware payload", "value": "532588252f529e9eac71b9950ca6a387e6ec8761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619905, "uuid": "e0efdf91-4e9f-4cae-ab44-8c08c7fbfd1a", "comment": "Malware payload", "value": "e770286caec84322fce9f98a51e3c51dbd6f0f6330b7fd4fc98586a0b832b9184727f5596b82d1b049e1d6a25adb09e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619905, "uuid": "7aed3c9d-2974-4f82-91c1-de4f65721221", "value": "T1E7A73389A3212568D415A33F8CE4AE7AC8897C693FF0CB563BFD4761097B1D8ED58B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619905, "uuid": "87123735-21bc-4f27-98d1-e7e51101437e", "value": "c005b4cd3ff755ef7b24e8e7196f0aef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619905, "uuid": "573c1fb8-ec9b-4a1a-9ffd-b8aa053b21b9", "value": "786432:TFlUR1O79W810TXMb8YrRQ766ADz6ZjfnIjESlBcUZzErdF1pCShaJVpTEU6CkhC:TEW79WxTcLwADmBREBxVE310TJQtCczO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772619905, "uuid": "9928bc2d-03a5-4e86-a459-b0b8483704aa", "value": 46490256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772619905, "uuid": "a5f97541-bc88-44a1-ab2d-688acc2305f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619905, "uuid": "4466837e-e4ff-412a-bfdd-e2ba771543d1", "value": "1bc91bf4370ba12bd1d01cb3598185e9ad018f5d457bdd6b67dbb4b9f6135c23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00906070-17b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620588, "uuid": "38a6c0bf-07bd-4196-9a9d-33a05ad8cadf", "comment": "Malware payload", "value": "15c68ba7b918552739e0a61a07f98b2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620588, "uuid": "e2102dc7-f7e8-4629-a78e-d8892169028a", "comment": "Malware payload", "value": "1ce653581b31023412f9a9cb89d9a8ef2a3a48f6883785c693d330f4413bc175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620588, "uuid": "bf53e13d-bc98-42e5-9ff5-ef946449c401", "comment": "Malware payload", "value": "679986f81c50297c7576326e4a69c1a76c014a88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620588, "uuid": "9493834c-9806-494f-bf85-3e17b4f80cea", "comment": "Malware payload", "value": "a8aba730bdb4d374ad7842fa315570f0f0075115c4969971cb923b78223a7654afaec15df1d9d2bed9f74d6ffbc31cac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620588, "uuid": "a9119e66-02bd-4529-9c92-880802c3833c", "value": "T1DD973308F3752165EC86933F8CE0367B9088746927E0CA9A5FF8CB6116671D9EF39B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620588, "uuid": "94c1e659-ee32-4cbc-a3c3-a71198392229", "value": "c005b4cd3ff755ef7b24e8e7196f0aef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620588, "uuid": "f78ee8d0-8fcd-4027-a862-01b01e955f0f", "value": "786432:pFlUR1O79W8+0TXMb8YrRQ766Z6ZjaFY+H4isLoUvO+DiQjby6NWkI5Ylvic3l+J:pEW79W8TcLwg8Yk4kCO+D9TYkPiB7Pqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620588, "uuid": "9f0d8b26-fbe9-45be-9d56-c5f7051d4429", "value": 42926736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620588, "uuid": "d090f3f2-a30a-46d9-916b-c4cb0332e313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620588, "uuid": "5c9c44ee-ffb5-4c17-9513-97e090a185ac", "value": "1ce653581b31023412f9a9cb89d9a8ef2a3a48f6883785c693d330f4413bc175", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fb3f82-17cd-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772630575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772630575, "uuid": "2d9aea8c-f8a7-4e53-813b-d983bb32bfff", "comment": "Malware payload (AsyncRAT)", "value": "ce873086d0cff999abbd9042c1fb6448", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772630575, "uuid": "d4021d3e-d101-405b-97b9-888f0ea211ca", "comment": "Malware payload (AsyncRAT)", "value": "1d12bc301a1cf5b6ba78333737b83c906649f4c474f87927e8f7c70c92e9e0ab", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772630575, "uuid": "743be1ce-908c-4e4d-8feb-1853b0df27c8", "comment": "Malware payload (AsyncRAT)", "value": "bb0df4a9d6c97601890bfe7e22e9f38bfd5cc770", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772630575, "uuid": "60ca04c7-d8ff-435e-913d-f1ef1407b709", "comment": "Malware payload (AsyncRAT)", "value": "ae826dc4b9834b37a94cf92ecccee8b8a50c645c64bd0b707a4ff16466634f088a12387697980b413f173791f6193d96", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772630575, "uuid": "1da43b06-976d-458e-8d49-afb7f730ccc9", "value": "T156F24B0573E58665E1FD0BBD5C3686044376FA474D22DBAE2EC450AE1A23788CF24BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772630575, "uuid": "ecb4e314-ee9e-4613-92b2-262a3000e3b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772630575, "uuid": "b879d120-deca-4a6d-a575-bbcbb1a5f6fa", "value": "384:TMTZ6Rd1ffRcdiuhElE1bdcWOe7X093bayseHQxnC7O+WmlIuufGfrfCRaWW2EQ+:TiZ6jFfRcdPhT1hVYRbJwB+WWBhQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772630575, "uuid": "b2637c09-1326-4439-9c04-c4e378a1f1c2", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772630575, "uuid": "827b7c19-4dfc-4152-9bc1-7687b67fffdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772630575, "uuid": "ee1ba63d-9815-44a1-a73a-16ecccbbddae", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6721807-1793-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772605861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605861, "uuid": "157f86ee-d0e3-4b7a-9237-7d61496b0e3f", "comment": "Malware payload (ACRStealer)", "value": "3003a60407d6954fda7b67d681606ea2", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605861, "uuid": "b400c1f0-8806-4a1d-9b9e-534c31704c23", "comment": "Malware payload (ACRStealer)", "value": "1e04ffcf999ffc21d769cd936f2662371d86ddec965dd486b55f5064312502f0", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605861, "uuid": "580d53c6-5d56-484a-9001-7d7ac73a8ff5", "comment": "Malware payload (ACRStealer)", "value": "f3f742d849abbf481ccfffb93befd2196e43f2e1", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605861, "uuid": "2c5e5b3d-64c7-496f-a615-3e62a2f8e1f8", "comment": "Malware payload (ACRStealer)", "value": "d8989d3b6c11c8dc174de2b4dab781c73400b146f8dc08ff0f051d5d17f8a754d525832a3dd935c84e91c9ccd0c6902d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605861, "uuid": "8041d9f8-39ba-4847-965a-b9bd93d810a5", "value": "T13786CF21FBC2D662DB63017850BF7F770B365DA0279481D3A2923D3969307E1563B2AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605861, "uuid": "790cb5b9-0efa-4738-b02f-3790fc525608", "value": "5cc00017eeff5b619beaecc3f3fabc47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605861, "uuid": "8465bb96-d652-4d89-ad22-ecd49c42b8b5", "value": "98304:K0Gilxn4z2qiFJ4vgQpYDhM7FgvBMsAVuQDjgEzj1:K8liz2vfNaaMsAkQDUE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772605861, "uuid": "05549eb2-0250-4e0b-84ea-2ef21e4240a6", "value": 8225272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772605861, "uuid": "6122fcc9-3805-4d28-97c0-b56071cc177c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605861, "uuid": "8ab01662-2bbd-4501-b450-0a6e0040d31e", "value": "SecuriteInfo.com.Trojan.Win32.Shelma.choz.26858.4901", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0131f7df-17b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772618012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772618012, "uuid": "746e5bd2-2d0d-4352-87ad-9637b00be3e9", "comment": "Malware payload", "value": "fe944c726c469f3eeb880b4aaf4905e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OR-KAHOL-LTD", "colour": "#CD930F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772618012, "uuid": "f8a19a55-b703-4e96-a2d1-a201e5adef43", "comment": "Malware payload", "value": "1f46e752ec127c6fb7c2ee4a6a049af0fa6881763d7a3bfc356cacd4b95afee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OR-KAHOL-LTD", "colour": "#CD930F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772618012, "uuid": "9121d323-d2e6-4c7f-a6cc-80bbeb29061f", "comment": "Malware payload", "value": "6f41ebeddd3fa98c6c9ee10e3d0a91ea7779a079", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OR-KAHOL-LTD", "colour": "#CD930F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772618012, "uuid": "7363ed31-d061-4058-b451-7b24b628b579", "comment": "Malware payload", "value": "e684a1ae0aa8a63b2d4e769586e00494befa9b305e6ed78bf50d2ab7e532e04a3d00482f3b7e62646e36f4ff0fb51cd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OR-KAHOL-LTD", "colour": "#CD930F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772618012, "uuid": "e2d9a04e-3fee-455a-9256-7409d9ebd0b9", "value": "T1B2164ADE6B7049C5CDC487F6FF2201AD3A2BA4BBDE5A4B45E00C9F59388696CCC51E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772618012, "uuid": "96bad79b-c2da-4651-822d-7fd323fbd17b", "value": "24576:SmxjqRSaoJDkgRIGsS9JHRQMEToXW6OTWEkkk3VdZdpg5NbJbVT8nxI2QbYD:SMjh1BRnWQdZybV+qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772618012, "uuid": "b0073b1a-1e74-4401-a68a-c37160479ff7", "value": 4395288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772618012, "uuid": "a55322bf-99ba-48d4-bb58-3251fec46ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772618012, "uuid": "747ffc01-e8e1-43f4-955a-bc1490c48045", "value": "1f46e752ec127c6fb7c2ee4a6a049af0fa6881763d7a3bfc356cacd4b95afee2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69546a14-17cd-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772630642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772630642, "uuid": "c939eb87-b6b3-4409-b409-fca5eb7453b8", "comment": "Malware payload (AsyncRAT)", "value": "2913a1c0a6c0a40cb41575d399e1891c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772630642, "uuid": "b688158d-7bba-45e5-bc0c-0c1acac7cba3", "comment": "Malware payload (AsyncRAT)", "value": "206bc99531c9eb6f7a6b73ddca3cfcac307aed1b33b95e14ba642e39c2cf7648", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772630642, "uuid": "a979789b-2aad-4688-a0f1-9d8d477a8bdd", "comment": "Malware payload (AsyncRAT)", "value": "7fbe1efab85d1e1a512d8fc52888727dbabae4be", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772630642, "uuid": "7ecc6159-9e3a-42fd-a675-2de9b1ba8c15", "comment": "Malware payload (AsyncRAT)", "value": "743351b48d61b19fa210a759dc58e5dae7c969e04680877c7cf51ea10f9afd5433e2a4a1cb549cec4178d0570eb0168a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772630642, "uuid": "15b488bc-33fd-408a-9d8f-2eaa0469fd7a", "value": "T18FF24A0573E59665E1FD0B7D5C3686044372FA478D22D7AE2EC490AE2A237C8CF14BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772630642, "uuid": "309e7e2e-0bb4-4ee3-9ba8-0d4dd0dd8df8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772630642, "uuid": "11e5511b-ce87-4040-a0a1-c502c06fb568", "value": "384:IMTsmj41GF+gWYhPghulE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCZPWWC8:Iism88LWYChR1hV4RbJwB+WWAdQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772630642, "uuid": "3ca812f6-e2ee-4404-8dba-b48858d2263f", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772630642, "uuid": "f7b3aa0a-d65b-44e1-be7b-ecc926094d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772630642, "uuid": "45291908-af3d-4e6f-b0f5-225c09d32c52", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11153fa9-17c6-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkMe)", "timestamp": 1772627488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627488, "uuid": "4269f27e-ecd4-4594-8ce5-c2cd926a465a", "comment": "Malware payload (DarkMe)", "value": "82398161c0c5b161d594e3b2627d1077", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627488, "uuid": "1792865f-ac30-4fae-911d-c7e834dca0d0", "comment": "Malware payload (DarkMe)", "value": "20a97423107a79b20ee6be999387778a2172febed1d2be2a0ec6211aa7fc2a2a", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627488, "uuid": "3d8043f8-8197-4377-ac52-1f1295b9a925", "comment": "Malware payload (DarkMe)", "value": "83227f580b93b6ff6b4960743e1eb3e2076fe0bb", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627488, "uuid": "4a178b69-e83c-44ca-8cb7-4e222e81d97d", "comment": "Malware payload (DarkMe)", "value": "7cc8d2f896428663164e6a36973562369f0d671d325d603dea833755255499a9e6a70f945a6601c34dd3b303858974e0", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627488, "uuid": "0059de70-a7b6-49f7-9f62-58b1b343a2c9", "value": "T1BF83182FF79149E1E6461A310AB5C2E96773BCA66FC7821F7640322D1C36EA20C4576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627488, "uuid": "b40eedfa-87f1-449d-b75b-ab662dd2e0ed", "value": "3e847ec4ad926dd89c2f4cb28d036c11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627488, "uuid": "b981e773-fb50-4681-aef8-349bfa032814", "value": "768:X0cBEDl8mtcoRPO+YuX1Ayf3EgkOqwLevxPIcvAkM8/eVnpc89dPdtWW96D//TRV:X0a0PO/Ujf3OnwevbVfo9dPdb96r/NOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627488, "uuid": "2797cb4e-4081-48f4-89b9-a75bc82c4eab", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627488, "uuid": "3d37742b-afed-45fa-8122-eab3b81207aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627488, "uuid": "b110a9fe-084f-40ba-ba8f-609254c52ab9", "value": "20a97423107a79b20ee6be999387778a2172febed1d2be2a0ec6211aa7fc2a2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2992e8e-1802-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772653529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772653529, "uuid": "573fd770-9a55-4de9-ac06-31bc1b57595f", "comment": "Malware payload (Mirai)", "value": "42be12166d5718c0993241d3f056d5d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772653529, "uuid": "2e1bcd19-9d2f-46e2-a706-9aad14900f4e", "comment": "Malware payload (Mirai)", "value": "20e8d0ef2d942ca1935e194dbd50f53f85a3125d6a7e7cafa1645ba6e0a9c283", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772653529, "uuid": "b84bce63-2fcb-4c4b-8428-5c54b6b59c90", "comment": "Malware payload (Mirai)", "value": "63e933acfa933ce4e582c343f4b31b5fd1084228", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772653529, "uuid": "3235165f-77b5-44a6-84b5-6b0ba85f173d", "comment": "Malware payload (Mirai)", "value": "9362f750f214e2825d9f80d1f9fc8616bc0024288ed4a9a37c5e4e301f6e94b536ceedabd09104d5581a743ca5540292", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772653529, "uuid": "b08e04c2-aa71-47ad-a851-3ddfc39ae908", "value": "T17A046C02731C0907E1572EF0273F67E193EFD9A214E8F644654FAA8E9172E72158AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772653529, "uuid": "af4dc5c7-3e63-41e7-b022-1992811b9e49", "value": "3072:bHU3dciipyJmllVdGNtPC5xC8ne6i/hxtfLYpX33c6IkkSGmJC:b0t4FsxdLYpXHcfkkSG+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772653529, "uuid": "3229b238-95b6-4b19-a2f7-effdc73dab6f", "value": 176444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772653529, "uuid": "bc7c0e7f-7f19-4cee-8d26-3ddfba2b4960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772653529, "uuid": "e5aab0f1-c8f7-4548-9171-082fd7d6123e", "value": "Polar.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf183b7-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654593, "uuid": "ee5582bf-d89e-4d13-849d-011e86cbe979", "comment": "Malware payload (Mirai)", "value": "c06e5bb449a46ece566ff52a0f884400", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654593, "uuid": "f7ed3dab-844b-46b9-9753-8092cfb61591", "comment": "Malware payload (Mirai)", "value": "22213fbdd48a370c337cda0e898d022a314beb8ae300104ed74161cb664a6845", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654593, "uuid": "58b11420-0764-4325-a08c-d8015973985f", "comment": "Malware payload (Mirai)", "value": "a9145db7051ead5ed9e8e6802c1657c0fb21ff32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654593, "uuid": "54c25313-5310-4ca1-a7d3-90d6dcae2be8", "comment": "Malware payload (Mirai)", "value": "99a4b1278cd36373cdd19eead84f0c63a41617caae3bf421bd8863f2c50745e3aae5f38e3df5751bfc6d22ed0b072259", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654593, "uuid": "173333c2-50d9-42fc-9827-fe764bb146d5", "value": "T18EB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654593, "uuid": "45fa4bac-8c1c-40de-bdec-b74f5dd72e2b", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg19/LWy:c9sSyzz36YaWWgg19q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654593, "uuid": "d6197a0f-2195-4598-826b-1678476d4f24", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654593, "uuid": "df6bb7c9-6aad-4ca9-8071-0bb43847b6b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654593, "uuid": "e0819eeb-d098-4bfb-96a6-d94f8f2d98e1", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3b5d53-1765-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772586191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772586191, "uuid": "b4cbce88-9f94-445f-9c9b-37dd1aaf9552", "comment": "Malware payload (ACRStealer)", "value": "3ac0c1b445c10d5af928c0c3ed8ea409", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772586191, "uuid": "28a3e076-9a8f-4cd8-a3f8-d77888f37f4d", "comment": "Malware payload (ACRStealer)", "value": "231ebbfd680cee62d1c4a2ea1b44686c311bfc94a1fe57af3a41ef4b08797c95", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772586191, "uuid": "d700eb5c-4c46-4ae2-a8cc-cd12252fc15f", "comment": "Malware payload (ACRStealer)", "value": "1c0f9e610b7a043928956dc36cf513ff7a02168f", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772586191, "uuid": "e2f3fc70-5f9d-4cbb-8372-1be96e11dcf7", "comment": "Malware payload (ACRStealer)", "value": "6b51ad6760cc31a08c2e7b8bbb981e36e540b5dc614a844884541307d37f951a739f56fcb585beb427aeaf1fff29677b", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772586191, "uuid": "f66b2399-589a-4822-bae3-08b7775b1ca4", "value": "T129C6A22CD905A366E2B2C170859D4A17F161892AF63D5F8B31C75F193242AC33EA1FDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772586191, "uuid": "15a90878-dbc0-4dcc-a57e-82979f0006f4", "value": "16d3dcda6fe34199f57bb11fc5930901", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772586191, "uuid": "66b39367-1838-4000-be5f-0724d66fafb6", "value": "196608:iilaNrKUYAu40C5u7alCFr7nQInJ45/9iD54+V11bFv4zws:iilaN8J9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772586191, "uuid": "fee1ecfd-d51c-4d86-87e8-b313a49a8414", "value": 12192080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772586191, "uuid": "40622173-fe99-41c9-9d35-40029d211c65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772586191, "uuid": "655b79a0-56b6-45fb-95a5-14b3f92250fa", "value": "SecuriteInfo.com.FileRepMalware.76928771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68a196f-17a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772614075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614075, "uuid": "240e9953-a3a0-475b-911d-b4e8e02ef471", "comment": "Malware payload (Mirai)", "value": "d9e5f4f4de71e3ef5a0dd3ffae020a0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614075, "uuid": "415eb3fa-56a1-4716-b9c9-d3e6f1544438", "comment": "Malware payload (Mirai)", "value": "2581dc4fa78b2561596d4cbe7e62c0fa3f8881c2af5b5ff14a77f80334b69173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614075, "uuid": "759aebc0-e0c1-4d1a-bb91-77996a31d2a3", "comment": "Malware payload (Mirai)", "value": "15fa62bf534d692369b0c92ac9c805e03b716fef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614075, "uuid": "6121655c-5c21-4a4e-867c-558541089a1e", "comment": "Malware payload (Mirai)", "value": "ea317aaa1a062c4162d6a2ba3347c20bf820bba54921b7a69411f48649b7b77ef43c78936777bbd58525e35418d5672c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614075, "uuid": "e5416f1b-0c1c-4976-b331-827890fd179a", "value": "T17A532943BC91991AD6C013B9BAAE60DE332173DDE1DE720BDC109B543ACA91F0D7B681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614075, "uuid": "affba54f-fcbe-4e55-b5cb-71b762e22200", "value": "1536:ortMf0p751vcX5R+pdrT5MqR69HFYyeX+yg4TFtmBDF:or80p74aG79HFXeXMqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772614075, "uuid": "2344550c-bcc8-45f7-816b-b4f157d40d40", "value": 65316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772614075, "uuid": "03ca6cd3-5b65-426f-b2d3-3865b7440b98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614075, "uuid": "3c658dc7-eafc-48ce-a9b5-d858c050e7a2", "value": "nullnet_load.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ea5498-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654657, "uuid": "c246ed6a-acf9-4456-9927-6c2d17512268", "comment": "Malware payload (Mirai)", "value": "5da9bc096894250dfe15ab409a170c01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654657, "uuid": "95d72230-a4dc-4959-874d-e18b48be2402", "comment": "Malware payload (Mirai)", "value": "265f68d8f53e671cffaabecd9b032c722301be508f66a95d682f4dfa9f3c7faa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654657, "uuid": "ec3db557-3ad5-43a5-861e-73058e247667", "comment": "Malware payload (Mirai)", "value": "890de2c24311052b472d99f46e3e61f2ffdd4b37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654657, "uuid": "5b83a5f7-8d2e-4ad3-a20a-45597cf614de", "comment": "Malware payload (Mirai)", "value": "18a98b4d47299d33b45393b225dc1295260aff38b2d0efcc0f0b45a05e815004af4a769533059a61b8322413e5c46f2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654657, "uuid": "0ad1d913-89ce-470e-8eb8-0b69234fee42", "value": "T1DAC2D1E07726FD31C5206C3DE53B4D8A3A91067C90FF353754258D398EC169A67E88E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654657, "uuid": "51755f09-1a1a-41cc-88e7-e314572679d0", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwr1YI9q3UELuh:NKy4qfqoeJdXWgSxL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654657, "uuid": "986b5f6d-9751-45eb-8bf6-6f3c0bcaac33", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654657, "uuid": "ba2de322-4e75-4caf-871a-a33d39854bed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654657, "uuid": "4417c088-39d1-42dd-8354-24b1510ad1dd", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb73080f-17b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772621841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772621841, "uuid": "087b9e45-632c-4049-97a4-d801ccd8dc91", "comment": "Malware payload", "value": "d1a5df5dd284a805e34b0ebfbd05060e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772621841, "uuid": "2caec7bc-894a-4a17-b31c-1219e755b906", "comment": "Malware payload", "value": "26650ea86d25fab44416b67e37a1c105e2071923171be4b0d9694ef7308871e3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772621841, "uuid": "8d6dead9-79cb-4315-866f-a33545daa771", "comment": "Malware payload", "value": "5e115b2dcc18871956baa02a6963555832ec1b85", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772621841, "uuid": "37236d98-0e2d-4cc4-b6d1-48adac57f1ce", "comment": "Malware payload", "value": "ff942bbdce4493399d32e7f63db602322408074e6c24cd0c549beea3c42685e04af4fe38f0bcd5ebbc661ccfcf692f72", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772621841, "uuid": "9e56390b-e6de-4d8e-974d-d50b47e8f9cd", "value": "T10AF09E4909AAA897A572EBA0FE832301439E77CD271EB58736D5671939002994AD6844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772621841, "uuid": "54b91c9c-863f-4592-a6a4-3b4688804cd8", "value": "12:wbYVJLeoz6lXOm8XI1kUM8YFyFSR2sS4og41P8DT:wq6oz6lXOfD8YNnRDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772621841, "uuid": "6b637ea3-08f4-4d1e-a1a8-9d92f1b594d9", "value": 479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772621841, "uuid": "547d7a91-8512-4b92-9600-950e8603bbd9", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772621841, "uuid": "0d7f426d-079a-4352-bcf8-9268b0c525af", "value": "firewall.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ac247c-17d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772633752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633752, "uuid": "def0275e-e65e-41ac-b29d-7b8306120801", "comment": "Malware payload (Mirai)", "value": "9160fd37e928a024a3a3b41a87c7fcf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633752, "uuid": "0dd9bd61-7a32-48b0-b8bd-5b6083ea3635", "comment": "Malware payload (Mirai)", "value": "267ce47e40a559a36e7c6336898019be9f9d6f9799418fd3f5d072ab2499ccb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633752, "uuid": "5e4943da-2342-4374-b2ea-dc2e7fba8198", "comment": "Malware payload (Mirai)", "value": "3de3e61128f99fcdd0cae5764c878eb0f1e5d7de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633752, "uuid": "ebce78c0-02c9-4c02-9565-e33b3ae09fb5", "comment": "Malware payload (Mirai)", "value": "b12460e01892925979efaed584481541454e7bbd2c7531eafa5e6ef6ea2d9f1c96f3dbbfb9367a76a65ccbca886dbd67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633752, "uuid": "bb945b24-1741-4671-8e27-e739211ff66e", "value": "T1EFF3E845F8519B12C6C6127BFF5E828D3B2627A8D2EE3203B9255F2C378795B0D3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633752, "uuid": "cec6969b-f09f-47ea-be6e-7076f77e9640", "value": "1536:RqXZGW9XPZdhJ/PiuvRxVBwjP7jB9AymX4VRk7T5GOzUJvhbhOsx9vIJHb1Ml44F:RqJGi6QB6PHB9k4U7dGOUJJx47SRC8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633752, "uuid": "c49038b5-6a5f-4d93-8ed7-ea80f6e1c532", "value": 157792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633752, "uuid": "742b90f1-6f61-42f3-981c-ca4d10eed7c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633752, "uuid": "527b3a28-5219-4d77-8217-14776a50d02e", "value": "csk_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89429385-1807-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772655607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772655607, "uuid": "e5dbf0ab-809f-4e98-8333-bf83d75d3eed", "comment": "Malware payload (Mirai)", "value": "a4267e9a3d07dd9b6620503df732bdb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772655607, "uuid": "36ef17dc-cd07-4486-adf8-0736c4eb0cd2", "comment": "Malware payload (Mirai)", "value": "268a0d3ffda0e24c3906c5d08ba7d07283aa25a84db9c2ad1b11f88c169d9174", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772655607, "uuid": "44e3903c-ddd8-44f1-890b-f07400e50612", "comment": "Malware payload (Mirai)", "value": "8f12e269c2b05f9a5fd936f96dfed65458a9fb74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772655607, "uuid": "6b48fea2-36c8-430a-8985-1461642c754f", "comment": "Malware payload (Mirai)", "value": "cb1850ab0030eee95a11e6df77e3ecbbc4def82774085729fe5baf0d6ed7e77e6c4f397fefc5631ed5547aca3619c8af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772655607, "uuid": "e0cb6357-6060-49f2-b8ad-44c5fdcaacdc", "value": "T1B404BF63B34F2091C86206F40BCF6B5D262375025EAB9BE76C6F363E6A374D945063E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772655607, "uuid": "858de7bd-6731-4a08-a35d-cd1db541f6b6", "value": "3072:67bQSkMhIXXi5i2ALwVEaabY1n7aDSpUEAVg7CgWoVjxC+q:67dhHkX0a4n78ehAQCgWoVc+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772655607, "uuid": "45a3e9db-fca1-46ae-9fb5-372c8584a18f", "value": 173696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772655607, "uuid": "f86182d1-df8b-4ca6-a2bf-0921c27c8b2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772655607, "uuid": "504c7c40-c660-4cb9-9483-31622b84c7ca", "value": "Polar.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58d1c62-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602826, "uuid": "a012583d-4c9d-4596-8921-9277cf1ad343", "comment": "Malware payload (Mirai)", "value": "55f7ebfe3626a063fb470713af975013", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602826, "uuid": "14f1fd2a-4de3-4a15-aab1-93932300bd81", "comment": "Malware payload (Mirai)", "value": "27cd0bcb52a7c6d6ac07629268c21105026a2905910547397ebdfade7c161b72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602826, "uuid": "36b34a77-937e-4de9-8992-58648a5f7017", "comment": "Malware payload (Mirai)", "value": "b18ae9168f45c9d0ff70fde64a833c28cee27148", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602826, "uuid": "486c2b6a-6868-41fd-8731-56b337917567", "comment": "Malware payload (Mirai)", "value": "e1cb9d2636b1bf67e93ea8f01fbf1e199355ae7d07afb9b3a27512c7caccfa15df852b32b6c08a9b37aa4fd7776cc933", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602826, "uuid": "83b66bc4-faad-46b4-9de3-c9b3c568e32d", "value": "T145342A45EB414E13C5D527B9F6AF02453333AB64D3EB730699286FB43B8779A0E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602826, "uuid": "b2233299-bf68-41ac-becd-a14f03e3baf9", "value": "6144:UFupBiuRroqLaIwI4bWImyfFXi5fD4f5V/GkClRE:KupBiyoqLaIwI4bWIHtSO/JaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602826, "uuid": "a7b7b87c-93e6-41bc-a57a-4d1834da8277", "value": 248720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602826, "uuid": "a31972b1-b9e6-48e4-82b8-cff79fa7e616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602826, "uuid": "e0321eca-25bb-471f-848d-2baa5fde8bda", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ceeae7e-17c6-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772627481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627481, "uuid": "0e68563b-aa11-4408-989b-90dec302dab4", "comment": "Malware payload (QuasarRAT)", "value": "0af5f278e76fc13a0389f7e1c966d17f", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627481, "uuid": "7bcff2a8-03ef-43e3-a7ea-25ad9b4ec7c6", "comment": "Malware payload (QuasarRAT)", "value": "283d94b92c5af150941993e642612386dbefd44c6298898fb8e544fa3e389a4c", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627481, "uuid": "945469e0-dc4e-40e6-b32e-f4280cb540ba", "comment": "Malware payload (QuasarRAT)", "value": "0849a9044b09bfbd2bbcef2ff796d557046b9827", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627481, "uuid": "cfbedeaf-f20f-478d-8de2-eae1985ca17a", "comment": "Malware payload (QuasarRAT)", "value": "441fc602ea74768a7fd684e28068fb60301874faabb91450e6258b39001c6f972cd7ffd64f7ace663a1d266ccfea66d1", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627481, "uuid": "0ba11934-20dc-4c7a-9cb7-4ae81989cf5e", "value": "T1C2E55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B1191677E1C53B5059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627481, "uuid": "4426fc64-b647-45eb-9c82-8d8cbc6f5821", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627481, "uuid": "de8f3c60-e747-4b55-8746-a39e8bd6794e", "value": "49152:CvXI22SsaNYfdPBldt698dBcjHbSxNESEyk/irLoGdhTHHB72eh2NT:CvY22SsaNYfdPBldt6+dBcjHexp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627481, "uuid": "744d6f06-9368-422b-9e0c-67d82c2347e8", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627481, "uuid": "7ab2503c-9836-44b8-9cc3-62719f93817c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627481, "uuid": "70a67c96-ed03-4767-98fa-1461ae7ca002", "value": "283d94b92c5af150941993e642612386dbefd44c6298898fb8e544fa3e389a4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e9ef61-17a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772613905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613905, "uuid": "25786f58-6c74-48dc-a9d0-8e2b2349b717", "comment": "Malware payload", "value": "7e26d07048f80273b8ae3d5720f840c1", "object_relation": "md5", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613905, "uuid": "eca8fb04-8b86-4ce7-81ea-6f4cc32a06a6", "comment": "Malware payload", "value": "28cb29accd009bbe16add2dd09acd945a902c10129783baba7a70365f79b121e", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613905, "uuid": "9e37ad6a-9036-4413-8392-aa8989d477a6", "comment": "Malware payload", "value": "c89dce74be0e9f90effa0ac43b455c8f5b226e07", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613905, "uuid": "3059b6c0-914f-43ee-a603-e6d3aac6d145", "comment": "Malware payload", "value": "74f28d94a4fc22a4b31ff81ed3ed1342710af1a7d68a7624e8ab129af5315dc619b5262a5b52ed65dc8a446c617bded0", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613905, "uuid": "06b1072e-022f-4286-9be7-bfaba99e2aeb", "value": "T1C89413753DECCD20F7B8BF0F185B7FDADD6A691BA0239A322578D9E0100469E1B39116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613905, "uuid": "42588c5d-a7dc-47af-804d-9b9bc561e49b", "value": "6144:y3iPUS0U+Aky+NsuCgU+Mg2EKracuCrGtD8Ge:TMjBy+WRgvMuO8IGtD8Ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772613905, "uuid": "676807c7-d2ac-4f0c-84d8-7c596af425fc", "value": 418584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772613905, "uuid": "f44a0f27-17d7-44d2-aa41-856515b7b10c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613905, "uuid": "3a76d318-a6db-4969-a8bb-da8f4b1db075", "value": "Terri.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22c1db1-17c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772628295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772628295, "uuid": "aca804a1-dbcd-48d3-b11f-1ff54db8ce6f", "comment": "Malware payload", "value": "2a4c3400739a58f9318634f1e46f0cba", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772628295, "uuid": "548fd4de-817a-40f5-b9bc-0c965345269c", "comment": "Malware payload", "value": "299efaff343ebb25f31484af37f32fe288686519b3485531de04a4980c39aec8", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772628295, "uuid": "a1d8ec8f-82b8-4d5f-8ce0-5a0215c26074", "comment": "Malware payload", "value": "7c7a838b8b5632a85a21ca2a5bc77ce86cf551a0", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772628295, "uuid": "526876ff-95d5-44f1-8869-20723c84636d", "comment": "Malware payload", "value": "87efd1f62efd0141e3f38beeab4bda0d8434b2c881747001a82b36a878bfcc8c5919c32134bc921b36f8e027608b9599", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772628295, "uuid": "79120836-5609-4b0e-a1b8-0ab39c19f78d", "value": "T18C86332BF8B91DA1A47AD07FC5F22AD187D5220AD00380B9A2D079D577F278D4CC969F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772628295, "uuid": "2618ec38-4eac-4112-b9d8-7ab118b8eca0", "value": "196608:+ZftT6Y68eNhCDe2f89rBkapOguv0uU+HB/OGUElH6XU8YYlbHXUm:+BZ6QtDe2yBT1erU+h/PUEl0U8YYlbEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772628295, "uuid": "e37547c0-0c44-494e-8b9f-30b2b8706606", "value": 8484930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772628295, "uuid": "56e2102a-f111-49e5-86b0-27c3e4a28bcc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772628295, "uuid": "4282b066-c589-43e7-a85b-1d7851893ad1", "value": "bkmsiqop.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b93d9e-17d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772633022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633022, "uuid": "acd9a438-3106-41c7-b345-26ab0cc50061", "comment": "Malware payload", "value": "64e4b0ffd8bed9307eb50b541b1d8fdb", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633022, "uuid": "7dc1db3b-1cfb-421e-a47c-85f9b5287523", "comment": "Malware payload", "value": "2a00705cfd3c15cf8913e9eb4e23968efd06f1feceaef9987d26c5518887d043", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633022, "uuid": "249355dd-4a52-448d-a2ca-134657efdce7", "comment": "Malware payload", "value": "58af8d0e3e77f8d16a5a42fc173ebccb5ecb1cd0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633022, "uuid": "98ee53dc-26b8-4d4d-8bd0-8459a0441b1b", "comment": "Malware payload", "value": "cd27d852c61ddf3d0909ad6aecfccecb5c61b4dd4cb12c9680bc3ad39f1e165e2a4430205e86c6c43a86155f0a0e32fa", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633022, "uuid": "c6e08439-5f27-4830-a6af-a39655ce1067", "value": "T14F22BF686091681BEF8BC1365FA565B186360136C63DEE41022044B797EEDBB37B274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633022, "uuid": "fe14db55-eee2-490e-b467-8cceadce6075", "value": "192:eL+k3OedC9ZeNpGk+9P2WT42fjkG8hQ4mlRZHLaZcSZWBNhU:ed3JC3ecdvJfjkv7ml3HXBNhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633022, "uuid": "5b080ce1-3357-406b-9716-a2292390c932", "value": 9960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633022, "uuid": "812b906d-cdeb-4d98-b687-ac3688bbbd4a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633022, "uuid": "354a0eb0-dc00-473c-a023-4fca976dee30", "value": "2a00705cfd3c15cf8913e9eb4e23968efd06f1feceaef9987d26c5518887d043.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d0293f-17c4-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772626986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626986, "uuid": "dbe0e847-9534-4f18-98b8-ee5a7a0a2f4a", "comment": "Malware payload (QuasarRAT)", "value": "735c35446293b59551deee9aa8ec335f", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626986, "uuid": "2d92be3b-5920-4463-af8d-e67740c34a97", "comment": "Malware payload (QuasarRAT)", "value": "2a70950431aa3f0c271658944ea052ce07d315e2d41e9a9c631a9b49c1a7366b", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626986, "uuid": "acdea8a6-4f9f-4d62-a45b-2e2ac9946a6b", "comment": "Malware payload (QuasarRAT)", "value": "c15a54cff61d80a1f19cc899713a95bef5b3cdd2", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626986, "uuid": "9422f8f3-7c82-4f61-a318-13de1f8bdf23", "comment": "Malware payload (QuasarRAT)", "value": "f3e541045fc632c2eee7e90def45aabce2db58f978bd9c4273e587cb411bd2e805fa760a11fa1e2289ca010bb2bfe2fd", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772626986, "uuid": "713f4695-30c4-448f-b51e-d7c83fce5ad4", "value": "T11241A21527E41529F2F78B32583B7614CA3AFD5F9D32CD1D0184C14C1462A14E92AFBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772626986, "uuid": "40495a8d-fd27-430b-aea1-8d802d024c5a", "value": "48:8rgngnBH14RzUQO/ilQOr6x1FPdLXuHvBmBNab+:8rgng34RzUQOUQOeJFuPBmBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772626986, "uuid": "8350b70e-c71e-4b1c-885a-361dc675f08f", "value": 2297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772626986, "uuid": "f2f5a66e-e2c7-44c3-a435-200db1510536", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772626986, "uuid": "e5561c0c-a8a8-4ee9-8cd6-a96258b0d2fc", "value": "2a70950431aa3f0c271658944ea052ce07d315e2d41e9a9c631a9b49c1a7366b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cefae98-1792-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772605254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605254, "uuid": "bc8d7a9e-ac94-4d2e-8f2e-c9317ae163d4", "comment": "Malware payload (GCleaner)", "value": "ac961b4eb052155164118eb7524200d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605254, "uuid": "af47ddf6-aa6c-4d62-959a-b76649100012", "comment": "Malware payload (GCleaner)", "value": "2aca019aa4a82ceaaa3a43c6ad0d2b45d7179f74d9b06fb9fd1b108559adc4f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605254, "uuid": "8733d059-9de6-4172-82fd-bbff052ca670", "comment": "Malware payload (GCleaner)", "value": "d3851a871cdb32483ef034f7047a3b45f94bc723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605254, "uuid": "1c062e04-b374-41b6-b28a-ecbbb2b22285", "comment": "Malware payload (GCleaner)", "value": "aed23675603023acbafc80356a3e98fe83a4ae4dec8b6fdf17e8b243440573bd2070aae9f93a0b9e72e62c1ddbfe1981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605254, "uuid": "c0046cb7-0fec-4130-834a-285117f14e64", "value": "T11615291EAFB3C072EE63D5B2F6645221393DB82D173885CB62B0282DE9907C1DAF5355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605254, "uuid": "0dd7d8e7-5168-4e3a-926a-c89e38d68878", "value": "62848721a0fe32270ffbda7abe4e1f5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605254, "uuid": "0ac9597a-60fb-47e0-baf0-838f87b3ec2a", "value": "12288:7YEd//LbpeDJ4jfiIaBRtwfESz9pfYbVC3pKEVj4988fLN:7bJIJ4TiIaBYfTz9wC3pKqH8fLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772605254, "uuid": "1efb018b-3579-4958-86bf-d6a8073afe96", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772605254, "uuid": "f03a7741-aeba-42b9-a0c4-beb52bfd4fe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605254, "uuid": "dbd18cb3-bc2b-4712-a6d5-c7a4da6d087c", "value": "ac961b4eb052155164118eb7524200d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c3ed94-178f-11f1-a769-42010a9c0008", "comment": "Malware payload (Stop)", "timestamp": 1772604011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772604011, "uuid": "ba252f1f-cfec-4d09-ae64-093aed064325", "comment": "Malware payload (Stop)", "value": "1c1491369af9fb2bd7e86925f2e2e2af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772604011, "uuid": "37f3156f-6ecf-4c86-a089-e31095d36363", "comment": "Malware payload (Stop)", "value": "2cf960125358486447a378c9b410169dc93dce2d8ad75cb5aee7789536448929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772604011, "uuid": "1ed5664b-fa0c-4e05-ac5c-b0373ec366c9", "comment": "Malware payload (Stop)", "value": "b97f04b4b6f23f28a98f002cd9bfbbbf036cd0b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772604011, "uuid": "169a115f-c493-4485-a932-710e0e4f3d9a", "comment": "Malware payload (Stop)", "value": "5009ba9e876e7e3b066e431a52e015b76473153f358ca64092a536b9e33d3d7234d9a83263c9b09d3b41b6b535ed7e32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772604011, "uuid": "8bb6658e-15b6-4eb3-9a66-564046a896ec", "value": "T1C535AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772604011, "uuid": "b7e1e8ad-1e81-4c6f-bfc4-2185d353556c", "value": "0c756c849bc7b459f78f7a5ce46cd4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772604011, "uuid": "89fbdc7c-578f-414c-b21a-53fc1139e538", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/dRPOO8xWQHUq7:F0dwAYZt6C31WeTVRPOhx7Uq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772604011, "uuid": "69954952-745d-4b29-a06f-7ea3dc001da7", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772604011, "uuid": "cbcfc027-e0aa-4d20-926e-29a334b035ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772604011, "uuid": "9c35df45-9766-4edf-be4f-62204cf2ddfc", "value": "1c1491369af9fb2bd7e86925f2e2e2af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ef8834-17ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772622590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622590, "uuid": "334fc6c4-a195-41f1-a924-4aef7576bb54", "comment": "Malware payload", "value": "6b04e288cf7f68a8c14cedb795488221", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622590, "uuid": "b0485147-f3e8-4228-99eb-29d3aae645cf", "comment": "Malware payload", "value": "2d9e986bd8885cf3abf6d6a1ba7d5c6cc0c69670821fe49a559303d16bea02c4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622590, "uuid": "0a114ccf-47f0-48f6-909c-ce993752e5ca", "comment": "Malware payload", "value": "e4f46d4516e9aab403f1f39ec524c1b798ce71a8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622590, "uuid": "e0cc1a86-f79c-478c-a2dd-ddb39676adf0", "comment": "Malware payload", "value": "51c0f176a33504b46e6cc11abea812315bd59d0ebf67900598fce03eea6e31f75bb90eb173d308b8db7d9afdfe1d9890", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622590, "uuid": "f050cbb2-e6c2-4b6d-81f7-3036116ecab2", "value": "T1E8273356FB88E80FE8F397324BB5512661115CA6C307E62349087A3C29B7FC45E66FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622590, "uuid": "77295529-ee29-431f-b445-e6c4cf1a2658", "value": "393216:tARkxwNSse2hGS6rAedpvP6Kjd61N18OZDvKSL0733G8Dnh3JmgB:tARkKCTVP6KJDS47G8DhZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772622590, "uuid": "c5ce344b-a204-43eb-8135-79484b4fc0e8", "value": 21205603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772622590, "uuid": "06dcc416-51cb-40a3-92f8-ca25aa39c5f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622590, "uuid": "cc411ca9-ba14-4cc9-9765-df1948012c3e", "value": "B9.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52317ddc-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654655, "uuid": "c783e4f2-ffa7-431e-ac61-ee461ba67fe7", "comment": "Malware payload (Mirai)", "value": "5a20cf64bd36f88146792d4e1bd11d91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654655, "uuid": "204c9f65-870f-480a-bc45-8a03873871ed", "comment": "Malware payload (Mirai)", "value": "2e09f07db2e5dde5c9b367d138a3e04cf120780a0bdecc0fcfaa0d3fde8b3d2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654655, "uuid": "db472faf-312f-4bac-8945-74c90bbbe09f", "comment": "Malware payload (Mirai)", "value": "a42faf4fe081d544d198e1242151c32154068f0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654655, "uuid": "9a1c8bd6-753d-4b75-b0a9-c7e921d7dec1", "comment": "Malware payload (Mirai)", "value": "36b4b8e3e2bee46e45e3afc857683d3d145cde57b7be3279176da84138ae54d7f309eca28b1511b85735b7ba3f3430c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654655, "uuid": "98f1fd47-9e2d-4409-a4ed-8d1fea6e28c3", "value": "T1C7B2D0CC65943484CA8D7C7C178D0A664FACA0D0BAEE9F16E350CD98B3BEA4F3459079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654655, "uuid": "32b67d28-6185-497d-a910-dae841f7a2d3", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBp1ZqSWvh:4QlS07FUXqIYSXQKquLq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654655, "uuid": "2827c99a-72cd-4618-8da1-70697f663fd3", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654655, "uuid": "67250b32-afe7-45fc-bd79-ea957c0f678b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654655, "uuid": "11916d0e-f357-4e8e-8528-fdb7c699a79c", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2b76c5-17d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772633680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633680, "uuid": "9f20f4b4-74e1-4b45-ae01-80cb84e1fa89", "comment": "Malware payload (Mirai)", "value": "cb4de9c7906e05b1db357e4310a9d85d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633680, "uuid": "4aefd0ae-a90d-4e2f-be80-84cac780ad1c", "comment": "Malware payload (Mirai)", "value": "2e28f54c8b8a91783dce23e97acede8aac0bf4844ed85a7c9a94e1705de35e5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633680, "uuid": "7b1539dc-6acd-422d-8d5e-2a0bbdc1d171", "comment": "Malware payload (Mirai)", "value": "c85a5eb6ab54557d8fc5cb57b140aa36a6f5ea28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633680, "uuid": "db410ac6-458e-4e8e-a118-704fffdfc877", "comment": "Malware payload (Mirai)", "value": "36e65dad3eaba4768b3f8ecfae7949dba4e2c38cd977d4fad115fe8389edd00dac7815e36cdaddb70b63e534e1daf80e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633680, "uuid": "1562744b-f1a6-41a5-a9f4-225560c04c2e", "value": "T1E7F33A06B4C1C4FDC49AC1744FAEE536E931F49D1638B26B37D4AB2E2E5DE206B1DA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633680, "uuid": "ae816ea5-8f4a-4ba1-91e2-52484e219473", "value": "3072:cthGeFy2IlZ1vKGIo6+V514Fn8FtUGnK2B/ZGNmGEmc:cthGR2EfdB92mxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633680, "uuid": "d8228523-8652-4304-a103-088b6ebb8435", "value": 164296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633680, "uuid": "d547097f-370a-429b-adec-89efa1ba1940", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633680, "uuid": "beeaa27a-f067-4bd2-b070-0dc31e1fa00d", "value": "csk_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a921c1-180d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772658090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658090, "uuid": "6d3dc601-7b0c-4e6a-8e0e-235b21ec9158", "comment": "Malware payload (Mirai)", "value": "2fa42b72faf6aaf8a916d45cd23896c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658090, "uuid": "f34ffa71-7d7c-496b-9275-c9e900a69958", "comment": "Malware payload (Mirai)", "value": "2e422d66ae4e56b2bb71f9c33624a4a1db180d8c4504ed5e5c3b1fa122fbaebc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658090, "uuid": "9182ced2-1292-4d08-ab11-6e90914917fe", "comment": "Malware payload (Mirai)", "value": "d051057d6f2b060b33b64460f073b8533e4e7604", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658090, "uuid": "e2aeafc7-b3ba-4cf0-9efa-4b593bfe63bf", "comment": "Malware payload (Mirai)", "value": "3277ba5709c1caac85296f83973107a3186ed626d501d2da84ee9e1fa6af44189be89ce5f77b0361e3c05ed66b294119", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772658090, "uuid": "fb0ea5a7-db51-4206-9d3c-31cc662f4ea7", "value": "T10B043906B5CCC0FDC89AD1745BBEB136D972BC5D123CB15B2788AE222E4FE605B2D644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772658090, "uuid": "9dca3414-823f-4cbb-a918-3dab4b8b9052", "value": "3072:Q32KnZuFYmIHyCHjY5PewnE9zeIxBTMxf7NjQbCysFm+KXgt:E2KuIHjNiqbzBQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772658090, "uuid": "a610ce30-a5f2-4b21-8b53-cc7a304e346c", "value": 181320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772658090, "uuid": "5bd271a5-b275-4a9b-8b96-b3c8a27e81e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772658090, "uuid": "5aa8a806-80a8-4f97-acb3-6c5e41ba9fe8", "value": "Polar.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b3ce87-17ce-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772631007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631007, "uuid": "ad338871-060a-408a-b188-454a4b6d9e2e", "comment": "Malware payload (AsyncRAT)", "value": "f63dd883ca463577ea2c1f3d590dd6dc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631007, "uuid": "1c02f7c5-3cd2-4d2d-85f2-17f8a6c6e17d", "comment": "Malware payload (AsyncRAT)", "value": "2ff04e798e3cce2d46a5c5cbdc032a9b556bb2117168e7edbdffa3daf42d87ad", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631007, "uuid": "72438458-7ba4-41c2-bbce-8c5635059d8a", "comment": "Malware payload (AsyncRAT)", "value": "dba11f0c3f50ab4c800b048326e28f37e5979e81", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631007, "uuid": "b715dd9f-dc1f-475b-be4d-996ef8420e96", "comment": "Malware payload (AsyncRAT)", "value": "45d89b6e23691fed6520ad621ef4e38db7fbb8d2465f88160598959f963a9cb70730ca281d447f3761b20e3774d5055c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631007, "uuid": "28a6a83d-7a20-4b38-8785-0ed0fd765c6e", "value": "T1CDE51219F7E600BCE0B7B678CA924A09E2B3FC094732E64B53796D699F173908E35741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631007, "uuid": "52796460-14e1-410e-af0f-a33253b102af", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631007, "uuid": "5eb0f8ca-af62-4d8d-aaff-03cba633678b", "value": "98304:u2IHguX9XUDO+JvAi/lKVTHJhCs469jVVNZJky5j:YgROe4IlKhR46ZVVuy5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772631007, "uuid": "56dfef9f-bae7-440d-80d7-2ef7b665679b", "value": 3312790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772631007, "uuid": "ac96b509-cc74-4fdf-a21c-b56065f15dc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631007, "uuid": "bba4488c-ad53-4ca0-950e-942cd71f35d9", "value": "2ff04e798e3cce2d46a5c5cbdc032a9b556bb2117168e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1826cf1-17c4-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772626978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626978, "uuid": "e58575fd-0455-4f40-8cce-b676394d16de", "comment": "Malware payload (QuasarRAT)", "value": "e2ace0fefc172c3bd37a7b1ca6816957", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626978, "uuid": "0ac35458-77b4-4d18-b0a0-06cf3026987a", "comment": "Malware payload (QuasarRAT)", "value": "30a9c4ba3d66d96e68a705f677ef1de510c6a936a21691607d10611773683048", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626978, "uuid": "2791c92d-17e3-4f80-bf58-4762ae2b8bdf", "comment": "Malware payload (QuasarRAT)", "value": "249b65cf90d24a3c8bb931fcedc245ae101b7ef8", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626978, "uuid": "41638489-7e3d-45d0-a6ad-ed085c0c7b61", "comment": "Malware payload (QuasarRAT)", "value": "aa559e7452a107294d1d1fc986c2935e1f689ea1ec13c42fe418dddfb2ea006b17d1aae4b8eec27f59df504be45e0e13", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772626978, "uuid": "7ce51880-8917-41b1-b63e-7187aa349dad", "value": "T1D62423A3BDE01464E56FDEF7FA8D554587973CAC0087D0D8E64AB80D07ABBFC2586490", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772626978, "uuid": "cce17e10-84ba-42cf-b7ad-ed9430d9c8a5", "value": "6144:2ZfOGlQ0CLy4XdmwZAWlN7ukunNfvs+bvz8P5mRf:I2sQ5QwZJjcs+UP0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772626978, "uuid": "7e2aaf94-6aae-4055-8dbe-03e71c0d6b0a", "value": 228023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772626978, "uuid": "e832808c-6ec7-48a7-abc7-38d6de9b1974", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772626978, "uuid": "56251cdc-28e6-4830-b484-7a687e9601e2", "value": "30a9c4ba3d66d96e68a705f677ef1de510c6a936a21691607d10611773683048.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18eb458-17c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627784, "uuid": "edad9708-03f1-4e8d-8e91-95797d6c94b6", "comment": "Malware payload", "value": "0668afbf87ea155c62a6911bd0699241", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627784, "uuid": "131732da-dbe0-41f2-a272-e16e5b7b15c9", "comment": "Malware payload", "value": "3198a3b0e0d628a06a5b6dc2f3832c491b0a0147b4cff605a79f121ca816dd44", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627784, "uuid": "374dfa12-b956-4291-9648-0f10e309c370", "comment": "Malware payload", "value": "16657c09d7af0643cb4381926bfada63d514cd88", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627784, "uuid": "25f56daf-735e-41da-a215-f5251521bbd1", "comment": "Malware payload", "value": "ce07c1e3bc4150d70c76cf173769bafb043a76d50b8af93aa1f4b1fc8820d061d14e7e63c9e4293f075a4caa0460aac5", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627784, "uuid": "45584e69-4687-4ced-a47c-d14c510a9aed", "value": "T1A541BB006FE94E25F3F38E710576A7345B3BF446AE42CA1E409806881832B44D839FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627784, "uuid": "bf8d398f-5cd6-4400-adac-04fb97b7328f", "value": "24:8Mr7J9mElm+E2keVmgAIvm6s+/xRw/ddSBmf0XuHY8KmKePlH:8krmQXPk/3YzRIdQBW0XuHWv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627784, "uuid": "6b6d838b-8e83-40c5-a7c3-e08f161321c9", "value": 1882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627784, "uuid": "63e1911d-526c-4128-ad7a-c96a70df2224", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627784, "uuid": "480fe33d-8b9d-4857-9011-4974214428f0", "value": "Rechtsdokument_AMR001.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6dc8c5-17c5-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772627047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627047, "uuid": "8cacc84f-f04b-4bb8-b59b-0020d16c4536", "comment": "Malware payload (QuasarRAT)", "value": "ded10e80a019b1a9031620be3046244f", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627047, "uuid": "1f90a78c-8138-4f5d-9390-93a02a0d3a7b", "comment": "Malware payload (QuasarRAT)", "value": "31cc1994f6fcbc4252908b1e45fdcd946feea3da0605d086214567143ade47f8", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627047, "uuid": "78a67342-b7d7-4be0-aee7-a47028d354b1", "comment": "Malware payload (QuasarRAT)", "value": "ac90231fa02015e7165684c3db563e1281ecaa8c", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627047, "uuid": "4e026b1a-eaec-4c7e-b902-d5f158e4d6e2", "comment": "Malware payload (QuasarRAT)", "value": "04ea83076446434244526bfd83159b17bf01f3b4c84046aa603b1015f217fa65426847c2184a5b6f05d9a224be68a147", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627047, "uuid": "64837e34-8993-4d7a-9e9a-cac3d2952d15", "value": "T13AA1B5552B43D96A8871A325E9A3D50CFD5E90BF201B622832AC8E0D7FF4569C7BC188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627047, "uuid": "44e7a9e2-93ee-4554-89f2-636d2040c366", "value": "96:RdDKI+ZYZN9nZIx8m23EuwvM/8tU8GdqE0/OscK:RD+679nCOysoUZdqBGsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627047, "uuid": "dce2a172-252d-4bd7-9edc-378ddbaf1766", "value": 4779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627047, "uuid": "fa20ced1-05e6-476f-87f4-916ece0c8299", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627047, "uuid": "c31cb500-f8c1-46e8-82bd-cbdc6e60ff8e", "value": "forex.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1fcbaf-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654591, "uuid": "05985840-878a-4af8-b8b9-02860b47c07c", "comment": "Malware payload (Mirai)", "value": "9ccd950057b5e278b9677813cb4f5b68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654591, "uuid": "6cf4082f-498c-447a-8ae9-05179f6dce73", "comment": "Malware payload (Mirai)", "value": "31fb6bf03e8b03a131d4ef5fa6585270d90e7f6e5fbee9747053caf0ec08caee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654591, "uuid": "e4897a99-b9e5-4050-a7ed-4fd3535cc24d", "comment": "Malware payload (Mirai)", "value": "3b4d1f28ad43597cb9369dd6d43d193d968823be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654591, "uuid": "ca7d489f-a03b-4a30-bee5-01c2edec44fc", "comment": "Malware payload (Mirai)", "value": "9d78478eae4e473cc418656974e509502e09ff2af667234891c59a9cd17e0abbcdfff920986bad0745f184d467585a99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654591, "uuid": "e37a85e8-402e-4b60-9d94-86b591f2e558", "value": "T1AA336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654591, "uuid": "c11af020-2f11-4194-9e13-154223af45d0", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654591, "uuid": "6eb4f174-64db-49a5-bb2d-1d267f148344", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654591, "uuid": "6b5d595d-c6cc-4d4f-9b08-89bae4ea9a93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654591, "uuid": "54808ec6-af3f-4abf-b599-c51c54ea9e81", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bf9546-17b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620723, "uuid": "3f29daa4-afac-4838-8f9d-44ec6adc9459", "comment": "Malware payload", "value": "6b17d0e6ca007bad02923f86aa8f29d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620723, "uuid": "cd874919-8657-40c2-af21-003025432be9", "comment": "Malware payload", "value": "323d66004a9fc6f83860be44307d59a4887c1b66f013245b0d9743f6c386b5a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620723, "uuid": "5dbb5ac0-1c31-481c-bc5e-3eeb5a2a3255", "comment": "Malware payload", "value": "475f915103dee09fab38d91538052979d769f3f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620723, "uuid": "6617e3d6-d072-4ac8-b306-f1304bfc6108", "comment": "Malware payload", "value": "25fe2292b340eec8f0fa632a6bbc2399e9af3fd870a818557db9e8d88d3e6b3a2c7ad8485b6f815ee2a4d3d6aee9bc87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620723, "uuid": "9a168857-fac8-422f-8099-fbd680e6ba4a", "value": "T195A48C01B750951DFA27FD78D0A2E2C243F1FC226AA6CB3B587534A75FE618F6811392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620723, "uuid": "ca800ff6-f1b8-4902-8504-ac8e179592c9", "value": "12288:o5487coBH6oxL/ktkH8OiIY8vcox/V+sV1:I4WcoBHhL/ktk8OiIYUcox/V+sV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620723, "uuid": "b9015ada-a882-46a0-a652-0bf87c998cf0", "value": 455376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620723, "uuid": "c536b309-6a26-4a47-8022-f0edee74b4ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620723, "uuid": "e1dfe024-6705-4cda-b3a5-835853b918f5", "value": "323d66004a9fc6f83860be44307d59a4887c1b66f013245b0d9743f6c386b5a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc070b4-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654732, "uuid": "1685ac3d-11eb-4f24-8670-2d35185f46a5", "comment": "Malware payload (Mirai)", "value": "1ff6127dab2b028db7fe5c46d7e352d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654732, "uuid": "9e829444-5e7b-46d6-8250-0c1f6e0f0c38", "comment": "Malware payload (Mirai)", "value": "329bf41be4cb82936d97d2e79c0c30ce6d25e5f4fb9252c43abb14b359755238", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654732, "uuid": "e72848e3-7934-49e8-a39e-10b72f073e08", "comment": "Malware payload (Mirai)", "value": "51e887003d36eb4ea8f49bf0146cd8fa9801c0f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654732, "uuid": "28d8d267-bf31-4a39-9094-1d3f1834d1ed", "comment": "Malware payload (Mirai)", "value": "9fa092fd32158681cac39d8564e8712cf74b22d7771a48333fe39d651f65ce5878af31e924ee82a41fdbd6b9cdb63016", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654732, "uuid": "b5adeae7-bd5d-4a40-aeb6-f59e7b35bb36", "value": "T1C773A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654732, "uuid": "e1f9caae-d1d3-448c-9f54-a75970f4d7c2", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerESt+:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654732, "uuid": "6907f70c-985a-4f79-831f-dca515cdfe4c", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654732, "uuid": "57d3d30d-c108-45a0-ba49-a4d12300e753", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654732, "uuid": "8791e4bd-8817-438d-b142-2dc178a6cc8c", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449b87ec-17d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772635305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635305, "uuid": "84dda4da-0e74-471a-b136-0b249313b692", "comment": "Malware payload (Mirai)", "value": "51c5f4d6ca8265090b461b40893a71d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635305, "uuid": "387f3140-ed82-401b-be8f-8e540315146b", "comment": "Malware payload (Mirai)", "value": "330ff89110d4ee9825104210fa925d805b8cfeaf8ad6669a2c39a1c9c70db939", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635305, "uuid": "df09b421-248d-49f0-9e27-ca386c2080f0", "comment": "Malware payload (Mirai)", "value": "ecdcb173f70ea33ebdac3765d632da97a3f1f04e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635305, "uuid": "7c22d6a3-88d3-4b93-a451-953048f8334f", "comment": "Malware payload (Mirai)", "value": "939da659cd1024515ecf470b9ab57e9f10d42bd1029d3f79bc05dba4e9fedb229b606b2ae9b257d30707e9167a63ff96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635305, "uuid": "352379f7-5be3-425e-b4e3-301e6ebdcbe7", "value": "T1B6A34B26F9351A27C4C0A4B621F74721F6F247CA26A88A1F7D720D4EBF356403653AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635305, "uuid": "2118188d-7d07-4eb8-88a1-cb1e27fd9b25", "value": "1536:CnzUSkaU84lUDir3yD3y60sPXFntkVzlrgtfHKF5W10JFVtw8856C:CnVqXWDPL1q328hC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635305, "uuid": "d9789609-36a9-49c5-b90f-68374cbc81a8", "value": 98040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635305, "uuid": "7fc7f338-89e0-4701-ab20-dce7d8009475", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635305, "uuid": "ec3eb22d-c74f-41d6-9d4c-69f8f5de9a3b", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5850334a-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625460, "uuid": "111e396f-7394-4c4c-8cfb-418c84725419", "comment": "Malware payload", "value": "cefd0dd5e1e20e41c58186a5f20e3fac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625460, "uuid": "5b7d8956-c674-4c18-9556-cae08f0a6769", "comment": "Malware payload", "value": "35034d19a0ba86425e4e6f7455c68410c0183c36dae932bf47216d585de0cfa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625460, "uuid": "79002282-e42d-4230-82a5-625f6d4647b5", "comment": "Malware payload", "value": "cbf49385f31a5c22af9d543773cc6a1a05733aeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625460, "uuid": "18b82248-c48e-49e0-81b0-0d817fab9f1b", "comment": "Malware payload", "value": "9cc3996901f8e28f169a3d08fc5e6fd55166ec32f9d2050247809f5f47e2457608ea546e1cea201ae4b23493296f85d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625460, "uuid": "d6d23a72-633d-40f7-8c50-eac045ad706b", "value": "T12614AE00676C7416CBFE4A3A40611239C57F9F5E2EA1D7079D46B84C6A733F20E16FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625460, "uuid": "162d2056-9bbe-4b5d-b81d-9c23c2b0ca3b", "value": "3072:d9Ja9Jb2nr1uOtE0k3aOzmJIvX6lvT5Y47n5:XJaz2/FkqQmuvX6tL7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625460, "uuid": "a8be2274-442f-40cc-8b91-ec55242fb207", "value": 207664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625460, "uuid": "1d51912e-4d60-4293-9945-85e101184aca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625460, "uuid": "097c2907-0289-4ac6-baab-174deff58d99", "value": "35034d19a0ba86425e4e6f7455c68410c0183c36dae932bf47216d585de0cfa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32415467-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654602, "uuid": "35c63622-26f4-4b6e-a805-a91f400e56ee", "comment": "Malware payload (Mirai)", "value": "69df762421e2d486e6ed9e1979fd2b30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654602, "uuid": "1d9ab5c9-2703-4c52-be93-36c42194f9d7", "comment": "Malware payload (Mirai)", "value": "3521e883039e0ab7a12af541c9eca3114ef32ff1553c1f2f03efd9e0d0b917f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654602, "uuid": "b9b86503-a1d7-40bd-971c-78ba6aa28418", "comment": "Malware payload (Mirai)", "value": "3a18f222115da7418b5411e6a7b10fb67c895fea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654602, "uuid": "5dbcdb46-f95b-405d-9219-588bec2b376e", "comment": "Malware payload (Mirai)", "value": "3036bea415d108c33835230cd778a2a52e2d96c391032a0d6e574cec0fd8eda3ac726702e1b37f54e60d046727382d9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654602, "uuid": "9ea0b00e-047f-4c6a-ba00-dc6dd8c75906", "value": "T1F223F791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654602, "uuid": "0a0a197d-1dd3-4ccd-9774-70e4e36f8e5c", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9TH/:5DmKF7Gxyk8cqoHAmWurAufsG58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654602, "uuid": "757f4418-6748-43df-a752-60f8cc9ea872", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654602, "uuid": "69239703-096c-47fb-bce7-df4e6dc608f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654602, "uuid": "e4fd3ccd-600c-495f-9314-3b25b256cef3", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61a70a7-17dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772637724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637724, "uuid": "93766b0e-0cf1-4e8b-9595-a71523798a42", "comment": "Malware payload (Mirai)", "value": "867387eafe042c8bb63166dc68dfe225", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637724, "uuid": "668c5f96-5437-4683-9a97-310c41f0ac72", "comment": "Malware payload (Mirai)", "value": "3574a9b7db122398adce1896d6b435c0250ae1fdb51d344af64d81a117e9a113", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637724, "uuid": "9b1e2ef5-d197-479e-947c-097f3288b7d3", "comment": "Malware payload (Mirai)", "value": "26287b97d3214561d8ee7596874d38cef1ffe03a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637724, "uuid": "245b64a8-23b6-4d46-a1b7-9a004052b350", "comment": "Malware payload (Mirai)", "value": "578502be5e7e248d5bfa4cb11c354611eeb4c4c5f7d111c0c1470fe4cdb9d46887a18dd6be42d66ee844cdc78a6290e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637724, "uuid": "9721f7eb-547d-4b7d-b763-b9fdc923270b", "value": "T1491302B396E83E84818B1079117D3C23969EF519039589A63AAC606349F7F1EFF702D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637724, "uuid": "cfab8143-7fb0-4753-946e-bcfda1919446", "value": "768:CIOuSt5m9TCsd24PAe3BO0Fv/FnG8DPNgyuOy/kVrnbcuyD7UHQRjN:CIOuzhd2UAevv4S+y7N9nouy8Hyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772637724, "uuid": "c958f5c1-1fc4-4444-9f59-00440dad94e3", "value": 42096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772637724, "uuid": "32cf9910-dbb6-4094-877d-acc2e848c9e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637724, "uuid": "14366928-4e67-42fd-845c-54d9b2bb225a", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac681fee-17a6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772614004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614004, "uuid": "87025146-fc79-43c7-93f6-831df6a93465", "comment": "Malware payload (AgentTesla)", "value": "8cd65b2613d0f8adaa83467794646065", "object_relation": "md5", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614004, "uuid": "d04ce2b3-d282-4aa5-b069-61564ede3c4c", "comment": "Malware payload (AgentTesla)", "value": "359a9f6645be8f9661221f715fd210673ab2c24fc7fe2eb4d3dac83cd64af0e2", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614004, "uuid": "64ea0f45-038e-4f40-a4cb-b87fc92e2011", "comment": "Malware payload (AgentTesla)", "value": "6e65e000f64962a9854ec98792dca6b309822343", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614004, "uuid": "00be6631-a27c-40bb-b94a-2f87e3aef157", "comment": "Malware payload (AgentTesla)", "value": "05863a4828275d8676021dc37881c3abe0a324984ee721d4b068f1d14d5f846db67668395c4fea571162eba0df158f77", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614004, "uuid": "6490b191-37ca-45ee-8b31-80e2aeb65e07", "value": "T189A302454D89F2BBA0D1E5FBC6906AB520F744E2189B395D96FA7B802F200D86F3F1D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614004, "uuid": "d858d06e-1893-4a79-ace8-d44daa9eaf75", "value": "3072:5n/2R4Z5YFFEqDb+udGdrd5dSYWibh5+X8sX:R2W7Y/Eu+aUrjdS0VkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772614004, "uuid": "5a3c777c-7e96-41f0-9a08-287b33453275", "value": 101846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772614004, "uuid": "74864b51-bf67-4b0c-b4d3-4bd0da892188", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614004, "uuid": "f2e06dc4-d085-4836-ba78-3897307ba28d", "value": "4265b06cb89c30c5ab927fec152caf45f40a9c6b598e91b70aef3f3667679b99.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861c8cf3-17a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772611793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772611793, "uuid": "e1d38dfd-3ec4-480a-8aa6-3f0c56f1f474", "comment": "Malware payload (Mirai)", "value": "6641328edccdf15f1ca03d3d291571a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772611793, "uuid": "87d4d79a-3677-413e-989e-8bd281f32936", "comment": "Malware payload (Mirai)", "value": "3669ac19d7ca04e7de7fee18b07ae0ff08ba9c9f1f1ee4b44ba85c79769eaa92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772611793, "uuid": "32326873-8599-4613-9784-4507006da15b", "comment": "Malware payload (Mirai)", "value": "7123b86d4f6f3046495fc0ed60c341d31281f008", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772611793, "uuid": "6c70568a-8100-4e8b-ad09-eb088f9c2ec0", "comment": "Malware payload (Mirai)", "value": "dfc6125a5c59b26fc8a5999345f21622ec7b6da3cb8492880b4bf0ff0ae3b526ef869e337367a915fefa1043c11eaff8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772611793, "uuid": "8a10cc11-bda2-44be-9249-5b7eb4ab0cd5", "value": "T182E36B42EE418E03C4C51775BAAF414E3322A755E3EB73068D18AFB43FC6A6E4E67146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772611793, "uuid": "c760a79b-bbe9-4ed8-ad8a-fe8bb4de5087", "value": "3072:vv/qPbgZkQxQzevcluDFNbtpy/r7MNuw7ir+BKM/98rh:n+bgxxQzevclupNtpy/r74uDr+oM/981", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772611793, "uuid": "666f3b3b-0f45-422a-832b-30117e681716", "value": 148990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772611793, "uuid": "06773c80-978d-492f-a80d-ffcee3d033ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772611793, "uuid": "25dbfccc-f10b-4030-b7f9-88f9d2da02d6", "value": "nullnet_load.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ee890f-17b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620248, "uuid": "ecaa832f-78df-4b89-bf3b-053a94897044", "comment": "Malware payload", "value": "2a16f10bba03017946effa4af2136bfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620248, "uuid": "674fdf42-91d7-4a48-bb26-57ef94916c1e", "comment": "Malware payload", "value": "374c0eb3a13b0ca64a0a3913beb508568d01f5ca55c0209191987361f08b4f80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620248, "uuid": "d7c74739-60a5-4716-ba26-f3e7d2161f50", "comment": "Malware payload", "value": "2fb42b5bf08dd4652986a0bd5a25a58052bb3afc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620248, "uuid": "5e5ffa99-c533-4f12-948e-f07a120a0a8f", "comment": "Malware payload", "value": "63a00e5bc6020b153dd18fc453aa5f2ff1e6332dfe087c43518d6520d1c17b043f736030433614246857d4537d87a8ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620248, "uuid": "74012cec-6d6a-45ba-a509-3be99e7a5567", "value": "T1BD763348A37110F9EDB3823D89E0AC7AD165BC9627B5C95E17EC83262F132D4AE3D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620248, "uuid": "1915c639-0081-40f7-ad25-39fa47a26a37", "value": "c4af357571dd94ca1603cb9291e6416e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620248, "uuid": "95593846-11d5-4265-81e3-e2e6b50f53d9", "value": "196608:YyBy5c4v+ED/rRRu7NtbFRKnZMA8LXMCHGLLc54i1wN+C8V:1B74NrrRQ7XbFsn6PXMCHWUjam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620248, "uuid": "836c2229-7008-49fc-a4a1-87b5eeec52d9", "value": 7387176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620248, "uuid": "a6cc9aa1-0e13-4299-b616-b64563f5e6b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620248, "uuid": "91c43741-00b6-4686-8869-9bf279c9ef9a", "value": "374c0eb3a13b0ca64a0a3913beb508568d01f5ca55c0209191987361f08b4f80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d74055b-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625442, "uuid": "d49a3535-9ea2-4f39-a9e8-ac0808c40190", "comment": "Malware payload", "value": "757abd38bfe50429b18d25abe3b912c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625442, "uuid": "f3375a1a-d41b-4069-bbbd-086f1af7975d", "comment": "Malware payload", "value": "377b69e9ffe2cf39b161720c6e31cb8557073e6bea3a8e75127cfbfdf9923693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625442, "uuid": "60c57c6c-b4be-4e9f-ac64-d1113b8d973f", "comment": "Malware payload", "value": "2b2222712f43b64fc579236b577129b70f183cf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625442, "uuid": "2c18c869-7683-4b1d-90da-d9879be791a0", "comment": "Malware payload", "value": "698ed81a2ae66042be2aea55182d70ad789b3c869c778a8571c2a65af1059e34ff66bba13dda653016b41a1f4ca5bba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625442, "uuid": "c86136c5-4bed-40e6-86e1-59f142bb21c8", "value": "T1E514AE4867AD7912CAFF4A3940611235C67F9F2E2EA1D7035D04B54C6E733F20E267AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625442, "uuid": "c36c8f0b-2726-4ad0-acac-f00d80a8430a", "value": "3072:3cVc+sOda2ho4XV66CEXU3aOzmJIvX6lvT5l2ANY:Mm+sOda2hf1UqQmuvX6tCA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625442, "uuid": "ba798d57-473e-427a-842d-dabd68579ca3", "value": 207152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625442, "uuid": "2774cea5-e619-4afc-a99d-eed21f3394a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625442, "uuid": "e3d477a6-320d-44c0-a345-0dabde7385d9", "value": "377b69e9ffe2cf39b161720c6e31cb8557073e6bea3a8e75127cfbfdf9923693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eeb4a74-17f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1772645953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772645953, "uuid": "3a3c3f14-52a5-4f38-9513-d6ca9c283398", "comment": "Malware payload (Adware.Techsnab)", "value": "226cdfbb7728a5ef24cf2b7c92598d1f", "object_relation": "md5", "Tag": [ { "name": "91-219-23-145", "colour": "#8397D5", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772645953, "uuid": "114e5dfd-3c41-4199-81ff-c3bce5205b4d", "comment": "Malware payload (Adware.Techsnab)", "value": "3b0fea3b54306d61b79ac98c23d5e2425a856860e19f9606d6e6e1b8947eaa85", "object_relation": "sha256", "Tag": [ { "name": "91-219-23-145", "colour": "#8397D5", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772645953, "uuid": "cd08bd94-8c83-4723-9751-b5c2d65ed028", "comment": "Malware payload (Adware.Techsnab)", "value": "e79adfcfd4844a3ad9155aa44360068c6750d303", "object_relation": "sha1", "Tag": [ { "name": "91-219-23-145", "colour": "#8397D5", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772645953, "uuid": "6348660c-77d8-44a5-b581-53f7e318fcef", "comment": "Malware payload (Adware.Techsnab)", "value": "95363c739892b0688f3a9675fdcb0a9e049b1cd1e124e6fec5fe1beafee29deb5b6eeaf5f746cbbe09f048c8445602c5", "object_relation": "sha3-384", "Tag": [ { "name": "91-219-23-145", "colour": "#8397D5", "exportable": true, "hide_tag": false }, { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772645953, "uuid": "a2153230-c128-4933-afd5-01d8676084fd", "value": "T16A4691D97AC413F09929ABDC824374CD0395A17E6FBB584D02E448BE3D1AE1766E0CBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772645953, "uuid": "40dcf1ba-660c-4adb-ba3b-16579652abc6", "value": "49152:VLY8R5lE8ZU0Z97+78zB9W8UP60wVO8Hx5w89jC8YI8Eh81y28yN8v8uO828MI8y:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772645953, "uuid": "c817e0b5-d636-41d0-ba19-d44d6a847ef9", "value": 5386008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772645953, "uuid": "ceeb40d4-2621-421e-8c9b-ffc0eaf33e79", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772645953, "uuid": "b2a8121c-3350-4df4-a319-1bd063a6f9ac", "value": "wobbling-twitter.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399b9d21-17c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627556, "uuid": "31e5cf0a-2eb4-4bea-bb0e-3500938530cc", "comment": "Malware payload", "value": "b8a5ecd548090e22fec9bf8322e62c48", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627556, "uuid": "2491751c-db9e-425c-9ea1-ea8733948a08", "comment": "Malware payload", "value": "3b5c998164411a73487e3d40c79698b4db96633756489f652f0f9b55929268c2", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627556, "uuid": "d0d8885b-785b-4ccd-a28d-08fe54c3e35a", "comment": "Malware payload", "value": "24fa309e9a04f828e1d06accab34e739481f8ccf", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627556, "uuid": "d92bbbef-145f-4503-9159-a8c314905df3", "comment": "Malware payload", "value": "83fd33f6b20bc25c1d066363c4edbb543d00dbd51fa532451521fb49baeedfb685f7f32e15308349a3fc6222c2cdf31b", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627556, "uuid": "4b5658e2-1d5d-4a6d-86a6-d57b322329d5", "value": "T1E1C1C626265552A58BB25B3291C1A881DD2B427B0326BD0835DCC64C7BE8ED9C3FC9FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627556, "uuid": "32d621f8-9d64-4377-a482-f6b8e2aabe31", "value": "96:PuWbhkjsPFJ8Knvaj8O1ireZNvSIGbFZjjCx0F50Mz80d5yc151:PcsP/GxFIFZjCx0rqc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627556, "uuid": "6ac5e838-25e0-44cf-962a-d5c59e7e6f71", "value": 5894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627556, "uuid": "d81989b1-d13d-46d8-b3a7-2148bb3df9b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627556, "uuid": "802ca5c9-0899-4d74-a5af-afd37b3af3b0", "value": "3b5c998164411a73487e3d40c79698b4db96633756489f652f0f9b55929268c2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47672c80-17c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627579, "uuid": "3b719ee2-127f-4b48-97f8-b05482045e33", "comment": "Malware payload", "value": "cbcde02f292b0d191fb6d03230a28659", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627579, "uuid": "332182c6-97d5-4274-9fa7-1c2f00b34077", "comment": "Malware payload", "value": "3bc53b60569dfe3cdf68f8ee9e030bd42e841d95ca5489f4704c3aabf5fa09d6", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627579, "uuid": "a5eb43ec-123b-4c94-85bd-5af5ba8d5691", "comment": "Malware payload", "value": "4b1a40f6004a243a470e01f8a497b6de4a3b60ae", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627579, "uuid": "219ef224-82a0-4cf1-a846-72a7624e5fd7", "comment": "Malware payload", "value": "443650fc9b7c54a76480c94a63c4b3b421d573b5e60c7922c4960ebff784faf314cbdc35c2b392dfea0f5f454504626c", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627579, "uuid": "2661e23d-7af1-478e-b325-b15aa9b88fea", "value": "T107E02BADE442D621972118A98F6ADE4FB3DB62C3FD404D57460B0E2D435895EB16E0D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627579, "uuid": "1d627df2-29e2-4ed5-8aca-cb8a081c3c9b", "value": "6:hmROn+3GgV5im4xLNK3VyABqcKN8YTdJMTEFVik/n+3GgVyuPCtuH1j0KC+3Sodk:wwi5nF4TNl3ik/HiJVj0K13NdMi2f9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627579, "uuid": "3d3ec8e8-3cbe-438c-aa0a-224bce34b1c9", "value": 411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627579, "uuid": "55fadd6b-c063-45cd-99fb-11cf78acdbb0", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627579, "uuid": "6fb21b2d-9d0c-45af-8029-1d61c0cfccfd", "value": "3bc53b60569dfe3cdf68f8ee9e030bd42e841d95ca5489f4704c3aabf5fa09d6.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c4bcf7-17db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772636841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636841, "uuid": "dfc20b3b-39a5-494f-9cae-c7b576db53bc", "comment": "Malware payload (Mirai)", "value": "629d97d91cbe0d75c4f33c71aa399b53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636841, "uuid": "d828b285-d035-42dc-9eba-c07c383e5782", "comment": "Malware payload (Mirai)", "value": "3c1c05af8792396620ec07f935ffdf60cabb164dbdd9b221bff01e5e6eb54778", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636841, "uuid": "932f2a93-0b88-4fae-a5b6-d7f83fd814eb", "comment": "Malware payload (Mirai)", "value": "070540bb6d9e7c7f3a5ebd34da900c7b20539049", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636841, "uuid": "303a1712-6d50-42a9-a562-226c85f7e7a4", "comment": "Malware payload (Mirai)", "value": "e6ec9c8a6f90a23e7382b69e5f0d7381f577365450d82f428d2010c858c3912b10fd25b5af69840d16e60663248aaade", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636841, "uuid": "a86704f8-e6c6-4a94-bc42-4f3f7c2a8e99", "value": "T142040946F8C19B11D5D112BEFA1E518E33231BB8E2DE7202AD255F60778B9BB0F3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636841, "uuid": "6c29502e-e78f-419e-9de7-3f39d2485a29", "value": "3072:rhWwRchmZ5YxKrQ7nH84QkAqyGxX4eV2nIa3fjczZBzCD+IYL:r8wRchmbFrQ7RjAoxX4eVqIaPwPe+FL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772636841, "uuid": "2d0288dc-093e-4194-a712-545f42e5a65d", "value": 187196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772636841, "uuid": "20a977c9-3d21-4004-a4bf-e7d318148608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636841, "uuid": "071c3740-3ca0-4f4a-a271-5799ec6894b7", "value": "Polar.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9c2e49-17d8-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772635537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635537, "uuid": "f6a96a78-026f-42f7-b52f-850d937cc152", "comment": "Malware payload (XWorm)", "value": "adce11d018513f3e056f384285087585", "object_relation": "md5", "Tag": [ { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635537, "uuid": "a8b87527-9565-4c7a-acfb-756a04cd6e06", "comment": "Malware payload (XWorm)", "value": "3cbfb774bea7e69795100ed56f19b6c7fd8644f560d922005d82845b80e7e9aa", "object_relation": "sha256", "Tag": [ { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635537, "uuid": "aa60f975-9046-4c8e-b63c-0f778c21d0da", "comment": "Malware payload (XWorm)", "value": "4e87fe8c9e40250cb6cb1178f70b7b0afbc8f43c", "object_relation": "sha1", "Tag": [ { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635537, "uuid": "62e4335c-02d0-47de-a69e-95c7fedeb9a5", "comment": "Malware payload (XWorm)", "value": "455f378b70af3fd578c8a27db4f8d181bbc9e81c97cccd2894bb168e4f5ae530c6dd4790c924c25c2022f27d1fc8e82f", "object_relation": "sha3-384", "Tag": [ { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635537, "uuid": "adf48634-2304-43a5-b10a-bbddf27209c9", "value": "T11BE19C6C8167C998E7C34A214B066510FF733A9C70589486CCFB482F58539FEAE64CC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635537, "uuid": "b19330f6-201a-4220-80f0-c073932ae9fc", "value": "48:90XBVExZl/nhh/W9ok41c1kFq/F1H5pibdeIozFtdVxJNEJ5CO6enaNAbAchx77:x/hh/yok4/45KdeIoxtdjNzZcvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635537, "uuid": "aebd0669-006a-487a-9d96-a93e80f1c648", "value": 6973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635537, "uuid": "fc0e4238-879b-475a-8da9-8b66ec818ac1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635537, "uuid": "43b1a489-3858-405b-b826-5917e69c7ffc", "value": "3cbfb774bea7e69795100ed56f19b6c7fd8644f560d922005d82845b80e7e9aa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea37772a-17dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772637301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637301, "uuid": "73f61e15-4408-4efe-a121-efdab352d43e", "comment": "Malware payload (Mirai)", "value": "56b9fd67f554e318932723b14181f0de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637301, "uuid": "060a3c28-1212-499b-80da-8b7260d6c37c", "comment": "Malware payload (Mirai)", "value": "3d4c2c3574de80f65a52a359b07bd21e25a5065056a75662c3428780c34d7d82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637301, "uuid": "58ecb333-1bda-42a1-bff1-30b14191d6cb", "comment": "Malware payload (Mirai)", "value": "5633f423aff235276d4f47b95edc57afacab4773", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637301, "uuid": "f00385c8-7466-4ea6-9004-9798ae51dbac", "comment": "Malware payload (Mirai)", "value": "9de66a82c6019bdc60815aa9a6c8cb7990b816025f74e470edf6286ef2aa03f339c10fc2571d443a794c52b0150b383d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637301, "uuid": "0b67ce2b-ab25-470a-80b5-76437e1541d1", "value": "T13F630261532AEB3694E0487A8E3C1A1B7FCC6EBCE34B66735F5805D51AC34C2E9C6D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637301, "uuid": "775a6b88-915b-46f0-bb72-b1f13f6dbc15", "value": "1536:yebC+5BUMqDaXajTTENpjEYMoPDaktKRuov3yF3gdIa/Ll:y4h5BUM+aXsieporrKzv3yF89/Ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772637301, "uuid": "3d6718e5-833a-4624-b4b6-d0cb15b3df8c", "value": 71400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772637301, "uuid": "38e21e07-d102-48a4-a81b-78264557c546", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637301, "uuid": "80166634-8b26-43fa-b640-16498315a1d1", "value": "Polar.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450f4828-17b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772619844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619844, "uuid": "2c195113-db25-4faf-8e54-7125723c53b6", "comment": "Malware payload", "value": "b3682f4479b1ccb07d5c24b3927ed15a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619844, "uuid": "2e6346cb-0635-403d-b87c-90bc82d67975", "comment": "Malware payload", "value": "3f0e9baaa2a724e6aede65e1db555b1d35aa942f59a9c9059f8ad17d55a8482e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619844, "uuid": "4eb7b881-9d19-4317-8299-0096fbcb5fd9", "comment": "Malware payload", "value": "4e877ae36e30d59ac277590d4e101329e54e0720", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619844, "uuid": "b316a5a2-dea4-46ac-aa44-77f780642b88", "comment": "Malware payload", "value": "ea22cba086940afd65d2fb50d006e7bff7d8022965d0436703f3292896c8778413b20cb1d17bf823d9e267552ca8f99b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619844, "uuid": "cd99e2c2-5e23-40c4-9a81-b405c5e6f901", "value": "T1E7258D01B750A51DFA2BFD78D0A2D2C243F2FC226666CB3F54B5345B5FA628F6811392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619844, "uuid": "fb26e9cb-f947-44b4-b38c-4f00969416c9", "value": "24576:8IrnWcoBHhL/kt24WcoBHhL/ktk8OiIYUcox/VWEVH1coZMN0V17cohyHSrVF:8q1MWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772619844, "uuid": "e6f64dc7-6bbf-44c2-9aba-30da2bd71a7d", "value": 1045712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772619844, "uuid": "dcfbab21-cfe8-4912-8cce-bcd47d1afdcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619844, "uuid": "aecbac10-1074-415f-a8fe-27af142a991e", "value": "3f0e9baaa2a724e6aede65e1db555b1d35aa942f59a9c9059f8ad17d55a8482e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b881a592-180d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772658263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658263, "uuid": "8a608a70-450b-4f37-9ce2-7525c8623b2c", "comment": "Malware payload (Mirai)", "value": "f224b63cf949baf28e3b477eab89300d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658263, "uuid": "c79ceb87-9f68-4c60-af3a-65023c208759", "comment": "Malware payload (Mirai)", "value": "3fafd61177bb46677d5f5ed4e12638f18a13a4f9a753e3052780081cfd37cfa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658263, "uuid": "917ea75d-9ef5-4442-bef0-ee4deffc5e86", "comment": "Malware payload (Mirai)", "value": "b79784bd88b37df970528c692c4ab7dfc05499e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658263, "uuid": "a0b7ae4e-f2f6-4c32-bbdd-88a41195ca15", "comment": "Malware payload (Mirai)", "value": "b06fb3f0326307f8d00edcbe837fe158e96eceedc91712f93694b4a2845779c5be876e570494bf5ee538bdc410fa26a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772658263, "uuid": "db2ad495-baaa-4dd9-a074-9dbaba39b99c", "value": "T145D36CC4F64FC4F5E81215713036BB72AA73ED3A113EDA43D3B95A219CA3981D91A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772658263, "uuid": "83621a44-c476-4172-bbbe-7ed668f672ea", "value": "3072:eNTuRSWV9FrpRNefM8hnBU+vDABiA7blxeRgiH:qT+SWV9608h7dA3TeGiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772658263, "uuid": "f94e26db-b9ec-4b16-a212-834afd55df96", "value": 135852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772658263, "uuid": "53caf1ad-8750-47d3-b1cb-be50d295f293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772658263, "uuid": "eed5bf11-14e1-49cc-9b1e-acbfdc4fb5e2", "value": "Polar.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52d6fa9-17ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772622609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622609, "uuid": "bd358358-b34d-4253-9593-4b001fcfd827", "comment": "Malware payload", "value": "be33f7802c6472ae56f142495aa19c5e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622609, "uuid": "4d507e91-e425-43b5-8e14-88e457eba944", "comment": "Malware payload", "value": "422586d9bf14a270bc9a0e397ed5effe7bb88f0a1955cf98aecd435f68f42788", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622609, "uuid": "514a6ce5-cb0c-4449-b53c-682af1283335", "comment": "Malware payload", "value": "5d0fb2b8e38bb047db2ed2f28ac4ec4a0dfce040", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622609, "uuid": "367b5dc4-a9ad-4d28-a0a2-3eeb29a918e3", "comment": "Malware payload", "value": "05b8c9f170c58d3a310aaeb08a76b0036d49c6e16f4cc697aa326ea7b77a4e39a39df02331655b75e73d56a14b0f1af0", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622609, "uuid": "6146828e-7214-4184-bbcf-1ba86626a751", "value": "T1EFF423A8EDB061A8E595FC27BF2BC1D792681CF2C0141C6F92BFC66D076530B9122DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622609, "uuid": "a35b8f3d-54c9-4826-b88c-efb969d1578b", "value": "12288:87C/fpL28VP/e0bK9ar+o/vMMTBYy8WCq0RcpzFlk2bdM3tWrQWjRYn+36cqTMeO:gC/fpL28VzrSuBYy8WHBNb2ojmmNMZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772622609, "uuid": "517f6499-a4c9-4cc1-89f3-563966bb7aac", "value": 734291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772622609, "uuid": "3c209145-b2ec-4ea4-8a32-53fd7f312633", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622609, "uuid": "5f81575f-0429-4ad2-aca1-e72cb2e81ac9", "value": "\u30c7\u30fc\u30bf\u30ec\u30dd\u30fc\u30c8.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731dad09-17a6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772613908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613908, "uuid": "acd2bbb0-174f-48b7-bd43-3676d70da74d", "comment": "Malware payload (AgentTesla)", "value": "46118e29d9db86acdb425bd1ce4d0b28", "object_relation": "md5", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613908, "uuid": "3e50efc7-ebfa-4c21-9cfe-de42e57ee70f", "comment": "Malware payload (AgentTesla)", "value": "4265b06cb89c30c5ab927fec152caf45f40a9c6b598e91b70aef3f3667679b99", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613908, "uuid": "bfffef32-4c04-4eb0-9435-8d95250c4aea", "comment": "Malware payload (AgentTesla)", "value": "38ab3cee0a97b2540b98cc42d46799b1bd163059", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613908, "uuid": "c0b9bbdb-952f-4686-a55c-42a91eb71f87", "comment": "Malware payload (AgentTesla)", "value": "dcb641d6d86d2e18aef517bb2bacc9c2fc414f24877f7295abc4de22f015e55cddf072f740c944233167904d1c5bfe36", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613908, "uuid": "a514fffe-f9e2-403a-a422-ce44b43ba41b", "value": "T18F144B31ED26067A0F475799FCA90B62CABC8218823654F5F6DE070D21059ECE3FE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613908, "uuid": "519a023e-be65-4a65-a04b-8fe20e52cb6a", "value": "6144:tjoM6k5RoKjjSXpPDYmU1V96OoEkcHAF8zgi:V5RoKjEyjVDgFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772613908, "uuid": "7b72de24-4558-4b51-b06a-d9c5d25b2048", "value": 204838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772613908, "uuid": "0f0ee802-9c57-42c7-9338-a5154246f066", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613908, "uuid": "0fcf8fde-2596-4ddd-b9b1-256c41a61fed", "value": "4265b06cb89c30c5ab927fec152caf45f40a9c6b598e91b70aef3f3667679b99.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf7fe8f-17d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772632876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632876, "uuid": "5c4e2d6e-bf32-4181-a145-1a7b474dda6a", "comment": "Malware payload", "value": "6d1d4e938ed1e46210375308ef3bcb08", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632876, "uuid": "e3e1403c-1378-4bdf-947b-096a035d51a5", "comment": "Malware payload", "value": "42a5db2a020155b2adb77c00cbe6c6ad27c2285d8c6114679d9d34137e870b3f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632876, "uuid": "7c99d96e-643f-4fc2-a673-472fbb6a25ea", "comment": "Malware payload", "value": "4ebfa2d967ce7983790b77a3987cb1c5d1b868f2", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632876, "uuid": "4687ad56-8bf3-4abf-834f-2700475bc852", "comment": "Malware payload", "value": "eb1a85272dc744eab6e1c708954014a4936642a94a0c448b07ba37820fa2b36e970de5ba34b3d0068df2b6186f7e36b1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632876, "uuid": "1149efac-79b1-40fb-9306-7bbc14e6eec7", "value": "T13C613C77E742295AAFD93B127A984DC0417174CAB9C3114A4C2296C757D44F8B7185AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632876, "uuid": "662e1583-6e9b-4a12-a658-3ff28465b982", "value": "96:iIyz6jwkYrK5ST4JQ81/yory2/5D8M6tRqY4j:iIKkg14fNyAy2H6t4Y4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772632876, "uuid": "30183305-0d38-4ae8-8f97-27dfccf8401f", "value": 3181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772632876, "uuid": "a06c3ece-58f3-4a65-ba08-996562c0233b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632876, "uuid": "33b0c275-b28d-496a-8894-d08739c4bf02", "value": "42a5db2a020155b2adb77c00cbe6c6ad27c2285d8c6114679d9d34137e870b3f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9581a3a8-17d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772634582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634582, "uuid": "f3a01126-e0ea-4133-8cd3-152f187cae58", "comment": "Malware payload", "value": "18606eb534b950371259aef8017cae98", "object_relation": "md5", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634582, "uuid": "2b00ec29-a720-4486-a627-86f96d62cafd", "comment": "Malware payload", "value": "4496753cf81847c09ac2452d29afd753b5ac6464f9c1270b2aa8e4a704cffb3d", "object_relation": "sha256", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634582, "uuid": "e64d45d5-957a-407f-b1dc-5da533e52b12", "comment": "Malware payload", "value": "f0cc777504c4e20f029f897e5fd76760803f1bc5", "object_relation": "sha1", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634582, "uuid": "a7ce22a2-6392-458d-b1de-66356a774e0d", "comment": "Malware payload", "value": "18ce96055d50333e9da4e6563a8dd3f4e8434611313b1352554f2ac89751753991ea5222ef562ce59a63677de4513a65", "object_relation": "sha3-384", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634582, "uuid": "c59485b6-e801-4907-9eed-3f90e6fadb4e", "value": "T16245E480861710A7FBB232A53CE1343CA34A7364D2A7053F85ECF4569DB5BC28DA5FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634582, "uuid": "4cff6fd4-589c-4891-9fde-f2242cc38726", "value": "384:Nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffz:Dg+Ve4rnAcaxatnHFjdz2YL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772634582, "uuid": "b3e54d0d-edad-44d4-8593-dae95c405296", "value": 1223105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772634582, "uuid": "3849a876-ad21-445b-8220-8f3fb23e6fa2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634582, "uuid": "7f598197-1dbd-47a2-a856-ecec2dc8f131", "value": "4496753cf81847c09ac2452d29afd753b5ac6464f9c1270b2aa8e4a704cffb3d.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecc3cb2-17b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772618035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772618035, "uuid": "22b6efe3-d984-4a00-95f9-c2c90da9530b", "comment": "Malware payload", "value": "d5d411d61b089d5761838138e7eb484a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OR-KAHOL-LTD", "colour": "#CD930F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772618035, "uuid": "d91a70b9-39a6-463b-ace8-b9be85bf6544", "comment": "Malware payload", "value": "449be9e617efdbbf57169e452ec4d20935e67e524bc26335a73209821873f3c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OR-KAHOL-LTD", "colour": "#CD930F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772618035, "uuid": "7db6b277-852d-42d9-990a-0e94253eaf08", "comment": "Malware payload", "value": "d62b3d65a2978b884e8e595e7bbf4038966eaeee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OR-KAHOL-LTD", "colour": "#CD930F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772618035, "uuid": "e410fdfb-95bb-40b5-aff5-e9fc76e76c4e", "comment": "Malware payload", "value": "6cd7b3a8d9d4bb6d64123075d74c04b419a3a451c7ab86e9e3f97851cea576d9f1f4c2172d5a0e5ba3e3b812e1372fda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OR-KAHOL-LTD", "colour": "#CD930F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772618035, "uuid": "8b73f2f8-0dae-425a-9912-54a5bcb0baed", "value": "T126164ADE6B7049C5CDC887F6FF1201AD3A2BA4BBDE5A4B45E00C9F996886D5CCC41E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772618035, "uuid": "1c3640af-209e-4c37-a2f8-3cc539a2be16", "value": "24576:kTZnpDXEoJDkgRIGsS9JHRQMEToXW6OTWEkkk3VdZdpg5NbJbVT8nx5IQbYD:kDh1BRnWQdZybV+Xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772618035, "uuid": "e97718ef-2e75-419a-844c-1063f2ff35ee", "value": 4402968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772618035, "uuid": "5a3b79d8-8d38-4c27-91bc-a86119951939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772618035, "uuid": "78f59d51-3a1e-4eac-82fb-ffcf5d80ca9c", "value": "449be9e617efdbbf57169e452ec4d20935e67e524bc26335a73209821873f3c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508ad285-1795-11f1-a769-42010a9c0008", "comment": "Malware payload (PlugX)", "timestamp": 1772606549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772606549, "uuid": "3f1a7df5-d03f-4f17-86c7-41251cb2b551", "comment": "Malware payload (PlugX)", "value": "c647e6e683a88af07d861847a18468f8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772606549, "uuid": "64c370e6-2939-4eb0-964c-ed6d2d6375ae", "comment": "Malware payload (PlugX)", "value": "44cfba85aa27265779b01f6eb8b69718462b1ca8078b21066061e8d1622dff7a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772606549, "uuid": "59ec3174-ab80-4a58-94fc-6fa9443378f3", "comment": "Malware payload (PlugX)", "value": "68932940cebf56bb2fe65e4cf53781a97579599a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772606549, "uuid": "5b03110c-372b-4f58-8850-7599340ebf31", "comment": "Malware payload (PlugX)", "value": "7769ff9924262ab9ecb6b4956b56e3a308415e03fabefc8d8fbe12fb8546ee3b40346a70d4d355f97f908d1a5924933e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772606549, "uuid": "cd384d75-7753-4db9-bd1c-0a2924dae795", "value": "T18A712E178340677AC1D98738224B69639CBA5C319FE618D39B1BDB16B8335F83D76B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772606549, "uuid": "925d6177-02fe-4ecc-a62f-f712a01255c6", "value": "24:vpmGSXW2GOCsRTtzoP64DelWzdQIt/NQh2cTgdEXZKLqyXvAwf/CCjls:vpguHs5tzoPfDDzdpt12gmyXv7Ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772606549, "uuid": "42d032c5-d9b4-41e0-8ead-a7dee1fcbf08", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772606549, "uuid": "9310be66-f1cc-44cb-bfe9-3a4c2120c4f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772606549, "uuid": "3431ce7c-29a9-4f6d-a97f-5a3380b9acad", "value": "crashhandler.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b153a3-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654663, "uuid": "6e1d2a26-8864-4a79-b52e-ec707565cc29", "comment": "Malware payload (Mirai)", "value": "1f1f760edf58d0600b949fa848ffb389", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654663, "uuid": "c53f7164-7422-4e43-8d16-27041489c674", "comment": "Malware payload (Mirai)", "value": "452af9a19f9f5a11cec9635d534f8a7347c0ce463006187ed9992f2b44385cda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654663, "uuid": "6ac82b30-a3cb-47ee-aac8-d36c33440b23", "comment": "Malware payload (Mirai)", "value": "289642b27377a96a604aac2225f75f0c23142e75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654663, "uuid": "3deb1c9c-d072-4915-abae-3519a750ce6e", "comment": "Malware payload (Mirai)", "value": "0ba26475d424d697f4af83d1e68201ad52d0924af02c117c7e3e4c6cddfb987b489ff031ad815a93da508b9cca2d1fd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654663, "uuid": "f25f7468-4a56-496d-8b15-d4b7715c25b3", "value": "T1722308C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654663, "uuid": "002a7cc7-0d82-43d3-8408-04c6c44fd031", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AG+1pa/4Qw7bn2iue:Gv4QPfZfW5XTOeoEzG0AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654663, "uuid": "b669e51e-5e54-4cc0-ad95-451f356a9986", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654663, "uuid": "5a610057-eb59-4e2d-9e8f-6f11bd5625dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654663, "uuid": "912fe663-ca29-4e5a-b646-6b687f6c4804", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cee7e1-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625400, "uuid": "dbfabcf0-c8e2-4580-bcce-7039ddd11e28", "comment": "Malware payload", "value": "8087589616a6bb60f476abeff85aeeb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625400, "uuid": "d24343e4-6f14-4c2c-a5fd-adf16915852b", "comment": "Malware payload", "value": "45e74be9011b06a1325ed2d26c65b1ac89c3574af88e59df748eccef5cad41d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625400, "uuid": "567e6deb-08ac-4359-812a-474cfd6ecc34", "comment": "Malware payload", "value": "4a50a5bdba521eb10c0e8ae84f722c301afa0547", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625400, "uuid": "24a86f9f-6fd3-41c8-8848-5fb3d4693ed8", "comment": "Malware payload", "value": "5c4c51e91bd146df3a8698a283715263b4f4d1c6204d6cb1d3c5524ccb3fb1d44ff345ad3ef4cdd7a58e8ba95a7a387d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625400, "uuid": "dd1b3efc-4a77-48d5-b14a-d719f15de7fa", "value": "T19C14AD04176CB916CBFE8A3940611235C6BFAF5E2EA1D7078C44745D6E733F20E267AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625400, "uuid": "7131c53f-3f53-4349-8fb2-7708c95a5898", "value": "3072:HuQfre4QrSCvlE4W3aOzmJIvX6lvTtEdA:HuQfrex/WqQmuvX6tyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625400, "uuid": "c3d50b5d-4ed9-43fa-9790-dc060974a9aa", "value": 206640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625400, "uuid": "568f6e77-a996-46bf-ab39-1423d5826aa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625400, "uuid": "afcb5422-aeac-46c4-8e50-ab63b2de01f6", "value": "45e74be9011b06a1325ed2d26c65b1ac89c3574af88e59df748eccef5cad41d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a93ddae-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625410, "uuid": "6bb5622b-77d4-46ad-8c85-c4cf9c98f0fa", "comment": "Malware payload", "value": "ecb13418d209631639f3e4fb378e940e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625410, "uuid": "e62b83d3-a624-4474-b60e-fe8b74ec226c", "comment": "Malware payload", "value": "46b81c77cf9101e6d41ee948c1b935664680180129265cb83d11190e94c627fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625410, "uuid": "9b5b0b1e-9670-4d3b-888d-a97ee56f3641", "comment": "Malware payload", "value": "fcb44c7fe6ba186dff151b173628f33b1fa750d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625410, "uuid": "abf1b2e1-cc7b-4c3e-be7f-2a9a9e62a738", "comment": "Malware payload", "value": "0958d6acc24e97a88e005ceed185fcd58ace1ca9cb457a35f4579a9bca05d9f974315006760a8a5bc22f23c1a388b3b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625410, "uuid": "199d6dda-ad54-454a-b0c8-31a547493fb1", "value": "T1CC149D0017ADB716CAFF8A3550611234CA7FAF4E2EA1DB468C45745C6E733F20B166EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625410, "uuid": "e5be2e8e-aaab-4b10-8f9b-b17ab777233f", "value": "1536:UUAbnNfTlseXPifL5vhh7/K+oBK+m1pZ8cz4hhjMkavDMPzma6X5Dz60QvXTvOrf:+nNfMfL5v/Esy3aOzmJIvX6lvTdSOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625410, "uuid": "cfc15ac6-5aad-42aa-b388-e096574382f5", "value": 206640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625410, "uuid": "7afec9ad-ef68-4ce5-aff6-325df4fd5906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625410, "uuid": "89968ab1-fd22-4144-b6f1-611e866406d4", "value": "46b81c77cf9101e6d41ee948c1b935664680180129265cb83d11190e94c627fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13bde61-17ba-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1772622603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622603, "uuid": "6a9ba33c-6fcf-4175-ae07-57f46545c598", "comment": "Malware payload (RustyStealer)", "value": "bdba20a426886066fbac157cb730e45c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622603, "uuid": "743f74ca-1125-42bb-a233-63be2aa33706", "comment": "Malware payload (RustyStealer)", "value": "46cca8b88edb47de897bb0d1dff84691ff65bd55610f91f6f6b3f77739c423c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622603, "uuid": "8ac0260b-2b6a-45ee-849b-154bbbb76317", "comment": "Malware payload (RustyStealer)", "value": "3804c7e168789eea9e127faabf73e9759b29eb79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622603, "uuid": "b1df9bb0-f381-47de-9278-38a02b32bb98", "comment": "Malware payload (RustyStealer)", "value": "705a4f76ee0bd8fddbe93b3022a84dea42eeaca861bab78aee0f078b014cf3f060c145d4b70b9d2a7919f9559917f118", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622603, "uuid": "00c5915e-2812-44af-b908-a54037a538f2", "value": "T152858D03E69585EAD49EC07CC3579632BA32B88E0731B2EB27D58A253E27F805F1D715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622603, "uuid": "deaef64a-5a8c-47fa-a69a-0fbbd322eeec", "value": "4ae12844478ab6eaa6579760187df247", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622603, "uuid": "91e388cd-ab66-42a9-b71c-a4c394c3d109", "value": "24576:NgHQ357d0pLkp2+HXgV57W0RFDH2wM5IeQbrNwRYOFM3VIH06iyD:NgHQ357d0u3gV57WSD9eQIYYYIU6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772622603, "uuid": "90a9ac17-50ac-4113-992d-6bb1b0fbb6c7", "value": 1847808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772622603, "uuid": "1851ac1a-f4bb-4bf2-b952-738117f1f24d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622603, "uuid": "327d08fc-0498-4855-8679-8e66b1b64d14", "value": "dajoke2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8bdec6-17c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772624908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624908, "uuid": "3073aa0d-8655-4536-a908-bfdb1b3365e5", "comment": "Malware payload", "value": "543e9aaa45e11e7a6f86c80533c51bd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624908, "uuid": "18dbc8b1-493e-4d3f-8ea9-ca6e69e4bf35", "comment": "Malware payload", "value": "46fd65b08ea59cbfb5719ddcdffc18aa8d95ecc409260e3509bc33238c52c0b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624908, "uuid": "f4869b18-0fd8-4128-bed1-82b462f6bcef", "comment": "Malware payload", "value": "331452f387b3ac2cc7e324368d072c9fd8f85e7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624908, "uuid": "93dbfac2-58cf-4259-a6c4-ef6f62a3fe16", "comment": "Malware payload", "value": "450ccb32a117957b8d2d094911c11aad1274781a57797d429a48dc0cf9b1148fc86110c4c53b5821d229f051c6c1233d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624908, "uuid": "6e017f2d-b779-40bf-a1d5-c0c020210c1a", "value": "T168B63389F36101F8E96B913EE8D01D2B93D578B516B4C74666BC8B610DAB0D8FF18732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624908, "uuid": "94d56c64-1a62-4052-adf1-2b228d831c3e", "value": "c4af357571dd94ca1603cb9291e6416e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624908, "uuid": "ab715d00-6c84-41dc-9cb4-ba72bb1d74ad", "value": "196608:IzXMCHGLLc54i1wN+6CrRRu7NtbFRKnZMiJ8Q4Jkz9RwprI8N+mh1Sax/8EDqqa9:GXMCHWUjXrRQ7XbFsn6iJ1LwOixx/ZbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772624908, "uuid": "6d141cc7-53ee-4f8b-b015-332e8c895467", "value": 10672568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772624908, "uuid": "774dc5fe-11c9-4163-8d98-667f27c8175f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624908, "uuid": "29a01174-0357-4a18-a57e-e5100ab073a6", "value": "Ziplynew.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6439d5e7-17b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620755, "uuid": "35968ecd-55df-4dd1-9136-3501d372a462", "comment": "Malware payload", "value": "523c2f81b15a83e4e522bff691a8f5a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620755, "uuid": "abc538cb-812f-402f-851f-4db260105385", "comment": "Malware payload", "value": "4711c8bd09e0096465b3b9c88b28f213ac27aa91c7ea3655589a1a142ab9d8b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620755, "uuid": "67190ef6-a5ed-4ec8-aeb6-79761316c430", "comment": "Malware payload", "value": "5a4bbe1ace1cda92afea277f99cb859e8344bec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620755, "uuid": "de8c928f-55f6-4640-8f22-f2719a95e7e4", "comment": "Malware payload", "value": "a66f6328f6a1f044a6f0e8efd0e9adafcaffcfe93d90a1bbe72d3170ebe9a0186db817fbc4fb2346119dbd1a4e2f0c95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620755, "uuid": "b711baa8-0533-4eec-9537-36852be292e4", "value": "T176259D01B750A51CFA27FD78D0E2E2C243F1FC21A66ACB3F54B5355B5FA628F6811292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620755, "uuid": "e3c9b97b-1c93-4dab-afa5-ad27eff0ae45", "value": "24576:dxWcoBHhL/ktOV4WcoBHhL/ktk8DiIIUcox/mS8V81coZMMZVwccohSU:1SW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620755, "uuid": "ee90347e-e5c2-4984-8728-565de4648165", "value": 1018860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620755, "uuid": "eb9d6f9f-abee-47f0-b572-cb7cb2178c07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620755, "uuid": "0abc21cd-757b-49af-b3dc-420d38114d84", "value": "4711c8bd09e0096465b3b9c88b28f213ac27aa91c7ea3655589a1a142ab9d8b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81174c0-17b2-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772619285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619285, "uuid": "5ff689c1-bd45-484a-b80e-18b9cd6299b2", "comment": "Malware payload (AgentTesla)", "value": "63dcc14f91eec2890283df3c21f57826", "object_relation": "md5", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619285, "uuid": "9d3bbf6a-7409-45c8-8950-543ec659e450", "comment": "Malware payload (AgentTesla)", "value": "47d4c1b4495893f20967cbdc0383e152ab10043cde8d92f6d0d3519c95751ff1", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619285, "uuid": "a65222a9-83d8-4246-a716-53c543027ab7", "comment": "Malware payload (AgentTesla)", "value": "a531b4b4362b2e5b1f0094ac063fb1cddc5960c2", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619285, "uuid": "854658ac-7c63-4732-8da4-117b440963b9", "comment": "Malware payload (AgentTesla)", "value": "f7001e8eac6f232cec1e9baa955661d4b417acc8ce8adfd0c566846242e2553a447ab3cc09dd4730982218ab1e5eb341", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619285, "uuid": "a3c51d1d-3a55-46bd-83fe-b50ee66ee8d2", "value": "T195144B21DD35067A0F531B9DFCA60A628ABD8609823644B5F6DE431D31068ECE3FD7AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619285, "uuid": "7cc06d38-7055-4dfd-ae30-edd21711c3f6", "value": "6144:tjJJ6kZXKlVSXpPMQBU1sq6l8DLctGF8zgD/:VhXKlkyOSY4F3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772619285, "uuid": "eed3e6a2-bf15-4b52-a815-73d75766a35e", "value": 205294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772619285, "uuid": "2279f503-1148-4817-b9d0-50236e489f4b", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619285, "uuid": "9354b908-da25-4178-8959-444c6968da4c", "value": "IMG20260403-06310.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb48eabb-17d8-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772635531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635531, "uuid": "75a265e0-fc25-4007-b9b5-b3dc7a2611ed", "comment": "Malware payload (XWorm)", "value": "2d35f77e983586fecf3eec86a5cb13fb", "object_relation": "md5", "Tag": [ { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635531, "uuid": "a054614d-5277-4670-b3b3-a80ee2fe05a9", "comment": "Malware payload (XWorm)", "value": "48460bda81bba24e1712a43f926290914eedc199082646be4e076f4780a7e5ee", "object_relation": "sha256", "Tag": [ { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635531, "uuid": "98c755bc-bff5-496b-b173-05b70865e45d", "comment": "Malware payload (XWorm)", "value": "688b3c010b64dab02acda4c565db1e535a23e6c1", "object_relation": "sha1", "Tag": [ { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635531, "uuid": "7757ebc9-41df-40c7-ae53-edb82b9f5357", "comment": "Malware payload (XWorm)", "value": "5ec4b2cea4d3a7fcc4a0cfd74fcd3132cc5ae8baa48759d984bb9b975c40bf134ac3492373379c50c9d91736d02b433d", "object_relation": "sha3-384", "Tag": [ { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635531, "uuid": "d13cdd25-e5ee-4c1b-8bc7-3ff6a8a540b9", "value": "T1E3E19C5C8163C998E7C35A214B026410FF733A9C70589486CCFB482F58539FEAE55CC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635531, "uuid": "f84f1134-0eb7-4b8f-ad2a-3361a77107b9", "value": "48:9Jh/XBVExZl/nhh/W9ok41c1kFq/F1H5pibdeIozFtdVxJNEJ5CO6enaNAbAchxR:3hC/hh/yok4/45KdeIoxtdjNzZcvpHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635531, "uuid": "31be84c7-0773-4fb2-a88d-6a97ef5257a0", "value": 6961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635531, "uuid": "e4947443-d950-40ca-a605-1353fdf71db5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635531, "uuid": "d7af1e33-975e-4c2f-89d4-07699f80b7b6", "value": "48460bda81bba24e1712a43f926290914eedc199082646be4e076f4780a7e5ee.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba22e30-17ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772622593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622593, "uuid": "32c22b8a-390a-4db5-a6d9-c804c0617168", "comment": "Malware payload", "value": "9571d82bbaf8d0a6b8c71e5dc19304be", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622593, "uuid": "a5e705e7-e91d-41dd-87a4-cb68c9cac4fb", "comment": "Malware payload", "value": "4a7b11e680a27611b1bd7ff5894408d1085bc9f5ea47fbea8c28e2e191e8eb9f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622593, "uuid": "c5eb2c3e-b691-44e0-95f1-d5f7dbe8bada", "comment": "Malware payload", "value": "311533c486a79585d568cb610431d7700c802d3b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622593, "uuid": "e21010e6-61d7-40b9-b8a9-8cf1af112f7b", "comment": "Malware payload", "value": "8f36ec1146c1eeb83a5c4d7600e8a0b65599e0cbd12b825e120212cf533009c1f871baa8ff0348b9075545f9365295e8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622593, "uuid": "5995e91e-7a2e-4c7e-b756-230a52bb649d", "value": "T1B356F1C6F7D8A92FC8775072C9BE52B151874C028A839F836D18760C69BB5D42F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622593, "uuid": "9052fc47-bc40-4c8f-9273-08159d4f203b", "value": "98304:tWPqWAoTwrYMKOfsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpClt5:4oKOfyaIbaciAFvrEZpXqmY9XrF/mpCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772622593, "uuid": "1903a590-58e6-40d4-a554-d0956bf834b7", "value": 5925999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772622593, "uuid": "e27d5d28-5e03-4db0-9696-89a084710a27", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622593, "uuid": "980ca74b-53c9-44d1-9a04-ccbc5a148cae", "value": "Csplay138.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cf327d-17c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772624925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624925, "uuid": "8e5a9aae-086d-4ec3-b479-bb1108446a66", "comment": "Malware payload", "value": "4d9001d8ede0c9966ad98d836d438704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624925, "uuid": "40ed11d3-c000-4583-bcae-59755fb93da3", "comment": "Malware payload", "value": "4b928e46b3710fad588217645f4bc7079eef1ebb2b8d8c2caade21300e28d0d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624925, "uuid": "317ee0d9-2049-4c50-b37c-df26f8bc864f", "comment": "Malware payload", "value": "89c85e1e00a6eda01e5dc0c0ec355b2cb0c0942b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624925, "uuid": "0f0ee542-8c8f-4821-bf36-0ce357b225b5", "comment": "Malware payload", "value": "854fbc6734564e4d9536cc5a60196614fac0c7b8f638f3e2a74a8bdd323636d6f99f56f771c04a8f853cfd4ca014ebcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624925, "uuid": "6b71dc80-de9c-4639-9f13-f5c1faf23997", "value": "T1EE14AE00676C7416CAFE4A3A40611239C5BF9F5E2EA1D7079D46B44C6E733F20E16FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624925, "uuid": "4aa049e9-818c-47d2-bed5-cdcf8738a910", "value": "3072:U7Ja9Jb2REOZ1uHdEG+3aOzmJIvX6lvTpCp7nT:SJaz2Ch/+qQmuvX6ts7nT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772624925, "uuid": "b28b1ca7-e1cb-4b7d-b13e-a11ada5c1e64", "value": 207664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772624925, "uuid": "b6304b53-a2e6-4c9e-83fe-6295b865d8ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624925, "uuid": "1a239330-78bb-4faa-8b38-d14ca7d7393a", "value": "4b928e46b3710fad588217645f4bc7079eef1ebb2b8d8c2caade21300e28d0d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5a29b0-17b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620715, "uuid": "c1e5f97d-42cf-426e-9139-084069c6dc22", "comment": "Malware payload", "value": "41f53b3ed6c72b771a4b2fe292ae773b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620715, "uuid": "3928e7f8-e6a2-419c-82cc-4ac429b9101d", "comment": "Malware payload", "value": "4c08b8359b425e7242affbeb8e6dd36a5788406d08b59789085ab0d92244dc84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620715, "uuid": "856b415f-077b-4bef-964e-f8e7f96c5c15", "comment": "Malware payload", "value": "0acda9097a77f686f33a65d1b537af60178b1d4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620715, "uuid": "5ae9c6d1-9d45-4f3d-815f-77fc2087da54", "comment": "Malware payload", "value": "abbea6d94a9069986ed6a8fa3f2a6da9ab5ede05b3ebaa8a06f0719ebff8e812aa145e7bd2c4fa9147c38a12352a1f0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620715, "uuid": "0b8d0df1-0484-4d15-9aeb-45c39788d697", "value": "T130A48D02B710951DFA17FD78D0A2E2C247F1FC22AAA6CB3F587535575FE628F6811282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620715, "uuid": "f228cba0-0833-4ce5-8e0d-10657651e572", "value": "12288:aV487coBH6oxL/ktkH8DiII8vcox/mS8Vw:aV4WcoBHhL/ktk8DiIIUcox/mS8Vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620715, "uuid": "ce90dad5-d70b-4326-a7da-23e466c4cdc0", "value": 452304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620715, "uuid": "dcc626a3-6b26-4756-8719-7178302e88e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620715, "uuid": "5292e6c9-1287-4198-b677-c963a36b8266", "value": "4c08b8359b425e7242affbeb8e6dd36a5788406d08b59789085ab0d92244dc84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2d8acb-17b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620398, "uuid": "35888258-c681-405a-beaf-8c70db81825a", "comment": "Malware payload", "value": "09a0b6963fa3078066c8f3a5a6ab52e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620398, "uuid": "fc33c195-27f3-426a-9436-e8b707d32f2f", "comment": "Malware payload", "value": "4ca712ad7c96a0f63601a94683c530cfb44081be20f155be3f48be555c093453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620398, "uuid": "968ba3b7-968b-432b-b5a1-495302775b0d", "comment": "Malware payload", "value": "3e58390523156dd6660bd45325abe6079847236d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620398, "uuid": "86089bdc-7390-485a-89c3-9e90447ecd30", "comment": "Malware payload", "value": "05d5e10d10abd2f733ce58963db1c9df9dd80c88b026ac06ca799d4613b14fe709a7ab415137b4979ac558d299f104e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620398, "uuid": "692dfb5d-ef40-4b29-b3b6-1f88060652b9", "value": "T11F073389F73215E4E84A613AD5D9692796C238620BF1CB4FBBEC0F6105E72D4FE24B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620398, "uuid": "5f563b17-77cb-4ebe-99db-b7c057e6b293", "value": "c005b4cd3ff755ef7b24e8e7196f0aef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620398, "uuid": "2acb741e-dbc5-45fe-8d72-eba9ea6c09aa", "value": "393216:V9W8+XXMCHWUjYrRQ7XbFsn6ELwzr5Kdi71V24ud7cluzcGJZs4RLEQH:V9W8+XXMb8YrRQ766Sur50i71S7jznPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620398, "uuid": "0b3add04-249e-460e-a914-0929699b1f44", "value": 17140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620398, "uuid": "845500d4-30a4-4225-89f9-0c65129f4b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620398, "uuid": "5fa58cc6-8af0-42d8-829a-1a8497ad3dab", "value": "4ca712ad7c96a0f63601a94683c530cfb44081be20f155be3f48be555c093453", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9446f86c-17de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772638016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772638016, "uuid": "d5bf9a42-6736-4784-bc7a-f2d8d782cf1c", "comment": "Malware payload (Mirai)", "value": "bc795c1b1a180b0a0765e862e36e1825", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772638016, "uuid": "614f22e9-9f6d-4321-8695-505b3c4a7ff7", "comment": "Malware payload (Mirai)", "value": "4e48cfbe0e06248397d3bf13c1c4d3e0c5428fa09de5e1016e2bd9609b4fd0eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772638016, "uuid": "53fca32d-e447-40f0-8671-bcf6ca48cb3e", "comment": "Malware payload (Mirai)", "value": "6d88bcbdc1b61200d51c2d81813decf7e8b06194", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772638016, "uuid": "655ff717-4066-4b02-b587-57705f9d96d2", "comment": "Malware payload (Mirai)", "value": "6e746b49c936842509134f956ce36fa69bbaa99b6618b4a36df9b0d31a91f34fbc7d4e86bf67af8cb41b66c4fd3d7409", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772638016, "uuid": "4b3d1b6c-6a56-41f7-9540-9b8086baac63", "value": "T152732B22F3B8173BC0B0B57480776A137EE95A9E0960EB8FBD750D9ADD132D416277A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772638016, "uuid": "5e1ddf6a-1fe2-430f-a3b1-b723b949f0e8", "value": "1536:dtJKtT0rTgdlQQWTlAmMRlAsiyCvj1swUY8UTAJqU4XlAJfved1DsWxH3Yo48X:vItIrYQQW2riyCvj1swUY8UEJqB60dxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772638016, "uuid": "27568a0a-3442-4f5c-a72c-e7da40c0f533", "value": 77220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772638016, "uuid": "ba3c561a-68e3-49c1-8672-6f4f90ceb49f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772638016, "uuid": "24417321-8980-4e27-aa61-ea124bacf099", "value": "Polar.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f5159f-17c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627472, "uuid": "e285fa93-d59d-4f0d-a9ee-995563e6d54f", "comment": "Malware payload", "value": "ad98985520fe85f0b7757a8f345de894", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627472, "uuid": "b7243fed-ef39-48b0-a91c-a35a67830c53", "comment": "Malware payload", "value": "4eb184cca3e03bda20308e828afc53aa5e22161397dfe2c3f16092c3d2907b31", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627472, "uuid": "700c9b4c-36c3-42a7-b1cd-0aada533a9cc", "comment": "Malware payload", "value": "807bde573229b770884165abb9ecb746e4472058", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627472, "uuid": "c4ca4cb7-c99d-49c6-a3a7-1e23510152ad", "comment": "Malware payload", "value": "c05eda476c370fe8576f9604aa3f4cbfc91f99e43a817b88edcc43c0b952c3ec4ee4b45904d71f81ae80321cdeb3b929", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627472, "uuid": "508d0f4c-c156-49cc-acc2-f6b63367da77", "value": "T1FB31CF145BF20318F6F38B7D68B973108976BC86EE61CF8D01A045482871A10E9A4F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627472, "uuid": "88308ebc-a0a2-4968-937b-d9052a946342", "value": "24:8B/BHYVKVW4G+/CWVGZ6CeUMkW+IyRgYN7GSv/OJPtTkX1scuuGrab/Q:855a1peHG7QJPtTUHiab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627472, "uuid": "7f785f84-cdd2-42bb-953b-56d122867818", "value": 1480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627472, "uuid": "9e65e92f-022a-4f89-b9d5-623aa709c2ce", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627472, "uuid": "dccffe3d-5fd6-40d4-8a79-b9c25cd052cc", "value": "4eb184cca3e03bda20308e828afc53aa5e22161397dfe2c3f16092c3d2907b31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8dae0a-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602838, "uuid": "ff30c0c3-34fa-4276-bccd-1c15d92410d3", "comment": "Malware payload (Mirai)", "value": "43af08fbed8ac3f62612a41020020e10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602838, "uuid": "b4420db6-3b3e-429e-8aea-f46ed98f6f71", "comment": "Malware payload (Mirai)", "value": "50b10164dbda3797ba8ba4b29968d2c376701865a7fc621c5d24d523b8fd8bb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602838, "uuid": "996faad7-def9-43a6-83e0-0ba4736aadf2", "comment": "Malware payload (Mirai)", "value": "269a6bb9bb5ed4881939b63d33951c4c698816bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602838, "uuid": "903974f1-9999-41e1-8d97-54a4017610d6", "comment": "Malware payload (Mirai)", "value": "8513394ec7336e40c6c43fb81bd425f7d33fd2a2a4eb37650a5a8f6e0d41a493b14dff07c63f13d6fd48cf9dc97a5477", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602838, "uuid": "b9c203e3-151d-424b-9098-b67db03dc028", "value": "T11434F806BB510EFBD8AFCD3706E9070629CC641B26A53B367634D918F54B60B5AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602838, "uuid": "a03a7fae-6d6a-4910-8a12-56e4ee11522d", "value": "3072:s/+uE3KffN29BoLuPBxIbX8rj3BKUJ0LoyLltBk4:s/+uEcfNBLuIX8rtKNLjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602838, "uuid": "bf817b2b-307e-4a1d-b602-64ff60886327", "value": 240248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602838, "uuid": "fdc71e57-7eae-4b9f-b69e-8e5c9f3d0461", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602838, "uuid": "c8ab6094-4098-4edb-9085-de9499c25ec3", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3204e4-17c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772626540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626540, "uuid": "ab60c1cc-0ac6-45cb-b598-3c0c81689f70", "comment": "Malware payload", "value": "a494d88d211743076b87c71ff26b9fb9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626540, "uuid": "e8265783-024f-46f7-92f8-64bd4ad5c16b", "comment": "Malware payload", "value": "51af876b0f7fde362c69219f7dec39f7fb667fb53dc5fe2cbdf841d6c5951460", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626540, "uuid": "ca669deb-e4be-4245-b0db-bb29bdec7321", "comment": "Malware payload", "value": "5939ac61b4d9d4430ffaa0cf24df21588ffce88b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626540, "uuid": "139fb004-feb3-492c-8c8d-b963c963d416", "comment": "Malware payload", "value": "25c38ab70b5189f61b01df624b53f6f60a2b762838d0613460f391495652d949b1bc0c75a138a6cf2b2b3f66ba6b7d02", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772626540, "uuid": "c2d30548-e5aa-457c-8394-ceaf29bd5511", "value": "T1039302A2F4B632F6FE2042C2C86142D5050974E8E05AD41C6A8241FEA7FE775253E7DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772626540, "uuid": "8b5d3ed5-d2f0-48bc-82ce-cc01c99b4d8f", "value": "1536:GCdEkoQLQzkVC0mknya5RKZX04G9wS3+LDIzbvIi/jgR4V0+kfqobe1kgKj:GgszKC0bya5RKZkN9wS3cIHVRHkfvqJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772626540, "uuid": "7e1a1608-dd43-4f2a-a082-afd9adbc1e4e", "value": 95841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772626540, "uuid": "9e748980-c4de-425c-adac-329206c94407", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772626540, "uuid": "3e1004d7-7a48-45a2-92b9-c803f69bf6d4", "value": "Weapons requirements for the Kuwait Air Force.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f153773-17d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772634598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634598, "uuid": "97be2156-e2fa-4109-97c2-924d4d8dd263", "comment": "Malware payload", "value": "f77361d308b77729065922fbb8a1918c", "object_relation": "md5", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634598, "uuid": "6b89d41e-7088-4d49-b6e4-3e3eaa335a39", "comment": "Malware payload", "value": "51b98ab3d3055875b3b0ff3e235cbc4eb6cc1313d25a76f971c43899ee73d811", "object_relation": "sha256", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634598, "uuid": "bc889934-8ca1-468a-a16b-852dd4f05c3f", "comment": "Malware payload", "value": "2c2c0add6ea8dbfae6766b68c123eb0ef0160469", "object_relation": "sha1", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634598, "uuid": "3e10dec8-db89-4706-9104-e0b72b844a01", "comment": "Malware payload", "value": "38a5a5c43eb4d8bc1cf8d2d029dce0202ec496f66630b0396d19eda2427a2597f00a2ea36e159ff1807f21d30f8d5583", "object_relation": "sha3-384", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634598, "uuid": "90353235-e5dc-4b31-bd10-f6831f7a7b71", "value": "T18451DD252BF24218E7B28B392C79E355D536BC09EA51CF9E02A014CC4C74224F975F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634598, "uuid": "bb013009-3012-4823-9ad0-de8be41063da", "value": "48:8jUnmSaTrxf8mJoTKP+5HCfMIHamKoqYC:8wnkfElHCkoFKoqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772634598, "uuid": "6d70b12b-272f-4a78-a775-42f8a8f95c53", "value": 2444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772634598, "uuid": "46dfd39e-c691-43f4-862d-55fb6e8386cd", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634598, "uuid": "2b0236e1-8a27-43c6-aef3-e86bc68c6161", "value": "51b98ab3d3055875b3b0ff3e235cbc4eb6cc1313d25a76f971c43899ee73d811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c36150c-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602757, "uuid": "fa278764-8566-4338-9cb8-23d1b8edac9a", "comment": "Malware payload (Mirai)", "value": "a37a72bebc22a8d7aee9311e5360ae81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602757, "uuid": "de9d9e14-9d7e-4e50-8556-ccc8d0c65783", "comment": "Malware payload (Mirai)", "value": "537a21c61a29303415080eddab4a70ade4907f744422f35a7c407fc436d08466", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602757, "uuid": "7a805ad2-b18c-4822-8ffa-1b00fb274668", "comment": "Malware payload (Mirai)", "value": "111bb64699f50b493b9811cc78b13ab639b48d12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602757, "uuid": "750fec72-5f42-452a-a268-836d44d40c05", "comment": "Malware payload (Mirai)", "value": "71344ccd80b919f0a5252ec5058081ef892309c9f94105b6326683499810257b776195e4b805183d1f60a9c5ab583f91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602757, "uuid": "245c23f6-85d7-4ac2-8200-b190c2f6eb30", "value": "T1D38312C6A913B98252F8CCF0353EBB66DED44E38CA4544A782D6C4DC1EB58397AE7443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602757, "uuid": "9f9fc021-1891-438d-be8c-0608bd03cb15", "value": "1536:UbhowzM5PfD9ZyHzxzwl1gA7WYFmgdY67h5bXKnYMLn9f68E4BNIX5OTkkNPeS18:Ubnzmfx4TxzPAzkgB7jXKnhLnVZE4B2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602757, "uuid": "f5560684-811e-4246-a77a-66729d112448", "value": 87188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602757, "uuid": "6e8c6e42-057b-466e-acf5-30ba88edf2c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602757, "uuid": "2260cb61-bf17-46cb-ac3a-6a19dfa049b1", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1bfe465-17f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772645796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772645796, "uuid": "28379b44-668b-41d8-a7b6-03c02becd56f", "comment": "Malware payload", "value": "7fe9c031da6346b7d04282e414ec138f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772645796, "uuid": "2599a034-8f0d-4ad5-8b20-e3ad33febf30", "comment": "Malware payload", "value": "53de02dd0d20f3c8371f1a970be6fb1367d5e1b63d2f779ba15041991d450b68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772645796, "uuid": "c3eb1448-d8e1-4cba-95e4-a95253fb744c", "comment": "Malware payload", "value": "8697fa1223bca17efdcb25fc6a9682c96d7409e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772645796, "uuid": "a8f9740a-d6ef-450b-98dc-d5ab556fd0ba", "comment": "Malware payload", "value": "28c99364afaeaf598c7c9bc732d893d1adad6f6e23d6625c0d34a2095576225b6ff249ef75ab4ed0f521f4c3c613c0f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772645796, "uuid": "f50f5367-f736-47b1-93ed-b8564b5b2a75", "value": "T1BA087C42A3EA05D5F9F79A3489E65213D673BC063B3082DF325C172A1F736E08976B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772645796, "uuid": "68dcf162-088e-4508-924e-481e98da5042", "value": "8062a445f5cd940b5daefb09f80bc2a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772645796, "uuid": "0b2caa31-a1a1-442e-ae86-ca0e635001ed", "value": "393216:F9UZyW0PYsIUmgB9S7QJrojJgVXIXT9fN3aoIKF1H5XMutmnnY4nZFUT7HihCLJz:FJX3mcLmSh81vxOtxthy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772645796, "uuid": "f8bcbb99-a0ab-4427-bd46-e386f1750d23", "value": 82109952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772645796, "uuid": "bb8bdc29-55b8-4136-b0d6-c0be904a3608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772645796, "uuid": "08d9c1b4-4fc4-45ef-940d-5f6f3539cf5e", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e24749-1793-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772605863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605863, "uuid": "52f801f7-317c-4704-8908-0677ab9eb55f", "comment": "Malware payload", "value": "943b0456be9b37e6c5cb0d0b1047136f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605863, "uuid": "5815ddcc-b82a-47fd-a011-e251a56acc31", "comment": "Malware payload", "value": "5464373da26631be5139073bb85bbaf877186f368c61eb1bf58d6926d0c3ab43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605863, "uuid": "6fa8410d-44b5-48e0-96c0-892db4237231", "comment": "Malware payload", "value": "b11a9985a7cf0be796e3e1944487c47160b3a81b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605863, "uuid": "5b8c570b-c92e-4c4d-8d3c-61971fa9d558", "comment": "Malware payload", "value": "717d5b928b0c86a3e4be0b8f0ddafe6590c2ef396c46827517160fce3027dee07e4879c26158a2c6ac23a58e7cf567a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605863, "uuid": "816aec67-cd0e-4961-9cb4-54a69f9c6728", "value": "T1F165224C1B08CA07DDA55B791A71F27807BDADCEA801D3278FD8BDE77D92B151848392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605863, "uuid": "9aecf62a-9bec-48b3-9691-402038064ddf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605863, "uuid": "8f1df706-232f-4c12-bd82-14d69b06b5d5", "value": "24576:LXflKR5qSnH8O71NWqAnPAHrUuciy0jX0Z3avYc6eaZuVHxoSKOI5aOxB:xc6Nngbjvr0dX3U6vU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772605863, "uuid": "3151778a-a9de-404b-84de-e21152df6cbb", "value": 1434112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772605863, "uuid": "5f4aeca1-a3db-4ddd-8d43-f49c757c276d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605863, "uuid": "a2d3afdc-c23a-40ad-9f8c-a6116d697c57", "value": "SecuriteInfo.com.Trojan.Siggen32.26905.8826.12265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42317462-17d8-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772635301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635301, "uuid": "2b618add-329a-4682-be63-a48e93aaf61a", "comment": "Malware payload (AsyncRAT)", "value": "2d6ce617bc36d5f7f470e5317a5482ce", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635301, "uuid": "1983c970-00a1-4fa5-8011-79b732c27d57", "comment": "Malware payload (AsyncRAT)", "value": "548964a6ea3d573cfae71aa5e2d0edde949075f80fc323c6432e96d2ad55b80d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635301, "uuid": "47f900bf-ad03-4ab5-a14d-3c2133d150dc", "comment": "Malware payload (AsyncRAT)", "value": "9f73a2fd0303e21602bf53580f583ad598dea502", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635301, "uuid": "9e7aba6c-29ef-4522-9ac7-74a422221297", "comment": "Malware payload (AsyncRAT)", "value": "add395c71da794e72c58c63b6e2f885cde7ae1ef37a95fed11be0bf3350618b3a4db3052b406864aeb43d0a63d689eaf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635301, "uuid": "3dc8ebf2-a50e-4441-b33e-58c55f6cf457", "value": "T166F24B0573E58665E1FD0B7D5C3686044376FA478D22DBAE2EC450AE2A237C8CF24BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635301, "uuid": "b29c6c4d-5e34-49bd-a1da-dffd1eb2c3ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635301, "uuid": "359ec1b1-93dd-4141-a00a-192273a87f0a", "value": "384:FMThWnP16fSAp0hOlE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCrxWWrEQ+:FihWPwfSAuhx1hV4RbJwB+WWYwQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635301, "uuid": "3c88b616-7d95-4a14-96e8-cdfc45be56d2", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635301, "uuid": "fe6147ce-640b-4fa1-bbf6-628abffd298b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635301, "uuid": "5ba027e2-5d5d-452a-b4f6-129e724097ef", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ea4e68-17de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772638173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772638173, "uuid": "33035050-db3b-4413-bad5-ffd7c5b1dfaf", "comment": "Malware payload (Mirai)", "value": "5e6b9f878a9b811a31096dc530654332", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772638173, "uuid": "0311fdc9-c315-413b-af94-6217ca9bf651", "comment": "Malware payload (Mirai)", "value": "55da8e0c9e5ddccd0b17cfb9fe04867f5583e1f04d7db76960a8c3df060c0b04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772638173, "uuid": "82ba0f8d-8d1b-49a2-87d9-a57a36090134", "comment": "Malware payload (Mirai)", "value": "70a8f44df05082e4ed763f8b3f6282d45ee042ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772638173, "uuid": "8b169d1c-2257-4dfc-83c0-0ae29b58862d", "comment": "Malware payload (Mirai)", "value": "08d915feff76c68b856a888da8cb915b3e784ba6aaceefa49a35e1a05bf7f8a9271ce9cf9cb433453bf0b03d74ff6b6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772638173, "uuid": "d10de3a5-d69a-472b-9226-0b93caa0a70a", "value": "T1214302B210678940C9F296BD253B73410508F374358CCA6AAFDC2C58A82FF2B677979D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772638173, "uuid": "2f423eb6-14c3-4ff8-a5fd-45acd9ef9a39", "value": "1536:ssWkiKoqvshGpwwURz2URVG7aLI4nouy8tyssK:1W0FYSUK7aL7outBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772638173, "uuid": "d24e7e40-5061-4b05-b1ee-35b733af08d4", "value": 58068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772638173, "uuid": "3b3b1e7f-daac-44b0-8c1f-a139c0166380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772638173, "uuid": "fb4b7930-f314-4f5c-92f6-e6d092431c7c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a227ba-178e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gunra)", "timestamp": 1772603440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603440, "uuid": "bf425ee9-51f8-4176-80f6-790772202a78", "comment": "Malware payload (Gunra)", "value": "182024fc6c5fe0b1b33fdd9c7c37e368", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603440, "uuid": "2c4b74c0-e6b9-4b19-920f-9bdf7b5324c7", "comment": "Malware payload (Gunra)", "value": "5677dfad26045e271272bc98be2fd24e2f6d13737850ab1d9857fd58de05e9f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603440, "uuid": "743f2980-c7a3-4e89-ad1c-076c9f35ce95", "comment": "Malware payload (Gunra)", "value": "b75596415398073aa4c050cdc2f83861b8b90ee1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603440, "uuid": "5ba3575f-8970-4fa4-a5cc-9ac007f4f463", "comment": "Malware payload (Gunra)", "value": "ba3bbf62c20d474738504848e85e681d7d0833f84028b9c57c6ca8aa562369dc41a1432efba508592b19d05937aa9cfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603440, "uuid": "7e0952c2-0954-49b6-aaf5-b27eb2a06276", "value": "T11C835A02B6A1C4FEC096C570879FD127AA36BC8423217A6B37A47B742F36E611F0E755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603440, "uuid": "8b5b1646-f961-4e4f-8def-58ae69d6efe3", "value": "1536:+Ut1Ygs3HDN8nNC55qwcOWWjVhBDy/X0IUwcKnorVV7:+QYgsXDN8N/9ObVhw00QVV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772603440, "uuid": "e5df5d73-f914-480e-a5fb-274109ec185a", "value": 84512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772603440, "uuid": "34a1f738-7076-480c-903e-083c487d4291", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603440, "uuid": "1ce3f77e-f526-444f-b5fc-70f199a259ca", "value": "build_4vHU_eBN.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5458e1-17b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620452, "uuid": "5db6c77e-bfac-4d48-8a00-25a344f73fe5", "comment": "Malware payload", "value": "cc846ab50b74c1a4b1a39bebb7f851db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620452, "uuid": "ba6e44fa-79d5-4b5c-a012-9fcb8e93253b", "comment": "Malware payload", "value": "57d30a9570425dce79df6322cb72147940cd866ce3d3d31d97358dfd63b97650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620452, "uuid": "8f89c492-7895-4538-914c-d719e3d1234c", "comment": "Malware payload", "value": "b3069c8793452a0451bc8cc14e88536027fbbad9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620452, "uuid": "4c68b86c-3f83-40d0-b508-ffb63457e80f", "comment": "Malware payload", "value": "53369b09bfd17938f8ef896cfd5d1b766feb2fd21e663cfdb091191807a8e79000f94c507d754701e66864e9bc8ce06b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620452, "uuid": "9da37bee-9d9d-4124-be07-f7b2a2ddabda", "value": "T126073385736009E8EDA9A23DC4D52A1FC59278D61BB4CB4B5FF846A10AE71C0FF18F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620452, "uuid": "000739b9-f229-43bb-a40a-e4d0fa00be40", "value": "c005b4cd3ff755ef7b24e8e7196f0aef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620452, "uuid": "61885751-b125-46d8-8325-57ab743a5d48", "value": "393216:Y9W8dqCXMCHWUjYrRQ7XbFsn6ELwzr55xcsR9FfxQ5OHqsfRzQICZSdZq0K:Y9W8d/XMb8YrRQ766Sur5UsbFfsOKsJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620452, "uuid": "d1e96c3e-2a8f-474e-8c86-ef755f99543f", "value": 17145944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620452, "uuid": "18c4a9c4-2bf4-4909-9e32-54bc07c994e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620452, "uuid": "a2dfb361-d903-43a4-831e-167547c65ef1", "value": "57d30a9570425dce79df6322cb72147940cd866ce3d3d31d97358dfd63b97650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8a55a0-17d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772634349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634349, "uuid": "7cc3b458-bb00-4cb8-ab3a-d4fe52b5d86b", "comment": "Malware payload (Mirai)", "value": "abc5b26bfe26ebe22baccc229aa526bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634349, "uuid": "0c7a542e-2b8e-4890-aa26-68598741946b", "comment": "Malware payload (Mirai)", "value": "58c19ff70d5aa42de12550893b06726298e7e0f6e28364a4eb81590bb6699ad3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634349, "uuid": "1c4c36bf-61b4-4b07-952f-811586dcfaea", "comment": "Malware payload (Mirai)", "value": "8560416c24d7c78b211777818f764e75d5cb2c5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634349, "uuid": "e6c6c0c8-a24a-4397-a389-ecf95d6966cf", "comment": "Malware payload (Mirai)", "value": "3bfbd43748845031566e9039fdf7fe09df2a29d260f1238d033ad524dd5948814c9eead5ed5282386bf7c3068fbf61a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634349, "uuid": "42a328ff-bc39-4870-86cb-c93ddf7f05e7", "value": "T1AC13F1DBF433FBBCC979B7B258AA66B43C2289046EC65779068533DE8CA46152E31C40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634349, "uuid": "e3efc31f-15ac-4826-9aba-242b975f29a3", "value": "768:qfkDAxZGiI4T+/YzlteuyfRpzmevvhIkQKjFfVKU40ZNWkfjv52zRNmdZx0F1:GpgiI4OYBteuupzmenhIkQKjFNKUVtQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772634349, "uuid": "848685e7-6114-4761-8287-7cca2d4b3df4", "value": 44736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772634349, "uuid": "e669555a-d690-4fe2-83ce-42848feca203", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634349, "uuid": "54f8b514-b953-4883-a1fa-5b179af7b6bc", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81102af5-17e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772640990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772640990, "uuid": "1396e716-0bfb-4b29-b4d2-540118466138", "comment": "Malware payload (Vidar)", "value": "e68d10a217264d024aae9a12381d6c31", "object_relation": "md5", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772640990, "uuid": "0d4c5219-43bf-471c-8cd6-75e5aa8c93de", "comment": "Malware payload (Vidar)", "value": "5923bca62a5df9e12255a6726bccbed3fbb84ba59385cc21d07cac986b2bdcb4", "object_relation": "sha256", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772640990, "uuid": "f2797654-f708-4043-b63b-b40a1ebedb07", "comment": "Malware payload (Vidar)", "value": "9aed1470763fb79c5378115eccdd643d9aafbcee", "object_relation": "sha1", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772640990, "uuid": "dd70ffad-3791-44bd-87a8-f7b652f68aff", "comment": "Malware payload (Vidar)", "value": "d766882a449509e239867a5fb2c856993a56ba572c0fbd5aad33e0be7f4fc6a33c4f9a8b4a795e75dce68fb4b092c5c4", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772640990, "uuid": "b4ef9192-a3c4-4052-9b80-dd543c31debf", "value": "T1F5C5330283E7932469236A75B09B2FB1A7605C855663FC47D4C9E3B65BB33822CCDDB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772640990, "uuid": "0b1d35bf-8f06-48d4-92ca-ee5865810661", "value": "49152:Y3hQNCTu5G+wsCj+U4FOv5Pu1pQH0p04eNvpNAYcDTrRpAaxoiCZ/DdYJvWX1nFI:ZNMu59wLNAG5AGA0drAXDnRyziCxiFW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772640990, "uuid": "b9965bdc-0c2a-4487-9257-a1b51e22508a", "value": 2683737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772640990, "uuid": "cd6d627f-1cd7-4ce8-bf15-ef0dc356570a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772640990, "uuid": "f926be43-522a-40a5-b911-e050240076c4", "value": "Executor_x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9881a0e4-17dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772637593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637593, "uuid": "fd3e3189-cd9c-4691-bef5-8c13be9e31ec", "comment": "Malware payload (Mirai)", "value": "985abe4c1245f902db8d4acc127f107b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637593, "uuid": "3bc0319d-ef49-41a4-8888-9649f7d8340a", "comment": "Malware payload (Mirai)", "value": "596a2797dfa0342cd84fe9661272be831309b187591669ece24514b9a23fbfd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637593, "uuid": "22f7e5ad-d472-4da3-80db-8e5f9f8cd80a", "comment": "Malware payload (Mirai)", "value": "47d114ca0ac7d2e59fcac65a421a3cde9a02e339", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637593, "uuid": "b7d0d8cc-b21f-40d3-9148-1a56a842999d", "comment": "Malware payload (Mirai)", "value": "5b77c732a9670deaf0019761541a9a44fd3575f0f2a8bec065bc598b0f2b3d8ce7bd7784fff519bf58fd1d839811d282", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637593, "uuid": "d3764771-41a9-49ca-91bf-44f8d3412371", "value": "T16EF37C62C870AE98C6258574F021FE3D6B539AA645871FFA199BC7714047DCCFA0A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637593, "uuid": "f44c2d7c-a06b-4c1f-9a2d-0a4692b26e3a", "value": "3072:nqRlminee0PIMHsx42zEbwbL/AOXc42KAlWCSIHMLgB:nq3GLsoEbL/3C3QCxMLgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772637593, "uuid": "1ca60252-f50b-4a1e-83fd-6f7d1fcf8ef5", "value": 157540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772637593, "uuid": "6bf75baa-183f-4850-8999-ebf181f25797", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637593, "uuid": "bc4120e8-a7c5-42cf-99c1-1a376fe72234", "value": "Polar.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac08b663-17d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772635049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635049, "uuid": "941edd06-9666-4d04-94b6-ce30e16d32c7", "comment": "Malware payload", "value": "97a92d22cd919804c2d4f88be59efda4", "object_relation": "md5", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635049, "uuid": "b5897680-4f13-4e55-a22c-92821f050b68", "comment": "Malware payload", "value": "59b21cf7580f69cf05843c0ceab3eee4c3faaa376a24b3bbde046fbc42f25ed6", "object_relation": "sha256", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635049, "uuid": "f571bd88-54f0-40eb-82cd-6e3282bd9cf9", "comment": "Malware payload", "value": "40e69b59bd7b1546a09df4098543f9da6f589e3f", "object_relation": "sha1", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635049, "uuid": "b6fef14f-300a-4790-a06b-8893dcd680d5", "comment": "Malware payload", "value": "07c5525caa2b8641390d5216eef14cd3af669ecf1ec6e76b22ef5191961f27651340657b8379d12807b0f04722a05c60", "object_relation": "sha3-384", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635049, "uuid": "81287ea9-9f46-47f1-88e8-685c62203eca", "value": "T15C519B212BF24218D7B28B392C7AB365A536BC05EA02CF9E02A0548C5874624E975F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635049, "uuid": "d3d24896-f417-4c4a-a869-d93182a77aa5", "value": "24:8jrDmi4728Dx6dAKd6mW8pl3mJBWLp+/CW3H+pUP+JnUMkW6d+/QT4I02xab9YKx:8jXmiUrxf8mJoTKP+pH+fMIHamKoqYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635049, "uuid": "20bc9577-ed61-4900-8a0d-7ceb719fd731", "value": 2444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635049, "uuid": "ef72d07e-bca6-48a9-84c2-aec330f52167", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635049, "uuid": "47a5989f-02d3-447a-830f-23ccb3f141cb", "value": "59b21cf7580f69cf05843c0ceab3eee4c3faaa376a24b3bbde046fbc42f25ed6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e387a891-17bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772624834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624834, "uuid": "0cd455c7-e7a9-4430-a1fb-189b3513b195", "comment": "Malware payload", "value": "89ac357c271f5e69cf8347b827e5ed25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624834, "uuid": "befa3a5a-e4ab-4784-a2e2-bae0c55804bf", "comment": "Malware payload", "value": "5a72de81072ba0f674bef14f7eb4b97703fa18e6ed61a94b653ebe888b6d7ca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624834, "uuid": "0728d14e-57c3-4f72-8730-3e5670e5f731", "comment": "Malware payload", "value": "e03f15bc17edf0d5c80ed352d24ec145965aeb32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624834, "uuid": "eeae7066-290a-48d8-b502-899bf9deecd1", "comment": "Malware payload", "value": "b7ba4686082d9ba231d9849fbfbce5dbe9660e093437ecdb3c3df4c684e81b65248e18e05449035ab54e5e8e32875b11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624834, "uuid": "3bc9d7d9-6799-4585-968a-12df90c4f910", "value": "T157738D0937BD0932DAAF9F7628B69A410F32B216EFF0DB4D1CC850C95C57B455A023AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624834, "uuid": "67caadc1-bb21-444b-bcbb-d98119ccc8d2", "value": "1536:LNznOqUEu61MCt2q3KpPFZDMFvujLqZcEmDvTWX/Vx:LQlNhqUFZzbEmbTWX/Vx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772624834, "uuid": "142c3ffd-ba9d-434f-a7c1-1787f4e5e3d8", "value": 78552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772624834, "uuid": "c8af4010-377f-40b1-8392-d9b9e267e096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624834, "uuid": "f7df1a28-4887-4f1a-a406-98542f35ce67", "value": "DailyFileApp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35613087-17aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772615523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772615523, "uuid": "e5635c7f-c8ff-49f0-83d8-9e48bbe048bc", "comment": "Malware payload (Mirai)", "value": "6ad01fadf2a50f5a78b1c0964e4bccc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772615523, "uuid": "8be24dff-b254-45bd-be46-1029d4461911", "comment": "Malware payload (Mirai)", "value": "5a883f181447faaf82ebfcbfd91e49a979e3e6db9c41e954f9af79f5a1b691f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772615523, "uuid": "2ae17408-f5c0-4a9d-be5b-626bfdbd706a", "comment": "Malware payload (Mirai)", "value": "63b0853a9f8c3f2af2ed204dbe27a0b4def70b3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772615523, "uuid": "d9b89b3e-fe54-4c84-8ac9-3d7173760a02", "comment": "Malware payload (Mirai)", "value": "e653118cdae075b83b9af1d2634d5c22c26b87005b7e7723225b00734a17440a9a128122f59eaf3fff7a175857e5bd07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772615523, "uuid": "273b3cd8-568f-4436-9dfe-d794481849d7", "value": "T104731843FC81D906C7D013B6BA6E61CE33116399E2DE7207AD216F6436CA91F0E7B295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772615523, "uuid": "2bda6a4d-ffc3-4124-84ca-d85ddec97b3a", "value": "1536:n2j/RjASjzCTuaIGZ9FTU5yjL+5DmFBM2Irzy2+469b4MjWDF:n2tFjvM9tUSymFm2IL+zZZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772615523, "uuid": "3371b30d-a49b-4be3-8930-d6ccb4cd9775", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772615523, "uuid": "f6dec89e-e866-450c-89ed-881297d01f5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772615523, "uuid": "dc9b02b4-3f4d-4af0-b5f7-2bd9b2001b1a", "value": "nullnet_load.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1c6b04-17b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620772, "uuid": "7c52584b-4324-42e0-89ce-1a63f916c16b", "comment": "Malware payload", "value": "19e005957d6d72044c123d5e09b33aeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620772, "uuid": "c7a7ee9d-c410-4758-a80b-f145deba0a2b", "comment": "Malware payload", "value": "5befc94dbb8eac229080e390c57bcec95b2145797d80f629d2e85e373b7907ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620772, "uuid": "658d3ea3-0dfb-43ed-863c-6798ba422e9f", "comment": "Malware payload", "value": "a6868e178b55ba790da2c7622cb81d86ddc49ebe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620772, "uuid": "505ada9c-cb69-4a0d-ac1b-c1e0f6b81e0e", "comment": "Malware payload", "value": "cc3b6f64058c78d96296539e50650a8ecd0bcdf0429e938db4824077fbee0816870944f6bf228bec7118cfc806816d14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620772, "uuid": "b3f7a464-b6d5-4ac7-8a4b-414358ab98d1", "value": "T181258D01B750951CFA2BFE74D0A1E2C243F5FC22A666CB3F54B5349B5FA628F6811293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620772, "uuid": "f8f3e57c-10b6-465f-be51-cc18968c1d4b", "value": "24576:TxWcoBHhL/kt64WcoBHhL/ktk8OiIYUcox/SWEVH1coZMN0VF7cohyQ:TXMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620772, "uuid": "292aadbd-af1c-4fae-9c84-c4dd40139554", "value": 1043436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620772, "uuid": "38596d4e-91e1-4abf-adbe-e59b9816c094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620772, "uuid": "62c98d08-683a-4431-8d1e-f32fd1f19f70", "value": "5befc94dbb8eac229080e390c57bcec95b2145797d80f629d2e85e373b7907ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039cfb65-17c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627465, "uuid": "8f71457e-42a0-4a4f-b89a-ffa7d46fc2f8", "comment": "Malware payload", "value": "38ae7e96acb5b16e755aad554a72046c", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627465, "uuid": "3d0b259b-803d-409d-9d71-8760f4d17a84", "comment": "Malware payload", "value": "5e21ea4e4320fb4059810f4489520e1a13b28efc311d9a75a0a5713ffe8a2488", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627465, "uuid": "07e97a4a-9027-4895-a169-fea6e0810eae", "comment": "Malware payload", "value": "c61ffdace9cfb4025c1da8774d2d3ad34ce36aba", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627465, "uuid": "ae8fccb7-caf3-46cf-8c9e-0bd7f848073b", "comment": "Malware payload", "value": "3e999b76b3b286000414e92664f804aa29d3d1b6c0e28a5fe710b81ee96bf7445fc12e3bf0de063fc9ce9f5289e69a97", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627465, "uuid": "7cd9aff9-3041-4cc9-9fc9-1638a4ec6b53", "value": "T197B6339D2DDF80E6D8C118B0D72B6BE723F395D748C58C72AEC13449A0B3E76A05B496", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627465, "uuid": "e7d86e87-a49d-4f2c-83e3-60dfdc3df95f", "value": "b648d0285161201dd112b3ec198f540c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627465, "uuid": "cfdbfdb0-900a-4b5c-b44c-9afe53096116", "value": "196608:TxApxcQqfNJc1D3q2Pg9k1fbOo1ToFT7XM9C8BSMhYdhXb+e2ualI:ivWjcxZY9k1DOo1T6TbM9jAr92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627465, "uuid": "4ed140e0-119d-4b12-accc-1771e44becfd", "value": 10645504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627465, "uuid": "a34cd08a-3de5-451c-8d93-15bc1c04aa7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627465, "uuid": "c260b80a-5354-4f2f-95ea-71c32a40651f", "value": "5e21ea4e4320fb4059810f4489520e1a13b28efc311d9a75a0a5713ffe8a2488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491d62bb-179f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772610831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610831, "uuid": "5ad7f427-79fa-436a-bd8a-fa2f57326afe", "comment": "Malware payload (Mirai)", "value": "01a07201f7c203bfb6bb78724a18c065", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610831, "uuid": "a08adb00-60d5-46c9-b58d-a516698226e5", "comment": "Malware payload (Mirai)", "value": "5eba349021e95339d69fc905707f5be3b7876fb5f74bec0a65bb520f52ebf0f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610831, "uuid": "ff80c412-342b-47bc-b749-b5bcdd72138b", "comment": "Malware payload (Mirai)", "value": "cea885ef24d032a05eb07407893eaec965b663c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610831, "uuid": "c9283d37-214e-465b-9d33-47f84f818a6f", "comment": "Malware payload (Mirai)", "value": "08187eff1219499f74ff44827004e9579d66899d525a412fcd3fc312b4fcecdac96ec568b86ba95b1620a27ae50496e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772610831, "uuid": "17a0e176-080c-4441-8674-c56679b14077", "value": "T162736C86E757D9F0DD060AF0217FFB36D93698363224DEA7E7C4F857ACA2542901229C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772610831, "uuid": "32e85902-8c73-4ce2-a4f5-9c7099dfba19", "value": "1536:x3eUfjQijuY1feW/yE8DidLHSKKfnaQ8D2gt7:x3xj9TeBuLytfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772610831, "uuid": "92e5d1a3-771c-4f9e-ba6c-40ad6511d94d", "value": 74716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772610831, "uuid": "ffb85ffb-1acf-4eb2-ac1e-a33a7b163cf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772610831, "uuid": "c520c3a2-1852-427d-a21d-a743609f118b", "value": "nullnet_load.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee69ef5f-1764-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772585768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772585768, "uuid": "e4cdd45d-1a79-43b9-8df6-69d1a365c938", "comment": "Malware payload", "value": "72e5a454f80dbad3e20de0f4459df310", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772585768, "uuid": "9fd0fc38-48de-494c-9f06-94c866ca17db", "comment": "Malware payload", "value": "6026b0e13e2a89fd097922634879e2b002769167f40a01c97e0f9390f41d5747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772585768, "uuid": "a4a29b4d-8ddc-421b-811f-12a12b47450c", "comment": "Malware payload", "value": "4427a7b2046b12b17e8b7f01de2164f4a2c1370a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772585768, "uuid": "ab82fb22-1b60-4d4e-aa4d-de40d65e01d0", "comment": "Malware payload", "value": "453a327c5cdcc2cd22adf77a0011cc649384bbca070504319a7df87f8c397591d0aad17cbd08d362833fee8d2e998f3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772585768, "uuid": "5d571f16-6232-4c9a-9935-cdd02efdc3d9", "value": "T1DCB5BF43F39D8368D17369388AA3D362B3337C815B21928B77A015689F972E05E7B7D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772585768, "uuid": "376ff861-0136-4582-a003-aab660e83b48", "value": "a44b5fabcf1d85685d70c98db3914587", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772585768, "uuid": "048ba023-b409-4754-822a-cdc44cc84c7b", "value": "49152:qSN/vxn5TH0v4UIm/aSJi1byw+NXqBVeP:/bI/aKwK8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772585768, "uuid": "6e7854b3-d74a-4cad-844e-f4f05501548d", "value": 2342400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772585768, "uuid": "f7fe4f86-eb12-48fc-aeac-41bc0927ed49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772585768, "uuid": "dbe07241-8d04-4d04-9e22-dcde8b3d0d86", "value": "2g8ih9pv8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9c0e86-17d3-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1772633087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633087, "uuid": "853ebd07-0437-414c-8810-2b05000cd227", "comment": "Malware payload (GoToResolve)", "value": "7ff4e86d5dea2840bae7141d66bbba0d", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633087, "uuid": "592c114d-ed50-4165-81de-5c4b22ed441a", "comment": "Malware payload (GoToResolve)", "value": "60c0a42b8f0a12f279edd2d77ba8a90c4043aa4beb638440d9737824ed21449a", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633087, "uuid": "4418158c-dadf-4e6a-a668-6c8f1b7f7f97", "comment": "Malware payload (GoToResolve)", "value": "37ddea59248b49e3c1083c54d75c7008dfd91a18", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633087, "uuid": "de2b95d1-8999-43a2-9699-79fa5d8ec037", "comment": "Malware payload (GoToResolve)", "value": "51552bb7ff4d2a941576d9a83a18e5b62c26b17c66e48e7ca6a5dc51d4ba7f467871b7e4063e3418958290e813ac729c", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633087, "uuid": "afaf5625-0e38-49b2-a574-87e97f0fc494", "value": "T1483733207649C171F53E10B289286BBF427D6D320F6580DBB3DCFE9A5B312C16B36A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633087, "uuid": "24e31b1d-77be-4bde-9b8f-9a4e1b1f986f", "value": "393216:ru0G/h3+M0v1UuQHRTRGH6JHfTF7UY+/kqFj4eFSmJlVvKneUdPlZQnl2H7gOnhI:S0GF+Mm1UuQ3H/T1uThFJll+eUdEnwHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633087, "uuid": "6c1beaba-9d89-4dd7-9c05-57b8e5375f0d", "value": 24530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633087, "uuid": "df275fa9-3331-4599-b5ca-14cfa82b60e6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633087, "uuid": "9d837a1c-9e69-4010-a851-050e174684d4", "value": "Or\u00e7amento2026.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c90968c-1791-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772604905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772604905, "uuid": "99817216-ee0e-440a-a1f0-83e9489a58c7", "comment": "Malware payload", "value": "5dae43b0c4aabb21260cc13e12e03d6f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772604905, "uuid": "9fb64287-c1c8-43e2-9bb2-4dfcf0cb7d73", "comment": "Malware payload", "value": "62a4f09495a81884ad87dc082ec2e5a911d17c69adfdb3b858c77517ee168504", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772604905, "uuid": "65ab571d-7615-487c-b110-48c61f28d6bf", "comment": "Malware payload", "value": "c21ade1da0a493edd8b171d6d9c44b5d309b4281", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772604905, "uuid": "eeb98744-2285-49c5-8b1d-ec900b64da29", "comment": "Malware payload", "value": "3ad5898cc69523ab073e9d51891875bb331d2f59a13a2546ce45e6a0bf5a87fc9167b09f36778fdb5615017a1d8afd88", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772604905, "uuid": "41cf1808-58f7-4965-9cae-7eb25ef4c7fc", "value": "T1F5A612223982C533E57F03702929D76A42797E243B7344EB63D86E3E1E716D19732A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772604905, "uuid": "207e3a44-6c06-42be-b000-219c3d5c7205", "value": "196608:a0XbeH9fYSCgXJiOqKkaVtck4YkSQ2zFQ0xdeW3LGOQ/HCoL:a0XStPtiOdXcPY3f5HxzGO+HCoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772604905, "uuid": "27a1acd9-ae42-4481-9a64-e855b2ecc513", "value": 9532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772604905, "uuid": "4659679c-a693-4f6f-abf0-1b98eb7005d3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772604905, "uuid": "b310b464-1d86-47f7-b26d-7fe992a515ca", "value": "MpAsDesc.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deee177b-17bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772624827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624827, "uuid": "4afd6a05-60d0-46ab-8d72-5a7c4fd3e1b8", "comment": "Malware payload", "value": "efae6cf53911165004ba68e7b6b0c266", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624827, "uuid": "6f20155d-f9fa-4a94-959e-ecf5b60a37e9", "comment": "Malware payload", "value": "634c1a011e3b938a4fbdcdecb9733345c160565a74630e5694162629ba5d4b1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624827, "uuid": "253a4c3b-ecc9-4966-8c5d-16a32a629227", "comment": "Malware payload", "value": "a073493f56288640abc8ff6cd5cff158da669d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624827, "uuid": "806086c7-76e6-4a6c-979c-052f081513f0", "comment": "Malware payload", "value": "942f8e7f1821de6e0c374614d0a3342ed5b931b86f07c692ce5fd5ea5f4bf44b13e1b4c38f2a29a6807793710db6895f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624827, "uuid": "ec532d54-524c-41a4-a1fb-5e811ef43a81", "value": "T1D6E56B2577C47D12DC7B0E325D25B4C4FF630D23110A662E308C6E670FB7A9356ABA6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624827, "uuid": "b9b812d6-c457-49bb-924e-c8ddbf35e302", "value": "49152:4/Resx89UtDZHWCyeJoSGi+zBWjY4skffnXzVc96Hq921KOCvbRwPMzuCLj63:4hxHDZHWKJei2Mjjs2lQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772624827, "uuid": "aa464148-90cb-4364-a9ca-44175dbccc72", "value": 3046616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772624827, "uuid": "432f113d-1525-4a50-8154-752ca5cb52d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624827, "uuid": "f09f49c8-2524-4fe6-aedf-137d8dcdba6f", "value": "DailyFile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5eb29b6-17d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772635978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635978, "uuid": "e2c2d4d5-9148-442f-a3d7-cb5aa3c1075a", "comment": "Malware payload (Mirai)", "value": "cdb98d06cd836d4b929de87f43288676", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635978, "uuid": "6d2d1e58-2528-4b27-9cc7-d92a00aec0f6", "comment": "Malware payload (Mirai)", "value": "64c2813297d0cf94cee79df1a896b620dcad5e97e127659b7d227e7a49509b53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635978, "uuid": "2965fc8b-1e28-4d57-b6c9-25d642f2ed16", "comment": "Malware payload (Mirai)", "value": "1d41fd0a32f0b1ca8d62e135f204bfd78c766606", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635978, "uuid": "d51063fa-b325-454a-a815-2b86aaccc347", "comment": "Malware payload (Mirai)", "value": "828aec519cd6c6f000eb414cbf24cf0b47bb4e0c185bd927995b8066ef835b5f81d121f96a40e3af1467a3e29b8c0a98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635978, "uuid": "3acf1c23-532f-4a8a-b91d-be0f208dbbf7", "value": "T1FF4302AA21F4D50CC7AB51B68059BC5F0100E6ADD0085ADDC7C0B4DA985BBF1FB8E5AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635978, "uuid": "440a9363-05c4-4a44-99b9-fc127e51471b", "value": "1536:ieExpj7DSkBfrVPtZLmqMnDj4IauWjcySnouy8tyU:ieExEkBfrptZMtapjcPoutR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635978, "uuid": "3dd512f6-b024-4584-9d13-57b2532728fd", "value": 57132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635978, "uuid": "6450e0e6-732c-47b8-9155-dde0cf459621", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635978, "uuid": "e916e1ca-e571-4202-b6c2-2b56166183c8", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcdff22-17c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627858, "uuid": "c6bfcaeb-95f2-4659-9e09-2bf94fcea177", "comment": "Malware payload", "value": "23f19858146c3e8bcbed70d5e4851f4c", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627858, "uuid": "b65fdec7-1384-4462-b300-e8fc06d6628f", "comment": "Malware payload", "value": "65336d043397311f7995ff147fdc769bd8f6ac49ad8d09b4e716adeff560ec5c", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627858, "uuid": "e56c3a37-6d88-4246-b17d-26c915dbc8b7", "comment": "Malware payload", "value": "93c07ee80a6a99453c51370c20965691f1c36a7c", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627858, "uuid": "da1b7b96-8a73-412b-9c79-b2491391caa6", "comment": "Malware payload", "value": "224d013e410080129c77b0207be65a5ca711cb4e093ef7374db7c693bcefc918347a5c1891db1f5a236d6f167b7007db", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627858, "uuid": "19d19280-403f-44ad-a50b-75c7a640a5c4", "value": "T151E5178DDFC9AF6BCC590772DCFB17A43435C2CA2B478727262984703D523E94ADA609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627858, "uuid": "dff75350-9e78-4b13-b064-5c0bf01a8d1c", "value": "49152:QZQFWx4zJOSFeBS5vDrFZQFWx4zJOSF+BS5vtr3g:oaNrBaLr3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627858, "uuid": "01459c66-8ca7-47af-8978-eeb81fa28246", "value": 3242424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627858, "uuid": "e238235f-2076-4ca8-906d-829d5df242f9", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627858, "uuid": "e130b888-0031-4ae6-a41a-ac330619d8f4", "value": "kakkaa_puolaan", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223f66eb-17d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772633959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633959, "uuid": "f233dfcc-52f4-4847-a150-d1f3b3720062", "comment": "Malware payload (Mirai)", "value": "a5feba06cc665f2828a0ffd6ac6046f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633959, "uuid": "899ca5fa-f5c3-4e1b-bac8-79322ff43a6e", "comment": "Malware payload (Mirai)", "value": "66658b564d53cf87b99e2364fa8caed242a5266faaf149fd06fd19af1db38a46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633959, "uuid": "4bbe278b-277c-4eda-9dde-f494977120b7", "comment": "Malware payload (Mirai)", "value": "37bfb20c9f278004b42f8bd74871ea2ae3fedb1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633959, "uuid": "5a35d892-8b91-47d1-b4ed-ef6e30657842", "comment": "Malware payload (Mirai)", "value": "6cfb09dea85b917d0a45ab24171f416fbf0bffe9919da41dd09fa7bb08ae087ab606cfc8c6b81c80c37682cff67a1992", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633959, "uuid": "b384e92e-eca4-4cd9-958d-00347d899ad6", "value": "T1C5932A51FC815723C5D122BBFA6E428D3B2613E8E2EA72039D215F2177C791B0E77A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633959, "uuid": "d813d677-24bd-4992-9ed6-ef613dd6c034", "value": "1536:u8kNq4rZYBRMvCFqgkCKyFpC7U/E/WwxPvPCKdiSqvP8Ipm:1kNq4rdEk30mWkKJkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633959, "uuid": "a608a909-bff0-437d-973d-c18eec59b89b", "value": 97352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633959, "uuid": "bed11742-cd9a-4f70-8855-2bd450675478", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633959, "uuid": "1a055892-dcff-46b9-ae3f-439102689104", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9d8d89-17c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772624928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624928, "uuid": "7b2e8f40-94c2-464d-b77a-ffbfb965aaab", "comment": "Malware payload (Mirai)", "value": "70ce60c2281ecb037f99ed133ee177dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624928, "uuid": "8f8dac04-388f-4db8-898f-82cd186a986b", "comment": "Malware payload (Mirai)", "value": "68266d997d36066164d6efd898def7b86ba3e52d63062a7d712db4aeac32917a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624928, "uuid": "412016df-5675-407b-b09b-894ffa41ac95", "comment": "Malware payload (Mirai)", "value": "825a52dca3ccefb0dd4b9f32d8486fca67f8c76f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624928, "uuid": "7d3f6c7e-608f-4647-99f9-14523c0f8695", "comment": "Malware payload (Mirai)", "value": "a562e0b0fb9a94940b65061d8332d4064b9f8e8bf8f02a7c4d2f6e518496da46dd65f6fb9ddcc1c8686e1fe183f33a04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624928, "uuid": "b988d348-94d6-47f7-9e7e-53398ff3d38a", "value": "T1D8144CC7F800DDBDF80BE37A44634905B130B76254931B3B6257B96BED3619A0963ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624928, "uuid": "8d45e705-381d-485f-a7af-c7f4ccd891f5", "value": "3072:CQFk08N9JHTRgGAw+re/QIb/SCV5M0eogv15MVtjbinLNfhay0cn7kZ:VkNvHTRFtb/Ss5DM15dLNUy06kZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772624928, "uuid": "ffa57ff7-f2b0-4788-8703-82703ce89b6b", "value": 193472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772624928, "uuid": "bfe2b8ab-0fc7-4128-8919-6d99b2a74f56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624928, "uuid": "1dc867b5-73c4-463c-ab8b-eb6bae7d11c2", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799a3434-17b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620791, "uuid": "a67c3a0a-8120-4925-bcb1-e74aa233dfb8", "comment": "Malware payload", "value": "631f72db4b562dacab700d3e1fc484eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620791, "uuid": "e2456532-bca0-4823-a980-66ca4f9ddc4d", "comment": "Malware payload", "value": "68bd8f2a2cafe4339a208e9f6d9a8f4fa870a61a378ec3783a4887da3eba6615", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620791, "uuid": "19a87239-e1be-4cad-8576-28962a56e38a", "comment": "Malware payload", "value": "2725c36744afbd98cd5f7a14d105eeda9b9887c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620791, "uuid": "ef7481f6-4fe8-4620-8112-4b67650031a9", "comment": "Malware payload", "value": "76eb11083fabf800d7d22fa1701d1546900f2396e7d33ad41af8cc5c4b3f2e30e6aa8f84cc8bca2ea2eb5e095b64f0c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620791, "uuid": "ff7be6c6-bfda-4a19-ae14-5f41caba87eb", "value": "T16A258D01B750951CFA2BFE74D0A1E2C243F5FC22A666CB3F54B5349B5FA628F6811293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620791, "uuid": "18aaed5a-7a6d-4abd-8ffc-ce6a6ef1d91d", "value": "24576:uxWcoBHhL/kt64WcoBHhL/ktk8OiIYUcox/SWEVH1coZMN0VF7cohyQsVV+:uXMWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620791, "uuid": "a1960019-f47a-400a-8fba-52f60e674cc7", "value": 1044688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620791, "uuid": "819727dc-4e8f-4749-863f-42352c83f1a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620791, "uuid": "1553ce2a-7158-4820-8609-841ad88767fa", "value": "68bd8f2a2cafe4339a208e9f6d9a8f4fa870a61a378ec3783a4887da3eba6615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a7fea3-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625645, "uuid": "17e994bb-4daa-4c94-977c-44262bf7c262", "comment": "Malware payload", "value": "07909a2e4a8f1bfc7a7f2e44e557a7e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625645, "uuid": "295e309d-124c-429d-9571-f3775c9ee65f", "comment": "Malware payload", "value": "6a37a5396c9b58f2e4f4d25269525c8af0c56b3c5f15000ef20f935f95718113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625645, "uuid": "2ff53aef-1f48-4a5f-b41f-a3feaf8091ae", "comment": "Malware payload", "value": "6a2b4dff121944cbc04ea3d7e537e3fbee3510d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625645, "uuid": "0d5fd955-cd94-42b3-a41e-2868b40d3b1d", "comment": "Malware payload", "value": "80a813153be84881aa63f7e81069ae1b8d3b6a737e8c890d3855f02708eb6d478fe841719f4904aa3af0158e24e10052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625645, "uuid": "94cd3022-d66f-47df-9c47-a78b1eae7ec6", "value": "T157827CA2CF640913DE968F36B4D59A125DB4B7438DE5CCDB614E81060F803426FE677E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625645, "uuid": "e4294530-1c1f-4b58-ac74-c6067c1d1e3b", "value": "384:/B2/7PtfrxUI/uo6ki2uMp2Ninw780SJIVE8E9VF0NyH+D:/BkFUhr2uC2knCG2Ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625645, "uuid": "604b881d-d571-4fc8-a978-e923fdbe6c5d", "value": 19240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625645, "uuid": "f4543305-626b-4b13-bb98-8c6da6499050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625645, "uuid": "8b0fcadb-bab2-40b4-851f-6a4db8e8295a", "value": "6a37a5396c9b58f2e4f4d25269525c8af0c56b3c5f15000ef20f935f95718113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9373a4e-17c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627448, "uuid": "f0e2d227-4376-4cfd-bc19-2d77e43268e7", "comment": "Malware payload", "value": "b1c2e98b674c1293ea6d75d830aa313b", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627448, "uuid": "aa5730e8-97c9-45bb-9fd3-dc9c77291647", "comment": "Malware payload", "value": "6b257b52ae1d137f742331041b439802f970b827cd1c883ddd6a189585af5436", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627448, "uuid": "19ee3aa1-0310-43cb-b817-ec9d3888b097", "comment": "Malware payload", "value": "779a01d66b87ace0e8128b206ce960b32f32b4e3", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627448, "uuid": "3f742bf6-18fb-45dd-a04b-2f2572c2cddd", "comment": "Malware payload", "value": "ed36a9bccd37b8d79741abc9f00554253812e043ea45d354ecfa13c013f5254201ac689842a695a3c13521a33a1ae6fb", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627448, "uuid": "207591c2-48ef-4a2f-8f0f-a42d5823a448", "value": "T1D531DE105BE20318F6F38B3D68BA73148D76BC86EE61CF8D01A0554C2871A60E9B4F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627448, "uuid": "b92a82da-949d-4de1-87fc-28b31333ce28", "value": "24:8B/BHYVKVW4G+/CWAGZ6CeUMkW+IyRgYTtHOJPtTkX1scuuGrab/Q:855aapeHGVEJPtTUHiab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627448, "uuid": "a66a24c4-5833-45ae-8808-d7dfa88f78c3", "value": 1462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627448, "uuid": "3abbc156-6694-4eac-8ce7-b7aeb2f3883b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627448, "uuid": "df254aa4-1e63-432e-b165-0635d85c0547", "value": "6b257b52ae1d137f742331041b439802f970b827cd1c883ddd6a189585af5436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e732c8c5-179d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772610238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610238, "uuid": "17f39a98-0170-405a-91bc-5ca4a7033d7b", "comment": "Malware payload (Mirai)", "value": "52805c0ef68ffc27f114963a8b28e295", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610238, "uuid": "ab03b595-1199-468e-b132-6afbf407dc85", "comment": "Malware payload (Mirai)", "value": "6b727573a20e52183dd2921068626f205bf9abef811aa17f1493ef0634a6ac97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610238, "uuid": "8e1e2c39-70e6-4c4c-892e-bba452467caa", "comment": "Malware payload (Mirai)", "value": "3420a656eca4e5ac1d80f3f0f26698cfc016bd0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610238, "uuid": "d97fb746-d742-47d0-8b18-e76c79824898", "comment": "Malware payload (Mirai)", "value": "30e16495fb70a2504b67244a6bb9728f776fe2611407b66c185e76bb6b0f608a8571ef2fcf3bd858262b7a5e3a9deccf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772610238, "uuid": "d10a9592-3111-4525-aee7-429ae2fe1561", "value": "T126735D99B4019F7CF95BC9FA41260D0EF82163065A830F27B767FE936CB20959E07D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772610238, "uuid": "5c86d745-6e04-4ffa-b123-f3fe6ca809b7", "value": "1536:JlzxW7ZB12jUPl6TwVmjA+mzNZlBTrx8SrEQfj:ANB12YPUT0XPlB/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772610238, "uuid": "822501b7-b74a-4197-ba44-ea956929f047", "value": 74592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772610238, "uuid": "cdcd1920-b6c5-471d-b71c-5a73dcdf31fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772610238, "uuid": "ab38a481-f4a6-4a88-a814-893bb5fba68c", "value": "nullnet_load.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77817ea-1808-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772656087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656087, "uuid": "f131b3e9-07d3-4e71-8481-1579f11d6a94", "comment": "Malware payload", "value": "f963c64b6bd49bdc625c51adcceb3e1f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656087, "uuid": "8a5ad8e6-def2-4588-b4d0-fc7cf38b7bcf", "comment": "Malware payload", "value": "6c3a3b0cf41d37f75d3883c26c9dac8fc9b08a4c87ecf719caa6263ea5395e4d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656087, "uuid": "400b3f8f-15a8-4da3-ad27-0f33163d6843", "comment": "Malware payload", "value": "7b458c253dc45938af0e8be1ec72cd97becaf193", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656087, "uuid": "6382f6b8-c3c7-4c15-a078-6424d20be048", "comment": "Malware payload", "value": "1fdeda20a4b00aafa570a059924a99585dae733e427a55b9c4f4594d3ac512d62f67e9786ac4a16a6fffa469bdaf2eae", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656087, "uuid": "9c8da3ae-6703-4a8d-b670-97ae3d218c30", "value": "T10031A0111BF20328EAFB8F395CB673218675B906DF658F9F029051985574520E879F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656087, "uuid": "0708279f-eb7b-4604-876d-9acc713af7b8", "value": "24:8dwdmGjMDvSwjKUaWU3AcPWkp+/CWxCeUMkWx3GRnAH4I0WK6c/6Cab7Oa7m:8YmeKpUQYeHJ3GnIA6q6Cax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772656087, "uuid": "063edb6b-68d4-4a7e-8f4e-56507782fdf1", "value": 1543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772656087, "uuid": "9b834845-536f-4a4a-b66c-eec12c851231", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656087, "uuid": "4de68e80-7c55-4b09-94ca-b862beb6a468", "value": "IMG-463417090.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57d395e-17c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627844, "uuid": "56857296-6bb6-4011-92b4-de1d32bd4023", "comment": "Malware payload", "value": "242341a776aea09b128fd306b3a63d3a", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627844, "uuid": "381b0c96-b410-4b82-9335-2e99c07f5cb3", "comment": "Malware payload", "value": "6f0e8713ff4143f107aa610252aff265035220c2b10ce2023c942d9df7565bef", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627844, "uuid": "20c83500-e07e-464a-ae96-370c798b7279", "comment": "Malware payload", "value": "cc298e78a2e6a996f9da83423c7c142d09f3074f", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627844, "uuid": "29f7b149-d55c-4430-8be1-ddf6dfff578d", "comment": "Malware payload", "value": "67a1a22545bcd5ac1c74a245a74234689a60818cff99b5930df79a1183e6f80fb38c8284bf2065d69c3f4850cf255fd4", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627844, "uuid": "797c3f26-1993-4d8a-9f3d-99b3c991ab48", "value": "T10016E48DDFC9AF6BDC590772DCFB17A43436C2CA2B478727162984703D523E90ADA609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627844, "uuid": "f6334667-64b6-4554-94ab-023a3d75ef4b", "value": "49152:/5fA6y78Q2ATZ07mIEiniEW95vA6y78Q2ATZ07mIEiniEWY:/W7SESA9m7SESAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627844, "uuid": "327b1ea7-72b3-4d70-8f60-e03db84e1ef5", "value": 4328440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627844, "uuid": "6de32958-f274-43aa-8c2c-0b560051c83e", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627844, "uuid": "d5162846-416f-40cc-a5d7-1a818992c9ce", "value": "helper", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec5247fc-1765-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772586194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772586194, "uuid": "ac3cdcfb-aac5-4472-8c31-e4e790125d87", "comment": "Malware payload", "value": "ba32e8d2ac8609225d199b2e35982d30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772586194, "uuid": "fff4c7bd-b33b-419a-ae8f-fd8e6a454a28", "comment": "Malware payload", "value": "6f5c7dc9f3abc08e0fc987ca2c7b2a6e7ea4c52d9819121a66b25eb2b004bdc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772586194, "uuid": "611fa032-1db7-421c-9eae-45b00bec841c", "comment": "Malware payload", "value": "c4d782a8505ad253b5cdefd769ef9ad33610e548", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772586194, "uuid": "314bc839-841b-4e17-ae91-095d80555368", "comment": "Malware payload", "value": "998459438958dbeb47bc4a589163d55686cb035b8c134fe6523ef3c6c8f764f75e5e9da1f436b7ca23fc16b6815e03d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772586194, "uuid": "42457ee7-70bd-4e08-bec3-8be12f9f56ba", "value": "T135861213A5CD23FDE06A89354E72B950593BAE70A51A8C739EE07A4CCE390511D7FE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772586194, "uuid": "8e5ef7dc-1ec4-43d2-8a0a-dfd7280d3e1f", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772586194, "uuid": "4d034107-fe71-400c-8262-f8c2b3f5741e", "value": "196608:ODbsdLhyrc9OcgG5SFYZxGkGapbHkStjpliFviBLWRz:ODYdLhyrc9ZbpGgpzk2jbARz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772586194, "uuid": "19726e81-f471-400f-9f28-7519f1ed7e28", "value": 8408751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772586194, "uuid": "dc130410-38bb-4348-8b86-ff9db3f5f775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772586194, "uuid": "61220e06-a8df-44f1-befc-9f6b5da5f306", "value": "SecuriteInfo.com.Trojan.Siggen32.27366.1141.23602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ab78e0-17ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772622586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622586, "uuid": "e2f2e121-d60b-439a-acc4-0d104fedfa4e", "comment": "Malware payload", "value": "d097c1f489a9062cdd1d61100c6e6ae8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622586, "uuid": "38f7dde3-4008-434f-a4c7-cb02325e693d", "comment": "Malware payload", "value": "6f5f2fe579dfeee04901aea62e1a167b3399877b74cbee1d291dc94eea696ce9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622586, "uuid": "5d165b42-e72c-4cc0-9920-fb5cfebff8f1", "comment": "Malware payload", "value": "3936e9d57bfa7f8df008bd7ca33b3b638b0f61ce", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622586, "uuid": "42059e60-2994-42df-9471-fe61fbeeaba5", "comment": "Malware payload", "value": "eabb0f569be2d80c330508219f2935eb75956a9a883e379543a1d9f70766ffb620f9b3306bfa927c1f45f44088814aad", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622586, "uuid": "a1dda567-ba21-4c98-ae67-c7b85219d299", "value": "T1F7E62341FB59EA1ACD77C433CAA5023792954C0C9263E31B14A9F26C8EB7AD05FC5BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622586, "uuid": "e8361e0a-ce65-4727-8240-63e7d1b04c1f", "value": "393216:ja09593oHlGqyjFjg0y6tXMaCpEz/Nvb2BHBBoJjZI:jl3oHghM0y6eJ+lv6Bvo3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772622586, "uuid": "ddf556c5-df21-4e01-988a-b22e303be3b0", "value": 14676628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772622586, "uuid": "6153f7dc-e11e-436a-9cf6-d6a3b51e4264", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622586, "uuid": "0f7e44f3-7992-46bb-9759-5037c110a086", "value": "AlaminTelecomV1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501ae248-1810-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772659376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659376, "uuid": "de5c97ec-7358-4941-a629-7830a08d3731", "comment": "Malware payload (Mirai)", "value": "201db602dc4b2daac8106f9fec39811e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659376, "uuid": "576afcc1-1f73-433e-aa79-94c8223d6664", "comment": "Malware payload (Mirai)", "value": "6fcbaa277d7372b57d0cb8b983253822e89adebd43a674feddb4a10240bcb63b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659376, "uuid": "6543fe4d-3199-44e2-9e31-ec8321350875", "comment": "Malware payload (Mirai)", "value": "31e468cf5fc340452252bffc54dce2e8207febab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659376, "uuid": "49c680e5-c9bf-4bc5-b8de-b1acc232a724", "comment": "Malware payload (Mirai)", "value": "cfaba92f22f9099a98e67cf511eb8312edfcf3cdc4b54e6f649b7c412875283691ffd9c1ab858933ee660310c00fd862", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772659376, "uuid": "7e3f0542-0ef8-4a5d-9e59-2d8db3e81b81", "value": "T1F6E202583E32A974CF72DE38EFBD445237478BB5E1DC353B0201E4A87181E093676589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772659376, "uuid": "3d1365f3-41eb-489e-b568-b67d81ab600c", "value": "768:1+bJ1wV6/+GzCo6DCCbaxRHp8nmVOo+4s3Uoz0B:1eJ1wVQUo6jb8p8s8tzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772659376, "uuid": "02824b33-e146-43d3-a3eb-d3ebb264fb50", "value": 31748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772659376, "uuid": "2ea8120c-63ba-448b-b197-7fe7841d9776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772659376, "uuid": "0e45799b-94a1-4899-8a01-b35b9e76caa5", "value": "Polar.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e68dd9-17c5-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkMe)", "timestamp": 1772627440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627440, "uuid": "ecd355ac-1f6a-436b-801b-ecfa26446432", "comment": "Malware payload (DarkMe)", "value": "faaa9cd379ef636ed2573622583652c6", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627440, "uuid": "1a104ec9-9acd-411c-9c06-1388b83fbf23", "comment": "Malware payload (DarkMe)", "value": "6fd672394ebd20732ac4674d0d20fac849d24ee16590b436cca6e6afe94b896b", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627440, "uuid": "94fb2a16-8d67-40f6-a290-9b6b602cb0d3", "comment": "Malware payload (DarkMe)", "value": "4f757091043e81ee52e5ffcafc5c5f5b4b2b1329", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627440, "uuid": "3b3d7350-2cbb-4d25-9c9c-251fab1f2a8e", "comment": "Malware payload (DarkMe)", "value": "38adfac34080e403a5a6f5c7bd4c71698899025c6da46c581f9bedbf7608540c802c5af00eb3f46e07703d4234b16a2c", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627440, "uuid": "d01d80f6-c6eb-46ce-bd12-0340167c8db5", "value": "T168E37B1BF68185E5DA46093009A6C2F95773FCB6AF87469B7544333D2C36EA20C613AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627440, "uuid": "d275b717-9d0e-4ca8-ba4d-de7c140133fd", "value": "3e847ec4ad926dd89c2f4cb28d036c11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627440, "uuid": "0b72317b-d2ac-420a-8fc8-7cfafab67287", "value": "1536:X0a0PO/Ujf3OnwevbVfo9dPdb96r/NOZZsgRQeTF4A3WBVUue:EMU6nwezVfobPF3DSepsMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627440, "uuid": "7b47bdf6-8d16-4afa-8e2b-b04d98ea90cf", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627440, "uuid": "7e52efc0-2ee3-42ed-a94d-aaf6fd9e69cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627440, "uuid": "4c1c0d60-e0dc-4031-a394-aa2281f88da3", "value": "6fd672394ebd20732ac4674d0d20fac849d24ee16590b436cca6e6afe94b896b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b57a62-17d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772635144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635144, "uuid": "9ad8f9bd-a89f-4b8e-b41b-6e87e57b1d40", "comment": "Malware payload (Mirai)", "value": "d43620e2b295808c98499728cc7ae832", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635144, "uuid": "3cb516c2-8bab-4684-be1f-86efed1e99ed", "comment": "Malware payload (Mirai)", "value": "6ffa7b2ea0fa89619efea10133495b391b4a3a7f2dec6bd3974f81f0f2dd6562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635144, "uuid": "4f08df5e-4fd4-43e0-9479-9768c1573105", "comment": "Malware payload (Mirai)", "value": "a53c222817f6b78cf56fb33be913a348093e1f2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635144, "uuid": "dd7d2353-fafa-43e7-aec4-c6e9a1ddb3fe", "comment": "Malware payload (Mirai)", "value": "fce3a1041366187e8aed479aa89fe3443d5cf8697affc6c6b0e6e49a804b4d3302188126f26ab5d2eea45da34d01f10c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635144, "uuid": "a777e197-69be-4f8b-9a9e-b55a10badbd2", "value": "T1C314D70ABB510EBBD8ABDD3709E90B0239CCA54726A43B353674D72CF54A54B4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635144, "uuid": "06e58c9b-b261-424d-a272-eb54d63f748f", "value": "3072:CVcQwFO9bwC+LLJFcK4xwXDkpZs+6c7ffZ8cKB:CVcQwFO98LL14uXDIp33VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635144, "uuid": "f9a73122-6207-44d2-8676-2aaf07e6110a", "value": 209332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635144, "uuid": "2705e05c-754f-4d89-b2f8-1239d4b59393", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635144, "uuid": "d496bc7f-b231-4621-b0c4-e0f3b2c6383c", "value": "csk_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd124c9-17ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772616607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772616607, "uuid": "02f09993-8e0c-40f1-8760-626eebbb1954", "comment": "Malware payload", "value": "a93a4df96b5a31fb13ca88deedb836c8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772616607, "uuid": "d5b1a3e5-5640-4313-a1d1-43af5ac4dce6", "comment": "Malware payload", "value": "70eb6b852d2890d5e661dc8c4aeda067ffb604f392dd62de92fa325cfd8da1b7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772616607, "uuid": "6f1cfef3-a8a0-4320-985e-2a1714fc89de", "comment": "Malware payload", "value": "b3bf86128f89b224ed43b6795617dd96d1380bf2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772616607, "uuid": "a363de55-6a4c-4115-b4dc-4b8c92b49e2e", "comment": "Malware payload", "value": "066a327834286e0450b503e85f1cbcba0e2591d5e9fccea553cb58512582999c125f76f6ac2de251dfe764d78c6347c9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772616607, "uuid": "4d98bfa7-18d8-419c-a9b7-61312868955e", "value": "T15A45B8F0FA769454438E8B53006E4D6895C65932572DB2E130F71F8E1EAEC282A5FF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772616607, "uuid": "442072cc-a0e4-4684-bd52-c5d1a45336b3", "value": "96:mXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX3:2TipSNWjhHYmCg5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772616607, "uuid": "904e20b9-79c0-4661-9e3c-ebbba527f044", "value": 1236436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772616607, "uuid": "afef4e85-19a5-4ebe-a9a7-f84ef42d3326", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772616607, "uuid": "20a69fbe-1a2d-4472-bca0-96e448b0c92d", "value": "rRequestforQuaotation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fdb5a1-17be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772624275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624275, "uuid": "b5820a7c-3a7a-4ccd-a2f3-a28d3e41ec42", "comment": "Malware payload", "value": "8fdfef82503d153f3b9f5702e5cad26a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624275, "uuid": "c40f7013-5d6a-4e0c-aaf4-19a123b52508", "comment": "Malware payload", "value": "7112c737d9bbc46441932ca6cf7e5427fbd041f7883c3f3bee16ad2226841f39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624275, "uuid": "356017b3-6012-4ea8-b726-933a12906d33", "comment": "Malware payload", "value": "b9b0e5007318b7bb0b935662561b3ef76c65d08d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624275, "uuid": "26a118ba-cb51-44ed-bd15-6a36b9dbae80", "comment": "Malware payload", "value": "cc206a58a4e4ee941bff6520554d0116f7d8d97b6719da34cd375365f91e8581d8389dbee0403e2584908a6fac07b22f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624275, "uuid": "76b5120e-7bc8-477a-97a1-8fe7c836e4a4", "value": "T15C86115562E108E4E4E5CF3BC96181F5A3736F564614877A53BC3DF2FA32B9F082AA01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624275, "uuid": "7fa3734d-cd15-4d57-9a75-12ddf315a162", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624275, "uuid": "07364f24-628b-4a69-adbf-3abc7b446e33", "value": "196608:H8xc9VjA1HeT39Iig7auDXURuAGCTMQ4qn:cxcO1+TtIinuARuAWQ4qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772624275, "uuid": "59b95b6d-9f54-4507-ab9e-fd1530aa9f41", "value": 8140538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772624275, "uuid": "cb977049-0752-4462-a495-871e32b7316d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624275, "uuid": "3c7a1836-1cd3-4cd8-964f-97a46390c413", "value": "7112c737d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7ed9e5-17ad-11f1-a769-42010a9c0008", "comment": "Malware payload (OrcusRAT)", "timestamp": 1772616907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772616907, "uuid": "53957a27-1e0a-4831-b5a9-e4f28523c85b", "comment": "Malware payload (OrcusRAT)", "value": "5bd40c30c012e80e0d130f53ee231042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772616907, "uuid": "7b64c9c7-3c48-44ce-a026-f19b07bd7c03", "comment": "Malware payload (OrcusRAT)", "value": "7187957b04aa7d03fa88be6797e38d67a32565775e47090d18ef78cc4e004c89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772616907, "uuid": "a5d41b3d-8523-4662-88aa-ee3c61bffad4", "comment": "Malware payload (OrcusRAT)", "value": "58e3b4374ae5202ef45d75adc9a203557b9df3a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772616907, "uuid": "fc93d30f-46ae-4ce7-a593-9f30c1b0b6ea", "comment": "Malware payload (OrcusRAT)", "value": "4baee84d1dbf8f32547152620045b947277dee04b95a856c2b478fda38306a6df9f43646e7e20149744dd6011b9d229d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772616907, "uuid": "bbe3e6cb-7c3a-4093-97ad-1dec58fcd625", "value": "T1EB15BF013FADBD07C1BE2678B6731AC90BB8ED065092FB4E085851AD1DAFB01BD553A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772616907, "uuid": "294ff275-43a2-44ff-a9d8-7090f0e3dd88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772616907, "uuid": "d9d2a352-5fa6-4b8d-ab1a-444a86374e6d", "value": "12288:f8shHAVBuQBBed37dG1lFlWcYT70pxnnaaoawMRVcTqSA+9rZNrI0AilFEvxHvB+:03s4MROxnF9LqrZlI0AilFEvxHiko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772616907, "uuid": "732f771d-9f53-4e54-8bbf-ab0bb1dbddf5", "value": 925184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772616907, "uuid": "e86ef0e3-9dbc-482e-a3fe-954796b680e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772616907, "uuid": "af01c062-a26e-4823-91b7-f7e60247ea48", "value": "5BD40C30C012E80E0D130F53EE231042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4a76cb-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772625440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625440, "uuid": "0e9ac1e6-18c3-4d06-b997-a269856452f8", "comment": "Malware payload (AsyncRAT)", "value": "fece54d1580103b007cdb49249b0ff30", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625440, "uuid": "24130bb8-9d99-4265-9f86-d9067fce5994", "comment": "Malware payload (AsyncRAT)", "value": "729173e6858ee21a2fe1d8ecce166cb0da18540ac2095ddbafed48122228bb4e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625440, "uuid": "739a723b-7757-46a3-8c90-181696374ea8", "comment": "Malware payload (AsyncRAT)", "value": "bc37f83141c926f3aecee3eb99f93811f2851111", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625440, "uuid": "a298517c-616c-4336-b0da-1ea65d25a2bc", "comment": "Malware payload (AsyncRAT)", "value": "b42a79755a05239e752a56351e00c0c460ac14323315a87fbb0d9a6b1eca96f217d1d34da17f27d5f185d4e1ee02ad61", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625440, "uuid": "9acb3f35-9d8d-4734-8a62-28cb24a5e678", "value": "T16DF24A0573E58665E1FD1BBD5C3686044372FA478D22D7AE2EC450AE2A237C8CF25BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625440, "uuid": "032bca0c-013f-47c1-b9bb-ae35ae08927a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625440, "uuid": "a8f74d78-501a-4863-9e4f-a7e075bf8aaf", "value": "384:IMT5XY+17Ng15KhElE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfC5yWWlEQ+:Ii5XHRNg1IhT1hV4RbJwB+WWp6Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625440, "uuid": "6cfddd9b-7295-4185-b782-07594ea793ef", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625440, "uuid": "b3e3b8ee-d265-49ac-b0f7-48bab658c798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625440, "uuid": "b6a5fdcf-958a-489f-bbc3-bd28f5752e05", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50693df-1809-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772656620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656620, "uuid": "66e386bd-982d-4864-b884-bf6f492cbc2c", "comment": "Malware payload (Mirai)", "value": "79bcf60d79108738faa0562a8460757b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656620, "uuid": "7c1bae80-ef4b-4ee8-9b8b-7e89707a3cc0", "comment": "Malware payload (Mirai)", "value": "72bd73c0e12806ec9d2021304f5127ce19b7b39d4f87f52a06066ae92c32bf93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656620, "uuid": "4e2fdbdb-d2bc-4e54-9f16-08c03b22284a", "comment": "Malware payload (Mirai)", "value": "d7d94bb0cf211b376b74d1931918545085404047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656620, "uuid": "d8b63d57-586c-44d1-80c3-e6d74ad71bf3", "comment": "Malware payload (Mirai)", "value": "9704569ae1a7a16224d0f1acc7daa72fde3464f79900c73c6de6a89ce30231f40f01770b2dcba8030b784325022f8758", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656620, "uuid": "24764a7f-f6d8-47b5-8e8f-bc25cd5e5b1c", "value": "T171F32A06B30C4947D2632EB03E3FA7E193EFAAD129A4F644351E9B8D91B2D321545ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656620, "uuid": "775fb1d3-fe2a-4f49-baac-68b57b0a1648", "value": "3072:O31pewhcEhRnSIGRxBU8lNjBFxdTlF89NEx:E1hcEhRSbRxBUuNjrxrEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772656620, "uuid": "12427cd3-7294-4653-996f-49a99e6a28cc", "value": 160028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772656620, "uuid": "ca862a08-39e6-4da7-a393-d1948f7e6b0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656620, "uuid": "9166242b-38d3-4720-92f4-d46c05447204", "value": "csk_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f37d6a3-17ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772615969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772615969, "uuid": "9b3e9151-eb6a-4c45-b1d3-77894ad2cca2", "comment": "Malware payload (Vidar)", "value": "48b7183afd6f1fb6ec04ff3e13d7b75d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772615969, "uuid": "f619790d-bbee-4b1c-b8f2-ba7926e9cff8", "comment": "Malware payload (Vidar)", "value": "73076f17f8502ef8d98dd42c60609c479424fedd812383e8dd88b4f5d7a00d6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772615969, "uuid": "83f6f522-4cae-4fb5-9a50-d9bab0748e78", "comment": "Malware payload (Vidar)", "value": "25027fa2a717733efc1ea34814abdec9f0a53919", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772615969, "uuid": "1de68c6b-5ebb-4787-a084-7752ae1a383f", "comment": "Malware payload (Vidar)", "value": "2591efdb1abc97873b1b591ad3ec94d80333ce2fadc4ef662bb7b815b8e3a9f75c5ecb372a19b2baf4c07c4050e2b714", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772615969, "uuid": "f5374648-5329-4690-8584-7bfc4f583930", "value": "T123959D47BCC064B5E5A9D2368AB112A17731F85A0B3137C72E55B7B83E7A3D40E39398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772615969, "uuid": "928e790a-9c94-4110-bd01-c96fed9440cb", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772615969, "uuid": "4ccc16da-40ca-4c7f-822d-6e7161ada761", "value": "24576:Yhv28A+IjXUvV/gHjuDxnXNHb3LkacQiq+2vLWXEOOcsYgtK/d/K1Pk:Y928AVjA9Eacxq+2EMYgtc/K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772615969, "uuid": "a8f61952-5312-4f98-9be0-95589a976dbe", "value": 2012160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772615969, "uuid": "0460f47a-e528-467c-b9a4-d7cb80c756cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772615969, "uuid": "77144f78-df87-4631-9f52-bd2d84f5db0e", "value": "48b7183afd6f1fb6ec04ff3e13d7b75d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303193a5-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654598, "uuid": "a1230066-1bba-41c1-957c-b24786e39c99", "comment": "Malware payload (Mirai)", "value": "db69978e4284889cd5eb60552f49db2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654598, "uuid": "799afd5b-a984-4c1b-b86c-0c4dba1fed0d", "comment": "Malware payload (Mirai)", "value": "73f8d4b8b0a8b42dd7f21dc0581a4f20f900d3c37b3774e5630101d2f5d5208b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654598, "uuid": "fdd6db3f-b639-4f12-b551-fe69ca3907a0", "comment": "Malware payload (Mirai)", "value": "3ccde810692ec0896cfdce4bb8d4188527c08890", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654598, "uuid": "d9572ca9-e25e-4627-8f91-f50ac0cdd11f", "comment": "Malware payload (Mirai)", "value": "c20f5c7dc7b02ccc0e5024f929099ea83a1511d8a0895f1c50fbd90bcdecdfd617da11bafe7cf4b69ab7e12735d30f24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654598, "uuid": "dbfe4849-816d-4c72-b60f-039d7ae02bdb", "value": "T1C5430981F44F81F2C44B497050A6F63FDF31D9AE42B1D62EEF99AF32DA675429101A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654598, "uuid": "d4b56ae7-78dd-45ad-8903-f30a32bef727", "value": "768:SfYcj17BglTIJ/sITKUEPgK+4CaS7HA691CO1zBAx3/9S2BxJVhcTqmq16US0sP:6DgIJ/sITaoECaCzu3hYqmG6R5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654598, "uuid": "7f934cb7-299a-46a0-abbe-b7016b7b90dd", "value": 55216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654598, "uuid": "94892cd8-0ddb-4a4d-827b-375098bca965", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654598, "uuid": "cd8f12f0-c6ed-401d-8a94-adf4a9a57af2", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c1148a3-17c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772624902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624902, "uuid": "37f0b87c-4b92-4940-a542-bec643c95b68", "comment": "Malware payload", "value": "4228ba061232725df15232efce1c774a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624902, "uuid": "2ddea5f4-b168-47e3-92c2-cd5fd36271ee", "comment": "Malware payload", "value": "741d936872971fa492a6d47b9ac0bbf3d2f75aeeb97d4f778f73e42fa67d7e23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624902, "uuid": "f724f0ea-7cc8-405b-ba44-906610752af5", "comment": "Malware payload", "value": "98c9e13d050739f075a487b213c12b9610c21ab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624902, "uuid": "6f5aee7e-4998-4782-ac41-381f3d59745d", "comment": "Malware payload", "value": "beccc7100f210eb5685a28971ea6fc690e66ceae992c41a996e5843f9186f6b78c6db8b6013f82de0487e80daa33466c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624902, "uuid": "101561a4-a7f0-4d54-806c-1b4e4f2d7bfa", "value": "T1829733C8B372267DD906527BCDF05A5BC188386527F4C286BBFC176209931E8FD38A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624902, "uuid": "f6c227f6-f5c0-4a8b-878d-a0915a1d84ec", "value": "3d90ffc71d229e9433c9e2f2acc0938b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624902, "uuid": "40cad6a9-2320-4caf-b414-8d6953944cbf", "value": "786432:yFlUR1O79W8q0TXMb8YrRQ766a7Dhx4RIAebtO2VEklne8V0ukC/shFf5gA+OuUy:yEW79WUTcLwa7DERedXlnD0uXkyauUkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772624902, "uuid": "eacd9518-80c3-4045-bd60-80f5e7be17b4", "value": 40326272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772624902, "uuid": "c51a31f4-4008-41d6-82fd-e2421a4f28f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624902, "uuid": "e9f371ad-1057-4d72-a12c-84773db3a959", "value": "Ziply.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09fa618-180c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772657847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772657847, "uuid": "df89ae22-42f6-4908-91ea-5246d4b18875", "comment": "Malware payload (Mirai)", "value": "80886aa036d146239dd8054682838909", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772657847, "uuid": "960b3caf-ac46-4901-8233-74ba5739df39", "comment": "Malware payload (Mirai)", "value": "7459bbe085574a77d6031b5b1fadff9f3c4a1361c05660c4e5ad509619d9b560", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772657847, "uuid": "e8a32ac8-c161-4f39-9e20-21ca66928869", "comment": "Malware payload (Mirai)", "value": "270df3fc8624708079dd6382853214f0778da05a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772657847, "uuid": "d2211f2b-7644-4001-b26f-2b5022648497", "comment": "Malware payload (Mirai)", "value": "c219d6678c71e9e44b06862a123b43bea1269ba2618bff843c2b9816052cf601ea8b73446d7ca3e2a5734af3b9a4bd19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772657847, "uuid": "847264a9-322e-4389-b9b5-6bf4e39e16d8", "value": "T1C634E80AABA10EFBE8ABCD3706ED1B4128CC541721A57F7A3274D914F54B64B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772657847, "uuid": "26e37402-edf9-4bd3-b432-8176dcc0d245", "value": "3072:Qsuybtd+PhnedWcJURn9NdvRz2sBqvRoSej+hmO1HT1oal:QObtd+Phna7JURnv90sovRo4h7z1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772657847, "uuid": "56ae576a-d7ae-4e6e-9775-5a944dcfa3ca", "value": 233096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772657847, "uuid": "97c3dd3e-4890-4109-89f1-1e1a7816a7d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772657847, "uuid": "74d45a8a-156a-4215-b574-3252d41c6126", "value": "Polar.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae71b733-17d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772632906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632906, "uuid": "2e7ed3bf-aa63-4697-b36d-c1c2e9af6d7a", "comment": "Malware payload", "value": "3962bfa78c7acd8d85b3700e99ae8d24", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632906, "uuid": "705aa86c-4403-415b-9a5d-5ad1ed87211b", "comment": "Malware payload", "value": "7467f326677a4a2c8576e71a832e297e794ea00e9b67c4fcbe78b5aec697cec4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632906, "uuid": "4f5a30c3-c1a8-4ddb-915d-a7cbdbce2216", "comment": "Malware payload", "value": "5e9d1be3cc70d617cba3953cc901e304951ea8cb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632906, "uuid": "f4b8b7ae-f11c-453e-9b7a-b3e7ebcbe64b", "comment": "Malware payload", "value": "69b6de30ebd682439220bb7a173249cee00ee2de51f5a19e73feece39656e6ebeb696537287d5347c55400a40f3ab483", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632906, "uuid": "5ffd48bb-4c0b-49e5-96ef-ef3592f407b5", "value": "T1A5A20887B640D336C8451B324A1FD7E48F75AC488F672216369AB35C2E72AE112F7DE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632906, "uuid": "2f47a915-1b2b-4a27-845f-60a3b1189d2b", "value": "384:6K51zzHDKc2qMey3M5UC0qEXdWSoJ8p+tLLrZgd/aI:6u1/DKcGeWMmCIPd/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772632906, "uuid": "1b48e538-f8bd-47f5-b675-d139665cc4f7", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772632906, "uuid": "447dc3fe-1dff-4344-b88b-a147d47dfd91", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632906, "uuid": "074ac7ea-5926-4da8-b1cd-c089a83496a1", "value": "7467f326677a4a2c8576e71a832e297e794ea00e9b67c4fcbe78b5aec697cec4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa52491-17a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772612391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772612391, "uuid": "b9aabbd9-e441-44f3-a43c-6adbcd51e26a", "comment": "Malware payload (Mirai)", "value": "af267033c0414eecc7b8d63a5fad1e9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772612391, "uuid": "bf438c78-964f-4af0-a45a-7e95314ce29a", "comment": "Malware payload (Mirai)", "value": "755d0635bb1effdf27f5f828ccdae96ffbe1bef6839f445168ec3611e65c77b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772612391, "uuid": "386d5554-0b52-4118-99c1-32a2fa712c50", "comment": "Malware payload (Mirai)", "value": "ba1509e78dbfb3d1b6d6a69160230c50e00361ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772612391, "uuid": "363682f3-8ed7-48a2-a819-59498b799c18", "comment": "Malware payload (Mirai)", "value": "346fa7102928a2838204f4bf4bc427a0180347925fa9bdde4d7dae0a51d80e6582cf125c4d83b6fe6f3bc4a456732806", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772612391, "uuid": "142230a3-b882-4f39-849b-1498d24047cf", "value": "T176631843BD4184EDC149D138537F763AC56635BE1239B1EB37E4FE2B6C06E600A2D89A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772612391, "uuid": "af848a60-c5be-4f5f-b682-4c9bc0aab00d", "value": "1536:RyS8pYi9mY72mIoLYKblpico7/qdnLDdd75DGA9:0WAmYamIoLYKehqdvdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772612391, "uuid": "28931928-ffe4-4ee1-b0cf-391d4e4969a3", "value": 72576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772612391, "uuid": "5d8b256e-f2bc-47a8-863a-a1157d3b39ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772612391, "uuid": "82c08143-c5c2-4665-ae2f-6be3b6894483", "value": "nullnet_load.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc943afa-178d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gunra)", "timestamp": 1772603402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603402, "uuid": "c88f8381-57f0-4b66-abad-2b61e58c6d6c", "comment": "Malware payload (Gunra)", "value": "186c77101c027a465b14cb4a74f8381e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603402, "uuid": "1c709c16-3227-42c3-8435-2294857360b8", "comment": "Malware payload (Gunra)", "value": "75cb7eb79a5fa0d388547520c6c452c700d38659080be074d70395729a0b578e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603402, "uuid": "9d2748b2-8ccf-4aec-9451-88c7c4dc6b12", "comment": "Malware payload (Gunra)", "value": "6faef3ca4e9ad30d736cd3716e116e040955b322", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603402, "uuid": "7e09de5a-808b-4d9c-83ea-5e07a3b09184", "comment": "Malware payload (Gunra)", "value": "6009c6dbc996d22c39453302ffb1d41da4931b4550e46a660291f9e125d83eb9b8e1acdfb8fc5b9369d2cd6b81627c61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603402, "uuid": "7d182617-a5ec-42ea-b590-939f65ca23a5", "value": "T1CA833945F993D4B0F1639231509BEBB78B34AD395212C88BFF1A3B38BDA5751894E21C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603402, "uuid": "531a34a0-825a-4775-9ae1-0988da935afb", "value": "1536:JcRy0/UFZT00wogy8LUUBN+bHYia6MuntQgujU6L7BZdcZorw:JyHULPwogjLNnQHPa6MuntX3cTcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772603402, "uuid": "5a3213f1-d5a3-480f-a94b-a0afe187ba5a", "value": 87736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772603402, "uuid": "ae945eb2-90fe-40b8-8b33-4bc4bbfdcf93", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603402, "uuid": "ee355d5b-fca4-451c-bf88-447344f8cd49", "value": "build_i4GM6ik5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab4bead-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602754, "uuid": "67abc1c4-d986-48a9-9efa-12e72a04226a", "comment": "Malware payload (Mirai)", "value": "b859843ccf22695afb7c49241344d5cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602754, "uuid": "362e26a2-a5a3-4f8b-902b-9be521beda2c", "comment": "Malware payload (Mirai)", "value": "76b5f56cc4b064f3b247b1eddd4e40ab8245705a02dd02a6501323dd1645017d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602754, "uuid": "e2fc7285-ef9e-44c3-b38b-d92d912d74f0", "comment": "Malware payload (Mirai)", "value": "9bbc75fed4a145c72c45687423d023fc33a4b11d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602754, "uuid": "350a30eb-f34d-4d43-9b46-6fbe227679a0", "comment": "Malware payload (Mirai)", "value": "2ac902e135d1ff74341b74e977f61689948cedde2c25ee77ae09b5239f113852f1255ee510efd894822c23ce32cd95de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602754, "uuid": "7ad67b90-bd00-4c6a-a98b-86e54071486c", "value": "T19C33F14DF1ABD5EEC54E6034486FB35EADB295397140C7253AD46263E1FEE0C11346C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602754, "uuid": "3e76bcf5-6bfa-40b9-a911-f365db78d39b", "value": "1536:XXgII7xtVj/Xm7UwXFJMp3JKsVqL34Knouy8Ey1:/I7ZzWNJMUcSout3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602754, "uuid": "dffb1c81-dc36-42e3-845b-f2625f3719c5", "value": 54044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602754, "uuid": "7443720c-0b86-48d2-a764-f6cebc696be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602754, "uuid": "e398489f-e9f2-4371-9295-e5960fb27215", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1611e01f-17df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772638234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772638234, "uuid": "c7eb22fd-a46d-4558-b19f-8f1d203b08b5", "comment": "Malware payload (Mirai)", "value": "3fb83974e8aa0dfb55972ab240818f8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772638234, "uuid": "98501475-cd22-46f1-8f5b-6b33a2173295", "comment": "Malware payload (Mirai)", "value": "7814930bc5fa2501ca5f8944f7f5e0634a81153d1f93ce8801424c6ff15b4caf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772638234, "uuid": "1c78d3b9-fcad-4340-b9f5-45b2a6f0f906", "comment": "Malware payload (Mirai)", "value": "17a17171f44c8902657e653298e2b3767de225a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772638234, "uuid": "6ab6ac20-1e58-4b56-9723-fdcc5ad0094b", "comment": "Malware payload (Mirai)", "value": "9065f3976c02e45fc9037b4d20774029646604f785393135d60a3567c3b5946c875037bc4aef61556f438d0d868017f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772638234, "uuid": "001beda3-5b0f-4876-8982-a519533d8e51", "value": "T15BD36BC5E68FD0F5E85215753036FB365AB3ED3A113EDA83C3A89A319CA3581D61A31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772638234, "uuid": "b6a289d5-ef53-4e32-b8be-192d97ad7cb1", "value": "3072:tvSiZhU+FrpjG1uOib1jFvW33H3zdRPFB:ZSifU+m1uQXB9FB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772638234, "uuid": "9dbcc29a-85bb-4e41-9499-86e7d86887f2", "value": 141676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772638234, "uuid": "652c81a1-d36c-4ffc-a0a8-92e0ccd784eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772638234, "uuid": "20c68b58-7337-40e4-a597-09d1bd6a28eb", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ba6df7-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625663, "uuid": "e4e2158d-0087-40ec-9857-cfb4bb4d7752", "comment": "Malware payload", "value": "41e38b3f00cd66fffe4e293ef1f4f2a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625663, "uuid": "20572c67-25aa-40dd-9284-b35439a0b559", "comment": "Malware payload", "value": "785f8dcd7dc657ae11cb305369168a9028653d64d2ec88f93b12512bd973650b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625663, "uuid": "558da8ef-e31f-4917-9d17-eac419f78b91", "comment": "Malware payload", "value": "16ddb6870de4b74e8b327dae13903085a3687a43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625663, "uuid": "08e8aee4-94ef-41e2-b7d0-955a5e790466", "comment": "Malware payload", "value": "2c296eca1b88060496398ef43fbe252c0f0b06e3c4f5fae6e6de154ecef807c0130d5246cdbeb2d91ef9c216d4a7c23d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625663, "uuid": "af3e606f-c027-440f-926e-b2fb3e744aeb", "value": "T1E484F1D022EC85E1CDBBCB36D0662E418AF5A677B9A2D241D8814579BF46F038F31379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625663, "uuid": "90c2e909-0acd-44c7-840c-028878f027ea", "value": "6144:8Dz4cOwijkzDzZsBS99NIdnYu7/3MfRUTgO/Gi0IJ4lci2V42JwQnP/+MqqA:uD1F7yYa/3MfR/Oedlci2fJwUhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625663, "uuid": "7b000fb2-3f8c-4efe-a100-19386bc20691", "value": 386000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625663, "uuid": "ca26d9ff-2407-4c87-ac97-fb86149b401e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625663, "uuid": "4a2240da-c95a-4ba1-a55f-595b044ae851", "value": "785f8dcd7dc657ae11cb305369168a9028653d64d2ec88f93b12512bd973650b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b413fad-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654590, "uuid": "69a8ffd0-a220-4720-8e65-604eabdbd33a", "comment": "Malware payload (Mirai)", "value": "747be8ee9f742a704503d0e06a0a3122", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654590, "uuid": "d32834a8-4126-4516-8b33-edbc786750a6", "comment": "Malware payload (Mirai)", "value": "786d11a7060ec8bcdadfce824837ca1164fd59d90f28624ebe650c1d1a6f16a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654590, "uuid": "cfef9847-dac1-41cc-aa9d-72545b965451", "comment": "Malware payload (Mirai)", "value": "0520647966ea14e07be91baec41bf6b70332d0fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654590, "uuid": "448fe46a-5138-4499-bc15-d08558d5d6f4", "comment": "Malware payload (Mirai)", "value": "7a83bd9e248b7087189068c826cd07cf76cafc90b3acd0d176d9d9b7776e003674a3c1259cf32c79d28f628b78e1ad38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654590, "uuid": "62def209-a044-4054-babe-c3f2ee2000b9", "value": "T1CE82CF3051AB75F5DBE14431EAAECEC6971B0BF8D1FC36E21658AB7C894110251F93CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654590, "uuid": "3983843a-6fde-4d5a-9555-5aa645bd5fa9", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMamxhymdGUop5h5l/:6/V0P6+kom0tVAoNvm+to1mxs3Uoznl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654590, "uuid": "e1b0d0f3-2c4a-4a31-bd63-b51f93da6b8f", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654590, "uuid": "e493c02f-5e84-45e5-92a6-5dc46a640373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654590, "uuid": "7fb33973-bd71-49b3-bf06-ee862940f418", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2a1909-17c6-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkMe)", "timestamp": 1772627726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627726, "uuid": "aebdb221-1d99-4c8a-9530-4f4f46f73190", "comment": "Malware payload (DarkMe)", "value": "0dc1299d82fe8780b821df07e281e222", "object_relation": "md5", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627726, "uuid": "84aa1c59-11e8-48e5-ad73-e9f176f49552", "comment": "Malware payload (DarkMe)", "value": "78b5f70a2481c430f483f263a7045d64c18e2aabaad48b9c8b0c80cd8d90980b", "object_relation": "sha256", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627726, "uuid": "7d74a259-6271-4aab-920e-6d87218981d0", "comment": "Malware payload (DarkMe)", "value": "a73f5ac8f526aaae4faf4a14646f89148e18d99a", "object_relation": "sha1", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627726, "uuid": "c1e30950-9b97-40a7-a555-708c631502b1", "comment": "Malware payload (DarkMe)", "value": "c8ff82cd5e2357e9bb66d44394ae7d3c9bc4bb484ed46ec6bf8faf3193ddfaa75b16e21af01ee2290b7298f27a985005", "object_relation": "sha3-384", "Tag": [ { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627726, "uuid": "60d2e651-4fc8-4e91-821f-d9e8552a5a12", "value": "T156933B2FF79148E1EA461E311AA5C6E96773BCA66FC3825F7140322D1C32E920D4576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627726, "uuid": "1834a1b0-f89c-469c-9d91-7874ff678a34", "value": "3e847ec4ad926dd89c2f4cb28d036c11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627726, "uuid": "cb51f486-3e00-40ba-bef4-4cc1b41a93c3", "value": "1536:O0a0PO/Ujf3OnwevbVfo9dPdb96r/NPyz:XMU6nwezVfobPQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627726, "uuid": "8fc8fc41-f7fe-4ec8-8756-c164900fc826", "value": 93496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627726, "uuid": "32e7e14c-5cde-4312-b128-4c9d884a7e8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627726, "uuid": "a8d1170b-e57d-4f8d-b360-bb6cdf5a6c50", "value": "PrivacyPolicy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca26358c-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625651, "uuid": "8bb078dc-b409-4d32-800f-91b5189a1fe9", "comment": "Malware payload", "value": "8481a194da949fbc38311dc1a6255e5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625651, "uuid": "d0eaf431-e1fb-484d-9208-bca559b6132a", "comment": "Malware payload", "value": "793dc0f974db71c9ff09ab78a71aed3bb467d89d76087e38afbeb40377981279", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625651, "uuid": "b9a5777e-935c-4f60-8f15-a46c9d485ca2", "comment": "Malware payload", "value": "3b62fd9131e5baa08795ed1da42174f380c52d5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625651, "uuid": "98c0967a-b6ba-434d-bfb1-8d142c78960c", "comment": "Malware payload", "value": "7eb7ba72db0667ef674c2967ec3ef1faced1c21f7f3d70a2006b029281191c1dcd8708d5f9b5e4e78d75d25d05c22c41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625651, "uuid": "c5ef385d-e59d-4cb0-adf8-c1186c8868c3", "value": "T1817402D422EC85D2CDBBCF39D0662E41DEF1A662B5A2D241D8854479BE06F038F7137A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625651, "uuid": "f3461988-02c0-414a-ac4a-9ed7e1a5901b", "value": "6144:EMcDz4cOwijkzDzZsBS99NIdnYu7/3MfRUTgO/Gi0IJ4lci2V42JwQnPPef:uD1F7yYa/3MfR/Oedlci2fJwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625651, "uuid": "f61905d8-21b3-4abd-b881-5c09abcb757a", "value": 358783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625651, "uuid": "f7777aa7-bb47-46b1-a6d1-f20a6a4502c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625651, "uuid": "2ef10d80-9c2d-4f54-8650-0012780cfbde", "value": "793dc0f974db71c9ff09ab78a71aed3bb467d89d76087e38afbeb40377981279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d95178d-17d9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772635642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635642, "uuid": "1cddf3e7-7cf2-4435-a686-b154c5f7cd79", "comment": "Malware payload (RemcosRAT)", "value": "006c1b888bc4ecb72158c20ca0d6cc2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635642, "uuid": "44b4031a-370a-4ce2-b767-6ad1dc4381f6", "comment": "Malware payload (RemcosRAT)", "value": "7976b72d4f0bcca38ba349dc7329e50721afa3b339b0615b42ccdaf899e062e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635642, "uuid": "4fee1357-d05d-40dc-876a-8878b21ad673", "comment": "Malware payload (RemcosRAT)", "value": "ebf61ebf10b479e1dfb19766b3f802f6499c7bb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635642, "uuid": "371a83c5-1ce9-4f36-905b-8d639bcd2237", "comment": "Malware payload (RemcosRAT)", "value": "6a7f4cfa032101c8f6f1d11025d60db29e3e8c22fde45b16c64d0b8a2e9632786ea521d667b23a9e05f62f8dabb1dac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635642, "uuid": "0a908627-9586-4622-bc5b-4d2fa11d3cfb", "value": "T134B4B001B6F2C172D97664300935E774DEBCBD201836997BA3D61D9BFD30190AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635642, "uuid": "e7a414cd-704e-491d-99f9-50f2cf34c652", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635642, "uuid": "4e11f98d-c885-40ac-b1ff-23d35978f7b0", "value": "6144:2XEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZlAXiBce5:sENlHV9FGeDWv3jADnyYiCNrsPZl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635642, "uuid": "24a259e9-8afd-409c-bb6f-76eff2dd9498", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635642, "uuid": "ea112687-264e-4269-bdb3-ce9241abb01a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635642, "uuid": "3e074f3e-a20a-4b5c-a6d6-c739633223f3", "value": "7976b72d4f0bcca38ba349dc7329e50721afa3b339b0615b42ccdaf899e062e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e935613-17c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627484, "uuid": "b1877b02-1d59-40c2-b7a4-b8e7d51921cd", "comment": "Malware payload", "value": "4d5b14375f90a836e608c28491f0308b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Tsundere", "colour": "#F44FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627484, "uuid": "fdc04332-72e2-40ad-8f30-6f3125cb8ec1", "comment": "Malware payload", "value": "7ab597ff0b1a5e6916cad1662b49f58231867a1d4fa91a4edf7ecb73c3ec7fe6", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Tsundere", "colour": "#F44FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627484, "uuid": "1a2da2d4-8e90-445b-b22c-96f192d61be5", "comment": "Malware payload", "value": "d0d7d0c816753639b5c577aacf14fd2e994b64b0", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Tsundere", "colour": "#F44FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627484, "uuid": "a46a2775-1d7c-457e-9b70-09cdf3909d90", "comment": "Malware payload", "value": "9227169b428a200c132ff1140a24275ec029937eae706bcf6117be4c6c357bd104fea3235fa8b4031c300436b06c4afa", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Tsundere", "colour": "#F44FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627484, "uuid": "0b7a1337-5e70-49bf-92e4-49d4a74aba4d", "value": "T1EAA5BFBC75047DD6266F136BDA96ACDD13B626639ACBA8CC40A877C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627484, "uuid": "a8f2f2c9-cea9-43b9-ac5e-23edefaf7dec", "value": "24576:AFWneH3BzqHS1xqIU5QSiMN4iak5B6Fbl31MHQzIctmH2b8rPAe7fdZvBi5pzZon:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627484, "uuid": "c802c724-7935-47db-b695-f9feec2ff9fd", "value": 2227654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627484, "uuid": "de32d197-2d35-4336-86b2-11cff5011e96", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627484, "uuid": "f221a0fc-abb3-4727-9ce4-3b10d263af1c", "value": "reset.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54211dc-17ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772622609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622609, "uuid": "581ad1ec-0f10-459f-92eb-104a17b90b79", "comment": "Malware payload", "value": "270902c6bb6844dc25ffaec801393245", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622609, "uuid": "01df9eec-123d-4028-8ee4-0d95c68a8937", "comment": "Malware payload", "value": "7b024deda9a285ce08cdea266a351c5714ca61e6799cf12aa474ccdf04363a68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622609, "uuid": "fe669a26-21ad-49ae-8928-e7f61130dc15", "comment": "Malware payload", "value": "09ce87f436e23234b713fa3975b279987c3fe1f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622609, "uuid": "b5a4c737-bad2-44e6-8fc5-e205833f1d0d", "comment": "Malware payload", "value": "89b1755af17aa20eaa454e80b8319428489a2dfc567015cc71c1f89ba25b7350d33b87a2f5dd0c34fcdee2bb83963019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622609, "uuid": "5b186c47-b49b-4d91-886e-90e85c3e0863", "value": "T1F9D633C9AA130EA4C9461E7F0F720E411A741A25DFF427506BA78CB71E6E34D2F05A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622609, "uuid": "6707b8a2-d39b-4bc9-a277-4a156ce3741b", "value": "03e79a94d0dcb51acdcf1e8fbb5bd993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622609, "uuid": "595d295d-785a-42f9-98f6-d94d6750b589", "value": "196608:h5NPwiLljpH1lU9WMBHCxYPlyYrKguWjcWyJSNxUKLd5H5G2sZbt038OGl8ls:bljpHrUMAHCxOduoXNqKLdJFybagT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772622609, "uuid": "28c5b026-9a2f-441c-b2af-ac12eb133962", "value": 13195464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772622609, "uuid": "89f3b07f-d92b-471e-b861-d0ea5f04e7f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622609, "uuid": "f2f2a8e7-9e03-4d79-8b1d-ff384c0cd502", "value": "PPTV(pplive)_forap_1084_9993.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d575d0-1772-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772591504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772591504, "uuid": "c4ad1107-1dd6-402d-8cf3-8d1acfa7a9f8", "comment": "Malware payload", "value": "22f423b09ecadea69a18c654033d69b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772591504, "uuid": "d65fbece-3c79-47d4-b450-0387eaebb0c5", "comment": "Malware payload", "value": "7b85a4ab95ac603ecc2a7eee39919012cfb583e20c385ae71397538f17df63c3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772591504, "uuid": "0faf58b6-728d-4972-91a8-845ddd74165b", "comment": "Malware payload", "value": "e493bb546cde9bb708e3c93c9f2a96d29c959c94", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772591504, "uuid": "8401022a-03fb-47d1-9e1c-f05e2e007c4d", "comment": "Malware payload", "value": "e6a13c3a41ef08fc7e1a2cf4e0358e425a14c39f75d2dfbc36084a65446ddab668d816aaf15b16e799e83e5410c1d1ee", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772591504, "uuid": "9bbc3b9f-3334-4f66-8e86-67d8004c86dd", "value": "T13A925CA916496C79BBC0DE7D9F3C7F0CADE4C1C02118A3ACBA4F39714A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772591504, "uuid": "f5f5d850-589f-4391-8725-60faf9474b71", "value": "384:N30M3vgRjGlsaq7gzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:NTmjfMzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772591504, "uuid": "c0ee8545-0e94-4be1-8f52-f4369a6ed607", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772591504, "uuid": "710335b8-ea47-4d83-a3fc-99f28a98fc80", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772591504, "uuid": "f754307c-f629-46ae-80fb-b0bf51c79173", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2d85d6-17d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772632927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632927, "uuid": "525e8b81-235f-4f4c-b65f-fb48e9020bb5", "comment": "Malware payload", "value": "c23fc7b74370d590223d962727e67907", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632927, "uuid": "8c3dd242-0f01-4052-8ef0-4024a5cf1314", "comment": "Malware payload", "value": "7c30c16e7a311dc0cdb1cdfd9ea6e502f44c027328dbe7d960b9bcd85ccf5eef", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632927, "uuid": "28e47273-fa2c-47e2-8a44-5dff0cae790c", "comment": "Malware payload", "value": "2e1cc87d974aa7f07a8911c631a191dc00535b36", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632927, "uuid": "5c6a7166-4457-4abd-a468-020dda302284", "comment": "Malware payload", "value": "ea6274091347efd60b85b76c1f5f48601b78b183df752e4fda9653dbb0d468c270e04e479bdeb11b4d79e377d5112e4e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632927, "uuid": "250313f2-4925-4e3a-bd09-81e2a12f2b85", "value": "T103A2E847B7409332C8814B314A1FD7E49F75AC589F772116369AB35C2E72AE016FB9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632927, "uuid": "08b31788-39ab-4f07-b6e5-1de67d985d2f", "value": "384:GY6bAWacfMey3M5UC0qEXddGSo78p+vV5F5gd/aj:GMxcUeWMmCgFzd/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772632927, "uuid": "f0c63a45-8d59-4557-8ca4-e2a861df2034", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772632927, "uuid": "a896a051-cc01-495e-8dec-be6a4846067f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632927, "uuid": "e9a01b38-2448-4599-9db6-02c8f7ff2979", "value": "7c30c16e7a311dc0cdb1cdfd9ea6e502f44c027328dbe7d960b9bcd85ccf5eef.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cf06ad-17d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772636005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636005, "uuid": "4b43b796-7da7-405a-b27d-c8479c3f28fd", "comment": "Malware payload (Mirai)", "value": "55a5833e9e68c238c91f33cc8c8fb183", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636005, "uuid": "0581ed35-5de2-4c93-9897-cf84d21e5b5f", "comment": "Malware payload (Mirai)", "value": "7ca7badd26c1d4ae3d3a6b9f9f1e276efbc4e41bd0042f178a8ad5354fe28de1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636005, "uuid": "f22846ce-61cb-4098-8350-0a4ca61b8148", "comment": "Malware payload (Mirai)", "value": "1f040d84d955aafd824f4fc28022e284023792be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636005, "uuid": "8cc8fb51-811c-4323-8ca1-d171cd586137", "comment": "Malware payload (Mirai)", "value": "6458a630eeaad97005b5f80bc6a68d5139ace3a8e82c29bec5047997ad6e4eff5fb965b1002ccb7912facfbaf1610f0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636005, "uuid": "c79aa6c5-644f-4cae-b926-569100abd90b", "value": "T145D36DCAE24FC4F5EC1155713026BB364A76EC3E123ADA43D7AC9E31D893A80D61676C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636005, "uuid": "f08a78b9-cdba-4bdb-a4f9-aef18100c35b", "value": "3072:/Q/qbFpFrpCXxSr3lpqkKVxISBF2ZHdHYe:o/kFpGBSTe4ZhYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772636005, "uuid": "15793f46-f57e-44ce-9b77-00336be2a044", "value": 140524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772636005, "uuid": "7dfb4f52-c1fe-4fb5-9ac6-d63e31f616d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636005, "uuid": "c46c62a6-6f18-42c1-9eb7-51158e14baaa", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3876bf5-17d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772635062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635062, "uuid": "ad0f8fbb-8bd1-4966-bb66-59237177f9e6", "comment": "Malware payload", "value": "45309b788fd5d3d3767026caf3ecbc36", "object_relation": "md5", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635062, "uuid": "dc0c9c6c-63e3-4722-b3f8-e4455112c961", "comment": "Malware payload", "value": "7d22c61e8aafc9a2a812cafe7720922ab12d770e5af7d92527d9b0dbd6e10f30", "object_relation": "sha256", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635062, "uuid": "433ffd57-7e4a-4878-997c-39b4b03d80aa", "comment": "Malware payload", "value": "746ec9a4eb22c30645f72011f83bed5b6ec10ed9", "object_relation": "sha1", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635062, "uuid": "b7e5592b-5b8e-450a-a640-c6a2005b5be3", "comment": "Malware payload", "value": "c8652bf5e1295c9e926f41ffbf1b267e39289d9972040b0c620a12438e68e1e32204cca98462951d02e64907f4c6237c", "object_relation": "sha3-384", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635062, "uuid": "4c13628d-e8c8-4c8a-b1fd-d93841717abc", "value": "T16B51BB221BF24218E7F38B392C7AE755D536BC05EA11CF9E02A0158C9C74624E975F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635062, "uuid": "a2e53bd1-8756-4ea7-84fe-e4bc15790dad", "value": "48:8jQkm8wbKxf8mJoTKP+xHPfMIHamKoqYC:8ZMKfEdHPkoFKoqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635062, "uuid": "ba1cb932-1621-4ba9-a82b-5ad9f956d940", "value": 2444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635062, "uuid": "c7ccfa07-ef43-48d5-ba01-b6abee576eea", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635062, "uuid": "c7fe9ce2-00e3-4b8a-ae19-870a6d51e578", "value": "7d22c61e8aafc9a2a812cafe7720922ab12d770e5af7d92527d9b0dbd6e10f30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19950ede-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625355, "uuid": "e432bce3-06c9-4397-a476-3aa916433cf0", "comment": "Malware payload", "value": "5134897b80aec0cff1c7145f0c711a84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625355, "uuid": "6a559a9e-c583-43db-a7fa-d3648f0b178f", "comment": "Malware payload", "value": "7ee1ea98e0e89ce540c34f61a838136aa65c51be3959db2ca8659801116946d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625355, "uuid": "dbe17ddd-8139-463c-848a-af99ca4338ea", "comment": "Malware payload", "value": "992e1380e78d5dc7e0693ee9eda845bfdc0efa1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625355, "uuid": "c87f2cba-a57d-446d-9801-4b9e4331898d", "comment": "Malware payload", "value": "75a980d3d2c679d4bfb948f02156ed4a084b14cf7f6e74d178ba42813c093770e132bf488a9db9b69794bba4211c0dcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625355, "uuid": "a233a3d2-a002-460b-9507-bc0486f86329", "value": "T1B54309A163E885F7DEBFCB3A94213D2106F5A61A7522E254CE8050FE3557B434D30BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625355, "uuid": "c9596179-8641-4fed-8a8c-8a3c2ff437c2", "value": "768:yaF2NRjbJlxWdkxO4EdWPnShjDwExkXY2MuKJ83FGpw4OIM4ViOEypKy:yCS9lqR3duK9pwL4VVoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625355, "uuid": "2f26f883-4303-42f6-86b7-f8b4a47ad3ea", "value": 55296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625355, "uuid": "77709894-4c38-40af-8f38-e21ec8228713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625355, "uuid": "134c2465-bdc1-40b4-bc51-7b9796982ef7", "value": "7ee1ea98e0e89ce540c34f61a838136aa65c51be3959db2ca8659801116946d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5788db03-1803-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1772653805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772653805, "uuid": "834de7bb-ac8a-4a37-8ff0-424908c36565", "comment": "Malware payload (STRRAT)", "value": "71b6b54c27925a65ffb84dee25ebad3e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772653805, "uuid": "34052463-6706-45f9-8868-50bc04f529ff", "comment": "Malware payload (STRRAT)", "value": "7f2e4b45ad072f284a1944947956fb78a6459f8b8b8a77bfa82550ada91dc30b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772653805, "uuid": "3f9a36b6-f4e2-4878-a6b6-5e26b695c8b0", "comment": "Malware payload (STRRAT)", "value": "d3327dcf9ffe5442270c81371fb8be4adbeeaf2f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772653805, "uuid": "1c7a1815-4d7c-4a5f-b2d9-dd6ad25804c2", "comment": "Malware payload (STRRAT)", "value": "569b3f17c212e6406c479904d66a9482f608c9147b368e0cb9e3c1377ec7592b7f4034701cabec2886d7e0e061759f0e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772653805, "uuid": "bbe92375-9026-4f3d-8b65-ff256606cad5", "value": "T1CD24F12B3DDA99B4E42344B21181D5B7E64C4399E466840B29FD2C8F0D32DAE4B43EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772653805, "uuid": "6aaafe3c-81fd-48d5-bbfb-042837907949", "value": "3072:8NY2SYqZPAslE+bADWD7dZU0C0dCVDJ11hNhbR/13DztY45Ibm52KNYdp7Q+1:8dSYADzACDZ+0bQ1LLvz+45Ib9px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772653805, "uuid": "bdf15230-236f-4e0a-8a91-e5155a9bcc14", "value": 213382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772653805, "uuid": "58ff1476-0664-4851-93b2-b1b725e88137", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772653805, "uuid": "19d478e1-0cb1-4527-99b7-1797bd83d195", "value": "Shipping Bill9655247 dated 13022026.PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cc73d6-17a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772614074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614074, "uuid": "9a3f3992-6373-4de7-a65b-64f482df580c", "comment": "Malware payload", "value": "40d0d039b143472a26291057bce2a6dd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614074, "uuid": "417b64f7-ed25-460a-b1dd-ba6f9fbd94dc", "comment": "Malware payload", "value": "7fda0383d6aadbe7da2e7143b76adf170031d67992ba93cdcec33bb6487ff10a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614074, "uuid": "583950a2-cf71-401a-9b20-b7c08ed0f842", "comment": "Malware payload", "value": "50338fa3c09bcf18754d58d9604b473ad2aa2f7f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614074, "uuid": "ed15f480-8087-4950-99c7-5246c602bd29", "comment": "Malware payload", "value": "1f5ba114380433c71f3be72c3fe9109ddee456b20f023663546a1a370cdb1e7540ae43537adfae5890a5fe29006360dd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614074, "uuid": "6aef17b1-0d03-47a9-95f3-7c0dd7a52b93", "value": "T1A8925CB416896C79FBD1CE399F3C6F4CADE8C2C42124E3ADBA0F39215A1166DC60535E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614074, "uuid": "aee89eee-54fd-44c1-94d1-accfadce7de6", "value": "384:GNcuQpWx+BL0SWL0gKzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:GN8i+BL0SI09zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772614074, "uuid": "78c13c40-9cb9-4a22-ae5d-99352266f1a3", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772614074, "uuid": "6409a701-1349-4d56-8150-2905048ea0e2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614074, "uuid": "39c13845-0b2a-422f-ac52-aff2dc1d4c9c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f054bb76-17c5-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkMe)", "timestamp": 1772627433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627433, "uuid": "9fee6994-bbc3-4fe9-a307-b0a43da06062", "comment": "Malware payload (DarkMe)", "value": "3803116a5c540623478d58a7f4776d7d", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627433, "uuid": "ace9598c-ac34-4584-a34f-151f6f27b2f7", "comment": "Malware payload (DarkMe)", "value": "809eaba81a141f3b2fac16a9f90b437a5e1eb75b8c547ca7ce650b61c9fc97b8", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627433, "uuid": "1bd437ef-5077-4a67-9935-837aa98306c8", "comment": "Malware payload (DarkMe)", "value": "d63f6417aa5e9ff4b5e323ae908bc5704486e77d", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627433, "uuid": "b3b53923-2370-4d4d-ab4b-8195fe637a10", "comment": "Malware payload (DarkMe)", "value": "06e27c1f5ea3e9b2fc5de0274c4415ed8b8db7b95479810b084779a52222b91b8c96c2c64a4c3ca0a11fc4071e6022e9", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627433, "uuid": "c2aa478c-3688-48df-8ed0-94d6f72da97a", "value": "T1E2D33DF6EBF478A5E20521337964A17C37D3BC4DDD96452AE24BF11A3422DC228E5A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627433, "uuid": "4cad148c-ed6f-428a-93a5-11541a3ab047", "value": "3e847ec4ad926dd89c2f4cb28d036c11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627433, "uuid": "0f887cdd-adc4-46b7-be7b-282f1c9aee02", "value": "1536:70a0PO/Ujf3OnwevbVfo9dPdb96r/3vQ:wMU6nwezVfobP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627433, "uuid": "a7cc7405-8f0d-4e63-b1da-e39d1d9bb672", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627433, "uuid": "e3d9ecc2-55e0-478d-a659-6498792e4828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627433, "uuid": "40a32272-9743-40b0-8370-50575e34f80d", "value": "809eaba81a141f3b2fac16a9f90b437a5e1eb75b8c547ca7ce650b61c9fc97b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7debb3-179d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772610117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610117, "uuid": "bbca06b2-4f44-4d31-8632-b077cdd434d4", "comment": "Malware payload", "value": "60143baa8fcd2133f02c98591e31d73e", "object_relation": "md5", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610117, "uuid": "86db9d42-63b3-404d-98b6-2f19c925c6b7", "comment": "Malware payload", "value": "81d1e25d612f998bc2d580af72928c6b76b2b958d529f989db131df3798e31b3", "object_relation": "sha256", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610117, "uuid": "de0f7759-552f-40dc-a288-c2d5b1fcf3b1", "comment": "Malware payload", "value": "27e0188e3993c5e7a679d3d28bded1d4d4246fb0", "object_relation": "sha1", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610117, "uuid": "2f2b6018-999e-41ee-ae8d-890ad1011357", "comment": "Malware payload", "value": "d10b2d029ac998a1d5078b803dfd7678ebe773d64e83184f15b478fd08f5a844c81ccff75951e43879284b65f44d4385", "object_relation": "sha3-384", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772610117, "uuid": "867dd8de-aeaa-4ea3-a238-a37d97c50e33", "value": "T15BF73321B67378A4DB2F67BFA0A95FD440307DE1B31BDA6B23783FA545B068551B2803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772610117, "uuid": "d8ad50c9-3d03-4328-9a37-13f60da9a7bb", "value": "1572864:fQsTGHdUpR+zlkRkrmyvRD/qoglViUngaiIwuMhNbJ/:fQsTGG3KlR/D/qok5nSucN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772610117, "uuid": "d3baa474-8383-4576-8bb3-075b15695c92", "value": 76406272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772610117, "uuid": "2fb78f26-2093-4498-90a7-b4f2038a7272", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772610117, "uuid": "ef2b7c60-e24e-46d3-99c7-8b675092b22e", "value": "sun_oray_x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aaa87d0-17a6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772613894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613894, "uuid": "fc35b846-4629-4c75-81e7-c5dbb9f53ffa", "comment": "Malware payload (AgentTesla)", "value": "647591a03870e58ffd80b2fb63c3180e", "object_relation": "md5", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613894, "uuid": "56c511f9-1426-4d8d-a87c-75ee712f3b2a", "comment": "Malware payload (AgentTesla)", "value": "83062bae9549c9098ed5475ee676f042a7562fd5c616bca36c4779d92b7b0683", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613894, "uuid": "99a16380-dd57-4710-a5e7-a34bd8961cc5", "comment": "Malware payload (AgentTesla)", "value": "a53826f2e26394df93bd214ad3a6d7519fe92cf8", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613894, "uuid": "b3e9c5aa-b95a-4b15-ba76-10c5fabef5fe", "comment": "Malware payload (AgentTesla)", "value": "3623ff2582fd24394682246461f9c757f6d668b7d1a5e7d9a67f5d1e11c0aecf563cd2c195ca814cfdc557ac8cebc803", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613894, "uuid": "d937f651-db91-40ac-aa11-48914c046927", "value": "T1B1144C20D93506790F4717E9FCA60A62C9BDC329823654B9F6DE030D61069ECF3BE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613894, "uuid": "8b50e89c-584e-42e3-900b-ef4b312654cb", "value": "6144:tjPC6k9pHuK8RSXpPUseU10C6uedScyYF8zg3:V+uK8pyfEZvFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772613894, "uuid": "f8d72620-2a59-4dd0-a24a-936da6a741b3", "value": 205482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772613894, "uuid": "9ca40b28-956b-487f-8677-1005809f7d27", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613894, "uuid": "2d7261fd-19c6-44ab-b2df-0339d6d87d50", "value": "04-03-2026-00291.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb437af-17b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772619830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619830, "uuid": "67296fa1-50f8-49e6-a860-0ffa15b4a7ae", "comment": "Malware payload", "value": "48a3c2c94f151b201b54df28b3d8ac08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619830, "uuid": "63b5f2bc-a9ee-4a5b-bcd1-1d6f434429c5", "comment": "Malware payload", "value": "83a3d900356c3df94fc83e4701b69c521fb031cba31b60b898ebba48d5bad8a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619830, "uuid": "47a74708-c40d-4d4c-8c9d-02f2b1108eff", "comment": "Malware payload", "value": "bcf5bc74d226993c63e977a61f314be501bf9cc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619830, "uuid": "68dcd692-9d28-48e5-97b5-faf42c4ab6ca", "comment": "Malware payload", "value": "1e1dc993986cdf253c6ec6e61e360908377a0c20504547293a29db964e64c75142eaaad4fe82389b3ef73b7743d8f7c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619830, "uuid": "04c27089-35d0-4b89-a04b-127272f8699f", "value": "T1F2258D02B750A51DFA2BFD78D0A2E2C243F1FC216666CB3F54B5345B5FA628F6811392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619830, "uuid": "de390286-f17c-4967-be6d-0c770753b468", "value": "24576:3Ia5WcoBHhL/ktl4WcoBHhL/ktk8OiIYUcox/VyFfVg1coZMM+VS7cohyfoqVW:37P/Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772619830, "uuid": "4c6772a3-40fc-4a64-8d5e-3ab1f85728d9", "value": 1045712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772619830, "uuid": "7f6d8955-744e-42cb-a4a1-4c72862e0fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619830, "uuid": "7301c36c-8be3-4f5f-bfc0-f5dc35b1b47d", "value": "83a3d900356c3df94fc83e4701b69c521fb031cba31b60b898ebba48d5bad8a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec939bb2-17c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627427, "uuid": "14cfb343-1353-461f-8d9c-b6c1154cab52", "comment": "Malware payload", "value": "c3b14399994a7c74e50d1078866313fe", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627427, "uuid": "51d1a8a3-eea2-473d-bd1e-7158e2ceb221", "comment": "Malware payload", "value": "83ef2867eec93efac06aa9b6bf99da1347b31810868a1708f57e8f5aba173f98", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627427, "uuid": "b50b6fc3-e790-4735-858b-ceecb6f79535", "comment": "Malware payload", "value": "2b144cbfce27820cb87302fbc1f2950c9976dc18", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627427, "uuid": "cf02fadd-fc1f-4b9e-a5c8-6de405cf36e6", "comment": "Malware payload", "value": "8ecfd6dc937f9c7958123f8448dbca48600b6d1f6a75369f1e93e90e1b76dfc3775c25306ba3d47be662a3f53a82e2ce", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627427, "uuid": "fdc5a454-71c7-4955-9253-f171d14fa8c6", "value": "T10104092BB7E47765D430D073CBE78315B730A6A1D1368B6B05C24E1FA56A01A7B4BF28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627427, "uuid": "bf554ab7-6881-4cbf-9bb2-0d6dddc54e4f", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627427, "uuid": "6ea4ab50-074e-46fb-b431-d57c0cf038a6", "value": "3072:EPd0tMfSIi4/uPiJrTaQXN3pVqDK4fPh+B6mHEOL0X0ewKZH/ulsQzfS:EVjSbp69TfN3f4nh+4W8xwM/cs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627427, "uuid": "c3c939fb-342f-47a4-a562-70aab15af589", "value": 187612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627427, "uuid": "ffb97cd9-3d02-40f3-9a51-db8bcd14383f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627427, "uuid": "d0e9b0f7-0226-4f40-a1b2-94ad044f1287", "value": "83ef2867eec93efac06aa9b6bf99da1347b31810868a1708f57e8f5aba173f98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f64fba7-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602762, "uuid": "2e8d2f58-afed-4893-aeb3-4117277ed195", "comment": "Malware payload (Mirai)", "value": "a8a858c97fc06e3e4cee1e6011c2cf8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602762, "uuid": "e47d6031-64b8-48f9-940d-efa69192d76f", "comment": "Malware payload (Mirai)", "value": "84faf5f4da61f5df7f1d0aebc0e3ebc695ad77645970bf9cbf2e95734845bc3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602762, "uuid": "ef60eccc-c7fc-45c9-b678-c649f2939e50", "comment": "Malware payload (Mirai)", "value": "091cf7ec35ce3cc0a254e84335bdcebbd881245a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602762, "uuid": "e3c5b8f7-eb16-4317-b407-b9e25fc935d5", "comment": "Malware payload (Mirai)", "value": "ef83be5deeccc81f203ffd4d08d78afe5cc09dc0b3306f5e9c0d173cc44dc13738580138377599571c75bd7aae2419fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602762, "uuid": "480cef7b-65f9-4a84-a7b5-2438731c037c", "value": "T196143A45F8818F16C2D412BEFE1D128E33272B78E1DE72129D245F657B8A86F0E7B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602762, "uuid": "41c2892d-5ed1-42f2-99f3-d64099b2bccf", "value": "3072:q6qg2WK3nDw+IBriQnXscAYYa7S5M78yd9yxmGKqFPON:Nql3DLgrnXPApaa/ydXGKE2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602762, "uuid": "4f653cb6-e090-4f90-81d9-19808debfa41", "value": 192476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602762, "uuid": "93365c25-e412-49e5-a157-bbaee3a6505e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602762, "uuid": "7154b5b0-0ec0-4086-929e-7b6d1f354ddb", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e58f369-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602760, "uuid": "b3b617c2-abcc-49a0-92ce-d2ce4995c0ff", "comment": "Malware payload (Mirai)", "value": "cf0a52d48117dc360418974aaaa01e4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602760, "uuid": "050ac601-1004-4f82-9ac1-00bf7f4ba06e", "comment": "Malware payload (Mirai)", "value": "86cb159b5ae4e8abb23ca3bf156ea060ffcdff5a13f1db6d9e151109d2b31b1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602760, "uuid": "b1d0c3d1-3b6a-44da-a022-ba4789755b89", "comment": "Malware payload (Mirai)", "value": "f366fe40ccd3e106cd4ee5dbe6d74f80533986b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602760, "uuid": "d69e9a49-f064-4b25-90c7-bb9b28f60473", "comment": "Malware payload (Mirai)", "value": "a2c6bc524dff20bb463dc090fe233a6bd700b89dcb7a291081c722a15cda3a09524a86f8818ff924e36a9073bcea19ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602760, "uuid": "946e3d87-ae62-42e9-919f-8a8488bf9378", "value": "T1CE6302A1061D54A7FE82C0786ABF1B92AE5E0F1D6051E18774547BC3AC11BB7B00BEF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602760, "uuid": "4026c385-d1b0-4421-957a-cccadf767819", "value": "1536:flEVq18RPFFlbO3voRAP2HwbO6iqiwEyJk502CLGc6xUyiKVJu/:flj0zlbO3voTwi6iqityoRCLr9yLVQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602760, "uuid": "affd9125-4634-48d5-931b-6806438cf3a4", "value": 70404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602760, "uuid": "29472802-aac2-4d48-afab-5eae5add2b3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602760, "uuid": "3a90d775-838d-47ca-aa56-b1ca20e4c8f4", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eabb095-17ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772629363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772629363, "uuid": "6fc7d26c-9e44-43f5-9447-6a1caac630b2", "comment": "Malware payload", "value": "b9641192e2b2d64983191edeaf0b21b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772629363, "uuid": "9228a10a-4222-4aed-9f88-875ec4069e51", "comment": "Malware payload", "value": "8797355f5a05d78509f3d3eed7d6616281f5a4beb4fcf4b057f23d3d0ff199e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772629363, "uuid": "591519f2-f301-45a5-84e9-194c822c8ca2", "comment": "Malware payload", "value": "089dc5d57a72f06d2f28797446cb4f8700101b89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772629363, "uuid": "26c3ddb3-71f7-4728-89fc-5d5c3cffbe89", "comment": "Malware payload", "value": "12fd54c5eb1ec723aa3be6fcfa06901db561f45cac2e8b4fbed2c2c764a6debb24724f32f4861edad9b73e6240a14004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772629363, "uuid": "f8281dae-c5a4-439f-a925-ab706e475eee", "value": "T14E369E43E29348FCC49AD37492875333B674BC294A357ABB5690CB312F62FD09A6DB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772629363, "uuid": "d0204f12-7619-4564-af91-513b9650fed5", "value": "cef3377fc196a715575590d2243c125f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772629363, "uuid": "c4737980-e47b-4585-8893-a1ff86638fde", "value": "98304:Sx0IFs1zT841JBBt7T/K7Q3Ps9qs9iCdIEcRg85:Pj91XmQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772629363, "uuid": "4ad412f5-988b-465a-9cf5-d80ce6951ac1", "value": 5214720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772629363, "uuid": "40eceb9e-69e8-4099-b50f-186b417333f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772629363, "uuid": "f2476067-cf2a-4279-a99b-62afae31776e", "value": "8797355f5a05d78509f3d3eed7d6616281f5a4beb4fcf4b057f23d3d0ff199e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86a855e-17d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772635043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635043, "uuid": "569c20d2-fae1-49ed-82e4-947fccea0f32", "comment": "Malware payload (Mirai)", "value": "fec2346e64d39f068318ad5b19826787", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635043, "uuid": "ecbf1480-41fb-4681-821c-a4efa7cea7fd", "comment": "Malware payload (Mirai)", "value": "89784ff14c84bc78cbf7768c44d64daf59f63b8c3afa81ac25e8a17d83d955c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635043, "uuid": "2c08a121-9274-4a5c-b0d1-4625669f4fc2", "comment": "Malware payload (Mirai)", "value": "850e12d294496879d70e82117277d52699ff8fc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635043, "uuid": "98117e95-bf0d-4581-a2ca-d635e3eb2b1a", "comment": "Malware payload (Mirai)", "value": "a7ec009e6e3ae4e117c1407876bf811ea82883c88ddadc0d816bf950b9adb025e6ab14c228f72be213fe4a61e9025b35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635043, "uuid": "81488a5e-bf91-42bc-baad-e5174496325b", "value": "T128530792FC924667C2E017B6BA6E968D373163E9D2DB7217CC200B117BCA50F0D67E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635043, "uuid": "0670ec34-2fd3-4e05-9779-dfc1c0dd4748", "value": "1536:2P7gznNKRw2Zyd7AmwvZcBaOw1/F6tnYjA8Ip:4YnNKRwyX+Baon0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635043, "uuid": "f0b31285-98fa-442e-9ab3-351a4a81a820", "value": 61348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635043, "uuid": "77efe664-08ae-4eff-ba1b-df2fbcd9e188", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635043, "uuid": "9ab910e9-285b-4546-823d-9c68819b4670", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28dd5ba6-17b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620226, "uuid": "c5253677-a422-4b74-a3aa-946dc5f47a5d", "comment": "Malware payload", "value": "3a557b54fefaab739759f4dec2d065d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620226, "uuid": "d202b9d9-3fbc-4f69-a4b7-a80c0d640b09", "comment": "Malware payload", "value": "89a63487a28ab7e99863c0160b73fd7931059124e0c3b944c40b999769a7b6a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620226, "uuid": "146b74ef-d105-47b4-937e-7cd461fd4fff", "comment": "Malware payload", "value": "8c5a7a07135dac9f481572d96be27e528e53a1a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620226, "uuid": "6e33abe7-58ac-4c95-aac7-7b389ea64c75", "comment": "Malware payload", "value": "e40a152cc259fc5502cb0ffd83f4bcf5e425266af833e12c1996100de6ff0ab13c1077b3cf529a7ddc42d139414d6783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620226, "uuid": "65cbe3b5-9d53-4b96-a6f6-64de6d95f6ce", "value": "T158C47C26B79852F9E157D174C6834512EB72788A0B31A6CF43E04A6B2F676F05F3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620226, "uuid": "7725d9bc-23ae-461a-9bcd-7ca8db358f62", "value": "335a44a7c6aba03c5073c57d302e6493", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620226, "uuid": "01ccaa60-7915-4013-b443-be60f593b628", "value": "6144:0wA5zejBm1w+UWdbNN5gymt7kSGQlWIpHCWPB3ZXIcikz34ew8lhTnB2LIsVF:ie0UWdb/d+HCCikz34e5lh12LIsVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620226, "uuid": "bdf7e2f7-4ac9-45c1-8aae-1a8e4d2f7b0c", "value": 583384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620226, "uuid": "5d2466c2-f220-4b26-ac91-caeb279f4213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620226, "uuid": "a65a0459-0bda-4b10-9933-1d288d50dc7b", "value": "89a63487a28ab7e99863c0160b73fd7931059124e0c3b944c40b999769a7b6a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859b2ddf-17a6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772613939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613939, "uuid": "0c28400c-cbd9-46e7-80e1-01a63bb94616", "comment": "Malware payload (AgentTesla)", "value": "0ec79bdf4c6437587af2409cf290f1fc", "object_relation": "md5", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613939, "uuid": "b50d44a6-8f1f-4ed5-bf7f-994bf7d8f360", "comment": "Malware payload (AgentTesla)", "value": "89be2c104b435e94e1515b375db569eb0f7742e9a60feb48448bbb6accd0bfcb", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613939, "uuid": "9bdb8a8c-06db-469d-892f-d6440e34297d", "comment": "Malware payload (AgentTesla)", "value": "566909a177f8af93cad106ebc54e126d68da3c1a", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613939, "uuid": "756be1ee-a4d5-4a6a-9e96-67dfdeed4ead", "comment": "Malware payload (AgentTesla)", "value": "135e7fcd91ba3a856211f7f5583247dce80d18b5f581395515da24dc90a54be6af4d632d8e4c5db817290136652a1189", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613939, "uuid": "11942445-4a2d-4b2d-9af3-fe0c594cb9d3", "value": "T15EA3127550DD3BE255BFCC3AC0C688F043225D9EE4E6D22ED2962524AF46BC9F4035EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613939, "uuid": "39a6cc1d-9737-4bc4-813e-bd6699775a22", "value": "3072:V0e27x+EaRCFE8E8wg8QDF0AOE80iFFya6:V927USd26F0AOE8l2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772613939, "uuid": "4c7fcb93-20c4-4850-969a-d29517c4c189", "value": 101955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772613939, "uuid": "efea46ff-339e-4ecb-9b11-83a89a0c66cd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613939, "uuid": "c17c578f-0199-46f1-ad82-d23928f3e91b", "value": "04-03-2026-00291.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20412c9c-17d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772634385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634385, "uuid": "85270a78-3332-4a26-b921-e2a0f78579d7", "comment": "Malware payload (Mirai)", "value": "5e3af0f1e6180d0e02671a071cf0b4f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634385, "uuid": "c7b6a129-c067-4a7b-864b-ac9f93df1f30", "comment": "Malware payload (Mirai)", "value": "8a4751a9340ea9d1293dadf7f6629879c2092d412790589b36b1807f6dfc294c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634385, "uuid": "59170016-f5f6-48af-892d-5ca1da849e2b", "comment": "Malware payload (Mirai)", "value": "574b2e206bb92608d0d2b9c228f1d276b3dd437b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634385, "uuid": "d202ad01-98e8-4672-8170-daf3ef3f7e00", "comment": "Malware payload (Mirai)", "value": "7ab132add025178aa181d314aac8b39b2307e2dff933161dd5da6308e31034417d82d55a0ca5cfaf76fb7c0b30deef9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634385, "uuid": "94ff61f6-48f1-4513-9fbc-26b2c971e19c", "value": "T18C934B07B5C1C0FCC48AC174569FB63ADC6271BD2238B1AB73D4EB222D89E515E1DE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634385, "uuid": "b78198e7-7778-4fe5-9407-5d271579776b", "value": "1536:LdpK6YjC+BnWjOtBN5KRJ7eaZTtb2Xvko0uq1khQM/PQoKwMCIPYHT8yN:JnYjC+xWa7o7eajUvk8q1khQyQoKwML2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772634385, "uuid": "17e465f8-fd87-4fa7-84f9-3d7abae42860", "value": 92384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772634385, "uuid": "5a61682c-b100-4fab-9434-667393a3eb3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634385, "uuid": "a77833bd-229a-4e5a-9c8d-989f2ce1964f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c09b480-17b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772619856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619856, "uuid": "f3c59ef5-8703-4fd4-bdde-12524f36e541", "comment": "Malware payload", "value": "7a27c5dfc75741dd76b006aca62181c0", "object_relation": "md5", "Tag": [ { "name": "Astro-Bright-LTD", "colour": "#65023F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619856, "uuid": "3b1923df-f99b-41f0-9eeb-588fafc39044", "comment": "Malware payload", "value": "8aa70fdc57303e3a5efc82d2b4a5bbdba6587fb17c7be63647014eabcf05e591", "object_relation": "sha256", "Tag": [ { "name": "Astro-Bright-LTD", "colour": "#65023F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619856, "uuid": "43060ede-c105-43b8-aebf-c5ca468619e2", "comment": "Malware payload", "value": "e6fa86a71791ca6d3ec32f5c74abf257fbe5cf15", "object_relation": "sha1", "Tag": [ { "name": "Astro-Bright-LTD", "colour": "#65023F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619856, "uuid": "21a32a5a-ba16-4ef2-8bb5-6c7ccce77b8f", "comment": "Malware payload", "value": "99491575415fc2b2969d842b3ce39bcc61cbec43f26d356ee4530d1ea1ed9078c0edc630a3550cc94348d2e6aa005fb3", "object_relation": "sha3-384", "Tag": [ { "name": "Astro-Bright-LTD", "colour": "#65023F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619856, "uuid": "bed94b16-dc8f-4d49-a808-8f5b6de5cf0c", "value": "T1D804F1A577BC1563DA7F1F7A2278D0920E3266177959C38E09C931E86D03B431AA13BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619856, "uuid": "f4f46aa0-7369-4668-a572-59eedd24f0c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619856, "uuid": "2394f448-9dde-48c1-8c35-623ac6d5bc8b", "value": "3072:h7aOEQacfD60wjBLnSYLsL7GP5OfyYnFr106ZTIJSUacaiBMNQSYy1dHVD:5aODMVLnHS7GP5OaYnxNZTWBacaMNQH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772619856, "uuid": "031d1256-2685-4ac8-9fd9-705cf593704a", "value": 180472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772619856, "uuid": "7bae50a1-50a5-4421-a4e0-be9a1e7607c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619856, "uuid": "49d18cce-4a35-4bcc-b70f-0bcd5b90445f", "value": "8aa70fdc57303e3a5efc82d2b4a5bbdba6587fb17c7be63647014eabcf05e591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520a635e-17b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620295, "uuid": "772f6cde-5998-45ae-9d7b-dc83f3315ab7", "comment": "Malware payload", "value": "72a849face42f2b9d2ae134c3ec1dffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620295, "uuid": "f558ecef-f7b6-46e9-9e1d-b468cfbd8d8e", "comment": "Malware payload", "value": "8c9d9150efa35278afcb23f2af4c4babcc4dd55acd9e839bed4c04cb5a8d9c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620295, "uuid": "e85012b0-a70e-4d60-8260-a61a6589931d", "comment": "Malware payload", "value": "9bd843799ce5683b3dfeb8e9034f6d4dcf2fa468", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620295, "uuid": "8bb4ab8f-4783-49e9-8f25-2b8ebc04b88f", "comment": "Malware payload", "value": "58937560f94a4a813f8215f2c22a230a1a04e89be835b5b2d2c4cf1c8550f5b0d8800edfba975ab3a87070c0abf583a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620295, "uuid": "000ca780-5c51-474b-aee7-2bd45843a297", "value": "T114F633C0B36128F9DE9AA33E95C42A2B51C1B8660BB4D94F2BFC5B6508171D8FF54F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620295, "uuid": "bc65829e-2965-4155-b7f1-50d67c453d2d", "value": "c005b4cd3ff755ef7b24e8e7196f0aef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620295, "uuid": "0a973825-6cb8-4782-8150-7143e4e76a3e", "value": "393216:W9W8Mh9XMCHWUjYrRQ7XbFsn6ELwzr5ikOnZ3oV1p25vN1:W9W8a9XMb8YrRQ766Sur57GSVO5vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620295, "uuid": "66cfef88-7bce-4225-a964-51c1fed2a838", "value": 16409928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620295, "uuid": "301da91c-8d83-45af-bd4f-3ef8c5b3f8ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620295, "uuid": "007e5a45-b096-41c2-b3e7-d7337fd01654", "value": "8c9d9150efa35278afcb23f2af4c4babcc4dd55acd9e839bed4c04cb5a8d9c3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df83a34-1806-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772655212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772655212, "uuid": "2738f7ea-64ef-4d99-a9d2-f34300baea1b", "comment": "Malware payload (Mirai)", "value": "a8401e5b434b15ec3b9adc896a66ad00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772655212, "uuid": "a023cf42-cab6-4eb8-9b9e-a558dc16de5e", "comment": "Malware payload (Mirai)", "value": "8cc43f0982b982a6b65a84d4172d16c200b6750c01f32217b614b401e0d83a12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772655212, "uuid": "63f1bf55-c3e8-425a-aeb5-2840dd9dc05f", "comment": "Malware payload (Mirai)", "value": "7d2aa4742c76ecdb82e7e96d3f76ab4df72ecaba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772655212, "uuid": "42c13a94-4458-4930-9983-f798c0117b83", "comment": "Malware payload (Mirai)", "value": "1459aefad0b26bd925f9ba78e1ee1772e26422a400a303cfe990d8614aa75f54b55467cdd44b9e5bc2e235f6793542cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772655212, "uuid": "33867a10-3bac-490a-b661-b4756307dcc2", "value": "T16514961E7E228F7DF668873047B78A24976933D627E1D644F1ACC3185E2025E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772655212, "uuid": "0fa4e68f-a1bd-4bc7-81fa-08b0fe90d168", "value": "3072:GENCNpbTtoYASU7aCDO+ennsGso5ZkV046JzfFlkZ8iTb/M3:GENCNpXza72sGlyVmJzfnkDTI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772655212, "uuid": "439d8e3d-692d-4ad0-9d90-ff4d96a40e9a", "value": 207508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772655212, "uuid": "5133e2be-4e4c-4e81-9e6b-d2c1182bbb0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772655212, "uuid": "4397ed87-c777-440e-911a-0e8321b31ceb", "value": "csk_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b70bea-17db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772636549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636549, "uuid": "5810d155-7818-40b0-800a-1fcf07c2974a", "comment": "Malware payload", "value": "15665eceedf3655956928b9e8ce6b57d", "object_relation": "md5", "Tag": [ { "name": "77-221-149-33", "colour": "#65979A", "exportable": true, "hide_tag": false }, { "name": "github-com--Jenazzz", "colour": "#0EB039", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636549, "uuid": "31927482-cbfa-4933-a5f3-34b0a56ef837", "comment": "Malware payload", "value": "8de112b105af427d2fab13d8db89c95f53ac437597a78a083d2eb7d6d2322f2e", "object_relation": "sha256", "Tag": [ { "name": "77-221-149-33", "colour": "#65979A", "exportable": true, "hide_tag": false }, { "name": "github-com--Jenazzz", "colour": "#0EB039", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636549, "uuid": "abe56c48-dc3b-4b5b-836d-c4508aa162bf", "comment": "Malware payload", "value": "5218275e85afddb9d5a2ca5b404b814d2e8d62c9", "object_relation": "sha1", "Tag": [ { "name": "77-221-149-33", "colour": "#65979A", "exportable": true, "hide_tag": false }, { "name": "github-com--Jenazzz", "colour": "#0EB039", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636549, "uuid": "91099bc5-e2ff-4a98-b286-e8fc79cf1e15", "comment": "Malware payload", "value": "fef9dfdb1eca96fb55dd96521aa8e20aec62c022dddf65f00bc3733cb98a4392e53f9dba82d9060f2717ad8b604b20e1", "object_relation": "sha3-384", "Tag": [ { "name": "77-221-149-33", "colour": "#65979A", "exportable": true, "hide_tag": false }, { "name": "github-com--Jenazzz", "colour": "#0EB039", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636549, "uuid": "f29e890a-9608-47ec-8290-c3a163076a86", "value": "T129D53337A1943293FC8A39E659844438CE3DCA964D860F97DC732517D62A89B5CCE32F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636549, "uuid": "b16aafb5-cbf3-454e-b9c6-6fe72e345934", "value": "49152:QZHliIeKovv9XTXpWumlHTtL8ZrElAyD8ugvjqJD8Ew4eqgvjqJD8Ew4eH:9Gotj5W5BTtIlElAVugvWDC4eqgvWDCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772636549, "uuid": "2134d375-e0b7-41ed-9628-155a00ce129c", "value": 2954356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772636549, "uuid": "130945f2-711b-4246-ac25-724e302c76bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636549, "uuid": "cd150974-c5f1-4757-ae57-d91f8a008a40", "value": "test1-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5780e8a0-1810-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772659389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659389, "uuid": "bae33222-0a67-43dc-8aaa-471b93b9f185", "comment": "Malware payload (Mirai)", "value": "f6e28de2870b8bc96906e58dfe9b348a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659389, "uuid": "22f54dfa-04d2-4234-9bfb-0545095cb09e", "comment": "Malware payload (Mirai)", "value": "8dfeedded25856f1896d40a1d2b13172cafda1f725a3fd196fc7b0527791fcc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659389, "uuid": "b131ffcd-03ab-455a-a847-040e31fd531f", "comment": "Malware payload (Mirai)", "value": "9ac503fc2ce6a60c776c3f00ea4b66b80027817f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659389, "uuid": "ad154a22-131e-4e8a-9968-c33fdacf065a", "comment": "Malware payload (Mirai)", "value": "aa9bf6380300db0dae6f21d2604fe376b7b3599a9dde63fb80a665faa922bf801f6b6b89998c2946a240b2f3ceb3caa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772659389, "uuid": "86de64f7-d0f8-4659-99d9-33a71672e87a", "value": "T1AD73FA82B9D1952AC5C063BFA66F619D3361A3F1C2CE3113E8A74B11378716F0F26E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772659389, "uuid": "0590cd77-7461-4970-954a-6958840303b6", "value": "1536:oRYdrkJ1fOofAjttt24vR2eFZkjdd/d8CdJCARnMHwyG9d3o:6Ydry1mur4vR2eedcwC9Riq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772659389, "uuid": "fb27400b-585f-49fe-9855-6421e9436f15", "value": 75256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772659389, "uuid": "a24adbe8-0c52-426c-bcb6-d41a4f2623a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772659389, "uuid": "13989633-a39c-4d68-9a5a-fa9e33c5da8a", "value": "Polar.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da740f1-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602759, "uuid": "6ec1aa23-d17d-4ca3-86a8-824b2bf4e586", "comment": "Malware payload (Mirai)", "value": "441381af020662a0d75e4a55215202a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602759, "uuid": "83c32887-3c3c-476e-8789-96efb48f92cf", "comment": "Malware payload (Mirai)", "value": "8ebd589d1536d3d7082f8e4806796992829534a472858412773815b0c14866b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602759, "uuid": "bc5e98d9-c732-41a0-96dd-dd02e1f90ed3", "comment": "Malware payload (Mirai)", "value": "b79dfceb41d814daf9c43620427cebfde0003fa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602759, "uuid": "a442b1ff-6f81-41b0-baf2-42d1944ecbef", "comment": "Malware payload (Mirai)", "value": "17c6b2e2501ca398610a4f92dd6ebbceabdb1d267c6c3afd6e22565618e5d71f4a39b8d06bf0ff6e39118deed84fc411", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602759, "uuid": "cfaca88d-7ab7-4283-89bb-b94a2f5ba5e1", "value": "T1017329DBF800DD7DF80ED77B44530A0AB270A79106931B36635BBA67FD321A55822F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602759, "uuid": "9e64950f-e841-4553-b9f0-a1e27b41c2af", "value": "1536:z3OL3wr34Qu3EhvOy0sxom5zFHAZWp6wtwb48FyRXFORZkRawHUzN6NzbotcuObI:z3OL3wr34Qu3EhvOybxomPAcp6wtwfyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602759, "uuid": "e748d878-18be-4adc-90e8-574865411cc5", "value": 80340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602759, "uuid": "ac0ad3a1-7745-4aa8-af97-96754f948828", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602759, "uuid": "b76f7cd6-a763-488d-9f11-d8cc99077b92", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfab6e06-1792-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772605447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605447, "uuid": "ea8638aa-99a6-4b5b-9cb1-d0f39089c2a0", "comment": "Malware payload (AsyncRAT)", "value": "3983829eae8a35d2e6deab2bd87b050e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605447, "uuid": "9b782dd3-7186-47c1-8248-bf8a01e303f8", "comment": "Malware payload (AsyncRAT)", "value": "8ecc6f285f92c80f6ebfe4fd5501ae9e8da87dd921df1e096f682309b94aae26", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605447, "uuid": "fb827eaf-448d-42fa-8b31-efbeb8fc32ba", "comment": "Malware payload (AsyncRAT)", "value": "73d9e5461105213ede581d045efb27d1d360900b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605447, "uuid": "1ecc0219-1dc4-43e2-99fb-b0196098350c", "comment": "Malware payload (AsyncRAT)", "value": "45878f8ce3159dc286d1e1942498811c13f140d4a11d1912e775f7fac1f13f1a6a5287a4e1935ce6b31ded80591ead8f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605447, "uuid": "2ea9c565-07bd-4144-a38e-dab7d16c9677", "value": "T1EBD24B08B3D88561E1FD57B94D7293048771EA4B9973DB9E1FC440AE2A23B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605447, "uuid": "b2b3b3b0-5f12-40d0-8dee-8186841cc92d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605447, "uuid": "e372d9bc-f835-48c2-9f04-c416876fab87", "value": "768:uuGRXHMMVEo8Yg/cIRGqou/Rb7fB/dTX/+:7GRXxVEo8B1igRbN/9/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772605447, "uuid": "6a9bc26f-77c1-4acb-9993-ae0d717d9f26", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772605447, "uuid": "7e71dcb1-c5b4-4757-accd-f98db46624f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605447, "uuid": "ce713647-0972-40b1-8b5d-acbd9eb5b533", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2211499f-17d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772635677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635677, "uuid": "4f195048-427c-42f4-86ae-32953249ffdf", "comment": "Malware payload", "value": "ff1173db5f3e912aad226f3b19d2c928", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635677, "uuid": "6cf0faf7-5023-40cb-b3c0-925258e2d7a5", "comment": "Malware payload", "value": "8f62742a2a529a12295be70321622a85d62411d064882ca18e9f871c43dbd5bf", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635677, "uuid": "945ba46c-8b1a-4268-a6eb-b1e66d6380cf", "comment": "Malware payload", "value": "39df65be8cf34c879ce8c40e02a2ecb9f04e1f47", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635677, "uuid": "39dfef62-fe90-4406-9c11-8eeabde8c417", "comment": "Malware payload", "value": "5d46c5b5c1727ea2d5973260044c2ccbc44b86ef0ef040c1a8aba9e84fe6fec5ba8c27deae47052b73a5ccfd97665b02", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635677, "uuid": "66cac111-a6be-4e91-ba01-4ad36a1714bc", "value": "T1F5051211E7A1FDFAD806433625A006D752496E23D719D00B2AD7322F18BEFB0ADE597C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635677, "uuid": "ef24e97f-a415-4dd9-a3e5-e06ecc171035", "value": "24576:8X3xuSl6rQ+iGXvllllllllllllllllllllllPpYL1gYbX4vC:qBuAYiGXp4BbuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635677, "uuid": "26ae7ecd-d09d-4b7c-962d-5f198a34f801", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635677, "uuid": "1eb7a51c-cdd1-426f-9ef0-17d348271815", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635677, "uuid": "d2505b9a-c7a1-4acb-ac1f-85deb11d1e0b", "value": "8f62742a2a529a12295be70321622a85d62411d064882ca18e9f871c43dbd5bf.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676828c0-17ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772616036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772616036, "uuid": "2e5cc21b-32ba-4fc8-a307-27379def98e8", "comment": "Malware payload", "value": "2a23388368faba6ef72da1dd437edaaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772616036, "uuid": "d109913f-509b-4894-9f93-2f098279edfd", "comment": "Malware payload", "value": "8f7d5bbcac0a69f50df906992873a3630e037ed227a3bf2b6892ada8dafc40f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772616036, "uuid": "43c77777-f052-4eec-9fc7-dd436698cab1", "comment": "Malware payload", "value": "a4d340d1f4354bd2bb1fcff5c4fdd81db6370543", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772616036, "uuid": "725092af-c161-40bf-a7d0-2f8341edeb73", "comment": "Malware payload", "value": "235be5297ac0fa041aab22073c42223bb3a56b9c4f89f82ba85241c33d71d7fbce00e38947e91c6466acfaab5b296557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772616036, "uuid": "4c1bc367-e758-4547-9665-5bce4db8b532", "value": "T177B5339D2DC6263AD96EC73C91C2879CB1337BE14C656D5BA3B81B593FE2C00297220D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772616036, "uuid": "63d6c161-1135-4c94-9db2-e02ae1c0081f", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772616036, "uuid": "7c5a2ed7-531a-4196-9410-34867331df55", "value": "49152:T1MVXeTDhGpuCR40dwkzx+9gUKBhBy0rd2xEdd2Egt6cs9ulzzc4G+CXU:TiVgORJdwkMCBT3x2xEiEgt6ElzzG+Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772616036, "uuid": "cef83d1e-5125-402f-a302-556d96a1b0d6", "value": 2408832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772616036, "uuid": "af563a0d-6d9b-44d7-b043-62564ad89471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772616036, "uuid": "2d9d169a-809a-4bae-a94c-53d6fb29158c", "value": "2a23388368faba6ef72da1dd437edaaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44fa0c6-17d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772634687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634687, "uuid": "23bd10b9-3f33-49c5-83a6-56594a038f16", "comment": "Malware payload", "value": "c36095ba1cf04d4d21e9b3b8e7a9473b", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634687, "uuid": "a6b2b498-aeb3-4c9a-8cda-a7ff14241461", "comment": "Malware payload", "value": "8fdd83cf4fe249630df9da5def1e79fd2c6e01c3e4f444996c73fc0c77da16d8", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634687, "uuid": "357f435b-bc25-494b-b11b-daca79579229", "comment": "Malware payload", "value": "a3d0fe6fc092a1c5494409469cc73aee4091d387", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634687, "uuid": "266ffe48-23c1-4fed-8fc3-ed985a2c7c34", "comment": "Malware payload", "value": "e7d179443b4bae236f4b80adc24f2ed81cf0fba4f2feb878906e08f2ec54a2267a3b4aa851c7232d8bffa4060b6f4997", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634687, "uuid": "64cd4fa7-e220-4243-a174-27103ed71a3e", "value": "T1969412027752FD9BF80B87751CC14D8A6117BDA10B6E041776C2B35E1D7A3E2B9A632C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634687, "uuid": "ccffb660-367f-4dca-9c2e-f4aa20b91f8f", "value": "12288:33GhUV1gZG0/a4GM5Fm/1x25gIWV6VYV:35Tgn/aV/1Wgge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772634687, "uuid": "71a53d87-56d3-402d-8f1a-1b611522a0bd", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772634687, "uuid": "0b189521-dfd1-48f0-9146-bb0431fe859c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634687, "uuid": "0ca69f5a-7f99-4771-9887-15e5b4412c2a", "value": "SWIFT CONTRACT.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6962c858-17b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620334, "uuid": "dc294c69-0737-4900-a021-346bb7c4939e", "comment": "Malware payload", "value": "b584cf657e27d3911cda44675f3e991f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620334, "uuid": "9491089b-97dd-45fc-813b-2c847318c392", "comment": "Malware payload", "value": "9187e157d8cac979e838a2498b5188f32236fce5f529b9628aa3383d5f3a861f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620334, "uuid": "18d87afa-ba09-404d-b4a6-d29d86a94f95", "comment": "Malware payload", "value": "0fc812dc47dd7205e50fda75f32bef01024aaa6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620334, "uuid": "eab35610-cb8b-4170-ad2c-919b5af2c3c7", "comment": "Malware payload", "value": "478dec6775e8a41dab416824ee6154febfac0a9ac2a3c875e41ccbb86c3e6565cae86812e3017d870fc87125f97ce7d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620334, "uuid": "eb93ee8a-0187-48bd-b649-84e2e7fe17c9", "value": "T15207338973A204E9D84AB136D8D0598FC5C2BD9A07B5D78E2FFC0B661D970D4FE28B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620334, "uuid": "78777771-f93a-43bc-b813-a79a717e2962", "value": "c005b4cd3ff755ef7b24e8e7196f0aef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620334, "uuid": "ab5b02f9-6a7a-44b0-ad64-61b7b3e44811", "value": "393216:Z9W8dRXMCHWUjYrRQ7XbFsn6ELwzr5+5bi674nZm/G6s8IUeD:Z9W8dRXMb8YrRQ766Sur5SbN74L6s8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620334, "uuid": "8ffcc1c0-e725-4fe1-aba1-8bc63f74e2db", "value": 17135048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620334, "uuid": "973af309-ba0d-44d7-b683-2b7165dd84c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620334, "uuid": "3be88775-122c-423b-8b1d-075892d5405f", "value": "9187e157d8cac979e838a2498b5188f32236fce5f529b9628aa3383d5f3a861f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3033b3-17a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772615187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772615187, "uuid": "35001b5b-7048-4e3c-8282-cd03331aa1d8", "comment": "Malware payload (Mirai)", "value": "07e8d3939a17e1a85b43304ce58612bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772615187, "uuid": "40eeaa02-cc79-4a1a-bf0d-bd9d85ae410f", "comment": "Malware payload (Mirai)", "value": "92a65e4fa18cd21fac7a1b63d19793de325807f2b75781ac56feda3b90d2b54d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772615187, "uuid": "32442f0c-307d-4f74-b187-690eef41b65f", "comment": "Malware payload (Mirai)", "value": "64e387717386b89d4a387caf4bbff74d00e2e3b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772615187, "uuid": "4a0476c0-4513-4898-80b5-c565a3ff5cc6", "comment": "Malware payload (Mirai)", "value": "8caf4e00aa212058a2b15715078cc0ba9c10f814a29c3c9d2fd9cca0ac38be3d98678b9a32456000d5b9d6fd545ac83a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772615187, "uuid": "014f062d-7097-4acf-96b6-3d92a875ecb2", "value": "T17393834D2E219F7CFFAC823547B74F259248339A36E1D584D1ACEA021D7434A742FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772615187, "uuid": "a263a76f-9f60-4235-b420-9114ce79be12", "value": "1536:hJJIw59EG23bgd9HkAcH1gOx+MiCpulQ2TIQ0IV20EWibv/HnUhxbfbCDbDbPS:vuw59EG23bgd9HkAcHjx+MiCd2TIQ0Ib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772615187, "uuid": "cee7c4c4-61c8-496b-a063-a8d6df308c72", "value": 97368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772615187, "uuid": "c8d5ac2d-0db2-4ac8-81c9-d555e813c1dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772615187, "uuid": "7908f8c9-1c17-47c7-b4ac-4c06e0966779", "value": "nullnet_load.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a936f6a-17b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772619102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619102, "uuid": "8a9ea5dc-e742-4969-b771-076cfe3c232e", "comment": "Malware payload", "value": "3abe80f62d0278e655559fa495da73da", "object_relation": "md5", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619102, "uuid": "20aaec7d-6586-414f-b805-5986f131e286", "comment": "Malware payload", "value": "92d697b24f4a83efb86c1fb6b43ee1b8d3fe9615ce316f1de52d22d1f3989777", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619102, "uuid": "9f168031-13a0-4180-bdfb-239f04f77e3e", "comment": "Malware payload", "value": "ae7b43e90349c578f2c8ca080548bf99d5ecc760", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619102, "uuid": "78bc9fdf-359d-43bf-8425-b69f7c8f7a14", "comment": "Malware payload", "value": "2a925bc039ef6481b7ea30bffdfbe8112275fa976f4a127cb70f52eb58fb41349e581b73ed5b737523d0fc89751c0ab1", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619102, "uuid": "f519db2e-1df1-4190-8536-e68c6db1cfac", "value": "T11751C716471BED440EC702949C1F7EEB14BF49020F38BED35AB992706CA867932A8CD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619102, "uuid": "7f6091e6-0f39-4115-9b80-391e770b2fa6", "value": "48:wKCRT7sC066csk8dWxZYgUFIWxVvRv3FgkTwwqMVRUNwaGirycN0+T:wz7DB6O0v3F6wqMVRU23cVN0+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772619102, "uuid": "047e208c-518b-4191-8c3f-e902ef5e96cc", "value": 2762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772619102, "uuid": "082589c2-738d-4d2f-9621-5625dffe6f59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619102, "uuid": "1c82b19b-ba96-40eb-ac9a-a7ee73176d94", "value": "92d697b24f4a83efb86c1fb6b43ee1b8d3fe9615ce316f1de52d22d1f3989777.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419d3f9a-17b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772619838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619838, "uuid": "3d6fb555-1951-4076-b703-ee7bdf0b2752", "comment": "Malware payload", "value": "e7efd76a0a7839b1de5e324c4f40db82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619838, "uuid": "81fd2b5b-b679-4514-b1ed-e8159251a5ae", "comment": "Malware payload", "value": "9323a6ba070aa02b5063aa4774cb9a13b6864526f4d0d0aec0f3932a1e21d9ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619838, "uuid": "fbcba7e3-d4b2-4762-a43e-0597146db4a8", "comment": "Malware payload", "value": "cb0621f2402aa0daab6606c97530da7bf4edebaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619838, "uuid": "04e5ac96-a17c-470d-b391-f105f98c8e5b", "comment": "Malware payload", "value": "b5137d70d657877a53266972fd6c50660a9aeca10f550ffdd1870f7cf4bdf0204fbc74307e024334238ef0ba771c2adb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619838, "uuid": "6eb862c5-ba3e-4d6a-b28d-7fd6cb522df6", "value": "T180258D01B750A51DFA2BFD78D0A2E2C243F1FC226666CB3F54B5345B5FA628F6811392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619838, "uuid": "7c34d6fb-6a9f-492d-b941-715c2fd0166d", "value": "24576:SIxHWcoBHhL/kts4WcoBHhL/ktk8OiIYUcox/V+sVX1coZMMfVU7cohy/WgVd:SsVuW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772619838, "uuid": "70dc0d4a-e6e9-4fef-830f-a07b51516c33", "value": 1045712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772619838, "uuid": "38e12f59-9876-4b56-be22-6a6c89160382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619838, "uuid": "1bd99343-267f-4e85-993f-beb297b2f7f5", "value": "9323a6ba070aa02b5063aa4774cb9a13b6864526f4d0d0aec0f3932a1e21d9ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290b9b13-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654586, "uuid": "efefbd90-5762-43e2-881c-43985d85e945", "comment": "Malware payload (Mirai)", "value": "1e209e097c77f88280bef8038b7997c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654586, "uuid": "539b9599-c207-489f-a683-287e015eb7a9", "comment": "Malware payload (Mirai)", "value": "943979c2b4ab6bde53da898fb5ae0ddc6d80fd04151a8c7c196064f2a49194d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654586, "uuid": "6bf2673c-4049-4c37-a933-a4af4cd14513", "comment": "Malware payload (Mirai)", "value": "54a6c72170b47c33b23260f8fd6b6ab2e8d50fea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654586, "uuid": "e0eb60e3-e095-4924-9025-443f1f0e8b47", "comment": "Malware payload (Mirai)", "value": "8a3f8423f2c70a98c101a75910d8eb69f184fe8180768592397eb347c9ea06abb914097b013d4a13bb1c4f60d9fcc3d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654586, "uuid": "c24d5c0b-4f3d-4320-bc88-68fceda2ecd2", "value": "T1C1B2D03C1B151B98DA1EC0BE43AD0B613CB81F2591829D9B6207EDD7AF5A8747413BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654586, "uuid": "613cf643-1f04-44ca-ad34-34ab477a740b", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiVFymdzJgGlzDpH7uNj1Jl:neD8ZSWvZHZbs1row697qohQvg9VFyii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654586, "uuid": "8c521a34-d782-4d57-b64f-5d21ae388049", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654586, "uuid": "9239b4db-a966-4dc3-aec1-bf8a994bf7ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654586, "uuid": "400c1e4f-014a-4d6a-b44e-aff994a2f91a", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0316f483-17a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772613291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613291, "uuid": "8e03092e-1839-40ca-955d-7af60dbbb606", "comment": "Malware payload (Mirai)", "value": "b57e5b5c595042376546dbe46b18aee5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613291, "uuid": "67a634e9-94c2-489e-9b93-995d5c24d34e", "comment": "Malware payload (Mirai)", "value": "952d50fbeba80966a785dc0a427b7514b7d4f0f8b13c072095bdef8dc757f66b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613291, "uuid": "f867003d-5d4c-417b-a5a9-af5e40ecb9c4", "comment": "Malware payload (Mirai)", "value": "8d999708485d75530b29c74ed674751cb63c5705", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613291, "uuid": "72312da7-6cad-4fb5-96c9-daeb3d00f23d", "comment": "Malware payload (Mirai)", "value": "32c80b8900a46782c52baefc4f5600a1deb3077d46650947188f0de72c3f7299ac7771716b0f11195aab986af5c0d5fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613291, "uuid": "6a7c0136-44db-4858-b784-f8c6513cf133", "value": "T16E7329792581F6BCEEE090B8F45320D518A20A1C37DCE1E37493947AEF74B49722DE69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613291, "uuid": "6d725fc0-5e19-48d8-bca2-a30c621242e1", "value": "768:iQEMqpCawCB0yOOe11If9TUpO7ANZFYJgD4b8YE/6AYr4BFOWKciijD3:iVMqgawCCyOxi1goURQg0b8HJbdjD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772613291, "uuid": "04a2afea-24d7-49ea-aa31-4f825810c533", "value": 75152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772613291, "uuid": "55d6ad5c-8683-4ef3-b0b1-6db553131a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613291, "uuid": "12f3048f-f7d1-46c7-9052-b16e13f271e9", "value": "nullnet_load.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b65b1c5-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625492, "uuid": "22f7a233-9ebc-4e6d-9cd9-e54343de816f", "comment": "Malware payload", "value": "d121c1a90258d353dcd6b7f3406f8f63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625492, "uuid": "77009529-26a9-44ae-93d1-334fa4547803", "comment": "Malware payload", "value": "960889d1a5896a2dc684fe6a887c6318f871807b6e3a8e5d0b18c5b088dd8104", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625492, "uuid": "3bb67908-ad72-4ecd-a60b-5d868c69006b", "comment": "Malware payload", "value": "2dc4c680a1da3c6b29efc1da85214af689256ff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625492, "uuid": "ea600786-bf0b-45a7-b580-64bcadc7bf63", "comment": "Malware payload", "value": "3754c8d775a81b4a75996a81a0f7694e531e0d6c5a7e07b0dc96dbc6d183cf149d8246a6ef4a79aac81d701da55d6d48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625492, "uuid": "5c29869c-7178-4b3b-9b5b-c29b6d134150", "value": "T12D8401D012EC84D2CDBBCF36D0A62E429EB4A672B9A1D182D485457A7E45F038F7137E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625492, "uuid": "145cee63-d931-4155-b7bb-8f5b7b98dea2", "value": "6144:5McDz4cOwijkzDzZsBS99NIdnYu7/3MfRUTgO/Gi0IJ4lci2V42JwQnPaUfOnw:dD1F7yYa/3MfR/Oedlci2fJwUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625492, "uuid": "8c2a80a0-e312-4c8b-b7c9-68288c8efb3b", "value": 388392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625492, "uuid": "86e3ed99-fdfc-4ba9-a204-3f0a360fc5de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625492, "uuid": "51afddfc-6176-44f2-97c3-665d8de799e5", "value": "960889d1a5896a2dc684fe6a887c6318f871807b6e3a8e5d0b18c5b088dd8104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18c64b1-17d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772634736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634736, "uuid": "ace1336d-2a0f-471c-9582-2ca7577f3d7e", "comment": "Malware payload", "value": "d405c88433d19f841dca340cc8630acc", "object_relation": "md5", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634736, "uuid": "6abd4cb9-610c-4d9c-b8d2-01150ab99d82", "comment": "Malware payload", "value": "96b4713c6b9e5283f9d2f570a51edce66fc44ced2ae130b65dbe1326690a27eb", "object_relation": "sha256", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634736, "uuid": "2853faa2-117e-46af-b2bc-6176afd38a3d", "comment": "Malware payload", "value": "037d4bae67f88c73447600491a5c38cc74f6f687", "object_relation": "sha1", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634736, "uuid": "f56fffde-6a00-46b1-b513-ad0437e795d1", "comment": "Malware payload", "value": "7c14a7e7f924caa76491ff5ebb2a0145d381594db749a80b8915c28314ee111004e0570297a0b045689f876eba402d21", "object_relation": "sha3-384", "Tag": [ { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634736, "uuid": "daab7f5a-6488-4813-b24b-20d4399c8d04", "value": "T1F245FD32D8078061FDE3657A0CD0AEC662230914BBF59CDD5999C4FBCE18B1A78BB476", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634736, "uuid": "3d61fad7-3bc0-4a3a-847f-89850139e005", "value": "3072:pbbmPti+OjPnmkZwiehPi7asZk7zZCuZRJG1SlhPFICkv6yNGZyY57PsRzX:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772634736, "uuid": "33bb9623-30ce-46e9-b539-efeeebe967e3", "value": 1253069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772634736, "uuid": "3330a7a0-f72b-4e8f-b0e4-e480a2a00ead", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634736, "uuid": "babd9ed7-7bf9-4bd9-998c-2cd3a2aeef6a", "value": "96b4713c6b9e5283f9d2f570a51edce66fc44ced2ae130b65dbe1326690a27eb.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039a5945-17dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772637344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637344, "uuid": "35084dfb-69ea-448a-9693-9aa28ca865d7", "comment": "Malware payload (Mirai)", "value": "ba1a071024334673ebb85435925b3da2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637344, "uuid": "8b483ca5-be77-4375-9f5a-56162bb8e260", "comment": "Malware payload (Mirai)", "value": "96ec8a2eef26d21e296ae2297f421f7bbaff211298bf1283eb7b5cb1c2899fbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637344, "uuid": "83dc5a2d-0a1e-40ab-84c5-a43460be9780", "comment": "Malware payload (Mirai)", "value": "5b4c8afadc454508de9272b00e457042eec37d7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637344, "uuid": "e0f35b00-dbee-4c37-9861-662e955e175e", "comment": "Malware payload (Mirai)", "value": "dae67a01da20facebfbbfa623054baa0f055fc3c7ea995cd8ac44dd816af2a656ac37d9ee050ba79de03fcd9837caa39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637344, "uuid": "5a180b20-f718-4976-808d-318148c4c60f", "value": "T14C040846F8C18B11D5D111BEFA1E518E33235BB8E2DE7212AD256B60778B8BB0F3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637344, "uuid": "1652fd72-474a-4c86-885a-0375bbbb18d0", "value": "3072:J+r0pi7SeLx8cCreBbQhzqxmSXDveWpaDXXIQX2Lq2gTnh1ut:I4pi7Tmjm6zlSXDveCaL8Lqbjh1ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772637344, "uuid": "6c4b10e8-b6c2-4a4c-aa3a-3fb890f06012", "value": 189180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772637344, "uuid": "d82ff04a-4639-4393-87e4-4f4175d8fde7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637344, "uuid": "648e7362-28fa-4483-a6d8-542a6cf88cfd", "value": "Polar.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3a50ae-17d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772633919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633919, "uuid": "f1b4cf88-a990-488d-b9d0-0cbb543417ba", "comment": "Malware payload (Mirai)", "value": "a53f9413e0b952daae98a59f0022dcfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633919, "uuid": "7f3faa40-41d0-4877-8af8-ff0a9fb310f1", "comment": "Malware payload (Mirai)", "value": "98006513b055d98a7ce679aa4845dd5273f1cccdde2a927dbc116cda4e2b5ecd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633919, "uuid": "3dacfd5b-f811-41f0-8e29-32cabfddb494", "comment": "Malware payload (Mirai)", "value": "389522013c9f1e91658e38d451eeb71ac485455b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633919, "uuid": "d0cec4f2-778c-49fd-ba13-2accbe85c173", "comment": "Malware payload (Mirai)", "value": "c90bb1cd2b02e705541e375285c2c39127fd5681333fae7585c3f254f59a6c444ee7819cae2eaf0d43d07354c9848a1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633919, "uuid": "c96086e1-32bb-4898-bf0b-c86d9bfbd310", "value": "T12513F1A227857E80C324453ADABCDB843693EF7D95B4FDA36159018D81C8C0DB778ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633919, "uuid": "88b53b19-4d38-4d08-b870-38ce9a84ce32", "value": "768:xkg6xJxanpRwuViQZ6GzDdj827dbXb6qRi2sStYDjs3Uoze:xQK8uViQZ/zl8OpdsStYDOze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633919, "uuid": "855d8b86-5177-4a4f-9d12-747423d17763", "value": 43700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633919, "uuid": "efa1aacf-df2c-4c2c-8fc9-6441d2d4b8d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633919, "uuid": "264ca1b8-0a3b-4a8b-87d3-9e32b0844c6a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cbe1c3-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625670, "uuid": "698fc304-854a-4c2f-b04e-ddd59bba7399", "comment": "Malware payload", "value": "421f7ecee2da17a8664e10533214a554", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625670, "uuid": "fe298c5c-9d62-46ae-adf9-48a2af4dbfc7", "comment": "Malware payload", "value": "9892f85925080f8c0929f337133280b8d1dce5ff311cfd0a2a56c5a968cbc304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625670, "uuid": "a91a501d-4219-4b7d-8814-73cb45223378", "comment": "Malware payload", "value": "55d050db9af3b04297cdec901ae5a72087cba9af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625670, "uuid": "c404388f-2119-449f-b809-c40b10ff570d", "comment": "Malware payload", "value": "87ae688c3e6f9ac411d4a07b26bc6d2a739110dc9076992025288799a477ce4092d91a659bfcbe9b9d8eb5224c474bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625670, "uuid": "a2d7a2ac-1566-43ab-a966-4531c41ec23c", "value": "T1348401D022EC85E1CDBBCB36D0A62E418EF5A677B9A2D241D88105797E46F038F31779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625670, "uuid": "2d0774cb-3ad5-4517-af31-e5bbbf0a86c1", "value": "6144:2Dz4cOwijkzDzZsBS99NIdnYu7/3MfRUTgO/Gi0IJ4lci2V42JwQnP6DZ1qF:AD1F7yYa/3MfR/Oedlci2fJwU40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625670, "uuid": "bd7f4488-4d3c-4f51-848f-43440930a9fd", "value": 386000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625670, "uuid": "61a59b47-a4c1-4e99-85cd-c49dbe2754b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625670, "uuid": "bd483fa3-e6bf-415b-a4fb-f56377ba0901", "value": "9892f85925080f8c0929f337133280b8d1dce5ff311cfd0a2a56c5a968cbc304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731d0647-17da-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1772636242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636242, "uuid": "8f72a7eb-0372-445b-8825-a59eebc8cb42", "comment": "Malware payload (ChromElevator)", "value": "b6ef1cba60d9ee2e3463ae7e16fb583a", "object_relation": "md5", "Tag": [ { "name": "77-221-149-33", "colour": "#65979A", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636242, "uuid": "14cd4bed-e3e9-40fd-ab55-0d31b4646aca", "comment": "Malware payload (ChromElevator)", "value": "98cd9e5c0b8e8692e7070e8b572fca87b694f5a13ac642c601ccb98ff72d3b85", "object_relation": "sha256", "Tag": [ { "name": "77-221-149-33", "colour": "#65979A", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636242, "uuid": "078fd991-698d-4f19-a6c3-75ed9e7753b3", "comment": "Malware payload (ChromElevator)", "value": "060f825c7325ac1f20749b3eb7d1146dad191532", "object_relation": "sha1", "Tag": [ { "name": "77-221-149-33", "colour": "#65979A", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636242, "uuid": "37b53ecc-aca5-444c-9900-ae15ac6e0c56", "comment": "Malware payload (ChromElevator)", "value": "653b07194455089ccce8f3a73fa0075f1f8308a6915c090f91bf9bc64d4a55b354af076e5f6dfefde69ab0569baffeb9", "object_relation": "sha3-384", "Tag": [ { "name": "77-221-149-33", "colour": "#65979A", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636242, "uuid": "a203ffae-9f76-44ef-a923-91e65eabc5c2", "value": "T106646D16E7A414FDE5A7D27DCE428906EB72BC4A47A0E7CF13A049922F136D05E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636242, "uuid": "a7dc40c3-0b6b-47a2-ab72-ec3136f4bb9f", "value": "572effc1f3dce76e3a309bd98868a84a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636242, "uuid": "2d7f9fe2-35df-4992-b973-0b8a3b940a48", "value": "6144:Lms45s6lyr5SO5GacSIki3tjBy98fiTE0HA:y5NaGbSpuB28fM1HA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772636242, "uuid": "c69e8c6d-0de6-469b-ae6a-cce62fca4a95", "value": 331552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772636242, "uuid": "d5dd5b61-2ff8-4ec8-a040-d5c6ceb8c876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636242, "uuid": "c82791a1-0cd7-4783-8ef5-d9527f3c3882", "value": "98cd9e5c0b8e8692e7070e8b572fca87b694f5a13ac642c601ccb98ff72d3b85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d030d58-17d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772633682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633682, "uuid": "2612c041-46ef-4f3a-9ed9-36868f996e16", "comment": "Malware payload (Mirai)", "value": "3f9c5f03ebc995342c53235f90d3f5e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633682, "uuid": "e36e50c3-6579-4b9f-b699-82a13021a586", "comment": "Malware payload (Mirai)", "value": "9b74c3e233c6a8f3b5e76e2b537987814de5378f3b31cf9fefb1ce473d731c27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633682, "uuid": "65418a5d-cf62-4e6e-a617-a8ca56adeb5f", "comment": "Malware payload (Mirai)", "value": "f1a25751481921515a8380919f35577a5fd05c93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633682, "uuid": "7a3122b9-a169-4103-94c6-4cbb4390b1f2", "comment": "Malware payload (Mirai)", "value": "a77ab7989fc139c4b2574cdd133570a222648072b523a556d41a674fb7f5c00053305aac8555129dac9cf356a1d9198e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633682, "uuid": "dd25ba7b-52b2-4c6e-925a-8b0fd0a67822", "value": "T1E32302C8AD46F6B08B7200F594DBD047AA8E4775885E364336C4150C88B9ECF53BA7E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633682, "uuid": "434ca990-6368-494a-ac91-5c0e7bc05d61", "value": "768:JENYiPvToMcT0AhEnf23MDhXB87uPpk25VKSsMj1j9q3UELlW:Jov6TQf2c9XBAckCKvMILY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633682, "uuid": "86e57043-50e1-4c65-817b-0fd34bab0986", "value": 46832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633682, "uuid": "e43eed61-a81d-4524-98ef-f3bbee4eec6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633682, "uuid": "85b908c5-b0b9-4b33-9010-42fb1c35dd48", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678fc949-17a6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772613889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613889, "uuid": "e60f714c-8f53-475c-b1d2-a1f855e7e476", "comment": "Malware payload (AgentTesla)", "value": "157831e04784de30e609811d500e6a59", "object_relation": "md5", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613889, "uuid": "8806090f-9b34-43ec-9cc7-ff0bcbc75f5c", "comment": "Malware payload (AgentTesla)", "value": "9c309ee5176afa3e10f6f865558306eb8b19a605a503851d0a3ce751362dbb96", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613889, "uuid": "d95c3e54-6bab-4b8a-8685-d5f2429b281d", "comment": "Malware payload (AgentTesla)", "value": "a39dfb50ec831cbe2e750ba5ef1f8bd50b5dabba", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613889, "uuid": "24b5fb09-95cf-4672-8160-b53a76fa2435", "comment": "Malware payload (AgentTesla)", "value": "7e01d7510cc129cac79477f9395f927d483b5c5a5b41624cbafd04ffaf7438b0f950d69dca77c25ff61dd7417028d91b", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613889, "uuid": "6fcc4122-c42c-4b70-b7de-3588f29b492e", "value": "T1FEA312FBA01D4593497C02B380E3B79EA774511AF092BA6EBC500B51A3D743783B66A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613889, "uuid": "7985cb1c-0630-4e14-af19-c4baa3f9338b", "value": "1536:ME5j9ocaPUoA4S3IKIpUc7M7tsqNKmuPz6lNSPaR3mrDjdLRh4L3VZjX0Tg:MMacyUokEUc7MkPaSaWrDN4Llug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772613889, "uuid": "5463ad13-a133-46f0-8613-4f83ae285669", "value": 100469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772613889, "uuid": "cae33276-234c-43b4-9489-cbe6e11c7863", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613889, "uuid": "61fb758b-ae1d-4202-a68f-89d9efbc3bc2", "value": "invoice202767904595.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf158b52-17a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772614492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614492, "uuid": "0268cdf7-9c8b-42bf-ba5c-f4e3d1050c75", "comment": "Malware payload (Mirai)", "value": "7a42f06baa8fda7f26e91b2240183484", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614492, "uuid": "b7c9ba50-9574-43aa-9724-4783c63e3be6", "comment": "Malware payload (Mirai)", "value": "9c42c8d446d50efbf0c526a56ee5c55cccac24885c030bf5c1110fada30cd7fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614492, "uuid": "40c98358-adf7-4172-a863-abe20adb1022", "comment": "Malware payload (Mirai)", "value": "59e9630e45bbdc9065c8e58190a6d923fe3d7949", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614492, "uuid": "b79dd45d-e173-47a5-89a2-604c901a6264", "comment": "Malware payload (Mirai)", "value": "2439e5ac052d2f545c9b18a53750f85e078914233f21f785b76d03c161f72fc7196b7b4fe644ff056688d15c59d17a23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614492, "uuid": "0575c2d9-d315-4ba4-a67b-b3baa6b02801", "value": "T145737C21AC792E12C0D4D6BE12B78765B1F6234F24A4CA6D7E310F8EFF505E4A6172B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614492, "uuid": "43072851-5cb2-46e5-a540-aa304989772d", "value": "1536:6f4Vjq873S3JiIzF6K5rRGgWu4naLZAiDHg:MIWshMGVyZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772614492, "uuid": "02cb5200-82d3-485b-bc60-61d7e29f8202", "value": 76960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772614492, "uuid": "b6532617-6169-4eb3-a2aa-98ca9d0c300f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614492, "uuid": "612a71e3-97a7-43f4-8e3f-aa749df288f4", "value": "nullnet_load.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b775162-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602755, "uuid": "e35ee0af-d3bc-4880-acb4-41aabc869102", "comment": "Malware payload (Mirai)", "value": "0db9bc32220830c8aa10d9c8ad376a6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602755, "uuid": "1ee474d2-4af9-4fe6-b6f1-7f29e0b852f2", "comment": "Malware payload (Mirai)", "value": "9d328ab9679c785c413beb9fd4e218c83381c4889d7d4025b1fec7f415107aa1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602755, "uuid": "3bdd9532-df0f-4c07-a385-25bc71abf4d8", "comment": "Malware payload (Mirai)", "value": "c0a6f53e139f92c703f99681b067580d4b77482c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602755, "uuid": "01d150c3-aa57-457a-9cf0-83edd24516ff", "comment": "Malware payload (Mirai)", "value": "90414e881187f254c79283caf61a7a3056d694acd1eb8de791f42329f898f22bb5104289594ff5a105792186a37f1aa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602755, "uuid": "dbf75929-c45c-4c4f-b996-dd41be197ba7", "value": "T1A4630202531A6448E600C0BFE48C6B8577991EB5B29D70970F85DA3CA1EED091DBBE6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602755, "uuid": "62ec8c03-a418-4d52-9b55-3a086f0a1526", "value": "1536:7EeO3P674DTgkfxqjBss0R+d0uFMMDnlgw9M+PUze0OikYTVxlLm:7Ef3PpfgsYms0u3FBDh9FPUebzYTVnLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602755, "uuid": "38f9048b-1df2-4298-a8e1-1be006e3d48e", "value": 69896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602755, "uuid": "c27411c6-4f9e-4cbf-8533-c66394978eaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602755, "uuid": "59079555-0b3c-4f11-bcbd-a7554f9c5379", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2b96df-17c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772628505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772628505, "uuid": "f520de87-44a6-4dec-a405-3b29c04dc13f", "comment": "Malware payload", "value": "de656d5a76e75440660d60af75236aef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772628505, "uuid": "e7d510ee-23ac-4dda-a0e3-4fda786f3807", "comment": "Malware payload", "value": "9f59231fdd161420b0f849af013dbe269633e09bac5bb52331fc0c7066a72f2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772628505, "uuid": "b78bc18d-a61d-4f60-a5b8-c132a57fcbae", "comment": "Malware payload", "value": "158990675bc7331192ed7a420de703e7bc889792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772628505, "uuid": "d9f4f3bc-7a7f-4a9c-a28b-b6fa89d9cf42", "comment": "Malware payload", "value": "d695bb6d5b0ce080763344fee329f238be273000dd2c54ed9d097db9fb9704196952b32a83e322ce8da4bfab32852303", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772628505, "uuid": "8d70b80d-842a-4fc1-b4a9-41502a111917", "value": "T1F3932A33E6B380B9C0ABD170EFC6AAF26771BD644034B35E07548A147F4AA215F7DA85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772628505, "uuid": "3e42fd7d-8db1-4123-a4f2-4ab644f8d500", "value": "f7f1cd840412a3bf77fcf49b2d53de8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772628505, "uuid": "a1567e42-ed4d-41b4-8281-97283f0bff03", "value": "1536:LVMA2SFcR+wsTLtEXA8lIFYC1ETTd827bMoI79onH/OATWr5oXZcJP5L5DgD:WocR+wsTLtFIIF1sThO7uVTqoXZcJP5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772628505, "uuid": "05233381-6d21-4049-b135-64c82291826e", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772628505, "uuid": "f1a4f05a-69d0-4441-a8c0-a968e63eaddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772628505, "uuid": "a6b4f819-5e87-45a6-aa57-298b32ae1636", "value": "9f59231fdd161420b0f849af013dbe269633e09bac5bb52331fc0c7066a72f2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6d7666-1802-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772653491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772653491, "uuid": "51ec502b-07c5-4bc4-b6a7-a6abec9a311f", "comment": "Malware payload (Mirai)", "value": "a8862f4f1106394f184d6b1647c14cda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772653491, "uuid": "eee7cd0a-9aef-4fa8-b3fb-7a1a69781078", "comment": "Malware payload (Mirai)", "value": "9fe26afe99017913dea727398b5ae5622b72ef17df196907c007fa268f82b1cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772653491, "uuid": "4d2436f7-34aa-430c-adc9-979c82f35b50", "comment": "Malware payload (Mirai)", "value": "737c9af2fb3ff7ecddf5e26955d31a191d8454b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772653491, "uuid": "7be73548-1393-42b1-8c71-c7def2036ab6", "comment": "Malware payload (Mirai)", "value": "c460d9ae22eb3123ed46d73ca833770c7009da9a3eec7946357da157d47015154ae9d9fb62571fa50e72b8f7b263ec26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772653491, "uuid": "f99b7f9b-8daf-4a0d-8e10-6652b8d3fa26", "value": "T1405302F1D06E9F40EC5DFA7050A3CC8633614EBF3186B861A19E5BC216B254E352B5E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772653491, "uuid": "285c2a52-d7d6-4fab-9b4c-87d7f172d215", "value": "1536:keP8PWdD14K0iVtnszgmPXaKCqPb257enz6ZoK4u+qgw09B:kesGB4niVhYPDCqaenA4u+qgwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772653491, "uuid": "79789787-86b0-4a78-9ee8-bbf59aa1c4d2", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772653491, "uuid": "06a3da7d-c0f3-4126-a126-7714a8c4da0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772653491, "uuid": "d85846c7-b454-459c-98f9-77f0ab34cd11", "value": "Polar.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ebcaf9-17d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772635541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635541, "uuid": "70fc98f5-321d-48e6-9549-21f8615dc0a3", "comment": "Malware payload (Mirai)", "value": "496e0b70d2d63790ff6bb065fc6557ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635541, "uuid": "6b6d5bf6-61a9-48ae-a828-c62245552772", "comment": "Malware payload (Mirai)", "value": "a06305ee00316a0dc3d45106b9aa5b8fe3e9b6ce6f574b73b9d5de3e093c4511", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635541, "uuid": "a104f836-271a-4523-9484-6d833507d0d8", "comment": "Malware payload (Mirai)", "value": "4bf8a7340c6b48bdac9425b7161614f062dcf78f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635541, "uuid": "e92486d2-c7de-480a-9771-21420cb51e41", "comment": "Malware payload (Mirai)", "value": "3306d65a89e4726bf828d3676e92881b0fc96571445c7f6b53ee9c85e28749fecc282db5e19155f5b12d74d1ec50e281", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635541, "uuid": "16a8d05a-4e36-4633-840b-0e4bac27f6aa", "value": "T13A044B46EA418B13C0D717B9B69F4245333397A5D3EB730699286FB43FC269E0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635541, "uuid": "5318c141-0723-4b87-b865-d05acc618c57", "value": "3072:UsN52YAlJr6Xn3ca5WI6Gm1Gmla129LeebFiRs7vM/9ez+9wj:US52YAlJ6nca5WI6GiGX1ELVbFiRuvMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635541, "uuid": "18f2228b-b02c-497a-835a-a0a9ae49010b", "value": 180728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635541, "uuid": "20b705db-1fb4-4f59-8dc8-b83968b60276", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635541, "uuid": "43eb0533-3a0e-4245-99d7-ca517f986723", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7909de93-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654720, "uuid": "4d2d2635-f391-4e4c-a4ed-8bdcabad9a2d", "comment": "Malware payload (Mirai)", "value": "45ec16f87a4c7f5cc2698711148aba5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654720, "uuid": "f136c0aa-5232-4cd3-84a8-03dde6591669", "comment": "Malware payload (Mirai)", "value": "a0e1767ad0c45420866d915a7fa8f429bc8d038278c8222c65c4aa36ee00fbd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654720, "uuid": "f88f2ede-576c-49a2-b41f-efb2869d9dd6", "comment": "Malware payload (Mirai)", "value": "7af13bbc1bdf511a671d3621017564a07f4033ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654720, "uuid": "04e7da43-a80d-49d4-ab98-dcea59e23a6f", "comment": "Malware payload (Mirai)", "value": "174a75c28df93f1aaf4cf18e214a0a49e47c43bc4cfe87b0babcc5e5ec0a6da3bcdc3c2b25bfadbc2f0266c8aa75cc3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654720, "uuid": "c67154e9-f302-4f44-9074-f83c8624e25f", "value": "T103144ACBF800DDBDF81BE7764C530506B170B7B254924A3772977A6BE83A0A50927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654720, "uuid": "00999ddb-372e-43c1-b654-34d7f11eade3", "value": "3072:kEOIqQjwVQe2LT1V9g2iZ9W/5ydeaN8D2O5Pia29qjkMfVKjbi2LFzKO8wF:uIqQqrCRVNhydtN8DBP2+kMkLFzswF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654720, "uuid": "ac8cb535-31cb-48e0-9180-9ca214618663", "value": 192320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654720, "uuid": "33531ff7-fffd-4915-8179-e8ec6f5233f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654720, "uuid": "580ec67d-2fce-4572-ba2f-9fc31420befa", "value": "Polar.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09d07f5-17d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772633742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633742, "uuid": "3b6f8e96-1c85-42ab-9f39-4a9e24e3abed", "comment": "Malware payload (Mirai)", "value": "0fc3a2be43bd8672e8f47aa7e459ca04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633742, "uuid": "5d9ca566-2a59-4a3a-9891-b3edb7309ea7", "comment": "Malware payload (Mirai)", "value": "a261c118c3555f36f1c9e2a83acb7e378d3b860d12f7584aafbd91e34b7ee59e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633742, "uuid": "f12c04b1-3105-441e-b671-65145a7dd851", "comment": "Malware payload (Mirai)", "value": "70c97f8599642a37c17817a9c9ae74dc15474b7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633742, "uuid": "f8b4b15e-2726-4f44-8f7f-16e827bf6601", "comment": "Malware payload (Mirai)", "value": "7b7dd2d60e732d7480aafde14037bbcb74916c68643470fc8042f5d958526276ca977d017dbfcf7055e60336c907a04d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633742, "uuid": "e66c6367-e36e-4ed3-9331-a10f33bcef56", "value": "T160A32A56FD824B22C5D512BAFA1E118D331313BCE2DE72129E206F2477CA95F0E7B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633742, "uuid": "e6a25e3b-fca8-4958-80bd-044a7b55c6e5", "value": "3072:u19sWSVH+jbpzgoNuaPnNa24jKCjBvoVVM:k9sWSVH8b1gogaIrWCjuVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633742, "uuid": "e59136d3-9304-4b63-97b9-ce5086d34e09", "value": 103916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633742, "uuid": "c436da0d-b12d-45ac-b319-5b346f72d930", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633742, "uuid": "725e3aae-e33a-49ec-ab97-243727f0f969", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d922f373-17db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772636843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636843, "uuid": "c5280e28-1c91-4574-9295-907fdfee82c5", "comment": "Malware payload (Mirai)", "value": "47f8d4b828d15445ca162056a9e78674", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636843, "uuid": "050df343-a972-4f8d-a00c-4a681a081a29", "comment": "Malware payload (Mirai)", "value": "a2cee300fd278a320a41e5f7b2e1caeaecda8faa650b6bebb6c3974e5a2c7ce0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636843, "uuid": "2ea76586-9286-40d4-b751-e848651e1cad", "comment": "Malware payload (Mirai)", "value": "8a35fbd5956a76879c6ecea77b4d6bf5e1d74161", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636843, "uuid": "170e36ca-5970-4888-a7a3-2b0b91b051cd", "comment": "Malware payload (Mirai)", "value": "c2023d426098966a45ce2c84fc0e1425636831d72020ecd58bf17a4932cc650c876b79d672dfc167ff79035c9521b464", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636843, "uuid": "fbdc2c2a-cd1e-4148-8096-c5704f75b8db", "value": "T10134E80AAFA10EFBE8ABDD3301E9070124CD652721A87F7A7274D514F54B64B99E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636843, "uuid": "d4d3e6e2-3826-4ce8-aff3-4cff579376da", "value": "6144:0lb+dNibHWmBPimazZCYKGQIk0MKREQGer5ulE5:0Ev4imazlKgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772636843, "uuid": "b32060b3-c2d0-49eb-a706-7ab5895bd9f6", "value": 232424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772636843, "uuid": "478a7c9b-c509-4351-a390-69157938e2bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636843, "uuid": "dd4fc887-4ff2-436b-96a1-8b29225789a1", "value": "Polar.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b49729b-17c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627934, "uuid": "954899ea-5722-4749-9170-60bc0b584c10", "comment": "Malware payload", "value": "eda3120182befe6215d6acb3b79424a1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627934, "uuid": "095564a4-b86b-41ae-8284-df3797607e84", "comment": "Malware payload", "value": "a2e3aae8805fad2b3062d8ef35341b6c47fe91e531bc015d0be783715dbb0599", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627934, "uuid": "012221f0-f592-4ec5-945c-3baf56b695d4", "comment": "Malware payload", "value": "d5c795a8aaaf4c1f1865af358eca33fd1727925c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627934, "uuid": "fb2e1dde-f575-4684-8d21-142a938b0446", "comment": "Malware payload", "value": "53745fe29da470fafc11bab2b4b5b6514885bb54d54ba85b41c6b8f3c6eb17150356d3bbfa6f30a943dda2b164f43699", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627934, "uuid": "c9c49534-a57d-49c7-9547-f87db30bd3b3", "value": "T16FB53367C3621400DF903F3824A3956BE37DD43DFAA5093A242E59E2DDA72E3E1D7261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627934, "uuid": "abb6200b-ef7f-4c7a-a264-dd4a45f13fd4", "value": "49152:cUA/rwKY8xNMIxZAHirg5IjJY/gyHhLSyf0ORhDqzGl2Jt:cUGrjeKZAHiruIjJVyHhLSLOvup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627934, "uuid": "f5d7a801-3272-496c-bfc8-ba2a62a48799", "value": 2491749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627934, "uuid": "5d28f23d-6a41-40eb-8958-7e33f9d6ac93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627934, "uuid": "2ed6b3d6-6119-4446-8e13-1d6185a8fe03", "value": "screen.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5570baaa-17b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620731, "uuid": "be45a498-5dfe-46de-992c-02c8f06f6a41", "comment": "Malware payload", "value": "a4ae046ade5776b0c7733e63b9461822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620731, "uuid": "dbeadb96-725c-4796-bad0-3400680328bf", "comment": "Malware payload", "value": "a426c184484f9c4d14d90facdd4a4fb56cffc18cf6045e3eae73bf1f3606d738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620731, "uuid": "e26e07ce-e875-4b98-96d3-e616af148502", "comment": "Malware payload", "value": "75234d211ca7a85a98909d63f7f835e676be39b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620731, "uuid": "04c10d93-b15d-4bc0-a93f-2ad8537a3d23", "comment": "Malware payload", "value": "c8f0ec0e814e41229ae061ebf2f533085107f1881a736e76d9f87d44b28d29ec6c22b9302ae417c49eb922c98bcc4faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620731, "uuid": "8a2bfee4-c40e-4aec-a607-2844415fd18c", "value": "T1BBA48C01B750951DFA27FD78D0A2E2C243F1FC226AA6CB3B587534A75FE618F6811392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620731, "uuid": "e36b926f-89b2-4726-ae4c-6731e71cdb3f", "value": "12288:1j487coBH6oxL/ktkH8OiIY8vcox/VyFfV5:54WcoBHhL/ktk8OiIYUcox/VyFfV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620731, "uuid": "2624c558-5bd6-4269-8818-94eba94f3c71", "value": 455376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620731, "uuid": "80a16310-36d2-4dab-b1c1-ee195ee18974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620731, "uuid": "7fa10a81-a7e6-458e-a503-bfd449b111be", "value": "a426c184484f9c4d14d90facdd4a4fb56cffc18cf6045e3eae73bf1f3606d738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81b2bef-17c5-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkMe)", "timestamp": 1772627419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627419, "uuid": "169f9697-cd79-41ed-966f-395ed5fa1050", "comment": "Malware payload (DarkMe)", "value": "1cc12e7ce18a7038b95ea830859ff8fb", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627419, "uuid": "e55ae999-dc21-44cf-a154-acc4dfccf35f", "comment": "Malware payload (DarkMe)", "value": "a4bdf7e2013ab46af409dec58ca822b4fe971a6991f231253c9471aabcab5c91", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627419, "uuid": "8121e151-4142-45e8-a659-2414cabd4115", "comment": "Malware payload (DarkMe)", "value": "c8d81da751502112ebd7dbd8595ac59b2ddaf364", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627419, "uuid": "123070fd-a98f-4a71-b42c-037d62d8e709", "comment": "Malware payload (DarkMe)", "value": "87845326c2c18fd5d9a662c9ddeb3f3c625918795a30a7dd2a1ecd577d3b6bce94657fe0a46ea1ec9ef3552f51831c53", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627419, "uuid": "b29e57ac-1413-46d1-a3c6-65b02641898f", "value": "T131D35FF6EBF478A5E105253379A4A17C37D3BC4DDD92452AE24BF11E2422DC228E5A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627419, "uuid": "83fae7d1-17d8-4576-b616-fcc3ecd1788b", "value": "3e847ec4ad926dd89c2f4cb28d036c11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627419, "uuid": "25a64d9e-e9d3-4038-b2a8-81d1c8041c6a", "value": "1536:a0a0PO/Ujf3OnwevbVfo9dPdb96r/3vQeV:LMU6nwezVfobP5eV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627419, "uuid": "d3e7753d-bd4e-453f-8c93-572de57b83e1", "value": 138200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627419, "uuid": "c02fc4eb-bad2-4939-9c43-a6296bb7cfe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627419, "uuid": "5d1c1f50-5028-42a8-bd55-bb2b4e3a02f5", "value": "a4bdf7e2013ab46af409dec58ca822b4fe971a6991f231253c9471aabcab5c91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf29136-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625657, "uuid": "f701ef2f-02a1-4f6f-9d07-cc32ce955e71", "comment": "Malware payload", "value": "d445be8c23808522096ec1db0f859e1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625657, "uuid": "95e5af75-9605-4c4c-bae2-62719e47e13b", "comment": "Malware payload", "value": "a54005386c3eff1af6007d0b76b6d2cfa719762622dea4c746bb82ed55997539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625657, "uuid": "54a13f48-99f4-4bf7-8093-de1f8a2b7630", "comment": "Malware payload", "value": "2b8fbcc87f153d874d45594fe8e6c2246159084c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625657, "uuid": "2691f598-5efd-4581-ae2c-525a1917bebf", "comment": "Malware payload", "value": "4afce8147ee779d795edc64f743fa053d4ff73942e662d8c6317d33909673aec839013aff5cd9d795bafff83afd339d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625657, "uuid": "0e8d8760-8f1b-47aa-88dc-b02a69fe7e1e", "value": "T1D58402D062E885D6CDBBCB36D0A22E058EB4A673B5B1E141D981057A7E45F038F713BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625657, "uuid": "1237d260-c894-45d8-920d-7cb27f800055", "value": "6144:DDz4cOwijkzDzZsBS99NIdnYu7/3MfRUTgO/Gi0IJ4lci2V42JwQnPbQjfS:7D1F7yYa/3MfR/Oedlci2fJwUMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625657, "uuid": "36a6fac6-7a11-42de-bd5a-12d150c69aae", "value": 385987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625657, "uuid": "cb2f05b5-b885-4fe1-b65e-64a1f20f5d9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625657, "uuid": "a2e70468-646f-42f4-9366-291faf09f58b", "value": "a54005386c3eff1af6007d0b76b6d2cfa719762622dea4c746bb82ed55997539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c332ae-17a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772613913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613913, "uuid": "8f16d45a-4c2b-4e39-84af-b6e14db950c1", "comment": "Malware payload", "value": "58eab890e82d82c32dd5410c757c8f37", "object_relation": "md5", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613913, "uuid": "5926fcd1-242e-4689-8b62-333e2196f6fa", "comment": "Malware payload", "value": "a6dc7a4ce9aabd1ddf501adae985423dd3a90315294c4ad3f5b61aa5c7984b2b", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613913, "uuid": "17ef544b-bf1a-4a9c-bd89-9ee0c4d846a4", "comment": "Malware payload", "value": "cec9ce30f88585e55588d015eb6c6987925db207", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613913, "uuid": "cfa00b57-28cf-46a3-9a16-96c184836fad", "comment": "Malware payload", "value": "823adea486fcb56ee99675cea2347ccf57deb48844181cb7b6218d34781235006c65c9327c4d7596b68f376b2636b458", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613913, "uuid": "5d534c32-08f9-40c1-8632-5f6703b6cd10", "value": "T188948A78AA53D726438E86E1374F0932EF20758FFD8514E5E333872A12537B64B96B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613913, "uuid": "1c697f51-c089-4dbe-a782-8aace38dc3da", "value": "12288:RMINSqE8TtMN9BChR91x6TYbrCx07dBDw:FVTtMzBCL91sYSxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772613913, "uuid": "aad5c7cc-5e77-4c6e-9033-96e85b6405cb", "value": 441732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772613913, "uuid": "59e81159-ce82-42a8-963f-085b2c8481c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613913, "uuid": "904c4192-c0aa-437e-9258-789dc1e55093", "value": "a6dc7a4ce9aabd1ddf501adae985423dd3a90315294c4ad3f5b61aa5c7984b2b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3adda04-17dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772637263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637263, "uuid": "876b8b01-dbd4-47a1-8109-39e7a7dd5e99", "comment": "Malware payload (Mirai)", "value": "ba17b2cb40c9050a5cf1f64e25a61804", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637263, "uuid": "cf6000a9-eec8-43bf-8028-fd5fffb9aa5e", "comment": "Malware payload (Mirai)", "value": "a8cdebb38a273d9538f3f3d6aacbd0836d25f9497e97ea9e6a2bac4da2eb8086", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637263, "uuid": "a097cda7-e193-46ca-bfe1-537570d23822", "comment": "Malware payload (Mirai)", "value": "aae7d9dbf66162e6ab4104b41450da8496123463", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637263, "uuid": "ae94037b-6c71-424f-ab86-583a63c07982", "comment": "Malware payload (Mirai)", "value": "bf55c39ace0fabea2eeb77454b7677aa69e7db746d9dbe1df7f81ae624e0a1cf73b7b476ef597480ed1380206e5770ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637263, "uuid": "94c0011c-49a9-4ada-aeea-eb5a82636e73", "value": "T13B042946FCD18E22C6C612BFFB5E418D372657A8D2EA31039D265F20378B46B0F3A645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637263, "uuid": "8ec76fae-58fc-425e-af38-f71e9c15f45b", "value": "3072:/mY2895/cAPPeocJgGrMHkgCyJ6p4/gKgZd+XzDoxIY:eY2895/cAnsgGrMD3Yp4IKod+XHoxIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772637263, "uuid": "10b2376d-ab6a-4e01-a91a-adbf253ebf39", "value": 175424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772637263, "uuid": "cbfd56ae-ad48-4580-b534-e80a8a81e47d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637263, "uuid": "3b29ca74-9b9c-4346-af35-de145662b3a5", "value": "Polar.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c29a8a3-1800-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772652605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772652605, "uuid": "f3755499-4d85-46d8-9ccb-391479730010", "comment": "Malware payload", "value": "5ece850141c6a5a2b3891b533c4acf99", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772652605, "uuid": "a0ced070-528c-49c4-bd49-93975b80bc5d", "comment": "Malware payload", "value": "a94aeb91f6457a1911d894baf0135a27bb3a3b721bd5f96c70e8514f898397b7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772652605, "uuid": "86784d3b-34a2-48bb-bb68-855854f9f8c4", "comment": "Malware payload", "value": "a926b2e36447adbd0127190a192116d2b9db0cc4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772652605, "uuid": "5ecc608f-c47e-4937-b6b5-a6803ae22d99", "comment": "Malware payload", "value": "316d79dbcdecf1240186cce5cf75e1ce35fd61eadf2315c3cfad7c7acd88ca3f71ca1e6b41eaf15c6412c0d1a6f6ff22", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772652605, "uuid": "ae4ce109-9abd-4023-b357-104f7c29eb23", "value": "T1DEE1F71E9835E51DE475983E364562CC9511A1B45FF46CF6DBFC81450FCB4C846538DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772652605, "uuid": "e9fdb5e2-a65f-4eb5-b355-0c50d93b9213", "value": "96:7/Mgwfl6WyUOWeN5z9kv4kOv/OOdmZw474LCbtS5po+q:DUOnkv4kO/OOd5QSnoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772652605, "uuid": "d281c5be-874c-4a46-abcf-e149c9f8a544", "value": 7145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772652605, "uuid": "aa805fea-4402-4af7-b23a-d9057e031821", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772652605, "uuid": "abbf92e2-88d3-4f51-bb17-bc995e58f859", "value": "nPDT5737083-HTCOSF0736.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aff51ac-179f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772610781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610781, "uuid": "7fb262e7-4abf-4c64-bfec-497acd2da7cf", "comment": "Malware payload (Mirai)", "value": "acfda8b7b77f47892f8750f76d4ea79f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610781, "uuid": "7ad66c5b-f5d4-42f2-bd14-ca21da0a0da7", "comment": "Malware payload (Mirai)", "value": "a9df931f5322690419c8a1e01007f64b42258283a64757fb2023590ee517c27b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610781, "uuid": "68dd57a0-3d9e-4fbd-938a-7ebdbe749c5f", "comment": "Malware payload (Mirai)", "value": "2f869221b416a3b2ca79761ad91a43bab9dd4637", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772610781, "uuid": "3167541a-78b1-42ef-8c9a-8804be81c6d2", "comment": "Malware payload (Mirai)", "value": "e80cf3b2d50476b4919bc1e9e69cb674e044f99fd020ade2251c2e4cb2fa1b9865de7c8bd36f456ed9dfad52c6415c9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772610781, "uuid": "8be92924-310f-41b7-9e88-6b43849483d2", "value": "T139539F73D0A9ACA0C04445B56568CDB00BA39804B6A77EB65982CE358007FFCF61A7FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772610781, "uuid": "c6726c2b-13fe-4689-90bd-8cd77483c4f1", "value": "768:V/+eIMbW9aClgb9WleEPn2uKg16N2DzKWQpxHBFqM8eEfzRfloViu2DCi0DF:V/H5C9aC70MKWQriRqVKDCi0DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772610781, "uuid": "d9366090-66c8-46dd-bae9-1d4210d82c92", "value": 66552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772610781, "uuid": "b0746743-3896-4495-89a9-290ce37ccba6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772610781, "uuid": "2ea40cc5-d549-4bcd-a84c-a8e6f8b9fedf", "value": "nullnet_load.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918e4cd6-17d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772635005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635005, "uuid": "5363863f-75a6-40c6-b925-7f37f93371c3", "comment": "Malware payload (Mirai)", "value": "a0537dac1fa9c7154f0b62089721eb75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635005, "uuid": "7f10d567-4693-484b-aa7d-d5cd5fcba877", "comment": "Malware payload (Mirai)", "value": "ab25a5e122ba9748f9bb0ffdf5d03e1012ca602587ced504f69a0cf619f499fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635005, "uuid": "926c21df-e18d-4d64-bab2-dd6bbd662e1b", "comment": "Malware payload (Mirai)", "value": "9dd89004f59ed04ca7c1c9b4530af8b64162ba26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635005, "uuid": "02a5e1fb-7109-46b7-90e8-1b248f110377", "comment": "Malware payload (Mirai)", "value": "d93a4af8e8430e27f3f315f1ec9d41eaf2b17b67f1dff09656dd0b6594bf880d8f7fd36add95d70d34ba470fa2e7d924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635005, "uuid": "fcf6431b-5e6b-4fe8-a64f-c9c77abd4c49", "value": "T119C2E1F412A24932D360A839EEBC1F0367F509B2C4BE135A126500AF73D2866A7F51DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635005, "uuid": "9385a2ff-975f-426f-a292-22941fb1d198", "value": "768:yDbMJPq4xUTw1Uq4ydL0LOoDjj6HVs3Uozx:y3MdAiUqnwlm4zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635005, "uuid": "0a691a79-68d8-408b-a812-230cd421c6d8", "value": 27272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635005, "uuid": "2d720348-c786-409e-addb-349e3ccb58d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635005, "uuid": "3ce5a334-fc64-4b04-b319-3f9fa08443db", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3394fdf-17ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772622606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622606, "uuid": "654cf56e-b094-4e3e-bc47-1e4d2c54514a", "comment": "Malware payload", "value": "147469f95610bd19ae124b3182788923", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622606, "uuid": "4323ffb8-58e0-4865-8648-237c1e43f2f6", "comment": "Malware payload", "value": "ad80d55e20df318c575950e4d1c00b40a8ed78baadd4f6b5c701b28f77f551de", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622606, "uuid": "64aeba3c-a539-4f81-a873-fdcea5dd10fc", "comment": "Malware payload", "value": "91e938adec5d0262b8a19d05ce1b88e2c30ea520", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622606, "uuid": "41d8272a-c8a5-4399-a529-edef16bb3544", "comment": "Malware payload", "value": "0e0a43e10376de736de2f5c156f98525159cddee706ac0650346aa87fd9f355a64fcf9b31e8fe2f0e8b90f9fb16a4554", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622606, "uuid": "4c42a7cf-30ed-4715-9f59-a953eaf3a297", "value": "T10546F1C6F7D8A92FC8775072C9BE52B141874C028A839F836D18760C69BB5D46F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622606, "uuid": "5c2ad889-7e79-4a73-82b3-9041cb80e3ba", "value": "98304:LPVoTwrYhKjofsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpClte:LGKMfyaIbaciAFvrEZpXqmY9XrF/mpCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772622606, "uuid": "eb49e8e3-1ea8-4de6-9521-c200fac64557", "value": 5823338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772622606, "uuid": "7233f1c2-db93-421d-a3ed-a783f8888326", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622606, "uuid": "98a269de-2907-4d3a-b8a1-230630c6d2e3", "value": "spacemanslot88.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024e95c9-17d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772634764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634764, "uuid": "850b4cbb-0676-4376-9194-52561175248d", "comment": "Malware payload (Mirai)", "value": "2b86a294d18d0bda2f7de7c4f9ef568a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634764, "uuid": "802f9a0e-9eab-42f5-b6eb-993ad339d267", "comment": "Malware payload (Mirai)", "value": "ae8aa6bfdab34183c9ed540cbc0fda416e01fa0b3104bdb251bf07828b5abb7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634764, "uuid": "7b7483a3-2171-4d1f-9804-f9b44140ff4f", "comment": "Malware payload (Mirai)", "value": "f1e9aac2244150f869749512ea06c5bd9d23655b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634764, "uuid": "4b9a6927-84fd-46ed-ba21-450122d0c193", "comment": "Malware payload (Mirai)", "value": "3169087b2ecb5e0b42b0ba2293be07f35b9a211e7ed7c0ad76f7d06833f45e6d387c43ef4a6f1bf87408b4bd7d455d04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634764, "uuid": "d5ed2e00-cd44-4fa2-90f6-9ff7cd749e7b", "value": "T16E43E665B892D957C2C01376BE5EE78A332573E4CACE3323F9255B2C3A8651F0D26E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634764, "uuid": "327da5c9-2636-4205-abf4-8d4d3583ab80", "value": "1536:DB15SKZG2IXG5/alSuv3EUKHzOT0WgsIR28:N15SiGm9CmWBIM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772634764, "uuid": "e0e313de-4c79-4e9b-9e07-edf1221dbc71", "value": 55888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772634764, "uuid": "497576e5-ac3d-4993-a0af-8105b422ea81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634764, "uuid": "0d4b19e9-cd08-4211-90f0-a225edb6cad8", "value": "csk_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d57b0b-17b3-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772619313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619313, "uuid": "62272546-612d-488e-a8a1-48e16218be94", "comment": "Malware payload (AgentTesla)", "value": "915f68764c5873b7a23c64950d27144e", "object_relation": "md5", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619313, "uuid": "d185d1ea-ab48-442e-b7dd-5672f3523c2e", "comment": "Malware payload (AgentTesla)", "value": "af29bd6084bfd4c06f77b56a78670409be14cd268204c521c7e450bf567ac4ef", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619313, "uuid": "57655858-184a-45c7-97a1-61ea09aad9a4", "comment": "Malware payload (AgentTesla)", "value": "dc88fa6df52e11aa4b959b6e391b602a9cad26c1", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619313, "uuid": "79032165-747e-49cc-bfc3-6f0f15cd215f", "comment": "Malware payload (AgentTesla)", "value": "eeae87c0e34e20f7201128f9339223984e51e673028e8a13c8c37fd8331a104e27ba8f50285e58dbdf43fbf488cf4f25", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619313, "uuid": "08398fb2-7cec-4e45-918e-acce63f2e2ed", "value": "T195A3129389BB7D0EF03867B94D93C8E05025C11DDF6B2C56D852A988FE83454ECC5B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619313, "uuid": "4c5fe5a0-5d82-4c49-b514-8ff42516029d", "value": "3072:kzC8p0laVNL+WZ9m9fE4G2FQ9H4RpwkpSQsXk:kG+0lst9of3GVOokpCXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772619313, "uuid": "bee2d1de-dccd-418d-9ba7-740780ba37b2", "value": 101985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772619313, "uuid": "024b2084-ee16-4f70-95ce-79d6bb7a7cbb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619313, "uuid": "534bc3af-3f1d-49d1-bf85-eb6dc6907711", "value": "IMG20260403-06310.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143e5687-17c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772624916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624916, "uuid": "62e05bea-1771-4929-b1bf-2093db0d07ad", "comment": "Malware payload", "value": "e09485105f347ea7c5a71f864c8f110a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624916, "uuid": "a93abf42-f4d5-4dcf-8d9f-8b955dfcbc63", "comment": "Malware payload", "value": "af4400a89955192d31f6590718792283a0911f9ee1ba06fdc6dd12edfedbac15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624916, "uuid": "d2441a8f-5051-4895-8d3f-fdd685cbeb45", "comment": "Malware payload", "value": "ff55adeb710c03d2c4d1f60ec21e988a4048f986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624916, "uuid": "3a5ed04b-b0eb-4271-af3c-c8588226bfab", "comment": "Malware payload", "value": "62f03511920616d0394262cc9442b073df720cf740a275570488fb605429049674029d492e3d80ee8f53d4c250427b37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624916, "uuid": "9855f7e8-b4ea-4765-80a5-89de158d857d", "value": "T1AE8733C4737025A9E52A503FD8C85B4BD5C97C6A17B4C786AAEC5B260CB30D4FE6CB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624916, "uuid": "b1d2f189-0794-4cc1-a968-695a7b45e589", "value": "3d90ffc71d229e9433c9e2f2acc0938b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624916, "uuid": "23d722ce-a4cf-4b41-b68e-52e3591eb8fe", "value": "786432:6FlUR1O79W8q0TXMb8YrRQ7665U+Gs95vceeU3yNBLZQHBjk0t7jew8QlWur59DR:6EW79WUTcLw5pPeU3I2HJTt7jefQlDrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772624916, "uuid": "eb4dfe83-0aaa-40f9-9c9f-43f848d9b494", "value": 39331152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772624916, "uuid": "0732dab8-b33c-4920-b48e-5a6936771ebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624916, "uuid": "f367e1cb-8519-4de0-843b-ad4772b8c7b8", "value": "Ziply-MSVC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5730b4-17a6-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772614008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614008, "uuid": "5f193208-d29c-4ea0-9cf6-c256c90d5ac7", "comment": "Malware payload (AsyncRAT)", "value": "a7fd62fbe080d89cedc37ecb7b38e569", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614008, "uuid": "4f0b8c03-9a2e-411a-8ea7-545aadd9a7b9", "comment": "Malware payload (AsyncRAT)", "value": "b0ad4116dc9efa736233250a5791cf0f624be2f5476e566eeb7494dc33ae77bc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614008, "uuid": "1c030c56-e00c-407f-a53d-27e1fad80094", "comment": "Malware payload (AsyncRAT)", "value": "9c743cecfb0fd65ddd772d94e3fba846785c3b23", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614008, "uuid": "147785ed-f884-4887-9b86-8afb6f807991", "comment": "Malware payload (AsyncRAT)", "value": "fa1c6c7b471a012e239d2672a3289a5ba17a2b8dd262cacfcaf7b240fcdee05b7c0e57762fd4981ee64d4a184ff56ed6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614008, "uuid": "28705201-ac0d-4f60-b0ec-ab42d2c198c3", "value": "T1FEF24A0573E59665E1FD1BBD5C3686044372FA478D22DBAE2EC450AE2A237C8CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614008, "uuid": "67bf3494-e5ab-4d12-9d92-615951a08364", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614008, "uuid": "aa0d71fe-b0c5-40f1-876a-98bb41b221fa", "value": "384:EMT5XY+17Ng15KhElE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCj7WW3oEQ+:Ei5XHRNg1IhT1hV4RbJwB+WWejQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772614008, "uuid": "e0ca50de-010e-44b8-814d-ca5c365ead96", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772614008, "uuid": "767a7fd4-a2da-4b64-91ca-088191b307f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614008, "uuid": "e98e7e56-1bc1-4fe3-aa42-eec4acf99f70", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c544569e-17d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772632944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632944, "uuid": "79263c57-fc37-4688-8612-ed70020ae209", "comment": "Malware payload", "value": "7236f1a51da141e422d553e36ef6c9d0", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632944, "uuid": "537104cf-aa6f-4e09-a0f4-21ee55ff3e22", "comment": "Malware payload", "value": "b0af82de672d81f3c2f153977923b3884a8a9e7045b182c2379b19a1996931a0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632944, "uuid": "c7d4d555-52b6-4199-ad15-d718cb688335", "comment": "Malware payload", "value": "3f441a009a907af55bd6d52b0f0f06b601c961dd", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632944, "uuid": "1bf94da3-3b4a-41b5-9c4c-2f35787e5908", "comment": "Malware payload", "value": "5ba50e54ebc7fbe3e63331e0a1b83f0b385360ccd128fd25efead80813890d7a132ec826650d84ececcc4998f68dcc5d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632944, "uuid": "3992a8c7-3e42-465c-a048-77255ba8a92e", "value": "T1F7512B75E682095A9BCC3766AFB88EC01036B0C7BCD3158A0D739AC647D1DE4275E5AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632944, "uuid": "5101b59a-e674-4b7f-ba84-e55a0dcafccc", "value": "96:iIyz6jwkYrK5ST4JQ81/yoryaijOtIN+g:iIKkg14fNyAyDj+IN+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772632944, "uuid": "a3b95caa-641c-415c-a865-64e4b0a115af", "value": 3125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772632944, "uuid": "7bdac20e-dae4-4469-9954-ee6c2812be39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632944, "uuid": "a5b7614f-7e3c-4cb7-a0cd-e15a70ab3525", "value": "b0af82de672d81f3c2f153977923b3884a8a9e7045b182c2379b19a1996931a0.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780a0efb-17a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772613917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613917, "uuid": "7d399933-286e-43aa-9b26-517cfbbdf546", "comment": "Malware payload", "value": "b7776c347bba5605bee3ab301e14fa83", "object_relation": "md5", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613917, "uuid": "d9c1c5a9-828d-409a-ae83-7fa54bb58959", "comment": "Malware payload", "value": "b0c05fbab5d1fe54b5848d9e5e27ecaae18ee4d5e84a6b37c1f6250490443ade", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613917, "uuid": "ce8263a2-7ca1-41c1-a863-d1386fec164f", "comment": "Malware payload", "value": "2bde798e842a3f578e67dce8b92e583cef307dc4", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613917, "uuid": "14c87456-fa29-4da3-8772-1e10a6dbd287", "comment": "Malware payload", "value": "310c04482b18e189c0876125507c5d8ebb914b856f2c6bd3513fca576623282751cb68ef22aede2e276affc38429613a", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613917, "uuid": "4beb3ae5-4f95-486d-a317-9b0b4d3311ce", "value": "T1F23423D722F5D1AC13F6AC156FC60FD0A81456327BAE8945C92AE613EF85BD08DF204E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613917, "uuid": "79162dc4-5f55-4c1f-9177-d651da97628a", "value": "6144:khgAMg8xErAWJpb8wY4wDn1EELerSf60CW4uZRsA6H9t:JBxErALDn1Edru7rRsvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772613917, "uuid": "b458f0ae-ff5e-43a4-ac4d-5a5d984aaa7c", "value": 238264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772613917, "uuid": "a9b24efd-8ebd-4902-977d-347174fa1088", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613917, "uuid": "2ba531d8-0005-4172-8c4e-9b9c730409e4", "value": "fjHErtLKrBY141.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2799a8be-17dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772636974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636974, "uuid": "0409a415-a7ca-4eff-a630-3d6ff9d70921", "comment": "Malware payload (Mirai)", "value": "fe584f40e1c76c8e36e079edf75c378d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636974, "uuid": "9349ae8f-6d20-48ad-bef5-098c75fb388b", "comment": "Malware payload (Mirai)", "value": "b1805c66fe8ba9a6394697213cf19bf607e832cc028578f39f29f20009a0186b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636974, "uuid": "fc83c759-1dd6-492f-9d7a-d000b1b36d35", "comment": "Malware payload (Mirai)", "value": "de49090cfcf0ed7b06762e63b3554dcb9e69da68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636974, "uuid": "93611a89-7323-4957-b163-5c19f8a0ddb6", "comment": "Malware payload (Mirai)", "value": "3ebda1bf708cb7eac810767cbdc05858e36c40759b11fc3bb4b71e40875939da6bbf1a9a574f7c10ce630147103db6e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636974, "uuid": "bcc16cc0-d583-4ac0-9b0d-f6892f099873", "value": "T10B933981F94B84F6D8474830406BF33F9E32E1B94071C65EFFAADE25EA63542A11639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636974, "uuid": "4284dc04-fd10-43aa-891e-4815b4c75204", "value": "1536:NmIPkOH+4XRIg6h+Mhd9uYMNSFXGlLW1sMw2Eua2PlHXLRgPPXN:YIPkOe4Xeg6h+Wd9uYMNSFpmMw/uHPNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772636974, "uuid": "77a3059d-04d5-4f55-8d71-3a13d0f14413", "value": 88976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772636974, "uuid": "d8237051-3c1b-4399-87b0-6017fd464821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636974, "uuid": "ab4d112b-5e54-475e-ba75-43ddc004e472", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b75127-17c5-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772627412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627412, "uuid": "377ef0af-ce6f-4bb2-b123-3ec40a9a8c85", "comment": "Malware payload (QuasarRAT)", "value": "5d525d43fa865f8e32659d97fc8611c3", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627412, "uuid": "63de6b88-39c4-4357-b00b-314d5d43e3f2", "comment": "Malware payload (QuasarRAT)", "value": "b191bc0fc040954270d72ef580aa95ab50e671605f5281bfda0e2ccb16323b43", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627412, "uuid": "ee5b49fd-5df7-4601-a65c-304205575139", "comment": "Malware payload (QuasarRAT)", "value": "db5e2729cc68b1cbae63b821836612f670a4f3b2", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627412, "uuid": "4b72de81-e023-4e1e-b643-97b5396cecb8", "comment": "Malware payload (QuasarRAT)", "value": "bb155b1baa17c97cf4617fce5c6d980b62ef6ac57444d684b60edfdd18286c362df4c8e4993803d1b6b78d6fac847895", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627412, "uuid": "4196db3a-b839-4143-a8b7-fc7107f82bab", "value": "T1DE51DF200AD211C9E2774B35ABF9F2F30A72F8A4E92B9AFD114082444B60564DCB5F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627412, "uuid": "90161d7c-ef55-4737-8cc7-50d80ed6893b", "value": "48:8qBW7IEntFHvkm/fT+3MlUmPLlsa/ftdOjShWZQFJDEzE0mUhZBcab4jYCq4:8qBETtl8mK8PR9dX2QUhzcrnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627412, "uuid": "14133da4-3325-4a95-9ea0-cb40f824ee93", "value": 2902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627412, "uuid": "78947afa-9441-4813-950f-c43ae46e041d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627412, "uuid": "b59596dd-4e2a-47d7-9a16-177fe83fc125", "value": "b191bc0fc040954270d72ef580aa95ab50e671605f5281bfda0e2ccb16323b43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94060cd8-1808-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772656054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656054, "uuid": "540ff7c9-f19b-4f40-889b-f78750ef0b08", "comment": "Malware payload (Mirai)", "value": "4c6417d6a907a3be00e2e75197c9a72c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656054, "uuid": "d88c11ea-850f-4ad5-acfb-841014eb539f", "comment": "Malware payload (Mirai)", "value": "b2869a6761199563f62a79bf96552fbc05a681f754260ca6bb880ccd4db6bf37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656054, "uuid": "61fe977f-5d5e-4a3e-8496-498a223f7e87", "comment": "Malware payload (Mirai)", "value": "f0105501f6380def9e1b03186a778b0ff71c6a08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656054, "uuid": "e7dfb5b0-76a0-4df0-9cef-a329f0c29e7d", "comment": "Malware payload (Mirai)", "value": "d17c09dac2565a06d11c7bf6355a0d65cb2df9dd9283515d2f9472cf91eacad2575cf024e3800cd433d38cde415c11f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656054, "uuid": "a251acab-852c-4d1d-83fd-2f8349a33c19", "value": "T18EF30956F881CB11D5C111BAFE1E518E33232B78E2DE7212BD246F7C778A86B0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656054, "uuid": "b503dca8-f8d3-4dfa-afe3-37328d645791", "value": "3072:31YEfXImUNhdXagXAJJcnJaXmgVf67M6b5FmFUCOgWz3YI8BE:3FfXImODKgXYJcJafV6hb5FrTgQ3YhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772656054, "uuid": "7bc999f3-5c62-4511-b9b2-f3f30651fffe", "value": 169340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772656054, "uuid": "4639cc18-eeb6-4314-9187-a9c5c3be0a05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656054, "uuid": "86c49183-e84e-4401-bd13-2b39d2349452", "value": "csk_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eae70dd-17da-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1772636262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636262, "uuid": "7f70f680-3f5b-443c-9684-ac90039a2c30", "comment": "Malware payload (ChromElevator)", "value": "a380a29f705501472cdf145fb82e29ec", "object_relation": "md5", "Tag": [ { "name": "77-221-149-33", "colour": "#65979A", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636262, "uuid": "c531b1d5-b95d-4237-8141-42818e5a8420", "comment": "Malware payload (ChromElevator)", "value": "b297e1c43cbe0917e2765dc6262b9ee0c7fe54c5b064e4eded56b36d956d3b26", "object_relation": "sha256", "Tag": [ { "name": "77-221-149-33", "colour": "#65979A", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636262, "uuid": "60767327-94be-4ee5-a23b-16dae6d43f23", "comment": "Malware payload (ChromElevator)", "value": "069af06e8fe2f396ad4c9d520ac6b223b3429425", "object_relation": "sha1", "Tag": [ { "name": "77-221-149-33", "colour": "#65979A", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636262, "uuid": "5e126828-2b43-45ce-8fcd-c9be83589589", "comment": "Malware payload (ChromElevator)", "value": "179aa495d434b34e17f5b0721e3f334d395f88bd26896d8d6f83371f24542e3b6d537208f3a2c96275fe74e9f13c3688", "object_relation": "sha3-384", "Tag": [ { "name": "77-221-149-33", "colour": "#65979A", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636262, "uuid": "6f682c03-97ad-4be2-9afa-edbbf7219058", "value": "T13A96338380630F95EB6BF77565B1AA3593EE2BEDC5F58129880113C934CA7E507C82F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636262, "uuid": "5f888960-c7fc-45cf-b8f8-48734a9d5027", "value": "196608:Ga/PIi+9oCYTbu86ruNqBaNg97027yEzulw0hTOBSLe7UzcMaf:Gji+NPjDaAILWZULe7UgMaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772636262, "uuid": "a4f42039-7acb-46c1-9a2c-9b5ddc46a894", "value": 8914506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772636262, "uuid": "e1a5b1e3-a95a-4504-8a57-bb9845d6f131", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636262, "uuid": "cec0e4b2-657f-41dc-99dc-9e301e0a8075", "value": "b297e1c43cbe0917e2765dc6262b9ee0c7fe54c5b064e4eded56b36d956d3b26.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61372cb1-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625475, "uuid": "5d466ffd-417d-4130-9ef4-60b1fdc8efac", "comment": "Malware payload", "value": "d4d6e3e6446228acc479da10badb58c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625475, "uuid": "e7804af1-64f7-43d5-824c-5996e6a76db1", "comment": "Malware payload", "value": "b2edaaea9039be5d4352b8a18cfa92140b4888c4a255d98c5ee806afdcba4293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625475, "uuid": "8ca659ac-f820-4fd6-8ac2-0e328443556b", "comment": "Malware payload", "value": "24a628a8a0fe11a224eab6d94ec3438bb775722f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625475, "uuid": "66cb4699-58c3-49c1-b500-5c7caf09c762", "comment": "Malware payload", "value": "37927eb1cf596ad5586ebbffc3b3014a5965a547745cb74356f7fe206321ea2d58525ca3e14dca7798e2526a84a82830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625475, "uuid": "a1b7b0f0-a140-48ec-8eb9-eb2468d25119", "value": "T1BA7402D262E880E5DCBBC73690272E8589F5A63AB661E245CDC015B97E06F034F31B7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625475, "uuid": "15fb2cc5-e224-4c0a-aaa7-e8b3d371c1e3", "value": "6144:9Dz4cOwijkzDzZsBS99NIdnYu7/3MfRUTgO/Gi0IJ4lci2V42Jwf:9D1F7yYa/3MfR/Oedlci2fJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625475, "uuid": "54e92452-6ec8-44f0-aad5-bdc0b22c818a", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625475, "uuid": "96404c34-3ccd-466d-a93e-5a7e53a94e32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625475, "uuid": "22837161-bd0e-4cef-a96c-e4a47965ffc5", "value": "b2edaaea9039be5d4352b8a18cfa92140b4888c4a255d98c5ee806afdcba4293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97191338-180a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772656918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656918, "uuid": "f7ba585d-38e6-4c05-b517-2772aaf76976", "comment": "Malware payload (Mirai)", "value": "548c742d08e6319a03cbbbeab57227fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656918, "uuid": "b1d76eb1-89fd-477e-b2f8-192ac3182d35", "comment": "Malware payload (Mirai)", "value": "b38585ea887fd45c0a6daa4a3b193625fc3503c0bb02e4f2bedd43d370f21f48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656918, "uuid": "f99b3823-70e5-438b-8cfd-7505baf0a050", "comment": "Malware payload (Mirai)", "value": "7173f09bed796ddabe1cac9751bcccce0f4b4c3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656918, "uuid": "294f82b5-1ffd-4c57-b9d6-f2404ea981a7", "comment": "Malware payload (Mirai)", "value": "a7a5c4dd48a7be208208b9546185e8ccfcf975a29896a120983b5bbb6160d2c1554223ce2a46c759460d8a52b57bad74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656918, "uuid": "c997f1f2-41e0-4a25-87d5-dea21dee5cee", "value": "T188D3AF87FB871461C89206F007CB0FAE6E9322918E1BD5E3BE2DA63F5E354DB0505B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656918, "uuid": "5a535aec-2222-4e32-986d-dc3473b372a9", "value": "1536:nzfh4cFwuO/tkpDHthSdDQbSrLNVy6CFDedjg7245C1xQxrzgOg+BxDJ/LWi:VPwz/ipTtMdDQ+f7sedjx45CPBOgOnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772656918, "uuid": "5da45b44-3f9f-4f5d-9c86-c811a705b1ca", "value": 132560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772656918, "uuid": "b54329f8-cd57-43d3-9146-157bed7e103a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656918, "uuid": "65048655-92c6-4c1b-9708-c408bd1ae2a7", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5879b4-17d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772634650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634650, "uuid": "5cae2ddb-dd1b-434c-a22b-2b77f0dbd2ee", "comment": "Malware payload (Mirai)", "value": "f00ddc42ca5ee1c67da4e4838bdbe7bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634650, "uuid": "00046919-5a0d-4cb9-bc39-30839cefd4b0", "comment": "Malware payload (Mirai)", "value": "b3a23470547074cad8a10344445a62060a0b729ed7faca76401534b106d9ffd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634650, "uuid": "467966d8-ae2f-47ab-b06b-b798c03f81f0", "comment": "Malware payload (Mirai)", "value": "62e74235118ec1710febd28045cd0c855448265e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634650, "uuid": "36e0f78d-7b6e-4b80-aae1-b76197b9ef50", "comment": "Malware payload (Mirai)", "value": "a876ec6af69751939328bfefa434aa9adcc8763fa23ee874e9330f18a010a86359534bb9cf7ca246e388d50e92cb09a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634650, "uuid": "a9f6e868-467b-4c4b-9871-ecd04d25da5e", "value": "T19E13E1BFBF008DE6EDC9C5B452E64BE10EB90E51B613E84E694BD5432E524B29843F70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634650, "uuid": "554a3add-8610-4bb2-bec3-e070a287408b", "value": "768:AYIbS8sDFK8lzjqSwhOK7l6DkXZ13JWgGtvZHC5NYdd6fP3qeV9gxJgGlzDpbuR5:APG8spKe/LwnB6A7JBG3Cvi6X3qaoVJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772634650, "uuid": "48a0b3a6-8f8d-4f30-a94f-08cf6b6420fd", "value": 45540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772634650, "uuid": "7a7f55b4-10b7-433c-a0d5-e442deacb7d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634650, "uuid": "3142f8bb-88a8-4a46-a898-0c0aa7005271", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea9cdbc-17c5-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkMe)", "timestamp": 1772627403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627403, "uuid": "606f9b48-bae2-43ee-b6cd-84e6883d9a5f", "comment": "Malware payload (DarkMe)", "value": "601ad6a1f0a0939e4746d751a49426c2", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627403, "uuid": "9d37b4e4-2ffd-4579-8578-7f452ffcfad3", "comment": "Malware payload (DarkMe)", "value": "b57304214ee527853715a929ec132893501c78c11abc1544f349b152b2f78801", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627403, "uuid": "6486226b-121e-476c-b1ea-dc790a4e0fea", "comment": "Malware payload (DarkMe)", "value": "1dd4ececabb5f8fb922b80614b977ae3f939bbb7", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627403, "uuid": "304a9c91-ad92-43d8-8c5e-3e3510699115", "comment": "Malware payload (DarkMe)", "value": "81ea7bf7d0d1c15a42851e92f9cf3b1f7a4594eb43889398c18c0ac75e0988b329e06232586e1031a723c5e5e7bfb7a7", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "DarkMe", "colour": "#7F5968", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627403, "uuid": "917f2289-fbf2-4b79-85e0-b85698f88315", "value": "T12C83292FF79489E1EB4A2A310AB5C6E96763BCA55FC7821F3140362D1C36EA20D4535F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627403, "uuid": "ccf7ab83-1773-45f4-b6d0-72a87b53aad3", "value": "3e847ec4ad926dd89c2f4cb28d036c11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627403, "uuid": "10b4ef74-49d5-4c2e-a905-c5524c31acb8", "value": "768:90cBEDl8mtcoRPO+YuX1Ayf3EgkOqwLevxPIcvAkM8/eVnpc89dPdtWW96D//TRu:90a0PO/Ujf3OnwevbVfo9dPdb96r/Nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627403, "uuid": "79c54003-fcc7-45a3-b928-33e21a292516", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627403, "uuid": "fe86e85f-3fc5-4740-af28-6f0fed0dc969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627403, "uuid": "68bec86f-31ed-4129-ae20-7de99da0673f", "value": "b57304214ee527853715a929ec132893501c78c11abc1544f349b152b2f78801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbb6f54-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625419, "uuid": "3d6fa5a2-d8c9-4c7d-967f-af0614221146", "comment": "Malware payload", "value": "53ab0f4dde704ebb36726e1ebbacad5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625419, "uuid": "eb368446-a0e2-4e72-8945-d9e1a22608cf", "comment": "Malware payload", "value": "b61dd6d72c2ec6f7ba6d8a3e63f3ade377821cf7b9b1692b333a0baba646a6ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625419, "uuid": "627aac8e-6e91-42ba-9b51-d20a22138c04", "comment": "Malware payload", "value": "4e6a2ff8f52a67037d92c6d21f57d086b5f69cb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625419, "uuid": "9c0dd60e-fa40-4521-863e-7e4f28a460b7", "comment": "Malware payload", "value": "f57eddfdec5d0e60097621d46a9e014ffe80ae9d612bc222a31b9ba00275f63e037a09e9a35c669021d6a94f7478b80f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625419, "uuid": "84825735-0c0a-4978-a72e-c996556dc506", "value": "T1DC14AD04176CB916CAFE8A3940A11235C67FAF5E2EA1D7078C44745D6E733F20E267AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625419, "uuid": "539d0ec8-88de-41f6-b4a5-8a375590a7c1", "value": "3072:AuQfre4QRSCvZEhP3aOzmJIvX6lvTtVW7nyu:AuQfreL2PqQmuvX6t+7nN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625419, "uuid": "c2b4dc14-823f-46d9-bf94-b5c5c0e722cf", "value": 206640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625419, "uuid": "152fe0fc-c60b-4049-891e-9e26af3710e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625419, "uuid": "5312e182-db3e-405c-a893-e8b6b9abad8c", "value": "b61dd6d72c2ec6f7ba6d8a3e63f3ade377821cf7b9b1692b333a0baba646a6ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59eddb6-17b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620516, "uuid": "936af951-6f73-4c3a-8d97-b36b52a4c738", "comment": "Malware payload", "value": "8160651991fa2825e25db9de75eb7fad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620516, "uuid": "248e84f0-9509-446a-ada3-01ab0bf7ea9a", "comment": "Malware payload", "value": "b822a1ce49b6ba54a4e7a2ee8711bf5b614e9dbd2174913eb13ce89f66214a78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620516, "uuid": "dbd33d57-5a1a-424f-b0a1-b967ceb23914", "comment": "Malware payload", "value": "7a902ef2c9d6e5e8a752dad86f82eb0f12a009f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620516, "uuid": "54c6d4f4-535a-4746-a220-f5045fc7de37", "comment": "Malware payload", "value": "5a8cb76aa8794270e2c09b6f1ca51a9046dfb8a7e033201d64170c712679440bfc4bade56a2e996e207d7e7be648e9c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620516, "uuid": "e048e1c3-fe1c-4333-94fa-e87c7884b18b", "value": "T1F5A733C463222555E896923B89E05A7AC1CDBC4E07F5CBC6BBAD8B760C5B1D8EC5CF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620516, "uuid": "4fdbef60-e26f-462e-9c44-045187b6b240", "value": "c005b4cd3ff755ef7b24e8e7196f0aef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620516, "uuid": "9719e471-85b0-40d5-810e-b9e60f55c8b2", "value": "786432:HFlUR1O79W8YJy0TXMb8YrRQ766f1AmQ++pdlF9MTyAYs3NEyCGtyG3XgcLzJYCF:HEW79WjJpTcLwf1/kdkyLs3HCGtp35J9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620516, "uuid": "36f129ad-3da3-40e4-a29d-8b21562efcde", "value": 46220584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620516, "uuid": "55525ec9-4b38-4a07-81cf-a7e0570b50bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620516, "uuid": "80ccfe2d-2586-4aaa-9d84-f760103ad1e0", "value": "b822a1ce49b6ba54a4e7a2ee8711bf5b614e9dbd2174913eb13ce89f66214a78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ab4dc2-17da-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772636386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636386, "uuid": "8dc8d00a-baaf-45be-a1d5-510e0ab712e0", "comment": "Malware payload (Mirai)", "value": "abab9d0e8d1b4e97472d8e56f8e8cb95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636386, "uuid": "438a5952-08e7-4e3e-91fc-2a8adb5c796e", "comment": "Malware payload (Mirai)", "value": "b8e4c6f2101ca4cdc26fc7629a78d1f7122401e50f05a5a55ee700cb479c9dbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636386, "uuid": "f7838058-6a4c-40d3-8cf0-05393abce6b8", "comment": "Malware payload (Mirai)", "value": "6217f6721f57ce02bbe47cba17db95143581f1e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636386, "uuid": "797dfcd8-bf98-4a35-93a5-ce8ae0b54c5a", "comment": "Malware payload (Mirai)", "value": "eb811186c0a75dcb6cbd894596b96abefd89f4b7e6ed582984dcc55f4574c9142c6cbc549c8fb21065ccbcab4ddc41a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636386, "uuid": "a00eaac3-2d7a-4209-b1a9-d1275181383d", "value": "T159B35BC4F643D0F1E8570571183AE7365B32F4B95829EA43F7689F3EAC62901DA0AB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636386, "uuid": "92a1c514-2de2-455d-99c2-335a7668b656", "value": "1536:QsHSxOFHH+uO/D9QrfQ5HFSgUNqPDQIWNJVb0SCC+1blcF2VV:lSxOF+uO/KrfolfUuDBWphmC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772636386, "uuid": "a713db60-51cd-4588-b51f-8b094bc662d1", "value": 116300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772636386, "uuid": "ffc635a0-a4bb-445d-97e1-d35809e55f37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636386, "uuid": "03172725-2904-4371-9f7c-dfc2690eccc3", "value": "csk_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68c26a5-17d2-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772633000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633000, "uuid": "48b8ccdd-f6ce-489e-b357-f1a45345cfa7", "comment": "Malware payload (AgentTesla)", "value": "d51e9b3c3dae031a5f25d30dffb55a5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633000, "uuid": "057fb957-82cb-4453-903b-e5c6bd9bc112", "comment": "Malware payload (AgentTesla)", "value": "b94e3e55acb1ba83308ad3298f4ecda656e87a6bc045b1fd9241bc394a64f258", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633000, "uuid": "9d63393d-2115-4475-8f78-2a65941e9422", "comment": "Malware payload (AgentTesla)", "value": "32e8121b473ba1252e236c0dd0a482f3de3a446c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633000, "uuid": "af93bb94-3c39-4a41-bf43-b34ec197babd", "comment": "Malware payload (AgentTesla)", "value": "2866c4b6a9785b6f21fafb0556bedf1a2fd983978e8b006498b1e2a2deca9d732d78ffda256aaa5ffd93b6dee220844c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633000, "uuid": "29938df1-ce4f-402b-952c-d17bef8dc0d5", "value": "T1AD35AE027381C062FFAB92734F5AF6215ABC79260123A61F13981DB9FD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633000, "uuid": "1f934078-0125-4a27-80c3-88c16a544e0b", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633000, "uuid": "5d642e6a-51e9-43c8-858b-f9afa2fdbd11", "value": "24576:05EmXFtKaL4/oFe5T9yyXYfP1ijXdayXO3gGNdJq0z1V:0PVt/LZeJbInQRayXO3gF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633000, "uuid": "ed2df298-81f5-4434-9c09-2696cabe81df", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633000, "uuid": "8221e235-a307-4fdc-ae97-ad9478701381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633000, "uuid": "a13e3a25-15fb-4ad3-98e4-ddd241abd84b", "value": "Factura de proforma 0000696622555.xml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c6fb34-1785-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772599654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772599654, "uuid": "88f95bcb-4ab6-4c52-9a54-0371ec83423f", "comment": "Malware payload", "value": "8fdf0a327ae613153a8858e44072e3e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772599654, "uuid": "d63d5d8b-3e64-49c7-984c-fee5dc32b019", "comment": "Malware payload", "value": "ba7523dde31b617c53322d39fa7a321435d68bb7191696b7631ddf1bb296cd57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772599654, "uuid": "ac67527d-94c4-4c09-b879-401fa14fc4b7", "comment": "Malware payload", "value": "0688aabe819948fda599d619c91677eac084d645", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772599654, "uuid": "94052f0c-e6cc-43c5-917f-4ea724532916", "comment": "Malware payload", "value": "ccae4615aa5e6384c81492dc87c4f5cb78cb58f6934d17ddb9a675f1f15ff8675ba09ca6a46ebc8e68d0c689d4193483", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772599654, "uuid": "b8bd615c-aaae-4cb5-b64c-467b402092c3", "value": "T160866A97B9925943C5E83737A9BE80C433635EBA8B8712565D04FE387EFE1980E39344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772599654, "uuid": "6a0151ed-82df-474b-9cf0-65f28926fc4f", "value": "98304:/sVYe6Dm7mslg4MDH1vH963IERuRlZlYW4HvxBRZlei9VH9:i9AEXovHGyZr4HZxlvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772599654, "uuid": "7cb650e6-5365-4d00-a8d2-e02185f9bae4", "value": 8572836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772599654, "uuid": "0cd0318e-4311-444d-a2b9-4980c7cf2f07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772599654, "uuid": "61796b1b-86c0-49da-a3b9-21752186bd7c", "value": "client", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c042f2ad-17d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772635083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635083, "uuid": "e7e9b8cf-cb46-49da-bf32-8ab1e3aff3a5", "comment": "Malware payload", "value": "e4cab5137f5f75eda723d706b98f9bea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635083, "uuid": "037a7d75-4c00-46a2-9da3-224a536eb326", "comment": "Malware payload", "value": "bb1075ca2ff0a9b5e407fb396f8f87705d8f512b42b3f4326586ef17fed8aabb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635083, "uuid": "a04bdcbb-a847-4843-bd23-91097cc354d4", "comment": "Malware payload", "value": "7c2f087e04499ba513d39bce82bc81bfecca14f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635083, "uuid": "ced25cb7-14d4-43ae-852c-36b4d9d8d267", "comment": "Malware payload", "value": "40a00ffb096e4373b6a74f7670c53a93bb637128961f591b0d88f2908f102355a48cbd2a44c1d8457ebc508ee93e71d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instantservices1-ddnsguru-com", "colour": "#FA5B3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635083, "uuid": "81bb1ccb-41bc-4d2e-99d2-6a1d44656279", "value": "T1A9D49E6772534E24D2894373C5CB894197B896C276B7F70E3146239624023FFDE8B6AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635083, "uuid": "b6171608-6f14-4021-99e8-1396e852ca66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635083, "uuid": "330f6505-4841-4c10-a9f7-824290538cb0", "value": "12288:Jxl/xYOJxECC9fBz8tjMn1JU8R51aM7pEslCd3X9+w0:AOEdqtjMn48RGM7X0D+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635083, "uuid": "113b2c92-daed-4dc0-976b-b7860c7d03f5", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635083, "uuid": "58b40307-9060-4943-b4c6-c054f8ff9277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635083, "uuid": "27850a80-101b-4400-845e-308349a71a92", "value": "bb1075ca2ff0a9b5e407fb396f8f87705d8f512b42b3f4326586ef17fed8aabb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff22883a-17d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772635189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635189, "uuid": "4996c741-cde6-4b83-846f-1107b7435f00", "comment": "Malware payload", "value": "d427075a83b419987d451b806b97a33d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635189, "uuid": "05d548af-f16b-4fa0-9fcc-ccfc25c20ba4", "comment": "Malware payload", "value": "bbda250570b7f70826e375282c2f8e5ed5a15d10bd0d7e0b5271da0b81992328", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635189, "uuid": "beebbd34-324b-46b9-b2a8-d6df8fed9d58", "comment": "Malware payload", "value": "078358e53cdb1e49aefac0c05d02f4d48b91d38e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635189, "uuid": "4f1a90ba-9802-4035-83cb-37931ecc2d2e", "comment": "Malware payload", "value": "2bc7a1b8294924193789dd99bf48cb8c4ede129ca993b25a02943b027cb81d3e1d0e815cbc55cfd8692d843b1cd04020", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635189, "uuid": "3dc23d4f-a4cf-4b8f-9841-2554c5d71321", "value": "T136925CA916496C79BBC0CE7D9F3C7F0CADE4C1C02219A39CBA4F39715A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635189, "uuid": "74c40340-3f36-4c77-bcd3-655bcceef75b", "value": "384:5Kh0M3vgRjGlsaq7izsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:5KxmjfWzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635189, "uuid": "e6a5afc8-f333-46ae-96f6-12f6bc070c85", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635189, "uuid": "89e900cc-8703-443f-8af8-d0eeb07aff29", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635189, "uuid": "25d05624-adc6-4545-a6ff-87ac56b557f1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5574caea-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654661, "uuid": "8f5f0618-82c4-48b8-8d42-2106ca24f1a4", "comment": "Malware payload (Mirai)", "value": "72e3b765df022e31f02255ec36231780", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654661, "uuid": "64c4f425-bc34-4168-941c-f1639b08344c", "comment": "Malware payload (Mirai)", "value": "bc2b52baa62bf4c1ba14c663fcdd375c907bed1e790d4debf694d59be3be296a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654661, "uuid": "fbc84243-b200-4520-863b-0a82ab864b71", "comment": "Malware payload (Mirai)", "value": "4df111af399eb9da02a377dfa79270f648e4e1d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654661, "uuid": "0958767e-d259-43b8-8754-597f1a1ba477", "comment": "Malware payload (Mirai)", "value": "83c69f1ca2ce38c2cf87b395b0668bbd1d27b763c26617a407ed2e497daf87f8a3fcce450c75307b572823c4b81abc5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654661, "uuid": "eba3cd80-190f-46b7-88d4-fc9b0927a5de", "value": "T12F431891BC819A23C5D4137AF56E56CD372033E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654661, "uuid": "86ea9f44-d571-406f-9924-db6ec3a1469a", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654661, "uuid": "2911ba55-2b2e-4975-a3bd-7bf966727df0", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654661, "uuid": "ff525740-b214-4dba-801f-e97a1178a777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654661, "uuid": "b73a22cd-8100-4b49-9e23-31bad3aedd19", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f701ebc-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625499, "uuid": "beecb66e-76e4-4b0f-b9c2-9df7596db05f", "comment": "Malware payload", "value": "6072a4297987215dd64234685bcf48fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625499, "uuid": "a33f8ee0-0dec-4841-a679-f53db5a32906", "comment": "Malware payload", "value": "bcaafb55e8b91ac3148bd8d067daf3dfda3a2d42f4ad5273a2d261857a909449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625499, "uuid": "58d534f3-3879-404c-aff8-603bf91edda1", "comment": "Malware payload", "value": "cbc6fdc3c445c57d0e5daa4df40769cda60d2190", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625499, "uuid": "36b3640f-4ab0-4687-ac32-29e3d2ebd500", "comment": "Malware payload", "value": "dc5db003ade7d16eb45ae202677d0719fe7b2c1e1bfc95f1e5b1bc4e55e9fd61094ceabfc937b3f186b8fed0f7675941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625499, "uuid": "5bca30bc-d3aa-4a4c-a0c5-a0ab0d5a83c2", "value": "T1A68402D162A849D2CDBBCF36D0A12E058EB4A773B9A1D141D88145797E45F038FB13BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625499, "uuid": "e3dba748-effc-40da-b3ae-26006b6c7841", "value": "6144:QuaDz4cOwijkzDzZsBS99NIdnYu7/3MfRUTgO/Gi0IJ4lci2V42JwQnPUQ2ftnr8:yD1F7yYa/3MfR/Oedlci2fJwUn2AJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625499, "uuid": "a314e79c-e376-4794-9a35-36e79625d182", "value": 388904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625499, "uuid": "62d9023b-9a8c-4200-92ed-846d6acef380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625499, "uuid": "67328bd2-cf76-479e-a29d-6b782048f4b6", "value": "bcaafb55e8b91ac3148bd8d067daf3dfda3a2d42f4ad5273a2d261857a909449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9043075c-17be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772624265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624265, "uuid": "44ba3306-3372-40c3-b9f9-eadd20b27dd5", "comment": "Malware payload", "value": "8b7cdf7f4a2f0b8e66cb74f7b24d8ab7", "object_relation": "md5", "Tag": [ { "name": "35-231-116-180", "colour": "#BB33A3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624265, "uuid": "72616d48-10c6-494e-944d-fdf04ac536ac", "comment": "Malware payload", "value": "bd59bb135653562210af1eb84bce0345472014b06f21c86e1bfd11e04acbf546", "object_relation": "sha256", "Tag": [ { "name": "35-231-116-180", "colour": "#BB33A3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624265, "uuid": "2a9b8915-9a85-4fdb-ba7f-6d37ef6481aa", "comment": "Malware payload", "value": "254485a5782fec452c463f01ff58d45026ea5398", "object_relation": "sha1", "Tag": [ { "name": "35-231-116-180", "colour": "#BB33A3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624265, "uuid": "6182ee2b-e67a-4588-b3b4-35781936c064", "comment": "Malware payload", "value": "2d47ed48e23607ca9c415ef9cd0c01d30dc7841bb0bedce148acc622f2359d65b43b19c4b3b469b9ab85a8e489956032", "object_relation": "sha3-384", "Tag": [ { "name": "35-231-116-180", "colour": "#BB33A3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624265, "uuid": "7761b1d6-9fa7-4617-8e13-06d0b78ef724", "value": "T10391C8383AAF5A484CC30027BDB764C9AE402BB695EA6C00F4E5D055FDEF611D63B754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624265, "uuid": "11e666eb-7ba2-4e62-889c-65745c28dac2", "value": "96:d5g9d+FvvOmLmbMslf84D0lE0lLZ80lO0l60lXed:8EvOfbMsOrXhd1xW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772624265, "uuid": "fa8ec546-8492-4ddd-85b2-367bbecc0836", "value": 4394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772624265, "uuid": "5bad0961-2f1d-456f-99e5-ecf7962b91d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624265, "uuid": "b52ea43d-1414-4d7c-8071-84dcb6d9885d", "value": "payload.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11d23d2-17d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772632964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632964, "uuid": "25337b01-6b3e-4e71-9cb1-c002627002b9", "comment": "Malware payload", "value": "ca37e31d651bbd5bbddef3ea716b8b4f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632964, "uuid": "348cf07e-368f-4b50-826e-9105d162edd0", "comment": "Malware payload", "value": "bd8203ab88983bc081545ff325f39e9c5cd5eb6a99d04ae2a6cf862535c9829a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632964, "uuid": "0a8cb528-d3b1-4f05-a5c4-e5eb03fa6bfc", "comment": "Malware payload", "value": "de9707a8505683930fccf5536e311242425d420a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632964, "uuid": "1f22acaf-9f13-4e35-8f19-5d7fadb76f71", "comment": "Malware payload", "value": "0242c9ebb6edc62dfd9f15c2f27bd56a6768a6a5f8edb1a77e9f68a7a6bd70b4e9f9be9904e40277b1359058de102e9c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632964, "uuid": "4db88a4f-1abe-463d-99c0-9f01cefda425", "value": "T175A2F686B640D333D8814B314A1F97E44F75AC489F632106369BB39C2E76AE112BB9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632964, "uuid": "4c076db0-7fac-48e9-82f7-991d15a87759", "value": "384:6P7h9nyZJMey3M5UC0qEXdeSo5y8p+e6LrZgd/aI:6P/smeWMmCdXbd/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772632964, "uuid": "3b1b2af5-4139-4b7b-914b-f69001b3d4f9", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772632964, "uuid": "0447f6cb-51ed-4453-8dbb-867b65de5ecd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632964, "uuid": "4fbc1ef9-3f77-46ba-b05b-ae7e7c008ff8", "value": "bd8203ab88983bc081545ff325f39e9c5cd5eb6a99d04ae2a6cf862535c9829a.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32820220-17c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627544, "uuid": "734297aa-d868-4e09-81e5-12b47cef698a", "comment": "Malware payload", "value": "27985ad9ab54cba961c38277ad92af3c", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627544, "uuid": "afad72d6-df91-4f5b-b134-8c7e9e065dba", "comment": "Malware payload", "value": "be73110e8ab696f184e0bce52aecb799b9bf1a8d6e6ae0ac7da32c293fefd46b", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627544, "uuid": "edc4d5bf-f6a7-4dd4-baa0-1c4286c66083", "comment": "Malware payload", "value": "538bd1ca53a59d1feaa9aa9c0b08aa47c742a60d", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627544, "uuid": "926d69f0-0601-4ff9-b4a8-786cd167b47b", "comment": "Malware payload", "value": "0e4305cb27991bcfaabf2b40dfc425bcbd1feae03ec88febf9ed424521db7a2d851dfd17489d4b707ad61c13515aa7be", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627544, "uuid": "8ae511cd-f6a5-44d6-8495-c49acddbef73", "value": "T1CAE06A0D4F58CD55C45033419F75AF02DF4111B07213F82031CDCB00D6C0401551F0C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627544, "uuid": "f0a890c4-f27c-42b4-8503-d07307094d29", "value": "6:gsyim4xLNK3QoQRLqKC0zoWzV7aWu8WFsC42mWWNdJwIYWShx2c5oyky:xyngogC0zok7aJ8WFz4rN8PWi9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627544, "uuid": "e33a31cc-a686-41d1-bfda-ad0f1b0a9323", "value": 393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627544, "uuid": "696c30ed-2ccf-49eb-95f4-99366c7b11a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627544, "uuid": "12900609-8723-465e-8245-9de65388923b", "value": "be73110e8ab696f184e0bce52aecb799b9bf1a8d6e6ae0ac7da32c293fefd46b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75af0be-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602829, "uuid": "4c9afa82-b35e-405c-8f9b-3c279d826ec8", "comment": "Malware payload (Mirai)", "value": "72fe8bb6f2f2fa060afc8377930737dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602829, "uuid": "420521c7-8dad-447d-a59e-9eb8d089a370", "comment": "Malware payload (Mirai)", "value": "bf7f6b7b7ad2e1d45ce333fee0507bd9f6a6182c0ef8401fdc9dab6072098eb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602829, "uuid": "1d1a92c6-c63b-4643-9403-70634a1669d1", "comment": "Malware payload (Mirai)", "value": "70a08a25fd260cf474546fda1c845a57b02d5f65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602829, "uuid": "9fb2e2db-9f20-4df9-99e8-026a2f531778", "comment": "Malware payload (Mirai)", "value": "0aca64bacabe61dd0c989c799c53180b8c20c398559bc6f1ed67b4a3b580617bd525eec49d759f40975db65ddfb02651", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602829, "uuid": "daa82a00-e903-42b1-bb1f-df0519b20125", "value": "T16183F781B882972BC1E023BBE66E518D33A663F4C2DF7216C8215F65778650F0E67F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602829, "uuid": "4b3f2d2d-9111-4f94-8cbe-a88bbcbd07d1", "value": "1536:AGp5ty8pweXnSBsBUwqLDdeUGwoIPstKL10/L6oU483zCL4V922XYd+v:AGp5tke8m8NPsgEhmVYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602829, "uuid": "911a0da6-a78e-4ffa-8b8e-96d8d42ec8a9", "value": 81672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602829, "uuid": "067fb5ac-4930-4cfa-8cd7-6d860e354f77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602829, "uuid": "44c72145-4284-4733-8ff2-9ef8bfbe8a84", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd20133-1810-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772659614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659614, "uuid": "91d49bfa-855e-4eeb-bb65-ae897a44b190", "comment": "Malware payload (Mirai)", "value": "e15591308d3a82cd6eee057831eafcfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659614, "uuid": "230bf5ea-61f4-4a75-ba9b-d5b185b6d581", "comment": "Malware payload (Mirai)", "value": "bfaf78af9271a725eff8f2ec41b025ae9560565518aeaf6e5e37bd78ff464b15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659614, "uuid": "32ee4712-bee5-4193-92f0-806f3e08dbfd", "comment": "Malware payload (Mirai)", "value": "84444987c19216a8a004e286da4e3adaaff99798", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772659614, "uuid": "2761e7c0-b16c-4f50-8f7b-32c0f4d15d99", "comment": "Malware payload (Mirai)", "value": "6881c5db68f14975e9c9f48c26a3e620bc661baf6981b223308b48721cf96e5ade0b6c195f93bd800b278363cd43886a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772659614, "uuid": "66e95daf-4087-4a53-bd3d-8d89533b11ba", "value": "T18623F10E8831B94ECADDB8B768572A657901309862CFDF4D3B368E91B778D1B713D0A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772659614, "uuid": "761d4c21-f6d2-49bd-a25e-754b3165d3b0", "value": "768:AJV+cWF6xbkhZg+ar8FW936DwqGqoL/AayBRhgVXRVDWtdpW+Ne0kcVrd6Wh:4+N6qhS+ar8i36/obohgl6U3cVrdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772659614, "uuid": "af34c150-73d1-4ac1-a761-a319cb3e936c", "value": 46932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772659614, "uuid": "0346740d-e3e0-4a1b-87b8-026c7a061ca6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772659614, "uuid": "3a7cf0e4-c875-4c37-b495-2304908914f7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38930aa0-17ca-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772629272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772629272, "uuid": "4ad920e8-be78-4aeb-942b-a0a1d5028af3", "comment": "Malware payload (MassLogger)", "value": "43d0eb5f6a992002e6a62dcac4a2e5e5", "object_relation": "md5", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772629272, "uuid": "bf100632-a7f5-4b75-83ef-37887304c39a", "comment": "Malware payload (MassLogger)", "value": "c0e45af8bb79063162e88de2d0da5bddf2c5e4d6a3de38ff47e0d7b0e995b910", "object_relation": "sha256", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772629272, "uuid": "6aa80450-f73b-4e46-8fe5-485008edc03e", "comment": "Malware payload (MassLogger)", "value": "89bb8b38104c76b108881dd84a7225210154ee5b", "object_relation": "sha1", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772629272, "uuid": "10cd5e99-46cf-4138-b28c-acbce86dd65e", "comment": "Malware payload (MassLogger)", "value": "da91de55d04c7de5c3419cdcd609425aa44549a7a1a8788323dd1c4e68320b5bc422cb8393d05496736bb18cec68b384", "object_relation": "sha3-384", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772629272, "uuid": "df20f5ab-4cd4-4cc7-b805-0a78b1ae3840", "value": "T17B4419443BF95619F3BF5F79A8B050504AB6F92BAD1AD30D1C8620EC2E31B51EE50B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772629272, "uuid": "ff649eca-fa0b-484b-83ac-dcf8cc90dde7", "value": "3072:ARYyGJwDsUAoyV0CdWvHZUdoTSBEegmIWZu1V1XnWO8j9XQIvn5bfIQ7SairKDye:ARYfaDsh7WxUq2n9AoxgrKDm/Xyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772629272, "uuid": "1ec76bff-9ce2-4adf-b9d8-b94a5ab0229a", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772629272, "uuid": "f00fd5f5-fb35-4512-9290-e556d7942d64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772629272, "uuid": "e47249a2-5425-49d4-82b3-ced679d8bd67", "value": "c0e45af8bb79063162e88de2d0da5bddf2c5e4d6a3de38ff47e0d7b0e995b910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506d378c-17d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772631889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631889, "uuid": "5495a6cb-ec78-4dbf-9f62-cfb91e3512d3", "comment": "Malware payload (Mirai)", "value": "ca1aa385cd9aae4b3bf680e6a884b8dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631889, "uuid": "953f2bab-dbad-466d-b359-22b3e2e3bb75", "comment": "Malware payload (Mirai)", "value": "c20b51a14bf5cc81aac067b6a319e8aabef5e948b569e8e88b968fcdc4b980b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631889, "uuid": "cc174a63-f47a-4ded-9262-a284979d99ec", "comment": "Malware payload (Mirai)", "value": "1e2e19e6d1c6bd2b2fa8c265ab50a80bc06f004d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631889, "uuid": "ca0cf9f7-bb9b-4f33-88f2-8b61e267b2a4", "comment": "Malware payload (Mirai)", "value": "1733dc13b16346d52097991517c3c99943bfe390b15af1c6e33a930844e0bb3a1c569e70ad609d412ed22374b9722208", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631889, "uuid": "341050fa-2b49-4985-a8b5-0924b0479015", "value": "T115838C77D4269A54C08546B0B8E4CF741F23B1C093532EFBAAE5C2A994A3D9CF502BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631889, "uuid": "19fe60d5-8784-40b9-9f0e-d6d263b34f58", "value": "1536:GaITNhXCXSYzTB+LxUhLnNwGVKlr8YEzWpxCr4IoW3jRDjMGuF:GFRaSYfyxUhTN+lczWpxIzjNgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772631889, "uuid": "40391141-2f24-4a3a-aa1f-75db318c7399", "value": 84596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772631889, "uuid": "60ccf87b-b0be-422f-8815-2714b605dbc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631889, "uuid": "a37e7823-159b-4337-84e0-b8528a2a72c2", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c34a4f5-17d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772631828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631828, "uuid": "8d72988f-8b17-4e31-a767-f8317b4c2e0f", "comment": "Malware payload", "value": "abb95a423cf44b29c0048506916ebd65", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631828, "uuid": "2f6c2eed-74f6-4df5-b296-bd8ba691cc4e", "comment": "Malware payload", "value": "c3ee14953c043a41c73f6489eaa11e44a365aac119593ec6fc300c0de8d48ae1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631828, "uuid": "6b2ba323-192e-4511-aa69-26343f0b50e7", "comment": "Malware payload", "value": "9a79db5666c8bb504c151b596475db368ddba4df", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631828, "uuid": "cbfca097-bf36-4fe3-9559-69f3d6a2ba3d", "comment": "Malware payload", "value": "d6c732500eb51be91b489cdfe85800e58e08bd4a6c40cb00fb13319e931dc5f9189bb25914ec6ae506dfd843d8189a60", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631828, "uuid": "68920b0b-7896-4f92-9d83-8f6f6bf1773f", "value": "T19544CCD45D8A80769B8F617C402F0E6F879CA547022D98C07EEEDFD46F699E4706A3E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631828, "uuid": "a1946ddd-6f22-4a5c-b976-f2dfc76d0885", "value": "6144:YkGX2kFrOREvyVIT9bcG2ThHbElOpj99LM+E1TfZ:YkGX2SrOREvyVITWGUbElOpLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772631828, "uuid": "89a5bcb1-0488-4e66-afb8-19e012ad2d02", "value": 277163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772631828, "uuid": "525d3fcc-ad62-4665-95be-5a6474ee15dc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631828, "uuid": "52e701ca-fdf3-4b29-901b-684fb6fffa69", "value": "Template_Asia__95.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d71c362-17b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772619375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619375, "uuid": "bc47455b-f9ac-4122-9239-9944cf18a34c", "comment": "Malware payload", "value": "ac927d4f8e3732a3f67cbfdeb09e095f", "object_relation": "md5", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619375, "uuid": "7f903123-973d-4be6-a485-3fdf84c30acf", "comment": "Malware payload", "value": "c416031db58c58ee2812d8994312fc442ef1653174bd6d6bc6e1a19508c6b2e8", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619375, "uuid": "7e6f231a-5e26-43b9-941c-39c6a8b3b35f", "comment": "Malware payload", "value": "7a05f428f33406588aee8834d21d4c942612fbb2", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619375, "uuid": "e0f1d82d-290f-4633-81e4-07411107b478", "comment": "Malware payload", "value": "6607ae22e8ee166e276cfb8d8fc9ce1370980043e86d5933f0f4c276ef0b4094209ff28a1d137f17548186f214838f62", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619375, "uuid": "31d3ef6f-33af-41e2-96cf-a02fecbecf7d", "value": "T15D941374CDF45182606A8A04D76BBDD66E15C8678B8B409283FB7B02AC533B1C7E17F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619375, "uuid": "e12ef6bf-2f1e-463d-a49c-1adee8908f23", "value": "6144:GUmVKtHh422NtCrofE7fDxGsuRX5T+os1MiCxwDQ9Efiro:baKtHJ2Orom1fuRgZ1Mpx/9Eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772619375, "uuid": "d456b422-51ea-4f98-ac5a-25cf0aa9cdff", "value": 415540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772619375, "uuid": "5b786f60-4bd5-4a40-bd69-3ca054d2bf25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619375, "uuid": "53c182c3-3b0b-4c12-898c-0a7495d4d785", "value": "c416031db58c58ee2812d8994312fc442ef1653174bd6d6bc6e1a19508c6b2e8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34ebbe5-17d4-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772633746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633746, "uuid": "a7594a8d-2905-4fc1-b15d-867a386b875a", "comment": "Malware payload (PhantomStealer)", "value": "4731b1468e1dc3a60543389f5b743929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633746, "uuid": "57959b22-3a68-47d7-8d1d-d4421d7f16a7", "comment": "Malware payload (PhantomStealer)", "value": "c52a58d86ed607a6e49ea632eb609bf08180ceae06249576633c4a6fd63e5488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633746, "uuid": "ebfcb691-7b7e-45b7-a14f-2d3880da3346", "comment": "Malware payload (PhantomStealer)", "value": "21a1c78001163a02610689b912c446b92e2c4a6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633746, "uuid": "fbb61926-a749-448e-b79a-3d033591bf0d", "comment": "Malware payload (PhantomStealer)", "value": "e527e1e01307d1d548142eea2e8bb42ff00bdc87bf0dd83352fad5003e429921f6a4c44ea8362f97a9538f1ab97a26bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633746, "uuid": "d378924d-3c7a-4748-a31a-8236c045aeb2", "value": "T11A85E00273C1C066FF9B92334F66F6115BBC79260127A62F13981DBAB9705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633746, "uuid": "fdd554dd-4b13-48e0-bf4b-05575ab48c47", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633746, "uuid": "9b72ab22-382a-4bc9-86ce-52561890169d", "value": "49152:oPVt/LZeJbInQRaYANZjyX/7+4BWmiXz:2TYbInQIVy6HmiXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633746, "uuid": "8d2b1231-2742-41ee-a2d6-886d9bb8e940", "value": 1745920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633746, "uuid": "c69c6eae-2fb1-47e0-838a-4d60788e8767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633746, "uuid": "137b946d-6382-4cdb-a32a-e5037925c98c", "value": "c52a58d86ed607a6e49ea632eb609bf08180ceae06249576633c4a6fd63e5488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8772743f-17d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772634558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634558, "uuid": "8e43d9b1-462c-4c1d-90f4-d51c7c371375", "comment": "Malware payload (Mirai)", "value": "2f7e845e28e95caf35ab2f2633b477e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634558, "uuid": "2980bfd4-d42f-43c5-8de4-dadd671a6174", "comment": "Malware payload (Mirai)", "value": "c56fca3e5096a3948c614994e6d5af29d31b0e000f008458fe4d470d79c08651", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634558, "uuid": "d72ae0f3-7c8a-4e76-80b3-19d994c6110b", "comment": "Malware payload (Mirai)", "value": "17b25a26b4981ab05199ee9c1844c2c2d0942167", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634558, "uuid": "dc3730e2-ec00-4cc2-abce-8b4423b4c8e8", "comment": "Malware payload (Mirai)", "value": "5df27137d26bd4e4e7ab6ff547132d93db4c45f8dffee0c37a292695ccc7e41fd718b01a9521c3ec6318ed84b37d099d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634558, "uuid": "0962dda6-c259-417a-89ea-2ab9cd130c3c", "value": "T1B1241945FA408B13C0D627BABA9F42453323A754D7E77306B524ABBC3F8779E4E22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634558, "uuid": "89f70dab-6f45-4075-914f-1f15cee70ed4", "value": "6144:I2e7NIFXm8asbYaSoNcqk0VnKiXyBSM/RSvUV:IvGF28a8YaSoNdXU/B7/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772634558, "uuid": "67cb00f4-01cb-4caf-b385-acc32bf78602", "value": 214258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772634558, "uuid": "3c8f0276-d12e-49b2-bd69-60b3a7ea72b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634558, "uuid": "7be5a0a9-ab67-49e5-a336-9057baa72330", "value": "csk_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a438b133-17cd-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772630741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772630741, "uuid": "b2ebd20a-dcb4-4595-b47b-6388fc37c3ca", "comment": "Malware payload (AsyncRAT)", "value": "52e519875985f654664a8215f29c541b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772630741, "uuid": "78480bea-c2db-4c0a-b4ef-df7037ba9744", "comment": "Malware payload (AsyncRAT)", "value": "c60cf77543c28638baafbceb49485d2ee837644928c0705e97723e9a183f6a4f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772630741, "uuid": "7e38a068-afe6-41c8-bbca-8ac25152acb8", "comment": "Malware payload (AsyncRAT)", "value": "7ca71ed5c564f3d49f9f398adbc6370598b84d2d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772630741, "uuid": "1a50d3bf-7c71-4e84-9105-bf1851e69ff7", "comment": "Malware payload (AsyncRAT)", "value": "cc0286ac2b819b10804abc96963e1ae4962de48dcfe724dbbab954e736f4490e63b2599476c2b57310d37e0b261ab56f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772630741, "uuid": "0a6d25a7-ddc1-4faa-b8ba-3cb415c0a67f", "value": "T1DBF24A0573E58665E1FD1BBD5C3686044372FA478D22DBAE2EC450AE2A237C8CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772630741, "uuid": "a2291e98-b82e-42c8-86d9-7fed3db0061d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772630741, "uuid": "440dab23-481e-486a-a9b7-29aa7b6548ff", "value": "384:iMT5XY+17Ng15KhElE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCcXWWLEQ+:ii5XHRNg1IhT1hV4RbJwB+WWtwQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772630741, "uuid": "185dc489-a918-4426-9c18-120f9a03ebfd", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772630741, "uuid": "03a8e5cf-0074-494e-a24d-4c96d17d9c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772630741, "uuid": "1ccd4c04-b225-493e-a108-7935e89e91b3", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc19949-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602763, "uuid": "5abac339-e8a3-46d4-941c-a628e2cabffb", "comment": "Malware payload (Mirai)", "value": "fce722c9edc0771cab68d4c3da5a88cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602763, "uuid": "4b68f95e-b369-43c0-9018-ce9a24e16bd3", "comment": "Malware payload (Mirai)", "value": "c6b86164d948a3a8abd9c990f55592c01a9917b0fa188eda80cabd5c579bcdc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602763, "uuid": "efb02dc9-fed9-4adc-b967-bb91671aa34c", "comment": "Malware payload (Mirai)", "value": "b225603cd6d76b3ce97f49f57f716e2176d855f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602763, "uuid": "e8b62ed1-b35e-44e7-b57a-e29ab7c33e06", "comment": "Malware payload (Mirai)", "value": "009554c6c2f7a1e3165d1cd9f5f79c7e1a92530077a8493b30f6cf5ea16db296bbc9bf0253a990c0f24b16b2ce36a4f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602763, "uuid": "8b90662d-c3fa-4cbd-92cd-df089bbd7dd9", "value": "T1C9F38D72C8387EA8D1A4D178B0719A791F83A8A041571FBF5EE6C2764087D8CFA097F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602763, "uuid": "f8b797e6-f922-4390-8c1d-220fed83c5eb", "value": "3072:3pP1IxuM/4N+ZeNeBqmDlNCPVWiKtnDWgqKMelp2:3pPywN4DlNCdH8SgUeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602763, "uuid": "2726e21f-816f-49ad-9368-59c22325bb21", "value": 162600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602763, "uuid": "91b54fe3-124e-4d37-b137-0b0800d6b104", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602763, "uuid": "56beb799-ec5c-48c8-bff1-c70d8460dc21", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd089238-17a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772611992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772611992, "uuid": "8f95aedc-d0aa-467e-b218-20d51eae75ef", "comment": "Malware payload (Mirai)", "value": "73fc43312ab6efde728198d1d4b4d749", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772611992, "uuid": "1425ad69-4a15-4734-9990-bd190637ede8", "comment": "Malware payload (Mirai)", "value": "c726e56fcb2693456279ba27fe9267832d65d39e656e681190833f01e7dca83c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772611992, "uuid": "63e7d364-a877-431b-a63b-db3e52f0658e", "comment": "Malware payload (Mirai)", "value": "315aa8695c13dd81360da30d51803a3a0546a993", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772611992, "uuid": "720d3b93-04f5-4ec8-95ed-44ac7cae7ba7", "comment": "Malware payload (Mirai)", "value": "ed173543e8b4a0669f1e4dae0468c90af243e10adc5592ad9a7b6bce4ebac58fb4d62c7cf79fe74221b29bf97bd80267", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772611992, "uuid": "dc7bd082-b1a6-4489-9ac3-613e489cbf44", "value": "T1DD831A82BC818D11C5C813B5BA2E118E331623A9F2DFB257DE115F2477CA92F0E7B596", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772611992, "uuid": "60336f85-c838-4c05-9ed2-d965186615f0", "value": "1536:vinJr73EnAYAnM09ltVTnjSUh9odbviFts3XRazJI2i6tBsT0NseFDF:0rYZAnNv/TnjDh6NKLPtBsT02e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772611992, "uuid": "16990199-f011-42fb-9f00-87a585274eb6", "value": 84232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772611992, "uuid": "cc684efe-668c-46ed-b578-1b057d8d93f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772611992, "uuid": "bacb22ab-2d5c-4afb-b84a-2f0d4c4a3cc5", "value": "nullnet_load.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b0ba04-17d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772632978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632978, "uuid": "a0c3d055-3c4c-4be4-9994-240fb1fbb4b7", "comment": "Malware payload", "value": "c0a52cd5dd35bf9d5d08c7eb12cfa422", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632978, "uuid": "d62ab2f2-0b69-4fd4-833e-22ff03360a06", "comment": "Malware payload", "value": "c7cf1575336e78946f4fe4b0e7416b6ebe6813a1a040c54fb6ad82e72673478e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632978, "uuid": "790cd914-a913-4314-8252-ddc9527eae4e", "comment": "Malware payload", "value": "6b186f2881729a977beb6aecb61ac0fe83c5777d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632978, "uuid": "a562b296-eafd-4c98-9662-e5d5c9e5c9c2", "comment": "Malware payload", "value": "ed1a2d9c54470212ed61fc4a9214a48899c92b4f9ac4aae9b9d60fbde4db4ad28d4eed1d1563631c1b6718cd0ae28a88", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632978, "uuid": "e5f3b1c3-1a00-466e-adcd-7fed4246d247", "value": "T1F9613B66E791289AAFD937236A984E81427174CAF8C3114A0D2395C707D54F4B7186AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632978, "uuid": "87456e54-0260-4736-9e21-28d1199e4d2c", "value": "96:iIyz6jwkYrK5ST4JQ81/yory2/5D8M6tRqqZt+j:iIKkg14fNyAy2H6t4qOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772632978, "uuid": "6b74e804-d3d5-47ea-b8fd-ba4b2c10c35e", "value": 3181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772632978, "uuid": "5904911f-8ed5-4a04-b13e-e6f72bb44eb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632978, "uuid": "d59804d9-351f-44a5-ac3f-3c6d47181add", "value": "c7cf1575336e78946f4fe4b0e7416b6ebe6813a1a040c54fb6ad82e72673478e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8c1eb0-180c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772657817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772657817, "uuid": "f6dd5076-1403-4301-baed-37f27a13d12e", "comment": "Malware payload (Mirai)", "value": "83de0720d64b83ccdfa6a0020b112676", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772657817, "uuid": "fafce231-87c6-4c7d-a804-ccffa8dd3748", "comment": "Malware payload (Mirai)", "value": "c85249e0e9bcecbe2386af9c0dad784cb847e16badac929c5082d9953bff4bdf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772657817, "uuid": "1c526172-c21f-4c98-a3f9-a9a703fe5927", "comment": "Malware payload (Mirai)", "value": "7ad9701bd8a3a1817cc25472929cba2656dfd937", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772657817, "uuid": "21dbdbfd-96d6-4130-85a0-66237837f34e", "comment": "Malware payload (Mirai)", "value": "229c25ebc9583f6b5e283da6db410d6a4d5736aff697af0e2b26d4e1050d482ca0a94928b4528fe6a6f1979052ac2f1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772657817, "uuid": "67bbbd63-5891-44a4-b994-2ac945a5d359", "value": "T1C16302FD71C44C46CC3C0CB9509397969E4061F562989B9D4313CAC8AE9F2EDB64D4BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772657817, "uuid": "06680563-b87b-4653-b8a5-8f74a38d86b1", "value": "1536:lvWpJQGWDaA+nKSWX1PL7pLMuRB92omFhiVsd3:hWD600RQuRH2ocSsd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772657817, "uuid": "31ecffb3-21c9-49ba-85ea-0eb322ee9412", "value": 73248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772657817, "uuid": "d9997d76-b105-44ea-9e91-ed45cd96c056", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772657817, "uuid": "aec3ce79-df61-4d00-b007-fa6aeacdc97e", "value": "Polar.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1bed79d-17d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772635488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635488, "uuid": "9e443a01-9b64-4323-8c05-cddb61661d84", "comment": "Malware payload (Mirai)", "value": "b9db978cdc38a8257ce5e5093e0110e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635488, "uuid": "f421ac9e-f8a0-4b3b-aca6-a7cc129b0a43", "comment": "Malware payload (Mirai)", "value": "c94b7ad766892ea5a71d26f37385df362505927cf9158201ec0e387b220d2f42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635488, "uuid": "2d1957fc-1b94-4ad3-9f55-adcf31557cac", "comment": "Malware payload (Mirai)", "value": "37b6e0b4c59ff6ed6147db5addc1e95baff2f8cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635488, "uuid": "3d27d811-c320-48f5-b6e7-5fa82c051956", "comment": "Malware payload (Mirai)", "value": "5e322ea385f1e3db85498db8ae2ac45e109bf7e60cbfc30fae7c860cb63be2b43b724430d528c61a5aa3e31f3bc9cacd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635488, "uuid": "585e92f3-20ef-4b07-a365-a66a87e7be84", "value": "T16563121B49631983D489A032C2B501D2B2159AF4FFDEDEEB552D1F2A4F291F709B2DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635488, "uuid": "f80e7d33-f001-4e48-9bfe-7c27c31d704d", "value": "1536:JdkBqsTDLx0of1ZZOZGnllODzqoScuLPSFXk+kfHs:JmRTPNzO8nllOSHJLqFIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635488, "uuid": "9b3a105c-d9dd-4545-aa29-96c30fd5173c", "value": 69064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635488, "uuid": "942552d5-8c96-4704-be12-33e8d2a4d3bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635488, "uuid": "cefc5c43-f41f-4fb3-b0de-8fe47f5b32f9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52700cc3-179c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772609559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772609559, "uuid": "8b193383-6293-431d-ae75-b1cc827ab002", "comment": "Malware payload", "value": "cf6db89a3ebb8efb5a6f7af5c4a63f50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772609559, "uuid": "ca557d1f-0681-49c2-bd3e-04be86310c66", "comment": "Malware payload", "value": "c9d9516e01719a3ff1309f0d845443186f5b4567c200e7befec5acc2bd2fea12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772609559, "uuid": "2603cee6-adaa-4d2f-ab3e-d723e27bcdb5", "comment": "Malware payload", "value": "cf9168487d8e209aba3841e32aca3d3e90c20168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772609559, "uuid": "a0b7f86b-06ae-4237-8817-4d1451c6f7bd", "comment": "Malware payload", "value": "bde1cf3f6c6841469335662a116e53963a2196fb164d57cdfadfffe12f42bdf8874f1d4cbedf356d1d9e0a106107c5e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772609559, "uuid": "17b568d5-c1a0-40d3-bf6d-42f33c029562", "value": "T13C07C60232934BC8E92548BC929FAF54FA21BDEE4924D75309F1B54F5EFD202D90992F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772609559, "uuid": "a064ef55-0fe4-473a-8d12-24c312efef6c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772609559, "uuid": "df2c7354-b023-4dbb-bd01-2842c76ccc50", "value": "196608:g9zw2SSXi+IsVpOZ4RTjfhMwv+yVDdmkhE6:Kw2JxIsVpnTjJMo+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772609559, "uuid": "705d224e-4d5a-4933-94ae-c42db775acbe", "value": 17228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772609559, "uuid": "3ba186e7-a0e8-4a2b-8199-8dbf2b268a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772609559, "uuid": "fe8ae6b9-bb7a-4806-ba94-ab163cfd142f", "value": "olecli32.Exports.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814982aa-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602765, "uuid": "759038fb-543c-4400-8ec5-4a328a924dc0", "comment": "Malware payload (Mirai)", "value": "cc6702de810fb6a3346ed8f83f4fbf3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602765, "uuid": "b1d45663-f0e9-4e17-b613-a213c7876a85", "comment": "Malware payload (Mirai)", "value": "cada3f5cfb9db73b322030c084ef77a79e3ba283f3aacc7f6fe57d8ee3a26550", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602765, "uuid": "93f04e4e-7c56-45ef-a727-4da735ececec", "comment": "Malware payload (Mirai)", "value": "831759ec7fe39f4bb7a422769af08cb97021a2b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602765, "uuid": "8bf8264c-aac2-445e-b44b-eb78279f064f", "comment": "Malware payload (Mirai)", "value": "6e537026d8e2908a2b81d55b76f0fc97ddbe2f5eca664bd0bcdb23fd1757be3c4e3bea63ed805a8330fb8a8007f58d0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602765, "uuid": "fd7aa090-cd7d-4bba-aab7-ed5304a33b98", "value": "T16453025094545D76C8B0027839A846C19CE48BFEF1DDB23AF1867009C68346B6AF9FEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602765, "uuid": "34d87dac-78b4-4269-b082-762b0eb40d1c", "value": "1536:RtEq1slHhrJmBFO/5va8TY9TkP9TZ7V80DidqdNrvf+zBX:QlHhUBQva8TY0xyh2Rvf+tX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602765, "uuid": "c2d5d43b-42e9-417e-a63a-e604f32e4044", "value": 65232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602765, "uuid": "1a85caba-5bbc-4390-b980-64169690cc7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602765, "uuid": "ec257ad5-8f16-498c-9b4b-e1d2becd0927", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d13cc52-17dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772637145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637145, "uuid": "62700c18-01a6-45f1-90a9-8d297e80785b", "comment": "Malware payload (Gafgyt)", "value": "e4fcf436804dd89db0f0b6c0ba1d3888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637145, "uuid": "a2d98ddf-db6c-4948-a903-f4dc93c01229", "comment": "Malware payload (Gafgyt)", "value": "cae18aecdaf4e1c863d42b4594e568ffc587b0a678ecc67cff1621a307070d93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637145, "uuid": "1b7bccce-b42f-4a5b-a9cb-e9c4f82cb271", "comment": "Malware payload (Gafgyt)", "value": "14eb428305228a12a823dbc9c083ecf3b097bb33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637145, "uuid": "3b361262-bb39-487e-b7f9-aa95c4cec161", "comment": "Malware payload (Gafgyt)", "value": "73a22ba7bbd295a42d1ea7b77e6f0986dd6750d9d4700f954ce908c67c97dffeab710015493f37b1cc37451a830c1cc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637145, "uuid": "8ecf5b68-f16a-4b0b-bd8a-1f7a3915b289", "value": "T161F32A45FCC18A12C5C612BFFB5E428D372657A8D3EA31039D666F20378B5AB0F3A645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637145, "uuid": "2c06785e-f3cf-4c24-80a3-16b14eeb0a43", "value": "3072:Oy0n+JbnsXrICvHTb29ajCGi9PG44F7BlGruQ2a5OmC:90n+JbsXxu9TjBG4c7BsruPa5OmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772637145, "uuid": "fbf1f81c-1985-4bd6-8942-5ccc1f2c8d94", "value": 170720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772637145, "uuid": "2b139cee-ae50-4269-8b78-c37ff6cddec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637145, "uuid": "b92abb33-c02a-4214-9257-e2b3897cef86", "value": "Polar.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b91da1-17c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772628356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772628356, "uuid": "8d459449-7f7e-4b76-9bde-1ede7c0ead2f", "comment": "Malware payload", "value": "67dd13cbe4c480d35d88467fbbcad509", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772628356, "uuid": "d1d56bfc-7ed2-4296-bdc1-c5d8c8d6cc57", "comment": "Malware payload", "value": "cae1cf84ee06bb36ff0c4c7362dfa9a30be0a353b231f4c44e6830f601b51e03", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772628356, "uuid": "63b662b8-c2f4-4ad6-9e7a-08b63a9ba1b8", "comment": "Malware payload", "value": "0c5108268007a6635db4a0053fa0e6a20d965f25", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772628356, "uuid": "0727c7f7-5253-4061-8b61-cd8f18876b41", "comment": "Malware payload", "value": "c4cc71f4406a05c06968c75c1431ed8465762d5447c13a81b638df314776ca4cb7d7b25adf90b5e65a1ffcec3a9158fb", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772628356, "uuid": "f8b05262-99f8-4b86-ad52-4de1c86f4071", "value": "T19F968C09A3944A55CA66D938CB27E333C771BC559633C24F16EFD30AEE7B7408B29A11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772628356, "uuid": "b2986f44-b5b8-4068-9ff3-9bff9ec6a731", "value": "d387bb507c476c4a2aa9dc4c0f17cb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772628356, "uuid": "25b4fc16-7533-4ef7-9408-61410abeb0ed", "value": "196608:7Psb1b9lhpXQo88D6b8zGTgVNmpKrn4THDQAD9Uu7GXyFt5:Ib1bxlN88eb8zGtQn4TjQQUuC85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772628356, "uuid": "242d5fe7-6a86-4dc9-9431-ee4b74cd3ed1", "value": 9253888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772628356, "uuid": "e74e0142-a534-48ec-99ee-da764a11d2e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772628356, "uuid": "6c7db9c9-fca9-4ca2-a8be-4589aa18776d", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2cc6be-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602760, "uuid": "5eddc2cb-5e2d-46ee-993c-2499c75b7ae2", "comment": "Malware payload (Mirai)", "value": "8bd47471a9e5028588bdf959aabb8373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602760, "uuid": "4afcbfe3-afe9-4b39-8bad-cbb67ece6138", "comment": "Malware payload (Mirai)", "value": "cbeea28fb47ea3bae00d6796e379357ed1c04fd6d82ca2409c102919c7f1c431", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602760, "uuid": "bfbfdb38-2f6d-4d06-8efb-738d4036d6a0", "comment": "Malware payload (Mirai)", "value": "aa49fb27a7372a2fbd190093f3a543634a60062f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602760, "uuid": "d4399c34-6dec-4532-b28a-e9c7a0c27b8e", "comment": "Malware payload (Mirai)", "value": "d4f57cca9d80a27bb9ee21e360466ba6564c1a9f78fe41154af7620492be98dfd537de127550b223d278ba313458ad62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602760, "uuid": "31968788-ccbd-4f80-a998-08eac3e2e66b", "value": "T152D36DC0B6C3E4F9E95601752133F73B5B32A436013EDD87C7B9AE62ACA2551C91A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602760, "uuid": "77e185e4-6afa-4b47-a515-306b9179036f", "value": "3072:JuOiT8Jlk1hyQylp7EjcRpRbcd+Ia9K/QD29SjyWjYN0c:xQiUhyQ2VEjcRpRAd+Ial2Qmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602760, "uuid": "a92b75a8-37c7-4ccb-8c1c-98ebfcdef9f7", "value": 131144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602760, "uuid": "ee2db7f1-0742-401b-8d6f-e7c16a003462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602760, "uuid": "a8b0d4b5-c551-407a-a6ab-c3ccf6c30660", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd7d03d-17a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772614493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614493, "uuid": "98d6e316-f6e9-4e8f-9426-5f04d95c8a9e", "comment": "Malware payload (Mirai)", "value": "3d5e93b7bb0e406db6d026713d96056c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614493, "uuid": "5d4319c0-ab0e-4cba-8a55-d239c1bf4640", "comment": "Malware payload (Mirai)", "value": "cc82b3051e31143956d3e04c3de9bd03f5a9c3f452fa7e6596ae5741a9e3bec7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614493, "uuid": "5fbe06f2-3c00-4f67-914b-a2b9b406aab8", "comment": "Malware payload (Mirai)", "value": "a0d8c0010e6d30997aea3b10e98373e4266aea3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772614493, "uuid": "617c130b-b77f-4350-838f-2cbee2c54096", "comment": "Malware payload (Mirai)", "value": "9addfca50c876f910987b1ce6da18445b07e7d269f087e5d37c75683408562b349643830b11fd4b0ba2fc66ef1e2009f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614493, "uuid": "49912eb2-c58a-473f-ae45-09726e63c8b1", "value": "T167A3620A7F610EF3ECAFCC374A992B85148E651621997F75BD70D818B60B24F19E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614493, "uuid": "0f757eb9-feaf-4322-90ad-8e9c17fe37d6", "value": "1536:noXVScL2f/0poEgA1ArLeibeUoo1/ON9MZBdifvDr:oXVScL2f/0poEBArLQfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772614493, "uuid": "5d32095e-f9d0-41a8-8f08-535cffed5c92", "value": 100552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772614493, "uuid": "5356d5c2-3f73-434d-bf87-b631a8909994", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772614493, "uuid": "dede24e8-a74d-4c6d-8b3d-56657c742ed8", "value": "nullnet_load.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811b242f-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654734, "uuid": "2961eed4-68fb-4536-92cd-f53b8825f7dc", "comment": "Malware payload (Mirai)", "value": "2e60322acbbbe9e0d044d00895b54318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654734, "uuid": "519a6144-a3e9-47e5-a445-18c69e79cb92", "comment": "Malware payload (Mirai)", "value": "cd9d482a9631abcd7cf2b88e491811aa332f993f2de225b2b08bbfdae7130f36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654734, "uuid": "d3b72a1b-f6c7-4eac-925f-d7f82c3b1a63", "comment": "Malware payload (Mirai)", "value": "adbf91f790ca0a50169c079d6f0ecb1185aa5dff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654734, "uuid": "d74f9b92-b379-429f-adda-512f606ed904", "comment": "Malware payload (Mirai)", "value": "f6de8be8d2e0618f4e847741e74891f05946795ff0a141d1a0af6d2256ff0bf515dbc6e05d5ef535efdd37a29e43aba7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654734, "uuid": "d6796fe4-6537-471a-a6b7-12a42fe7d62f", "value": "T1FB630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654734, "uuid": "c5aa0eeb-6482-4c79-b4a6-fafcb146aa21", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654734, "uuid": "fc561920-94eb-498c-b76c-d7057ab4b7cb", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654734, "uuid": "f20dde01-797c-4ce6-b169-6d8f186bb1e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654734, "uuid": "69af0f1e-71ed-4591-b583-21b4d982253e", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6406435d-17d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772632781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632781, "uuid": "bf45de11-33eb-47e8-8f2b-b37efd671c74", "comment": "Malware payload (Mirai)", "value": "ad9159fa6f768dc78dfcc3811205446d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632781, "uuid": "63b6b639-48ff-4dc2-be99-73ee626c773f", "comment": "Malware payload (Mirai)", "value": "d05b3a23cc54d40dba135140b3f9886800485ed45199afafcb5ef2f44c5c4278", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632781, "uuid": "ba86aa49-e6df-420a-b7cc-b028f3108e03", "comment": "Malware payload (Mirai)", "value": "06dd553a175827f56f9a1f067ac1c3728c9aa702", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632781, "uuid": "76e5a3c3-33fe-4c6a-b960-c255234cd333", "comment": "Malware payload (Mirai)", "value": "9c71033054ae5f48a6ce01c515453c4cbdcc6992b09527eca823516b9613653ebf2a0d569132b0f1e6dcba1a7363fb97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632781, "uuid": "2a205fd7-7cc3-477c-a0dd-86ceaca81f47", "value": "T17714A61E7E228F7DF668873047B78A24975833D627E1D644F1ACD3185E2029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632781, "uuid": "4f36a316-4ea3-4119-bd01-f83f205647a3", "value": "3072:zicEdTgR1wXHDw7QJrBz5t4ZHwEZ77tpCqHZ8OzVtC:zicEdTqKXckR5yxwu7tpxHvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772632781, "uuid": "0e59d2c0-8506-4320-92c8-01605fd3449d", "value": 208276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772632781, "uuid": "3b5928aa-e834-4efa-a5c8-b7fa3feccd67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632781, "uuid": "6e27c2de-d777-4915-8630-981b4fde1fd5", "value": "csk_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beff4a08-17a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772613177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613177, "uuid": "f0b4562e-17d8-45b7-94ed-be717ac168b2", "comment": "Malware payload (Mirai)", "value": "c1f915184f38ad7f5a67a4be1fea85fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613177, "uuid": "2049fb79-e4b2-4d73-b8b3-01aa90b68772", "comment": "Malware payload (Mirai)", "value": "d07b76ec268a4cebf4718c40037a6a855dd75385e6841e5788f899cedcb1d4d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613177, "uuid": "3a9c4d37-1d0a-4a2e-a259-3f4b59983afe", "comment": "Malware payload (Mirai)", "value": "ce9378e409aae976d08f6532c3b70dfb1cacaed6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613177, "uuid": "bcc279ab-b613-4c5c-86b0-eefc2bd2aec0", "comment": "Malware payload (Mirai)", "value": "2f43ae16d0f4e643ff28a5176232e66b7d1bf62010de56b2935233973860cef0b04da6766321b5a3b9a2d156abf01cb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613177, "uuid": "4f314695-a6ae-42f0-b262-d9d6dc1ca3f3", "value": "T140633B0237684E03C1A659F9292F23D083FFEE9121F4F5842A0FDA5A8275E37555AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613177, "uuid": "176cee62-f706-4675-b092-6761584b27be", "value": "768:kOwkQx3TMR28v4Ru+RqD6wTRAbaAdQAiYfu9B+9jXRMxeB2TK/4fo2ql+Y2AH5Yw:GZM4NJKLBAixOKiUKQfj+H5YLd6DFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772613177, "uuid": "9874223a-5b10-4f4b-8c59-54e5048570cc", "value": 70752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772613177, "uuid": "3629272b-152d-49da-a0cf-8b47e9becfbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613177, "uuid": "8a14443c-3835-4fec-b660-9ef299c35edd", "value": "nullnet_load.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291356f8-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625381, "uuid": "ac2652ce-7e78-4cdc-a135-9cf6ce0dfae1", "comment": "Malware payload", "value": "1da31020a495968ed673607b91085c94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625381, "uuid": "8ecc7c80-74ca-4bfa-a04b-7e1f7ae8a244", "comment": "Malware payload", "value": "d0c7471c7950b2f80dbf92f929dfb0f10d518b551b326e56e9b2870de90196f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625381, "uuid": "50a57ca1-b13c-45a1-9ee2-e48f53d804d1", "comment": "Malware payload", "value": "6ac766822142dec8c54997b21b9f4bb3e778cfd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625381, "uuid": "55f0e8ef-ee49-4cc8-8ccc-55b59b636b4a", "comment": "Malware payload", "value": "cf7a17394232d95cda226cd400a210462737996f152e4b246a568cb981433c73d4fb4ba0fc99e62fd7d09402bbfe63cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TECHNODENIS-LTD", "colour": "#63D611", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625381, "uuid": "c6fb7888-7cfd-461c-844f-399298af720c", "value": "T1E2149F00677DB526CBEE4A3650612238CA7F9F5E2D61E7078D44749C2AB33F10E15BE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625381, "uuid": "7ca7a0a5-da20-425e-abd3-db8f218a0326", "value": "3072:e8cA+IU02Yzgl6LAEke3aOzmJIvX6lvTN0E7nv:e8cA+tkEeqQmuvX6tf7nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625381, "uuid": "3cded675-d6bd-4e2d-8e0a-4a4ca5b17c8c", "value": 197992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625381, "uuid": "ea99abe1-d3f7-45f9-9eda-29000676be79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625381, "uuid": "44b20f68-889c-4e54-861d-390c3795254c", "value": "d0c7471c7950b2f80dbf92f929dfb0f10d518b551b326e56e9b2870de90196f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95268e2-17c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627394, "uuid": "f88f5f2c-ef3e-43c4-8c0a-8530510aca82", "comment": "Malware payload", "value": "bab8cb74dc2ab4f9a3eb065cb0aa1b17", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627394, "uuid": "afc268a2-7668-47e6-a0a1-48d65a820e35", "comment": "Malware payload", "value": "d26acc49e0a1d0be5863f0407d64a622f6a37c474481df23948eb9e05021b0c4", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627394, "uuid": "8506190e-2815-4e3a-8cec-de8379bcf63a", "comment": "Malware payload", "value": "4146e5444f09259d30d1384ce769ce80c1b0ae9b", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627394, "uuid": "023055e8-bfca-4f7a-9771-3c54696d7a2f", "comment": "Malware payload", "value": "deff8a81a31064e4c0a8ad96fc0ba270a0286abc1b12f4f6d9fec1bc6040deed4b1ee22f9426d448ae8c6e2990b0f38b", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627394, "uuid": "ab7de1b6-c826-416d-95de-312a3d483404", "value": "T1A1E3C72BB7E47765D434D073CBE7C315B73096A1D1368B6B09C24E1FA56A00A6B4BF28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627394, "uuid": "4a51ab1e-f05b-4a38-aab0-837259bd506f", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627394, "uuid": "96e321df-1da9-4dfc-a971-b4ffb83125f1", "value": "3072:EPd0tMfSIi4/uPiJrTaQXN3pVqDK4fPh+B6mHEN:EVjSbp69TfN3f4nh+4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627394, "uuid": "837c1511-a9c0-42f1-8cb0-6e052eb01ea4", "value": 149007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627394, "uuid": "7a632f77-1b89-41bf-9931-2b3efe29cf79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627394, "uuid": "e0f8277c-cb6c-4f0c-a62b-97d014e69e45", "value": "d26acc49e0a1d0be5863f0407d64a622f6a37c474481df23948eb9e05021b0c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb424cf-17ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772622600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622600, "uuid": "6f799176-8927-4ae2-9d03-3a01bc3413ff", "comment": "Malware payload", "value": "4d69a9e3052167a639cddd15cb2ea6c3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622600, "uuid": "250e3bf2-43c2-43de-ad10-90b6e541bade", "comment": "Malware payload", "value": "d3be25a24c99610e44eb9167c6592583ceca6e238709122f42c99c99415debe2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622600, "uuid": "bf1b20ef-1aac-4607-b573-8467e02efbda", "comment": "Malware payload", "value": "5a6afa5cfc53e16e84849665b9501fbfecffa356", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622600, "uuid": "24a1aed5-21ff-465e-8798-ee6082ffb150", "comment": "Malware payload", "value": "ad68619aeedf74cbd67b9f3575ebfd99131935a1729364f8d3aa8757c21fa895d1145321c8187a1e3c64d7ae845b76fe", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622600, "uuid": "483918c6-17e1-48d9-a932-4e575e606d09", "value": "T121D5AD8AFB0C992FDCB6103A1DAA077126575C9A8D82D7433404732CB9B76C84F5ABDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622600, "uuid": "e5cd6c49-642e-456f-9115-cc9b21a1d3df", "value": "49152:V6pgAYsXw3u6l4N6T4qq8F2NVa7talgaSic3Q2E8cNT:VU7tXwE6TzqTXaJ7ic3Q21cNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772622600, "uuid": "9fd36fa0-5fa4-467b-b719-a4b06afaa7f4", "value": 2780780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772622600, "uuid": "68a5d562-adbc-46d2-a811-d2d138b8b93e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622600, "uuid": "913a9428-7403-45c7-91e0-fc6e7b4c0308", "value": "Tcpatel-tcpateiu-release-2.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1466affc-17d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772633077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633077, "uuid": "843900a1-ebb5-4a9f-9b46-364595c72c11", "comment": "Malware payload", "value": "e6cd770db1c2e88cbc3e2397911a9b77", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633077, "uuid": "8606e67c-c6b3-4a1e-b3df-becf39acccfd", "comment": "Malware payload", "value": "d443db565451899de08d14a789f744a1768bb982bfa2fb92c2b27064e2982abc", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633077, "uuid": "059205e8-dcec-4f89-897b-14d5245ee252", "comment": "Malware payload", "value": "5bc5a1268a2f02b9535720dbdf441222b1f14551", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633077, "uuid": "ca369d59-a739-4e85-a93a-747f74412daa", "comment": "Malware payload", "value": "1deed0456dc890cdf7e26209ce0f006adf0ec4ade8d1567413a619753b70f27293814b66aa0b7a9d7ef0846643e5ef24", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633077, "uuid": "6e1ad6a0-662d-4a8b-912c-e79899cce7e1", "value": "T1C2222B56AE96263CDFF10B5880CF99F5677E539A907209681222D7986CF019FC0F21DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633077, "uuid": "eee665cc-da8d-4bc5-aba2-0dbc57dd6b26", "value": "192:vTleDAEmNd+514mAEC4heQrGvOVGxh/7irSDQxqauK0h6V8XZmX4wcG9OFx15:peN0z7iaQxqaufh6V8nVG9Oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633077, "uuid": "7488b192-872e-4f32-9f57-6ff3b1b0276a", "value": 10720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633077, "uuid": "c22660df-29f1-41b5-845f-7370e60c095a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633077, "uuid": "086a046e-8fca-4e81-8198-c58201cb8aee", "value": "ac89f59b0a770d0230ed5a948248e6dc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e112c61d-17bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772624830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624830, "uuid": "a8579b29-6b86-42fe-991d-50fa8a5ccba3", "comment": "Malware payload", "value": "1d3e20b3b6136a0eca7be1f8c8412f59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624830, "uuid": "9dfbb8d4-e64f-481e-a1fe-c7832de95bd0", "comment": "Malware payload", "value": "d45eaa47f2cb18de3d204cbbb0f779c14d3378083988720637ae1cd65cb5a164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624830, "uuid": "229dbaed-f56c-4547-9beb-970c20a191b5", "comment": "Malware payload", "value": "697398e322716c49b0a5e0e83131fb24271b7fbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772624830, "uuid": "5baf1185-500d-4372-a8ec-73c5caa5f94a", "comment": "Malware payload", "value": "db8a647cefaf0d81e92fc8c9c7c5a8668f3e1904f2459249de5c5275b75f12de0461ddfd77a77b383cb0df9bb55cbad1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624830, "uuid": "663034dc-6bd3-4b99-b1b2-65a68e34e6ad", "value": "T11FF28D826FBC0012FEFB5F3978B5AA524E73B6AADE32D94B0491408D0D26744A65137F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624830, "uuid": "aa673888-225c-4d60-ae0c-ee6ae14dffbf", "value": "768:mnu3+cPsBPFKU1DHVXrrvUhDHVEIkN+0AjaAmbLU:YBcmPFZDNrreDbwXzV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772624830, "uuid": "3679cf61-b7b9-4b3f-8ef3-f33643b56ab9", "value": 37592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772624830, "uuid": "3578ead8-b80c-4635-b75d-8978f392f8be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772624830, "uuid": "48bd062f-0ed0-444a-8ea9-dc9ae0a3e5cc", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9571c583-180d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772658204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658204, "uuid": "f4f1e3d1-4913-41d2-af3f-c74997d06182", "comment": "Malware payload (Mirai)", "value": "592b12e36817f4a41f5cc98124e37b8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658204, "uuid": "cb3187ad-4056-44b2-a293-1ff093a69266", "comment": "Malware payload (Mirai)", "value": "d503553d798b7fb2fc8335c661cd2d37f1721549ffe2aea420d28e9944253b77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658204, "uuid": "26b03196-4240-433b-812b-9acda9756867", "comment": "Malware payload (Mirai)", "value": "d17d8402ca4b5b6969656df944a5df333134c8b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658204, "uuid": "1264f9b7-583c-42d8-ae9f-97ca609a33e6", "comment": "Malware payload (Mirai)", "value": "bef3ceab3ed3b604964acb46792e5940fece5207c98618b9b94806da713a73627a0d3fba20fcda891b540031cc0ef690", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772658204, "uuid": "c6c0e9c0-8047-4dd6-95dc-4f6578d1a81e", "value": "T19043F1D6ED2C6687C69CC330C8BEF60D5494701C92EEC1F73B4613AA689BF1A1C4C19A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772658204, "uuid": "32c7e583-3083-4b9e-b5f5-32d4dc55c7e4", "value": "1536:/n+QV3XCtaBGhn1m47YQ/ijDgVLEHtZTnouy8ty0:/+QV3XCfmwYQ/ifg5EfroutV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772658204, "uuid": "c19b7000-a990-4549-b44a-375745143e99", "value": 56180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772658204, "uuid": "30ff5755-09f7-4a78-b6b6-62d1bbe19b3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772658204, "uuid": "2003cefb-0205-41bb-a696-f9722e4661f7", "value": "Polar.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e6bfb3-1784-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772599525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772599525, "uuid": "e1e55fda-2672-44bc-9beb-933ed36168d0", "comment": "Malware payload (AgentTesla)", "value": "8887b47d43df80b63f5802f86a5ed149", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772599525, "uuid": "698051b9-e8a6-4a97-9622-99c7049c3bc6", "comment": "Malware payload (AgentTesla)", "value": "d69e28ad967695288c295e212cc4485bdcb256dbc0a4f571dc2194a89dd13770", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772599525, "uuid": "0ccd1d8b-d066-42cb-8c97-eee30ab7afac", "comment": "Malware payload (AgentTesla)", "value": "eb49465522fdf9856832a15cc329adf6ee1134af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772599525, "uuid": "166dbeda-c892-4807-ad63-cde09230aac9", "comment": "Malware payload (AgentTesla)", "value": "f9fd7d4fadc41f97b5b861cfcf261868c8e2c95520c4f5deda45b3beee20af6ad6b63e4e568b56aee6a2c3e0e066dba0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772599525, "uuid": "173cb457-5ed7-4441-93f7-9e6c3a44ab4c", "value": "T1F155AE121EA6F5D8677CC50A917F180BA2C64F8DE0C71F26A46868D4DBD380B4FDA27D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772599525, "uuid": "7a5d241a-046c-4d51-9567-bf10645ac657", "value": "12288:eF+o1A+r/D7C8kd/evBdod2CUcwPcj65OlM/R8rMjDwGvs:U+o1A+rvn6/evBdpCUAj65Oq/R8ADw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772599525, "uuid": "fc2b7357-fe0c-48fd-b002-c3668fdb2987", "value": 1403904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772599525, "uuid": "df87ec75-fca7-4de4-9fe9-5c7dffe2c691", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772599525, "uuid": "57d293a2-5b10-4b5e-9213-2b094618b0fe", "value": "bank details.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ae6877-17c5-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772627032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627032, "uuid": "f3b5e4c0-5ba8-44f8-baeb-a96b39b7ccb6", "comment": "Malware payload (QuasarRAT)", "value": "2196ad6dcdc885b5d196698e9784bd45", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627032, "uuid": "bcfc13b3-2c2c-49bc-933d-bb57cdb9b7af", "comment": "Malware payload (QuasarRAT)", "value": "d7eb98c48dd987b4b08e3383eda8ca971a231ff37ae1dc955af12ba331d86477", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627032, "uuid": "c1913b84-91c6-466a-8ee0-c6f4d9f1ba1a", "comment": "Malware payload (QuasarRAT)", "value": "407e1c738410211ecb19288c3d21c2cbba6f0a5b", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627032, "uuid": "150f1654-d2c6-4fd8-9741-a5258a6a46dc", "comment": "Malware payload (QuasarRAT)", "value": "cf5609c346fb2b2426ecd6b8d8e37155538c5aa71dc17b0b0f4a5837c382d9785ff89d28a05fb9f05325605596539e1c", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627032, "uuid": "494d482b-ff54-4512-b8e8-babfa331f38f", "value": "T17B51A5A53F43E8A98465B114D9D74289FDA890BD300B661071E44F1DFEF8CBA837D48C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627032, "uuid": "9e5f4440-cd1d-43bc-a29e-23dc4da94bdb", "value": "48:fPfe4mDgrTXj30um1eQJxWyyl2zxUj9avwNdepW7gmyWoOWLw6AUjw0:f42EuwvM/8tU8GdqE0/Oswyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627032, "uuid": "91c9d2d5-cfe5-4e5e-8114-56726f32c966", "value": 2804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627032, "uuid": "bb48e54d-90bc-4c6f-87ad-a52d2cc6ecc4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627032, "uuid": "6acd7839-d785-45e0-9ca9-c2b7215265dd", "value": "PZ-Reversals.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ff5523-17d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772633083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633083, "uuid": "9f7ebf9f-07df-410e-9ecf-655d7e3670c5", "comment": "Malware payload", "value": "9ad8ee39c5b01142847834106b84808b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633083, "uuid": "4c1722dc-6d87-4b25-b95a-256879eaa6f4", "comment": "Malware payload", "value": "d9728ff50c214306451879631a6b53f905a241c11375d3f1e5d9db5f321983e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633083, "uuid": "3b817b03-4d3b-443d-b87c-a99547a6087b", "comment": "Malware payload", "value": "b4b3172f5c885870beb8bfe901db92622a781f01", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633083, "uuid": "b9f538bd-fae0-4061-a79f-1f19bb600936", "comment": "Malware payload", "value": "2d1735e48a030771273a970bec06218c314ff9ce6c636a81cbf67055744ab4fe59ca6d414289a5fe2d93da57c2e26d82", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633083, "uuid": "1e4fb3c1-abdb-460f-bcdd-643267a1e8ad", "value": "T12645C79D69A32DECCE247ABC403DF5894FD23E09B2E39D176C51658A98E35DC0D208F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633083, "uuid": "023b2006-798c-424e-8199-330e6ce989b1", "value": "384:6+rGdmq9GCup16yL9nAzq835YkFKMWzIbq9H5f8CjxIpCIqDmXvZu4E6lVtb13DL:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633083, "uuid": "153023b9-361f-4a3a-aaed-a5557a95809e", "value": 1167123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633083, "uuid": "e757cbab-1152-4fbe-8ed8-957dead34681", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633083, "uuid": "6629b6a7-e152-405f-b3ae-fc329e7d3f84", "value": "Agoda_Booking_Confirmation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6becbbe-17e6-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1772641510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772641510, "uuid": "651c5240-47be-45a2-8b87-fc77df27178a", "comment": "Malware payload (DCRat)", "value": "6643c67fec6ab6b86c427c2a83af47ab", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772641510, "uuid": "6a4a3ad1-07c0-4ee0-a7c2-72077172ff46", "comment": "Malware payload (DCRat)", "value": "da701cef0f825f0012ae82ede21b74c61806760c515f1f045cd9d050848e697c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772641510, "uuid": "e853d60a-4d19-4b61-ad57-a7c79abb1c12", "comment": "Malware payload (DCRat)", "value": "5af5cc0cb59254a25e8436c7d5851173a6a7bda8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772641510, "uuid": "7219130e-5aef-4db5-b359-d18c9c002667", "comment": "Malware payload (DCRat)", "value": "acb5a670c430d4f6124a0339f153d7a16bf6e85c1d977afe93a4efbe3be5337384623460a36d02bd2b294a7dfa7e246d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772641510, "uuid": "9686a2c4-1cde-4358-b22e-b5d40cf66ce7", "value": "T163645A1833EC4F19F1BE6BB6D4B361559770B85AFA7EEB0E5D8190DA1926340CC00BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772641510, "uuid": "1b9b4249-469c-4003-989a-ff6881c54bf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772641510, "uuid": "978ceeac-904f-4b55-a9a1-247adf7fbabf", "value": "6144:YLMy2oo7Kq1XO/qIqINSDrmiAeN6x2Aji01VId1y4aCdB7bpJr9u:YZ2N7h1+rqIgAev1BFdBnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772641510, "uuid": "a58212fa-32e0-4c4e-9384-a80af36e21a1", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772641510, "uuid": "db4a6b97-a303-4a26-8fa3-2d02fc3c4c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772641510, "uuid": "dcf6a039-4805-411a-94e1-e4fb6db9458f", "value": "6643C67FEC6AB6B86C427C2A83AF47AB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e361b7f5-17cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772631706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631706, "uuid": "44d38eaf-fec7-4a28-a961-f264b45f309a", "comment": "Malware payload (Mirai)", "value": "7bb0ceb7cf2358119718e8e717756549", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631706, "uuid": "dd17895e-6f20-43bd-9c5e-cbb7cd47c9d6", "comment": "Malware payload (Mirai)", "value": "dae27b59f55b78ff6c7430ca65c3c578081f96819b55d2bb7ae25774ca5c02de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631706, "uuid": "3095ff2d-f981-4da2-b5d2-26e4af622f1c", "comment": "Malware payload (Mirai)", "value": "9390b0603d2bdb886c13e2db7a0b80aa1358f02a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631706, "uuid": "f2e651f7-f727-4da4-b915-d1efb258cf11", "comment": "Malware payload (Mirai)", "value": "2cab524d54bbc7bccb648ce0fb6513c1605ad4a2b441aef5947e43c99219fd0e21836b9022102e7ea097469934763b2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631706, "uuid": "1507af3b-9c05-4a5e-acd0-770238edd395", "value": "T15D241946BA418F13C0D627B9BA9F42453323A754D7E77306B528ABBC3F8779E4E22501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631706, "uuid": "24af7c46-190a-43d3-94dd-284d3316c766", "value": "6144:dWFEgXa9+WaGHkF2IAG1kCbEnK6XTAxM/RQWV:dQlaUWaykF2IA01F2A6/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772631706, "uuid": "9e5c90ba-7cc7-444b-b854-d0ec3f5806e0", "value": 214786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772631706, "uuid": "524887c7-3e56-4ab3-bcd3-980e7d035f2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631706, "uuid": "d21ccc43-cd7c-4641-84c7-e2d961aa7dec", "value": "csk_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bd0cd1-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625504, "uuid": "83086e5c-ab49-497f-ad91-10de172df8b4", "comment": "Malware payload", "value": "2c2dd57ba659dad7c16d49356e057cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625504, "uuid": "718ed40a-bc22-4025-9182-f92abf6c4746", "comment": "Malware payload", "value": "ddbc8a1a4372071d2b901c55bc29ad6653dac6043c1d67d610dcdef62ae61a60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625504, "uuid": "9df3f79b-111c-4b68-8cf2-bfa9b30f3c0a", "comment": "Malware payload", "value": "947844242bbafaa112d092c6fd5c36f41ee0214b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625504, "uuid": "87996b37-69f9-422f-9bb2-05eb196fa60b", "comment": "Malware payload", "value": "5a07192d3bbe02aa85660f9ed687f5b2f77a14f0c1a43dacbd56bbe450a282106cf70dcdd543a31a8ede17108fae358d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625504, "uuid": "bf10a506-66ab-4a62-8b2d-b5ab678714d3", "value": "T1968402D112E885D2CDBBCF36D0912E068EB4A673B9A1E141D881457A7E45F038FB137E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625504, "uuid": "a5c8549a-e61c-4dd0-aa02-a43ded79941c", "value": "6144:IDz4cOwijkzDzZsBS99NIdnYu7/3MfRUTgO/Gi0IJ4lci2V42JwQnPQQ7f/nx:CD1F7yYa/3MfR/Oedlci2fJwUbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625504, "uuid": "d027e26d-13b5-488b-a3d2-0dbc2631849a", "value": 389480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625504, "uuid": "084d4bcb-f96b-4423-85bd-7005a43caf64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625504, "uuid": "abcd1f19-147b-4bf4-b9bc-e174c30f36a7", "value": "ddbc8a1a4372071d2b901c55bc29ad6653dac6043c1d67d610dcdef62ae61a60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e61049-17d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772634660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634660, "uuid": "773f2293-1593-4b50-bb08-c050eccdb48a", "comment": "Malware payload (Formbook)", "value": "8c2bca96cd8192cab350b7f6ea9bc769", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634660, "uuid": "0f9d86d2-54e4-4e7b-88e2-a276c2b37232", "comment": "Malware payload (Formbook)", "value": "de2796276ba77967176194b687f905e4aedade9c7aae2f489e7d60b3fa7b4152", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634660, "uuid": "e5c5f92c-0f22-439a-bcdb-0c0d3c4d0d63", "comment": "Malware payload (Formbook)", "value": "71709ad373b64765540d329251fb867c619842d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634660, "uuid": "29745a41-549c-4b78-9c98-ddef090ed60e", "comment": "Malware payload (Formbook)", "value": "64fc024ab69215a11f316d57208e40aa831eb1838cffc7132f57bf32349fdca587f06defb8f17aecf082b5a9c27861dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634660, "uuid": "bf11ad03-5d84-4c27-9ea5-d5c3d995b5f7", "value": "T1E1542228875AC917D0D2A4F2BC9E52024F905F37B4AF8787F760DD627AA26C0394C797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634660, "uuid": "54f8722b-11db-4f17-ae04-a8997983e68b", "value": "6144:DOlk0oVTgxBtC7xmOZtOiLwjWYvznrcEoUuSHyWAq/6:DbJcIxmOOqwJrlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772634660, "uuid": "f1289beb-fe45-44da-b049-fdc35b7d0cd4", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772634660, "uuid": "3276d3c8-07f5-473d-91ed-d056068a4497", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634660, "uuid": "40b73248-6862-4cfb-bd78-6235af599c12", "value": "de2796276ba77967176194b687f905e4aedade9c7aae2f489e7d60b3fa7b4152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8798da-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654589, "uuid": "c324e7c1-2e09-4825-9e4a-4881a8e3a503", "comment": "Malware payload (Mirai)", "value": "27c4eaf21a9869e7a23a0366af476a8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654589, "uuid": "92369d42-cd23-40d1-99d6-03422c373398", "comment": "Malware payload (Mirai)", "value": "de324dfe9faf6ceb419b444e467418832cdb4fd8957dfdad22c8774d64a3afeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654589, "uuid": "29dc3f86-e647-4fee-b84f-9b72bcedbdaa", "comment": "Malware payload (Mirai)", "value": "e833886ab6e989af536450b994e70a417c3d310b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654589, "uuid": "b5e05e79-f92e-42ea-a5b2-cd112d593410", "comment": "Malware payload (Mirai)", "value": "9a4edf0b72e49473323c5ecb6c90862bdd72601dd529ed72255b711211d544a5ae3f68fe6edba438ca3681de04babd99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654589, "uuid": "6663325f-51e6-4624-a89b-7bd7b73f076b", "value": "T138432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654589, "uuid": "8832ddbc-4179-4fcd-9d9d-ed7cd4f9a211", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwi:RqtmZPuutfbltZFBSJsBcfDSTFI+BEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654589, "uuid": "4a47bfff-eb2c-4166-9ce6-55440305f983", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654589, "uuid": "ef1cdddc-bc6b-4e2f-96b0-87b367a53e48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654589, "uuid": "ec2608f2-b10c-49c4-bf89-e90427c687f0", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae84b5a-180d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772658079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658079, "uuid": "4c38100a-075e-4c62-a678-dab1a6562670", "comment": "Malware payload (Mirai)", "value": "9b4c413ecf479656030d2c6632d4b110", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658079, "uuid": "48b7bca2-7f8f-478e-b0c0-d0044d337a19", "comment": "Malware payload (Mirai)", "value": "e0d694ab9827b088410bed16b4e4235efc389dd45bd09c2e5701316db3d17e08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658079, "uuid": "5ebc0c6e-7284-4d72-b133-a0dedeca494a", "comment": "Malware payload (Mirai)", "value": "fc660c817ab59460cfb56ce9566dffad8fbc0fb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772658079, "uuid": "b75f0e69-1b11-4209-80d8-d46b43e01281", "comment": "Malware payload (Mirai)", "value": "df482ff13773165640dd11f895e3028a4d376de359226de785b9221ca61b2832ac2836feff5c73aff5817bdf155e4e36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772658079, "uuid": "47d75908-911b-49c7-91ad-5e159ed5ec01", "value": "T1BC6301FFF29AA0B0EE060E7980112695EE3376A93656CFBA59469453FC99C051E33C43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772658079, "uuid": "6924b455-114e-46d4-8f9e-d57b4e7c2acc", "value": "1536:n8lZbU58Jjml2s56eXVzst0/ZRh7lOECt3teWS/:n8vY56VsNXVpBnlLCt3teP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772658079, "uuid": "63b12643-6515-44cc-a2e4-1f6a5ba5f048", "value": 67784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772658079, "uuid": "259a92da-4f5b-46fb-90e8-6bb1c31e9593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772658079, "uuid": "85aa9e24-f81e-4671-a351-db313b8602e0", "value": "Polar.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e14bab8-178d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772603109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603109, "uuid": "6381d63a-1c57-49ac-a2d8-ed4e6515d13c", "comment": "Malware payload (ValleyRAT)", "value": "1b967cdad5c29c1cd4d4208146e03ad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603109, "uuid": "33c37c2f-965e-4b98-935a-b8563648c951", "comment": "Malware payload (ValleyRAT)", "value": "e14b02f51afca55db719999f9b73cee56f5224608077253bf858388fbc3320d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603109, "uuid": "fcedc426-0b6b-47d4-b7e9-fdb902e83fa2", "comment": "Malware payload (ValleyRAT)", "value": "86f752f58f0fd7194bcdccbf3e79c28d03c6d972", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603109, "uuid": "01268432-48d4-4170-9dd5-8ab5919ce5fa", "comment": "Malware payload (ValleyRAT)", "value": "7079488b382a82a75bf62832c40923e44e9eb33d34aeb7605b6502122abba4f6f65c60504fbe0be2baadded6842747c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603109, "uuid": "56a2c8ae-b69c-4611-bbde-4c2dd1957d76", "value": "T121541210A5A0E5B3E8A743763B7A6F36DFF27011622C2F6A13601E2978B16C2D15F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603109, "uuid": "0a68e3ac-ffc0-4304-aa13-1f2ce6d63220", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603109, "uuid": "5e55a9fd-2201-48d5-a8ec-19bb9487ba5d", "value": "6144:/TA8oPCPt4RfYd03unISZrer+yrSiqgwsV:/TA8Wm5ISZg97wM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772603109, "uuid": "190a41cf-42ee-4a14-9046-0dbb0223565e", "value": 279046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772603109, "uuid": "dabb402b-b0d7-460f-a922-27108e3a515b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603109, "uuid": "ebb11388-ab95-4cc9-b726-cafc92fa1be3", "value": "1b967cdad5c29c1cd4d4208146e03ad1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1324e775-17d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772633075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633075, "uuid": "4d7c8197-aa55-4b27-b18c-87881486861a", "comment": "Malware payload", "value": "ff00a348eed67bc2fd9f670f25467242", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633075, "uuid": "7598acee-df6d-4f07-8463-4a66cf994a59", "comment": "Malware payload", "value": "e18c9959515321650d1a8e2b03d7b463d25d5a0104060677130deca8bfaa347d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633075, "uuid": "26af73b9-f40f-43e8-83fe-059bfc295528", "comment": "Malware payload", "value": "ce64cb57193dbc5b20a602059219c4144df593b8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633075, "uuid": "b7c070a8-6571-4df1-8762-dcabc35313ba", "comment": "Malware payload", "value": "43583932b4a660aa36ec3b425d5f324867b94ba385598e59cac8e19c1e9305bcd74d45efde52eac5d5aaad0202b522a3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633075, "uuid": "bea6df06-0bf9-4df5-bfaf-dd9515e050b6", "value": "T16BF0C027418D45638E571AB285594219A53F71464712E4C653B395A4704A3DCC7DDEC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633075, "uuid": "21194fc8-bf85-407e-9df2-71d97cf056be", "value": "12:YerZoA8nUI1kbQpc4N2imUK8yp7JyMvUAb/RWA3S9qAcAl9S:YiyAyYbW6J/vUAbZWA3xAc8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633075, "uuid": "4258950a-d5b8-4bab-89e1-8937236fcf38", "value": 543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633075, "uuid": "c7f610a1-2544-45bd-8e0b-e8e87bf92aa7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633075, "uuid": "e6417e15-83a6-4fdb-90fa-0400a46145c5", "value": "partyinvite.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7fc0feb-1784-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772599394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772599394, "uuid": "80acb9ec-d271-4c85-b9f9-0ab2a26a3ce7", "comment": "Malware payload", "value": "c6e8e9266a822905211f3e26def6a3f7", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772599394, "uuid": "ca3361c8-aa80-4247-9d52-1e4b460d0775", "comment": "Malware payload", "value": "e24293d1cd4fb69c6e3cbc709a55d2339df7349fba447de2b755da678bfb42fe", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772599394, "uuid": "b3bf278e-c929-451b-8697-6f1f3fd545e9", "comment": "Malware payload", "value": "f1cf7522be1a88490c2da1da16c0592c7747b8be", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772599394, "uuid": "54f96bc2-9bfc-4173-81b3-bf401ee2f0f1", "comment": "Malware payload", "value": "819dbe10ff36f2405f6eca2f602175097512d95316ddf6250040729749676e4734e1abf9957a389267dc8339411acf4b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772599394, "uuid": "620173e4-ffee-4199-a716-3632a306f3cd", "value": "T1BF94121573A6FD87F40B4B322CE409927207FC205B5E581B3E86B35F097A7E2A56636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772599394, "uuid": "43cb1cee-dc42-4754-91c6-94f9e788dcd3", "value": "6144:NSOY+3HGjhFLsUjqDzPWy1xtmuttG6AHPjQqDvW5RrbWMBEmMlYavCUColnKsQdO:f3GhhjUzPWyLccGpQSURHWM2LlYaPFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772599394, "uuid": "d8b8ec89-1245-4a20-a5d5-1f011d5914df", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772599394, "uuid": "d643db5d-4522-483b-8410-005e8e4ba0f2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772599394, "uuid": "9b468a94-3bc1-4e5c-a66b-6cfd038be115", "value": "NEW ORDER 2026.03.02 KYUNG SUNG.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c7b783-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654588, "uuid": "a25c8b5b-f7c4-4a2d-ab74-1d1514aef975", "comment": "Malware payload (Mirai)", "value": "fd623f4b022c29ce743b1653ce11de4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654588, "uuid": "e6128548-756e-4629-963e-d1b287c6cdd0", "comment": "Malware payload (Mirai)", "value": "e3d8bcd0321563594bd2789374ffb68593317158f0302ef1c03d12979defa02a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654588, "uuid": "94d3e5b3-cd38-472f-bc77-6324cf81523f", "comment": "Malware payload (Mirai)", "value": "cf92f1dc7d41f559d277fcb42bb6fc39f2da259a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654588, "uuid": "4dbbb3d1-ed63-42eb-9746-641f9054799c", "comment": "Malware payload (Mirai)", "value": "13fecbcd469b24dea9fb49f0b838df3646cca10fc817fc8e621cb7f275b3d0ac9504396c1e81f59da1083435c88561e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654588, "uuid": "1778df27-6689-4ec7-a018-68793d18711b", "value": "T1A9A2D17FA4DA4897DDAAA03B101D00DA14BB2C5453A783C23F6575B38DA74E9F836780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654588, "uuid": "ee1997fe-ab45-4337-9ec1-72a778bfd0df", "value": "384:MEcDqRfKUWFH39z+/49EThvIruI8qB+eANnlBQpMr/4IzBi+v1Rpa:VMkKJFH39CBhgy7qsZoMTttdpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654588, "uuid": "be429215-922c-4159-bd45-0ae7d9194c80", "value": 22440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654588, "uuid": "571f4787-d61c-4a4c-bfe7-73189674d7e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654588, "uuid": "b38cd112-612d-42a1-bb66-348115969fa5", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756582d6-17e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772641400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772641400, "uuid": "fa57500e-549e-421f-92b0-96efabc78421", "comment": "Malware payload", "value": "7b4b1de7890024f5a939ec27302627f6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772641400, "uuid": "a75603d9-38ff-449b-a7e4-18d083bdc9f4", "comment": "Malware payload", "value": "e3fcd5939117e6d491f2401bedc427173da1298d69f48b04ceb049817a3d47bd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772641400, "uuid": "30b22a47-873c-494d-92a0-8cf72132ab3f", "comment": "Malware payload", "value": "af44a764747999414581f90cf78e1488a9673e52", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772641400, "uuid": "4780fdf0-80a0-4d26-b7fc-8299424db6bb", "comment": "Malware payload", "value": "0dbf4a1bd5f558341d584f72d24ed01ebd697b9a543130f7249d382de40d2c56c47324c4f641834a8e9e141882d0f323", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772641400, "uuid": "2416e3c9-d05b-420b-8f1d-43104a9450f9", "value": "T14855A482F7E781A5A89749F18096A22BEE702708D815E225FF731603F5F271149B8FDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772641400, "uuid": "9137fbdc-a030-4cea-bacb-ec09056f0912", "value": "e3bd8ce5b9b29e3ac963c4ae92abd432", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772641400, "uuid": "f1e1c744-3a12-4cd4-a2a6-e39e67d27113", "value": "24576:slT149SL/vX0N+nSGfZ8fuce832znDEFlYqQ5YG97oIX4u9xZ0GIOH3BBrCvsUlw:JoUxi6hmR3LgY+DrHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772641400, "uuid": "7d1bd5cb-5707-4404-9816-c3ee5d3433e2", "value": 1332904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772641400, "uuid": "91b2000c-237c-4f54-a5d3-8259c1850da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772641400, "uuid": "19a10e97-1852-46c8-b050-88b0231a7736", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49200fc9-1792-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772605248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605248, "uuid": "d8cb8c3d-21be-4759-95de-4399cb564667", "comment": "Malware payload (RemcosRAT)", "value": "07091766d2a042f32d90aee1d8020342", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605248, "uuid": "e1cf0c26-ef1c-4ef4-ac3d-c9381e8e8073", "comment": "Malware payload (RemcosRAT)", "value": "e58aba655675d2479bebf957fb376036d34cf923c87c673031ec7cdbda0d6113", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605248, "uuid": "6e20e957-fde1-4e69-9969-adfe8d868f31", "comment": "Malware payload (RemcosRAT)", "value": "a9227819ae09a84eaad023d4231f2c2995bdd0d9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772605248, "uuid": "89254f64-f228-4e5c-9b5a-3f17917c874a", "comment": "Malware payload (RemcosRAT)", "value": "cb4b38204e49746161583ed335192168eeed4e04ccc679eda472a95ad66f9106c748ab732ac88b4bf8ab6ea910ccb844", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605248, "uuid": "a08179cf-2ff9-40b5-8060-b507e2a807f6", "value": "T194450A3B8A0C55C55A6F984719D9A026BE2CC1ED2426B1CC39A6DEDEDE1C93E31F053C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605248, "uuid": "3d6cc7a2-5ade-4ee3-a19e-327c9d9f2e92", "value": "384:0JP/0ZX2Bja6yYsK5AkF6RHZyIWtgtL6Z18HXHNe0Yd0ookwtZ5MEDibDKY3Nu78:0JP/0ZX2i1c/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772605248, "uuid": "7639c499-9360-4355-af94-6213eaee0f1c", "value": 1247391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772605248, "uuid": "a069b118-226d-4c24-9970-75fa34db866a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772605248, "uuid": "34e96d52-8003-4d92-837f-fa3c5f18a5f2", "value": "kmh.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76cacf14-1815-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772661589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772661589, "uuid": "c93adc2b-2115-4365-a22c-855e5bf1fef5", "comment": "Malware payload", "value": "c54589ed799b7fa3a7b3ea8acb79e1dc", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772661589, "uuid": "655328ab-061e-4533-84b6-a897afba5acc", "comment": "Malware payload", "value": "e5cb3162a076c10489521145d472356628fcf0b3fbce22d325533a542ffd7a50", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772661589, "uuid": "8e21eded-d738-432b-8b77-e38573f4c6f7", "comment": "Malware payload", "value": "3bcc5ba4b6ed25fcb0d405df935fdfefac176e39", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772661589, "uuid": "cc3a98a3-3fd7-480f-839b-2293c77c303d", "comment": "Malware payload", "value": "fa7cbeceda2b3c47c18f4aafeada466884f42f9a6dc79149d14ccdee3f3f5517bb8aa6b40c0a004191badb2b10c90296", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772661589, "uuid": "9957af75-b574-4fe0-9f95-08a30acbce8c", "value": "T12A0529C226EE5ABDE68F5FBBE60B731F472951410A28E981C1A17943DCA7E1340BCCD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772661589, "uuid": "57ada4a3-dfc4-46b9-8e2a-1d9fbfb9f92b", "value": "d9fbaf0315bca5165d4ff34eb66ecf4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772661589, "uuid": "2dd52d7b-d877-4677-8ea7-a2c4ed74a5ef", "value": "12288:N6YeVAmBad1W0GLYwtfefPdV+N4zYiS2Sy7ApPyzkftbsWL:AYeVdofGLYwtMPdVPBSyEMkfiWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772661589, "uuid": "269458b4-85eb-461c-8115-95c010855bf2", "value": 795944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772661589, "uuid": "26621167-39b3-4317-b638-ce070a9cb104", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772661589, "uuid": "6b126dda-55b2-4b69-b08b-e6e008f36d94", "value": "20260304e5cb3162a076c10489521145d472356628fcf0b3fbce22d325533a542ffd7a50.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2978ce3f-180a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772656734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656734, "uuid": "e5876d45-dbf5-4e66-aae9-cb024ed71aac", "comment": "Malware payload (Mirai)", "value": "c8e7e0b1dcd777e30eb7a37efa245409", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656734, "uuid": "7f6e07ea-f58b-43d1-b8a2-8dfcd90779ab", "comment": "Malware payload (Mirai)", "value": "e5d7bad29cb65d890eed84166b41c9492a20a2535fed753a9393a46e7e37fba8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656734, "uuid": "6484ffeb-0155-4c57-b3c8-f8db228d5d70", "comment": "Malware payload (Mirai)", "value": "b34d350df4687267fd5f8234b5c372345c29150c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772656734, "uuid": "9cc3f5be-2f00-46af-8d59-a4e98cdf02f5", "comment": "Malware payload (Mirai)", "value": "309a4a842575cd03d86051cbc9210902ec7d8afc094794f58365001826fe93f90e81a130076c4673882c30584ecf7c79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656734, "uuid": "adfc54aa-4d93-47a2-bf95-5a126f86189e", "value": "T11A133AC1A643D1F2EC5212F5147B67628F76E4364A7DFA92EBA92531FC03B10960B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656734, "uuid": "1bb06cbc-bf29-4c0a-98ae-af11575c5d7b", "value": "768:QQaiSup66OkEgy5oD5YQuj4J7UTeU4wQOnRspVI/4bOGd7nX:QQaiSuptOkEX6D5YQ/J7UeUDtRspDbOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772656734, "uuid": "6107706a-c330-4b97-8516-4d0fabd9313d", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772656734, "uuid": "beb07d85-54e8-43de-94b0-ff6cc418704f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772656734, "uuid": "4c70a41a-8755-40a6-93a8-1c8106bee8ad", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08524d1c-17b3-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1772619313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619313, "uuid": "8fb1aadb-3ab5-43bc-b11b-09e229ed5299", "comment": "Malware payload (DCRat)", "value": "63d32b3f858c91f77fa1d67331763c28", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619313, "uuid": "206d8719-09cf-4837-b905-9924078dc378", "comment": "Malware payload (DCRat)", "value": "e6bc720eeeba33cc4fd4b40e9b935c603932a325ff8136312d245ead8d3348ad", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619313, "uuid": "dac8dd22-912f-47e9-a654-b2d201440eed", "comment": "Malware payload (DCRat)", "value": "8f79ee8d75f321d0bd16559ddb4a03d76a061530", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772619313, "uuid": "18830125-4972-4618-8498-c8f7af7dcacb", "comment": "Malware payload (DCRat)", "value": "ccfe3af1a9192bed35cbbf1a93154b5edc89dbe6704a71b45d97dc44a8eb23bc3307e21f735404710c4112139c3bea7e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619313, "uuid": "ac82cfae-0b91-4327-b8f5-c16a3b99e52c", "value": "T16C455B01BE44CE11F0191233C2FF454847B4AD5166AAEB2B7EBA376D59123AB3D0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619313, "uuid": "3230a019-13cc-4a6e-9e6b-3e73552f583e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619313, "uuid": "0bed1429-a15f-4408-93a5-ce614cba6ded", "value": "24576:gRRBq5KYVq5lFpFgTqWvh6RwCResf0JMiIt9qd5aaRA5O:oDCKpc0JRKy/EaEA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772619313, "uuid": "fcc9c8cd-f871-46da-bb47-2daaa21d8028", "value": 1222144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772619313, "uuid": "01071117-2be8-4caa-a7ca-e53267750bd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772619313, "uuid": "ec3d8553-a31c-44bc-a013-4b9fbdd3894e", "value": "63D32B3F858C91F77FA1D67331763C28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0026e4c6-17dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772636908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636908, "uuid": "f6d7866e-cac0-487c-ad3c-a663c916e719", "comment": "Malware payload", "value": "e9c723222a74e4e89f4943fab49c3fbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636908, "uuid": "380e76b8-6258-44e8-8613-0fad8bbcc29e", "comment": "Malware payload", "value": "e6de289d246cef11ee845ae351b9a5a52062aab5a2cb31d9e6b802c15f2e4b82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636908, "uuid": "d3f00b30-b219-4c81-aa93-4b4390384205", "comment": "Malware payload", "value": "1fad38bf92bdbcdcb8f128b41cdeb23fb19871fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636908, "uuid": "3d34bafd-a2d5-4645-bb64-1ed103ddb20b", "comment": "Malware payload", "value": "e3f25c3affc5f62e698d0c2471e19e1de4daccfda1519c2f5f695d554f0238ec7db8e5a5acf734ee94ef6c604c08e589", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636908, "uuid": "84dcdf5d-588d-40ab-a3d1-c20c51be7b95", "value": "T1245533D2B6D3C5CFC4F3FA39941846BC79353D2A5906030B9A6D43B77A1AD680B87D12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636908, "uuid": "e603b238-ab21-495d-b40b-7a9d77a9703a", "value": "24576:dO7EQb5XgACLCKdjpfYnWN+ZPhTUu5UPsDGyMVYNVZpUPf:dOZnWkZP1dUuMVYHwPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772636908, "uuid": "eb792e40-6ea6-4e8b-8fd9-732c221cb934", "value": 1306850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772636908, "uuid": "0810754e-5bd3-4d68-aeb7-acdb801bc10a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636908, "uuid": "611e99df-0b2a-43ad-97a3-6bb939bb7dc4", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbe8330-17dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772636961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636961, "uuid": "1a061c1d-97f0-4849-99e6-f5c11f66a78d", "comment": "Malware payload (Mirai)", "value": "bc535acffb0e2ff2a780a5ed9918058a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636961, "uuid": "b09adbf4-a4d7-4a06-919e-29208f47d043", "comment": "Malware payload (Mirai)", "value": "e7c1477285d0a1e3df2c1921ccf25f94f306c355061945da7ff2e23acfbc8bda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636961, "uuid": "9f050e8a-c00c-4896-ae7a-1ddf78808ae6", "comment": "Malware payload (Mirai)", "value": "70ba0e7af48b1b43ce33c1a5b8f0e49656f4dcca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636961, "uuid": "eb4209f8-a674-4d7d-a7da-c59b24990a59", "comment": "Malware payload (Mirai)", "value": "67a26770415944a19437668d28786ca66ea255674e65f2db14a73258a5722d8281bfd15251ba52b0238c5841f7f1c426", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636961, "uuid": "e9543a20-e600-4e29-8a05-cb31c3db1c30", "value": "T1BE13F123A4E9824CD2CB72F0DDC9376F1A78201295189976EDE4C03EC26275D6A7CBCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636961, "uuid": "a724a25e-81f6-4349-8590-8800263f6604", "value": "768:argJPrwSYkYP9z/PJZnAwjipFXcJw8IjD5tagkkmvX8eAGbZFXnbcuyD7UHQRjf:MgpN6FPJZnMFXcGPgvM0VFXnouy8Hy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772636961, "uuid": "0216f480-0aa7-4bdc-affa-0be1d7f1909d", "value": 43364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772636961, "uuid": "ea4494e8-9297-4b14-ae37-f92a09d63552", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636961, "uuid": "05974ca5-534e-4ea7-8701-7c39e62dfe1d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a6682e-17b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620275, "uuid": "5a84ca1f-c3f6-4199-a28b-03ec9222dc1f", "comment": "Malware payload", "value": "ec625d78c84f753672c8d5c5730c142b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620275, "uuid": "d9b49ed6-b198-436f-99f5-8cf218afbb5b", "comment": "Malware payload", "value": "e97d40eb61c9f310723046c9a80863deba5d58d56ac302a95ce0054ec2af4040", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620275, "uuid": "af54c068-7275-4e1c-86ea-0d22de5d7d5e", "comment": "Malware payload", "value": "bdd230869784a8387b7b38355e2eaf4bbb8d57d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620275, "uuid": "ee9e8b47-1936-4764-9fbc-f53bd63fa0ee", "comment": "Malware payload", "value": "58df1ee0b5b026924a0e7140ebf102093da7e13f93e55f6548ebcc273b41537c455be9fe4e04182961588f36cccc775a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tropical-RIiff-Ltd", "colour": "#1FE51C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620275, "uuid": "726b1379-0428-49d8-921b-8bf478544223", "value": "T151E6338AF75511B8ECD6623DCCE06A56D764347217E0EA9B5FF842E02A670D8DF38321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620275, "uuid": "8df9f028-32dc-4efb-b32f-7a939b226ded", "value": "c4af357571dd94ca1603cb9291e6416e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620275, "uuid": "410f1746-1cd9-44a3-aaa5-05f43ac15f8f", "value": "393216:jrRQ7XbFsn6J4kdUtr0xSE6ej1cy8bKLtUuRMZ47XMCHWUj:jrRQ766jmB5E6Gcy8+LyuR7XMb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620275, "uuid": "2ae5c9e9-68c7-4d46-8fc0-1762224cc328", "value": 14569352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620275, "uuid": "5a1f691f-c605-4de4-a743-f9ab1928f178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620275, "uuid": "792b4693-0c93-43e6-b80b-9564f36e817f", "value": "e97d40eb61c9f310723046c9a80863deba5d58d56ac302a95ce0054ec2af4040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c17e3f6-17cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772631586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631586, "uuid": "b3878273-603c-4300-9ae1-a42aca901e81", "comment": "Malware payload (Mirai)", "value": "4d599a5cddaf326853ae13785d375ba1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631586, "uuid": "8657da6a-8cd4-4840-861b-f60cb5c35145", "comment": "Malware payload (Mirai)", "value": "ea01d20879c799450ccc2d3738f12b92027f17d2ddc26e423c780a0bc813a1ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631586, "uuid": "10c743a4-8467-4c7e-9aab-55a71859c492", "comment": "Malware payload (Mirai)", "value": "1b9f483090b7a7194ed639f659929f0abe7ea893", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772631586, "uuid": "f9ea4026-a8b3-4580-a416-7022c944f290", "comment": "Malware payload (Mirai)", "value": "204d878ba7bf583559ba7a438bf3068d785c31e78b24b03d1a1c06ee1c57263a0189a6a8cd47718aa54fff886e4d73da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631586, "uuid": "a17985e5-49a8-4c22-b20f-ecb60fcf9bea", "value": "T11BF32906B30C4947D2632EB03E3FABD193EFBAD129A4B644391E9B8D9172D321545ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631586, "uuid": "25aa283a-c679-4771-b119-b7eb6b30a22b", "value": "3072:X3Z+rVH1ZCNQxR2zuvNymBiH/cdg8avEb:nQR1ZCNQxR2zGNymwHSiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772631586, "uuid": "7994e350-b618-485c-87f3-031204f838a0", "value": 160572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772631586, "uuid": "91092f39-022e-4ebf-ac92-e5de4304ee7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772631586, "uuid": "d84dea48-2e09-4127-9a99-ca4d71cc403b", "value": "csk_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81cbbc04-17a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772613074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613074, "uuid": "b9fb478d-af9e-411a-80cc-2f922a6ecd74", "comment": "Malware payload", "value": "17469038249bb10579c09a9e5834892a", "object_relation": "md5", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613074, "uuid": "a3c289bf-3a7c-4b20-ab87-68f191bf1ade", "comment": "Malware payload", "value": "ea29ed0d8a57700d6fbf54d5753b34edea712f83a4df42dedabb6d955ef65767", "object_relation": "sha256", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613074, "uuid": "d39f13e7-a5cb-4782-b471-f548aab25112", "comment": "Malware payload", "value": "332c59d8d918f0d61cedd92d088f5692232790ef", "object_relation": "sha1", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613074, "uuid": "a1f014c1-560f-4a42-8235-9c7ca28a74a9", "comment": "Malware payload", "value": "204a8e1d23e5ce0098e5a44b0c5136d706eb88919ecac41e73ef1c6899bca97b58986d4c2ad47d6391a6b904d2f358e2", "object_relation": "sha3-384", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613074, "uuid": "40d6de44-5204-4474-adf2-3aa0a877e817", "value": "T18A617B53EE5CDA3CC3AEE2FE9DC32528B0064D511BA60120221397DE9D48A4B0D8D2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613074, "uuid": "5b5c7ab2-f6b0-4526-8e9d-7c057a7f4523", "value": "96:88Ii1qa+++9NXBeN17QUSWAj2akvOFLRM5VkGiq07JL48wee7:LIi4a+c17Q/V8OZEV07Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772613074, "uuid": "b0f7d30d-7753-4425-8d19-6b417eb523c1", "value": 3354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772613074, "uuid": "9eeac4c2-716c-4200-9447-3caaf8c06eb5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613074, "uuid": "5ecffa40-04dd-4b7e-b2c9-11e9daf42c53", "value": "nRequest_for_Quaotation.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bfee3b-17dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772637181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637181, "uuid": "b6345796-3d8b-478e-ae4c-4d169ef4d564", "comment": "Malware payload (Mirai)", "value": "f1db7ed5c268888816690c27b7d472e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637181, "uuid": "894bd40e-c93b-43ff-9eb7-39d39d8d63ee", "comment": "Malware payload (Mirai)", "value": "ead7ecd7e4a0cf483f209ca53e74df83161249c3695fec70703f4a7ab971fdaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637181, "uuid": "2d6737e8-b4fe-4bef-8015-3fd146ca8064", "comment": "Malware payload (Mirai)", "value": "2b8fbf763a8baff460498bd3f1491e7e0e5febfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637181, "uuid": "46f411c9-89e7-477c-86ea-4942564a71c6", "comment": "Malware payload (Mirai)", "value": "28a8ccfef9fe801e4a4edc15a7fa5fe56fd837147038386f6f864b4d76ec0e8b88648e6726e31db959650287eec4f6b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637181, "uuid": "815d84a2-7bf2-4ae6-811e-077ece79c413", "value": "T1F8A34B97F440CDBDF84FD77A44570A06B571E3D20A830F26666BBE63BC721954863E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637181, "uuid": "b32348b1-7fc8-4e26-98cd-c5a2f621e619", "value": "1536:f6juxy0IDH5b1usxR4mwVbYN10bj8L++he4D34MP1lZX/otEacQ3TtR8T/Y:f6juxB7xYN10bUhd4w1TkcQ3TT8T/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772637181, "uuid": "b5a2afb6-348f-4c8b-96b1-3329f8b9212d", "value": 101084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772637181, "uuid": "76f1f991-36d5-46d0-96f1-44f449be1dc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637181, "uuid": "50c16d76-2faa-4edd-94ca-d3aa8acc3a20", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e54a09f-17d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772634785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634785, "uuid": "bae597b5-cf38-42dc-800f-4bb09bf8a395", "comment": "Malware payload", "value": "cf93ca8a86209831318fa6e7c05629f7", "object_relation": "md5", "Tag": [ { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634785, "uuid": "6accd510-8481-4065-8ad8-ef078e282af7", "comment": "Malware payload", "value": "eb45b510fa2118be7d06bc0322a9167efd08ba2e8fbc3d745b33a0c8ccdf4744", "object_relation": "sha256", "Tag": [ { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634785, "uuid": "bb8f5b83-2f3f-41d9-ba00-f7f92074112d", "comment": "Malware payload", "value": "c714240829cfaec86e0dcb1e961184a6996fe729", "object_relation": "sha1", "Tag": [ { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772634785, "uuid": "267e68b9-2a3e-4b6c-b350-935d883b8320", "comment": "Malware payload", "value": "c72a81a6dee178c6bd236eba8817ba41c53fe8451d10e8baed4791224a986357500148bb60d9508bfed329602116ee47", "object_relation": "sha3-384", "Tag": [ { "name": "newangelnewlifenewhopeformoneygetrichbac-duckdns-org", "colour": "#C20F2A", "exportable": true, "hide_tag": false }, { "name": "PNGdllHunt", "colour": "#AEDADE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634785, "uuid": "3478a616-7c2f-4031-81ef-d8898712d494", "value": "T108D41212B2A1FEBBE803573718C4089A6655AD038B2EA11F68C6371E4C7FBD5F096539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634785, "uuid": "1ac6d891-aebd-4b0e-9cec-55159932dfe8", "value": "12288:YGtl1z3ayvo7gZGe3GhUY3CChz19uLaSlF8J:FX3ZSgvHYy459uaSlFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772634785, "uuid": "b47ea5a4-4060-4c85-ba02-a40540ec61e4", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772634785, "uuid": "ace765ad-11bf-4912-98d6-e0c427e9b269", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772634785, "uuid": "bbe4586e-4a1f-46e0-a0e9-95c5ab1bae21", "value": "eb45b510fa2118be7d06bc0322a9167efd08ba2e8fbc3d745b33a0c8ccdf4744.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edbdc25c-178d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gunra)", "timestamp": 1772603377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603377, "uuid": "b15ffc39-42c6-4ca1-ba63-b40fe460af2b", "comment": "Malware payload (Gunra)", "value": "b54edbcec7664fde548a7ba1fa8b3b78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603377, "uuid": "ddf72ec1-cac4-4e98-af37-1bb690dc2a37", "comment": "Malware payload (Gunra)", "value": "eb46dfb4f15000a7d4af040b68e541251fd5716d2a77958b471a17ce2960416f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603377, "uuid": "ed40af90-6a40-4cd9-b526-a5012a37802c", "comment": "Malware payload (Gunra)", "value": "075dcc323259d84297e3699768c0519cc4796868", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772603377, "uuid": "c0131917-4b32-4377-bb10-1fb20b906959", "comment": "Malware payload (Gunra)", "value": "9c8254144cc786cede4c68172c0e66b0dc45b4aca154d6c6cc79f78dd4083707fb08d2d6dc485e0412d4c9223f67f010", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gunra", "colour": "#BE5275", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603377, "uuid": "31ba1c5b-0d9b-43d2-8618-0fc356e47623", "value": "T166830855F850DB61C6C4267AFA5E528833630B68C2EE72028D11AF7427FB95B4F3B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603377, "uuid": "47d2a126-0e7e-4cec-b5a1-ae9096f91f6c", "value": "1536:nUa1b2TvmH3/e0nfL2z3JWTrf3OYivifDa6tOJqW0kTDAEGI166EikRuYb5Vbiie:nNb2T+HbnfL3aYraBAW0kvG6ub5Qis4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772603377, "uuid": "b59f3b7c-9cfc-42b4-ab79-734b8bbf89c0", "value": 87704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772603377, "uuid": "68776169-42cc-4004-b153-dd015effc385", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772603377, "uuid": "61923fdb-f350-4a75-9faf-1f5e278fa894", "value": "build_hQN4yJ9k.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5185b539-1805-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772654654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654654, "uuid": "12e31dff-8a36-47b7-8eae-512df90d39e7", "comment": "Malware payload (Mirai)", "value": "63186ca416139a99f842730217b2d26d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654654, "uuid": "bc08193f-1752-44f1-9dc2-9668a7485647", "comment": "Malware payload (Mirai)", "value": "eb73b392f8448fe0b2177f8e7857a88c3a0cf3c66d85919134c883b2ae56385b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654654, "uuid": "39c65a4b-b216-414e-b68f-3d76d7f402ae", "comment": "Malware payload (Mirai)", "value": "08843b4d9fa01d4987c51c8249f5dfec9d430758", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772654654, "uuid": "6447d256-b9fd-4529-8a10-1e9bff9ad51e", "comment": "Malware payload (Mirai)", "value": "6dc2c1d60286b9d3224edc435213e91f0fe9f5fc48729660d15de1821808014fc14202b8d32ffb40ff21bc3c4ed37417", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654654, "uuid": "dd9b20e7-9cab-4f20-a387-f851d9e1594c", "value": "T16B330A8EB8029D3CF90BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654654, "uuid": "8418b66c-4b0d-472c-b05e-ed03e9269df4", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGa:r/hqaJMeteqK806MHdkfQX6HuCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772654654, "uuid": "824e9ff3-badf-4a53-b56b-75af2df8bb31", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772654654, "uuid": "cfee975d-5f88-4f6a-9677-ffa40c03b3ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772654654, "uuid": "ac13aa45-1bcd-4a7b-894e-15c18e651dd1", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85268d3-17dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772637244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637244, "uuid": "b73012f8-d0aa-4b35-a4f5-68b60845037a", "comment": "Malware payload (Mirai)", "value": "13eb09bcb6f24676f206c216ec6824b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637244, "uuid": "bdf32bea-9fc5-4d22-b483-abb1b1419e79", "comment": "Malware payload (Mirai)", "value": "ec9b01ca07e25e58a090b0f43db2a4990935b24cb3b5cdc10a9565ae09a46d05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637244, "uuid": "ed08a8cb-245a-46ad-8533-e9dde48d1a65", "comment": "Malware payload (Mirai)", "value": "aeba233d165c21fcf5ea1d543e91730ec7d0ef19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637244, "uuid": "3364f521-0aac-408a-baf6-1f7f6b44a543", "comment": "Malware payload (Mirai)", "value": "a6ab4a0289fd2bd0142e61c2eeeddf4c47ec8d4ea34a8cda5b6ed700f099a5dd829be98e58150da85f9dcf75e13dafec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637244, "uuid": "88f3c3ab-8e73-442c-9f9b-a9f479bb76f8", "value": "T18853027D376EA1D891650F3FBC7488C067AB0FB4D07E060EA3C2C99A9AC137AB971551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637244, "uuid": "d3c934c8-5e48-4461-b758-aee16ad79a27", "value": "1536:YPnrJEXlT38rkSw6Za1iR4RM4Lrgtpfjy+QYS18Io4s9N8ezP:KrgT3kOR1pHLEtpfjy+QD8944N8er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772637244, "uuid": "827646fd-55e7-4964-9f03-91d2da77d569", "value": 66012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772637244, "uuid": "441e9a97-76f7-4460-9140-6a102f7ed71d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637244, "uuid": "c54bb245-347d-42d0-b211-48f07a9cc25e", "value": "Polar.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59248114-17b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620737, "uuid": "36d0da7b-1de9-4675-bc82-7468471ed593", "comment": "Malware payload", "value": "24e54eff8f0c5475d4f5014d2e227aa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620737, "uuid": "aa482de9-e576-4e2c-8ef8-cd08f525fe46", "comment": "Malware payload", "value": "ecaf0fa5f52f44b9600c4ef53b97d65bfc66afc52e5361e73e90c613d98f8d9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620737, "uuid": "7c518093-a155-42f8-90da-9dee8eb49fa3", "comment": "Malware payload", "value": "db506f019354b8057febf86f489c08f238b60434", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620737, "uuid": "f0e6af06-dfd8-4357-8b55-9ae8e977f46b", "comment": "Malware payload", "value": "4b77ab15b89f71e25e445a4873088569f72e3c06da440430f717d4f71a097e59101eebef4c7aceb9de9284f52676e916", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620737, "uuid": "2c4453ce-16b2-4a26-b458-a1da1dde02be", "value": "T17FA48E01B714550CFA16FD74D0A2D2C247F9FC26AA6ADB3F2476346B9FE628F5801386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620737, "uuid": "bbe491e8-a3ea-4244-82f3-7af735d1628b", "value": "6144:n/3d7+gowNn0vaO487coBHX6F1ZVoOmL/kj5md++kq8vcox6C7rmVP:8rw61487coBH6oxL/ktk98vcox6C7CVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620737, "uuid": "bc09665e-c5e4-4c3c-bbf8-b47ee0e9e2c8", "value": 471760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620737, "uuid": "7ecde1b3-e365-434c-88c9-1afe02c56bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620737, "uuid": "5f7b17ac-c882-404f-a396-7d8e85b1a840", "value": "ecaf0fa5f52f44b9600c4ef53b97d65bfc66afc52e5361e73e90c613d98f8d9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e4d1a3-17d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772633024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633024, "uuid": "09c15c55-f639-4e77-8e28-0819f107c55b", "comment": "Malware payload (Mirai)", "value": "234e3e6d701eda25d1fab94d80d683e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633024, "uuid": "f290fae7-efab-49b0-9023-788d0398bcb0", "comment": "Malware payload (Mirai)", "value": "ed4eedc3100f705e8a94ce3249a17a0a8dba2fc7e09b12b5c0eca89306aef87e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633024, "uuid": "078e4143-ba11-40bc-a5cd-1c3b1c84be72", "comment": "Malware payload (Mirai)", "value": "d86181c56ba073e05b82b3cde9917b20f2b85100", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772633024, "uuid": "ea4876d7-70cd-4015-b349-5e60ce66d146", "comment": "Malware payload (Mirai)", "value": "dfc1af585e8321621ed5c468aebb6fe36b8165380e03c389c4c7a0acdeda11c58320295c96c355ef5a0bc97b26e7df24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633024, "uuid": "ef761186-8cbc-4b92-bb35-4f8cfeee1f09", "value": "T1B013F133DD849FC4FF67AE242E42A7EA63770F61BAA08CC35054C5D3BF64179690099A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633024, "uuid": "f46f616c-707b-442d-b0da-32b2e84ef6de", "value": "768:WgJUb/K8mUrwl1NX1hGzM8uccTwwvS58xZZB+TIYUFynMEoOr24uVcqgw092:32bi8mUcl1NXmujHS5GZ6UNynMEl24uP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772633024, "uuid": "09295c9c-8a99-4f9f-9043-14ba6ae55618", "value": 42004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772633024, "uuid": "318b1e8a-5165-4be1-8be3-e209a15cbfa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772633024, "uuid": "0703dccc-89b4-4e3b-aeb2-b2c74ed3a11b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a0c7c0-17db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772636782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636782, "uuid": "05067326-0524-4ca0-817a-9987b9038e08", "comment": "Malware payload (Mirai)", "value": "384804f72d0fd6bddc245d752fb92681", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636782, "uuid": "b15c751e-2389-4c85-85fb-e8d873d2c755", "comment": "Malware payload (Mirai)", "value": "ed681bce05f44af250889c53ab5918109233d1c82dfc4daf7452a80dddce3c78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636782, "uuid": "782a4169-ec2b-4cd2-8dab-0f93d7254a56", "comment": "Malware payload (Mirai)", "value": "aa27c934c4c699b5d788765f6656ca4876731b5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636782, "uuid": "d3c14a91-a02f-42d4-91f9-7e3feca0c305", "comment": "Malware payload (Mirai)", "value": "6ee8da6d11b7ef7dbc9a5bcdbdef2571211c3e493bbfed8c4a1d4ffff9ca19b2005c9fa1514ff12985b042d1bbf7549a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636782, "uuid": "1f5fc1ab-aa39-4659-8a54-750184a00d7c", "value": "T1526302B8D774D9B1E5CCACBD84CE1825D844E2A0519C869456A00DCCE7660CBDDEEADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636782, "uuid": "cbb6f431-5c68-49c9-80f1-5fb934857713", "value": "1536:zJkOIcZ0JYE/RkTdkJBHDNk0lWrbwcx9kjQ6p8Y:Dt4/RkTdKj60QbyjV2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772636782, "uuid": "2986254e-2b2d-4bdf-a4b8-6767f58e393a", "value": 72376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772636782, "uuid": "3af0399c-7aba-4614-bc70-87a2bcd04736", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636782, "uuid": "de9ac286-ae63-4b9f-8fa0-084fc6f5211c", "value": "Polar.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c824b7d-17e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772640982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772640982, "uuid": "bf60ccfc-dc2e-4c08-9482-eacb94d14974", "comment": "Malware payload", "value": "4d5c0dfcc7f0d5fd22a3bc41ea4a9bd7", "object_relation": "md5", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772640982, "uuid": "18dbda74-da44-402f-89da-b7afbce55aa0", "comment": "Malware payload", "value": "ed7c98b2ea017fb82e7e93806d3a348002e78eb2cd1902c84c3bf664ec1dac38", "object_relation": "sha256", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772640982, "uuid": "90dd0330-ab3a-4d5f-92a1-74da0d8e0c21", "comment": "Malware payload", "value": "1786317e121caf70cef33f194174f4a995bd02ec", "object_relation": "sha1", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772640982, "uuid": "59d91316-236c-4214-8759-5e1ab213acc6", "comment": "Malware payload", "value": "73d718a3e2892a9e11972c0de0c581adcddeefc2116e7bf263fde5d640f3eb7263b308a004a9965e7097b35d1bce0b76", "object_relation": "sha3-384", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772640982, "uuid": "cf8636be-c735-45a3-b1ec-21375380da2d", "value": "T12046336AFBB3F23FAF448236B1ABA33DAE7DAAA381401C4BD515CD7124837605516C5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772640982, "uuid": "0fa45175-7d22-463c-b3a5-cee311a9bfcb", "value": "98304:DkqHzIJFQP4AYaixD5ACIP953LnDzHwsdibSk1KpDVW42TRUNCpvt0IZJFQX9PkQ:AU8J+mX95NIjDDUrek+WKAz0IZMXOC2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772640982, "uuid": "9979f456-bf5b-45bf-a258-db713d16a379", "value": 5590239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772640982, "uuid": "881f4b9f-df8c-426a-aac1-ef888edbfe2b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772640982, "uuid": "8dfd7670-ebf3-4eff-bfaa-fa419c3194c6", "value": "\u300e\u0412\u043e\u043etst\u0430\u0440\u0440\u0435\u0433\u300f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15dacd5-17c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627381, "uuid": "95f48afb-6c19-44aa-a735-742099d0f2c8", "comment": "Malware payload", "value": "a1766f6c850937511fd9b3b36d9165ab", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627381, "uuid": "006131a7-8cc4-4809-af47-68da8b8514a4", "comment": "Malware payload", "value": "ef12aa289a6d744cccb7484234d56290899984f762a871bd45119b4fba75c2fe", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627381, "uuid": "fbed23a6-2aa9-4b4d-a241-c7f30bbcc0d3", "comment": "Malware payload", "value": "afba45452fa20b7f8dd2159e4883c80f50a1a791", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627381, "uuid": "484d1f47-f17b-4d1e-bd48-230c8381009c", "comment": "Malware payload", "value": "8c973b7217bda3f287c11978cda1cdceb7f3f039dea5d5d8b999ee74ac3bf01f5041d582662a4cb44f7ab12a82c52cbe", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627381, "uuid": "729e58b3-8a58-4da2-a29e-de920d91bc62", "value": "T1DD35333D81DD114DE02AEA72D68144CABFFF9630614239E7DA7D03681E436BB9B851F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627381, "uuid": "aaacb195-1d41-48e8-ba47-cc330efb2d0e", "value": "24576:8RE2MLXG8eoXCX//P74gC575TJdw6Mi1VTQt2V+q+EUXN:+4LfehXDRCx3ca+8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627381, "uuid": "b03e8104-4b78-4f9f-8fb8-317dfe1e646a", "value": 1086553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627381, "uuid": "08065395-3f6e-4886-9620-74f285e71fbf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627381, "uuid": "6513b9c1-b668-426a-983e-ebccee55a33c", "value": "ef12aa289a6d744cccb7484234d56290899984f762a871bd45119b4fba75c2fe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916cca1b-17a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772613959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613959, "uuid": "2c690509-af1a-4726-be0a-ed28af6f467d", "comment": "Malware payload", "value": "d72c96eb886e493ee9fd51a60cabdc2c", "object_relation": "md5", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613959, "uuid": "19412b29-2094-4521-8ee5-bf1ef9328410", "comment": "Malware payload", "value": "ef23b1e36652405bd62b46b0c0db9e47d0e2d1f77936b8c553d9c09cb61f5484", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613959, "uuid": "fe42c3d3-e6e6-4b6e-a392-522730931550", "comment": "Malware payload", "value": "621eee2e8e2cf319faaccdd80a96b79272b8ab91", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613959, "uuid": "ebbe4964-8641-48a4-92d0-9740a48d87c3", "comment": "Malware payload", "value": "b121ec3402fe7b9785b7f79c8e496f3d5ec61d7d30980702b33fa1ebdb9ec2391930ff2fe8bfbe7e8184365ebeaba537", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-33", "colour": "#FD5F46", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613959, "uuid": "2d933981-f965-499f-a67c-e47b06401ebb", "value": "T1F65423C18DAA925E827DE7658FF1B7B1379A7D1487C05EEF210A0FA0716ED0A45B04F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613959, "uuid": "258fdd4c-67fe-4259-b44e-eee7092f1071", "value": "6144:KJAKwjHJOsGccLSTOs4rfW/HT1BjiM3QSEJ9xs9tprYW3317rHlRq:SDPaOsye/HT1YM3Q+phlRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772613959, "uuid": "c55d5352-6383-489e-8dd9-4f07639aea88", "value": 290294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772613959, "uuid": "a714799a-1010-438e-b3ae-616a00758b1a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613959, "uuid": "640022fe-2554-4d25-ada2-b1dae73dd9d1", "value": "a6dc7a4ce9aabd1ddf501adae985423dd3a90315294c4ad3f5b61aa5c7984b2b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec105bdc-17c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627855, "uuid": "a75adca1-dd57-4844-9d18-9b1946b976d8", "comment": "Malware payload", "value": "6813baa11ba22e19617d9727abe482a8", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627855, "uuid": "e04ce08a-4935-481b-9c81-655376ef491b", "comment": "Malware payload", "value": "f0c0b7bc0a00457870b2b02f8d834b7d21d18b9f5a93a61c47b22cd50439e400", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627855, "uuid": "7138db49-0e95-4065-83e3-77b91d89b5b1", "comment": "Malware payload", "value": "1007b382ef7c2334f76e8e95b80bacf5cd246131", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627855, "uuid": "81ac5af4-6415-45da-8658-5c1c57fea99a", "comment": "Malware payload", "value": "7ee87d158c6851a0afe807b830d9cdec77666f2238c20b50a0fd3739cc1062c1dc5277c4f38f5599ff8fb6d553099dda", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627855, "uuid": "84d9b07e-acfb-4c06-875e-1750ec7805c6", "value": "T12011CE1CF606C6049B511530CF3DBD03B9AB1593794BCC60129F37396AA1785933E0C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627855, "uuid": "aaae9406-0712-43d4-ba23-eef09a77a298", "value": "24:QcCmFgYGF0H2V72hM8WFJ2hN82hJ29Wr2okq2G72OHKJVt3rlALa1U:yBVqXW+nFG9WaLdCqLWu1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627855, "uuid": "87f07e55-1316-460d-83b5-b23fcd451ca6", "value": 1032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627855, "uuid": "22b4edf4-458d-4281-93cb-be76bf0b15b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627855, "uuid": "dba6b1ee-0c1c-4130-915c-3bf5b4b9ea64", "value": "IndicatorsMT-4.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be777ffd-17b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772618330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772618330, "uuid": "1e11f600-f09a-4547-b984-773482974701", "comment": "Malware payload", "value": "7be1f9a968c5b1567570e12738392d7c", "object_relation": "md5", "Tag": [ { "name": "Astro-Bright-LTD", "colour": "#65023F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772618330, "uuid": "4f03bf8e-cfd4-4b5c-bcba-57c7ef16d2ed", "comment": "Malware payload", "value": "f3c11d0d18c5fe7c40c2ff833a618a46873ae99b0e7525f692d407395fd61b8b", "object_relation": "sha256", "Tag": [ { "name": "Astro-Bright-LTD", "colour": "#65023F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772618330, "uuid": "6af2824d-4263-4676-84d4-85cb6dde472f", "comment": "Malware payload", "value": "b8599d33ac4b562740f930903d7d6618430b0953", "object_relation": "sha1", "Tag": [ { "name": "Astro-Bright-LTD", "colour": "#65023F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772618330, "uuid": "2ecc4ec9-7fda-4d6d-848c-c3b8f7b51982", "comment": "Malware payload", "value": "449e2ed181f2bdd0731e2408c87ad182d463fbc058db4c25814ef41bc8c5c76745891fd4c7c8c200c1607ba0df6e843b", "object_relation": "sha3-384", "Tag": [ { "name": "Astro-Bright-LTD", "colour": "#65023F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772618330, "uuid": "e5878ed7-061b-4538-af80-17fd6c722498", "value": "T124C3CF8A7FBC0413E6BF0FF9A07481528F36B71A7A12C74E49C465EC6A133458A057EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772618330, "uuid": "6f8d74c1-81d5-4f30-9d22-9fb068d97cee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772618330, "uuid": "1885d0f9-2636-4e5d-85e5-f2deef96cda0", "value": "3072:01YGGVnDNzfUvJYLsL7GPGODNQvYOdddVK:fGmnJcSS7GPGOH0dVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772618330, "uuid": "5ff96cb5-6612-4c65-9bb0-7c0a8c03efed", "value": 121080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772618330, "uuid": "8c29e193-c991-4caf-ad66-fc027e126bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772618330, "uuid": "4ecf9547-e8b9-4ff0-83c4-2a4cb57d7c35", "value": "f3c11d0d18c5fe7c40c2ff833a618a46873ae99b0e7525f692d407395fd61b8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad803f08-17ba-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772622596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622596, "uuid": "6eb285b1-dd96-4bf2-bb0c-a051e467551d", "comment": "Malware payload (ConnectWise)", "value": "4f201c7e5184642443b5367eb90742b4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622596, "uuid": "4149c9bc-cb21-4edb-87dc-96d5ea38d7ac", "comment": "Malware payload (ConnectWise)", "value": "f5d729bd33b1fdd065b7a3d24a5198b19c17476bb527eeb954e15cb64c303e0d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622596, "uuid": "0a78644f-a30b-44cf-9ffe-bffec16d02ba", "comment": "Malware payload (ConnectWise)", "value": "b3a812f15121a87ab8ef7804745cf4a9e0b17d96", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772622596, "uuid": "be478ffe-7c9a-4652-8d6e-a524c3a58af1", "comment": "Malware payload (ConnectWise)", "value": "9ef922112a100a488ec2d3facf9a53e6ff4e1d711c52b245599ac9c2b415e6e5f5233526702946a02cf5462279f844e2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622596, "uuid": "c6d27f29-a4b1-427e-9261-536d071eb039", "value": "T1C2C6232153F99024E0F35B35EE7AD165BA32BE618E16C54F1314780E39F2E8196B273B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622596, "uuid": "2dbb87ad-9523-4d52-a323-282f7ef6a037", "value": "196608:OBn2hg5kEWmXhcfKjSV7h7vGe4Bn2hg5kEWmXhcfKjSVSBn2hg5kEWmXhcfKjSVW:6gdEEijYDGJgdEEijJgdEEij7gdEEijc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772622596, "uuid": "857a7342-702d-4152-a3a6-b31f2656111f", "value": 12234752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772622596, "uuid": "9e61ae45-d5b2-4f9c-b684-8d308548286d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772622596, "uuid": "46e4e3fb-e111-4c5b-af5b-ecb3a5a74a2f", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d23f78f-17a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1772612932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772612932, "uuid": "4b9abe8d-b0e1-4ccf-a723-383dff2e6be1", "comment": "Malware payload (Hajime)", "value": "3c49789f554b996bd6208d0298b77de8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772612932, "uuid": "36edb0ab-faca-41b5-a1b0-77e291e2c39b", "comment": "Malware payload (Hajime)", "value": "f60a839b4bce2e10008b55d7913afc3fbeb37093cdea6dfa6e0e3e6af5af0ea4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772612932, "uuid": "6acb3c6a-15cf-42e5-8e64-70b4d2007c71", "comment": "Malware payload (Hajime)", "value": "265e66b1f4f48651dbb2c10c28f4feb50cf4ea5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772612932, "uuid": "ff92ac63-fb2c-44f8-b24d-660b0e921f64", "comment": "Malware payload (Hajime)", "value": "278f1eb92c95370a93ca9f8dcc4c2c78e503725793a26a1ad626e5ae7e250ba6df2dd88f390804010b4c9ec43bd09c1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772612932, "uuid": "22fed5ce-c230-4886-a205-313d5e75ea20", "value": "T177F2F24732D43B33E56248F4D7FD5F8BA15ABD24EFDE242BA4113A61707225D28CE81A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772612932, "uuid": "e58a1f8b-9e4f-4a3f-b6e6-d51cb1e9bbad", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghF9:yYI0ARqw1qAEW67UIWi7M8gJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772612932, "uuid": "40070c2d-2b42-41ff-a1c6-9db47eb4a9f4", "value": 37476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772612932, "uuid": "c281352d-b7ff-4632-8f25-749197c1cda5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772612932, "uuid": "bcf4581a-ce0a-4c95-af36-1a3110e2c6f3", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1687b00a-17c6-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772627497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627497, "uuid": "f1a2c5d7-70a3-4a91-96bc-fa9f40e51a1e", "comment": "Malware payload (QuasarRAT)", "value": "0fbe35e0a8f83d2b7d56aad38a4f498f", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627497, "uuid": "5f9c0c54-5383-4db3-98de-cfc3e25dfb88", "comment": "Malware payload (QuasarRAT)", "value": "f6f19c898956e618648964187d110f88542491cb30a69db18da0c58b5f422dbe", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627497, "uuid": "d22d5718-ea11-4a75-9e36-baa3fa714a5f", "comment": "Malware payload (QuasarRAT)", "value": "0baea9a68567c536fe20f27ca0e6b96c6fea56a9", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627497, "uuid": "df06e92d-1739-4cf8-be00-8672c1fab933", "comment": "Malware payload (QuasarRAT)", "value": "6b8e7a313c457c7d90dc744f46940a7c75d9161ac85c390cf02a967a0030cf6f0cb9001953fcf597246bc1c07055c313", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627497, "uuid": "9ec89339-8df2-4697-b2d0-d3f718549863", "value": "T1E8E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627497, "uuid": "80fd6bd1-b88f-4517-bdf9-33e89d62b021", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627497, "uuid": "2d6b462c-099b-42e6-9ebe-8290874f3294", "value": "49152:rvOI22SsaNYfdPBldt698dBcjHqvRJ6JbR3LoGdhETHHB72eh2NT:rvj22SsaNYfdPBldt6+dBcjHqvRJ6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627497, "uuid": "97b9b26b-82d3-482c-a289-47a7671777f9", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627497, "uuid": "547c463c-dfb0-44b6-9c70-b990b489dae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627497, "uuid": "c3895ba8-1e45-4bfc-8eae-860b8bb56da9", "value": "f6f19c898956e618648964187d110f88542491cb30a69db18da0c58b5f422dbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b362ab03-17db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772636780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636780, "uuid": "ecc781ec-5ca5-42dc-9694-4f691b641bcc", "comment": "Malware payload (Mirai)", "value": "1185809b8d0d038ded584c654aba9195", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636780, "uuid": "344fdb18-c4b0-4a61-b16d-b2585b079fba", "comment": "Malware payload (Mirai)", "value": "f70bded366ac386fe2b39fb3833a6b695348ca462016e73c25855a76871de72b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636780, "uuid": "48032ea3-eb43-45c3-a094-782da8a91b42", "comment": "Malware payload (Mirai)", "value": "ead9eff690aeadea430d94af0e499f6b9599d62d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772636780, "uuid": "428570bc-f272-40e4-a5fb-3ea951982de5", "comment": "Malware payload (Mirai)", "value": "6ad70635b06e930306598bc9573cb83905db12a7bf1b7b889c4897068317907da1329a8bb158e77eedfd3fdc3b5b0f0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636780, "uuid": "26e658b2-b30d-4b00-b799-5647c09a7f07", "value": "T1F16301609E861C711D316C3FE06C0195AA6C2FBDE0F5AD571224CAEC1EDE52A26CD88F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636780, "uuid": "129108bc-9a27-4443-9fbb-fec000a631e9", "value": "1536:i9uJJ4vFrjbKM7lH8xerH5ljMigPDRpRcbhkFkgb0mTHEpCY5ULJI:i9kJ2xFp8gc7bKbOr0VHmLJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772636780, "uuid": "920f5489-0f12-4fdf-b1f1-b6f70a6d0c0d", "value": 70236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772636780, "uuid": "e8cb2b13-af22-40e5-85bf-788a093a58d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772636780, "uuid": "5095d2c5-858c-4300-9422-4c4d90ab49fb", "value": "Polar.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb0fccb-17c4-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772626678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626678, "uuid": "76c4c660-6286-4746-a063-58043c26cff8", "comment": "Malware payload (a310Logger)", "value": "1da05431aa0c0b83f2d3319dc06dd23b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626678, "uuid": "d2d38c3d-c317-49fa-8bab-d2dc16829ec7", "comment": "Malware payload (a310Logger)", "value": "f79bbbb5426834f7b541a87414c3f9c319d8e1ea2c8bfcef4ec880a8bbb69332", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626678, "uuid": "43ad8ee5-9bc0-4c0a-a95b-fe0e163524e3", "comment": "Malware payload (a310Logger)", "value": "5094e6d158936773fc7e1c282283e89a917ccffc", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772626678, "uuid": "3be43318-badf-42ba-a36e-c43350b4e822", "comment": "Malware payload (a310Logger)", "value": "c29f5583009c7ab708867628023a746f14bd3dea1ab2ed8fea88e853d2033efd05ff90b904b9351c98d3a27927b1ed61", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772626678, "uuid": "953e7e67-9673-45ce-a7d8-03d52e103a57", "value": "T14655CF027381C062FFAB92734F5AF6115ABC79260123AA2F13981D7DBD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772626678, "uuid": "169537ab-8766-45a7-94f4-9571fe1f0026", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772626678, "uuid": "e965fdc2-3cc3-4b8f-bcdd-dc647b685c0b", "value": "24576:q5EmXFtKaL4/oFe5T9yyXYfP1ijXda6HQUf9AcKr5V9nFMe3cghLYyvQR:qPVt/LZeJbInQRa6HQK9Ur1HRhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772626678, "uuid": "0d178aeb-64ae-4d4f-990f-68403ed3d5b3", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772626678, "uuid": "13deeb5e-7957-43bf-bf51-fedb598e76e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772626678, "uuid": "0e2df956-7fe9-4878-9e7c-63831d545917", "value": "f79bbbb5426834f7b541a87414c3f9c319d8e1ea2c8bfcef4ec880a8bbb69332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fc9096-17c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772625484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625484, "uuid": "01790fda-2186-42e1-8ae4-d880d0962469", "comment": "Malware payload", "value": "43b76e56b912527b080390d3354ece1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625484, "uuid": "fd3cc66a-330a-4383-8329-af26b3ba7e8e", "comment": "Malware payload", "value": "f89caa0a8006ff2d1a0a85801c2617ccc772e9bb70e34961e14a5f0570119183", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625484, "uuid": "cf0c83f4-0dac-4f16-9ac3-7d24b702c2d7", "comment": "Malware payload", "value": "9c08fecc2730c96dfcf9c3cc7969d0e68c040f20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772625484, "uuid": "bd3e3e2c-ba00-4cd0-aff7-c51cce40bc1e", "comment": "Malware payload", "value": "fa9ea6751a0ba13ee4bf7b31209562c83eb159c79cd4582b0029ebb38d82eb10436dd18f9f874258e16ae003765cf384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SPARROW-TIDE-LTD", "colour": "#6A3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625484, "uuid": "f1a32898-fc40-4017-b905-5cf08b279a64", "value": "T15374F1D021EC89D2CDB7CB3AD0652E05CFF49676B6A1D241C98059BA7D49F038F723A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625484, "uuid": "79345fa9-dd2b-4968-a72f-d0dd8b54f489", "value": "6144:+fDz4cOwijkzDzZsBS99NIdnYu7/3MfRUTgO/Gi0IJ4lci2V42Jw+Q1Eunr:+PD1F7yYa/3MfR/Oedlci2fJw+Qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772625484, "uuid": "04ffec97-6b03-4257-9162-198e17b117db", "value": 368936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772625484, "uuid": "ca486064-aaf5-4183-ad6f-4f494c8a9625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772625484, "uuid": "33a81481-08db-4487-9427-1da2a4314958", "value": "f89caa0a8006ff2d1a0a85801c2617ccc772e9bb70e34961e14a5f0570119183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c0c844-17a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772612515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772612515, "uuid": "ca701a8f-745c-401f-aa12-b8109c1ce278", "comment": "Malware payload (Mirai)", "value": "5fca2ee0e1210dc42996b2826e94dc1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772612515, "uuid": "dda54878-4059-4063-b4c5-26f71d386ec7", "comment": "Malware payload (Mirai)", "value": "f89d25a12a3642fc6493fdb10967afb4d7ff12dcec9ddd4b5c4343e03aed97c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772612515, "uuid": "4eea4820-150a-4541-b3af-630230b9499b", "comment": "Malware payload (Mirai)", "value": "ad97142bafee07ca083aae3656789a50a55ee0b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772612515, "uuid": "04bce537-0dea-485f-8f42-a05656e8cb13", "comment": "Malware payload (Mirai)", "value": "38f625e8c8d64d14951d4c154eccba2769143532b22e19dfbd77d51ac86f34cc56499dc8d9f6df8c69b9d763a6899588", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772612515, "uuid": "5ace41ce-1a19-4b8e-8568-8cd92e616cbc", "value": "T1A2534BC9A593E8F5EC090A712173FF758576F23F216DEC87E3A499A2AC42103D1162ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772612515, "uuid": "34b310a3-3d82-4d49-b884-d21f801ced27", "value": "1536:dnA1GL2BeQAvXLfmYM0GTm4JnSzKY/0HckpTiCicD2gt:y1GKBefz+70G64J4KY/JSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772612515, "uuid": "8c348263-5d59-4815-b2dd-352668afb214", "value": 66608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772612515, "uuid": "2cf59ab5-f939-4c1a-9045-9549570e5cd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772612515, "uuid": "2c2cab78-6cc3-439d-b392-dd85cb5628d8", "value": "nullnet_load.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28328948-17d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772632251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632251, "uuid": "92344a9e-fde6-4e9c-a7d8-2196d0383725", "comment": "Malware payload (Mirai)", "value": "30f43367d05a67166a5cf84992acc884", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632251, "uuid": "43cfab14-47d8-4b96-b7d2-a40937bd2cb4", "comment": "Malware payload (Mirai)", "value": "f8e0dcb2269a05ca030a70acb1e332d3493a77d683e2f6cdfaa5e7e6f5f00052", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632251, "uuid": "24322f9c-0342-47b6-a891-09d3ba0a882d", "comment": "Malware payload (Mirai)", "value": "9f952afeeae27d1aeaf9f9bee20aa84da7bb7b0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772632251, "uuid": "2ea2320d-03fa-463d-9215-a69194fce535", "comment": "Malware payload (Mirai)", "value": "1c58a7e49956db89f13d6c83dbf0e98e7d8799f579a71db23dd37078d1523cf703e3eba11a20c42557249dff864b9526", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632251, "uuid": "f59ac3f9-a9df-46fd-a87f-25eb8ac4c94c", "value": "T197B35AC4F743D4F1E85305B1187AE7369B32F4781A2ADB42F3699B3DAC61901DA0A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632251, "uuid": "86baff5b-53ec-4bd4-9c55-08bf63146c0b", "value": "1536:V0brvpFKu+GkU/YvJqQRvu8kXvs5C5i3O6eG/UhJSfwG+hp3lM3ls:VSrvpaFU/YvJJUDvridejAfA3q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772632251, "uuid": "ee259a46-9a4a-4679-b600-44090d84d846", "value": 116908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772632251, "uuid": "8442b0a8-8c14-4e0c-b2c4-a5404b4c01b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772632251, "uuid": "a9237c38-4d66-453d-bbea-31c438ccd828", "value": "csk_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0406281-17a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772613125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613125, "uuid": "04cc31fb-f4f4-46d3-9ce0-fee187dbbc4c", "comment": "Malware payload (Mirai)", "value": "190ffb5a95426e41406cf7408012ba3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613125, "uuid": "6097000d-103f-4102-8de8-5f4c5540acc5", "comment": "Malware payload (Mirai)", "value": "f8eea1f5af1af4eb4f5c9ce1f38d65a99ecb1ab5915b7f9cc1c53f290d4b3e79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613125, "uuid": "766f0f24-3187-48e5-8126-f01384831943", "comment": "Malware payload (Mirai)", "value": "c58ddd654828435997a5d5f34b4b211e827c8ef2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772613125, "uuid": "5abd7874-91fe-4c6b-90f8-2d5eabe15fce", "comment": "Malware payload (Mirai)", "value": "b441c2914654b67e1bf9d734d02b737d874865ddb136b3a25c79023e2696cc1b1cafab37e5112495c42c5fe1fe744cd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613125, "uuid": "e9e8f9a5-6905-4661-8ab1-7d6338dc4734", "value": "T1D2734B86F98B84FAC51B8C3051B7F13FCA30D87E417196AEEF596E35CB379029216189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613125, "uuid": "3583f9ef-a81e-49a3-8b12-4f760f82969f", "value": "1536:WNQh18AdIiZk/eLy2lHQjb4cM/NxLcs8lGJhD2gtk:WNJACiZk2LBl3cMlxAs8o8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772613125, "uuid": "006e4f13-3231-4dc0-9f69-ad4daeab3b51", "value": 74672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772613125, "uuid": "aa673c22-caf3-4c4f-907f-5c0458b5351f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772613125, "uuid": "bdcd07f7-733f-4b16-b642-5ee340eef6ca", "value": "nullnet_load.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf3b03a-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602758, "uuid": "f0c80e9d-236b-49f7-b09d-79ede9c0dc31", "comment": "Malware payload (Mirai)", "value": "7d5f5af671d6cb6723f8c4770c700623", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602758, "uuid": "8b0477c7-f234-4484-8453-f89aa87ccd9b", "comment": "Malware payload (Mirai)", "value": "f9a9d9eda1bdf8049c2c433ac9d908d60665b79cb8ad2d001b37b91cac456dc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602758, "uuid": "1fc9a336-e43b-4aec-b577-4eddb6210a8d", "comment": "Malware payload (Mirai)", "value": "7e4f5d9522058990703ee99b1cad07fdad5ab8d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602758, "uuid": "a807696f-10ec-4adb-a78b-57d597582041", "comment": "Malware payload (Mirai)", "value": "72838af5f8e6e53d960e141f24c7862911aac8b0299d33fda878a18ca232496c75346bc1fa15ba2505dbe35a68e65b5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602758, "uuid": "01a74be4-2136-47f0-a61b-0e36d23e310a", "value": "T1EAE2E179A555E663E7B04C37CB34DA47C5E40378E1F9101231842E9CAAEC88669F76CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602758, "uuid": "b5f8dfa4-1e5e-412a-98e0-55f0145647c7", "value": "768:/qox/ZCG1iNrWteoZ7PWvCNGyG8wmtHFEfmnXMRs3Uoz/:yoxRCG4EeoZ7O6NGtbm4mnXtz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602758, "uuid": "0b89466a-34ce-4e45-9f77-0c71adb639f8", "value": 31352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602758, "uuid": "3eabaf8b-ad89-4ada-b745-96d47b97a368", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602758, "uuid": "6e0a5e88-e3d2-4059-8089-79e3f99c544c", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d224b7-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602833, "uuid": "e1201b56-6a60-4fe9-abec-530b6523181c", "comment": "Malware payload (Mirai)", "value": "d485ddb0698cede8668118621fabcad5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602833, "uuid": "df7e08b0-e797-4c1e-b52c-500ca5d24456", "comment": "Malware payload (Mirai)", "value": "fa78032990dd31c466f91d527ac97b2a968aa8333ef3123387982acca0dbfb08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602833, "uuid": "0c40dc06-37cb-402e-a2c3-d3def8804a32", "comment": "Malware payload (Mirai)", "value": "654c9987c30f3e14a07771b45009936a5e6170ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602833, "uuid": "99363ef9-b6ce-4abf-9e56-26ff533b9bd1", "comment": "Malware payload (Mirai)", "value": "74c43dc6f72917040f6be7559aea99917a96b952d6df8e8a44bf0159475914a99ca5e7f2a0e38554b26891c64b1f6df5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602833, "uuid": "5b9a9e58-e8bf-48f4-8e96-41a78c3af710", "value": "T13734C61E6E228F7DF269873447B78A34975D33D627E1D685E1ACC2005E2438E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602833, "uuid": "88075852-e33d-42ed-9cac-6300742e6227", "value": "6144:5P1Qow3WfOEzgoM/sVDblouHWhPqwBQyMAdVoHxFZvgrHWAjpvtVV2H4EFbHD32+:cppAvFbjmFSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602833, "uuid": "ba7754f7-8725-4c06-947c-10d5fd6d3336", "value": 235512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602833, "uuid": "643d1c92-e145-49de-8141-9c0df72e594d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602833, "uuid": "3d382458-52f9-4941-bb8f-83d93cb2906d", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ddc78c-17b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772620782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620782, "uuid": "a1a6b52b-2f61-443e-8342-811d7536061d", "comment": "Malware payload", "value": "993d4d69f698980e0bc3acb5caf34017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620782, "uuid": "876120da-ae81-4f0e-9db3-6a0adc552c1e", "comment": "Malware payload", "value": "fb44c4153f75ba0105e9581e13b78512d6c9ca1b751ceb92a61550087fc6efb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620782, "uuid": "67d474c6-2099-409c-b0d2-c725201ea874", "comment": "Malware payload", "value": "e6e048e10c9e8569f58d635fb5cd8795734e66f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772620782, "uuid": "e592b579-0131-448b-89da-5113af4c722a", "comment": "Malware payload", "value": "8a6f761005425365adf1d981a3f104946d90a83e8b4567d60ce403c46584d0f899565c4229ced360ff046ff0b8fd1fc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Royal-Step-Ltd", "colour": "#7AE097", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620782, "uuid": "e13226ce-85df-4095-ae03-bdfb17f6f0fe", "value": "T131258C01B750950CFA2BFD78E0A2D2C247F6FC226666CB3F54B5345B5FA628F6811392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620782, "uuid": "ce85b69d-4ed0-498a-8380-7f25500e48f5", "value": "24576:s8WcoBHhL/kth4WcoBHhL/ktk8OiIYUcox/VWEVH1coZMN0VF7cohyfZhVc:sSvW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772620782, "uuid": "5b120e2a-0949-44fc-a785-54569c95acfc", "value": 1044176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772620782, "uuid": "04df9c4d-c0ca-4beb-bfdf-b7737bfae5c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772620782, "uuid": "3bffbaa9-61a9-46dd-86b3-9346ed4b16e7", "value": "fb44c4153f75ba0105e9581e13b78512d6c9ca1b751ceb92a61550087fc6efb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d4e97d-17d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772635980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635980, "uuid": "156b0f16-0db6-4612-b239-e53417bf5673", "comment": "Malware payload (Mirai)", "value": "fe66b170d45ea8400866c0007ffee6b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635980, "uuid": "56e71125-270b-4563-9c0e-b98a5437e88c", "comment": "Malware payload (Mirai)", "value": "fc1a26afe92ac38e07f19e3e24cec21d9417999f18abd9dbd407a5d277394ddc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635980, "uuid": "069b069e-fdca-4d41-8c5e-d13cfd8db36f", "comment": "Malware payload (Mirai)", "value": "b8e2b888c2cbf0c08504fec3c176c319afe01007", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772635980, "uuid": "92682327-58ff-4506-84f0-a6ef83f9c974", "comment": "Malware payload (Mirai)", "value": "071ea1a751b0cf724c58b8fb628750d6562c51ff565b23e28df4a6fe2b9fae8e476056281c4984b820b4f5d822b5d19e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635980, "uuid": "628e31b7-dc21-4c2c-89f8-50c39cfa4855", "value": "T18C0429C7F801DDBAF80AE33608534906B530B7E248825B3772577B6EED3A1951927E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635980, "uuid": "e4cf2feb-d7d3-41b3-bc09-873989823eb7", "value": "3072:Tc1+STb8vzskvJeTKZ/yZt4rIFJNkQwEqiKoTVwjbiJLbyxTxfoteD+4NX:ZST0s0pyZOrInNdPKolLbyfotTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772635980, "uuid": "17600b4d-6187-48b9-a0fb-e5d60eb8e529", "value": 178080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772635980, "uuid": "cb66c510-7d4e-41c1-97a0-90545861b5bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772635980, "uuid": "1c2874e1-5d6e-4265-9e9a-002c445bcc29", "value": "csk_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe8ec42-17dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772637740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637740, "uuid": "098fbb27-d9ff-4ef9-b85b-62638f1dfe9b", "comment": "Malware payload (Mirai)", "value": "965e3a92c2e08d856c5243bd3e4b7e4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637740, "uuid": "a6252f29-d178-4583-8150-796585d2c819", "comment": "Malware payload (Mirai)", "value": "fe63711220e79562d4c11dd21023f362bed74da71baa3a1e6ff59279cbd08d2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637740, "uuid": "8e4ee0d3-c13e-4ad4-b43f-487f3e484d03", "comment": "Malware payload (Mirai)", "value": "dd512e9182505b66f4669fa7362cf086ecf6b962", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772637740, "uuid": "16858c81-b28a-4cb4-aadc-644ade2f0af1", "comment": "Malware payload (Mirai)", "value": "a4a61c61090df36013fda327c4289a20d557dd56a93e45d42cbb7ce152729487db3470bfaae822a130c05178c745b26d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637740, "uuid": "a881a1be-853b-415d-81cc-d730e95ebc7d", "value": "T1F3837CC5F643D5F0E8570570203BFB371A32E2B9002ADA47D369EA73FC52612AA5679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637740, "uuid": "c3d484dd-b74f-4399-8132-d69d8e383cf5", "value": "1536:HQ0PJPGt9q+S6EQ8CXHK9ZyVV1SheEV7GT3P+D8xXXohxj1SJXp:lPJPG2zjQ8CXq94LwheEpGT3WDMn64p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772637740, "uuid": "21d267c8-72c3-4436-b82c-dfdd11e5e3a2", "value": 83280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772637740, "uuid": "6fc90bdd-6439-40f3-9210-e0a56a362e95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772637740, "uuid": "19ec0cb2-3765-436a-95a1-62e47b98d1e5", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f04998-17c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772627925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627925, "uuid": "fedf5c42-9350-4327-aa4b-1eb2430914e7", "comment": "Malware payload", "value": "09dec2051d4cf8e95731f9fe4df8aa97", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627925, "uuid": "f6fe5f46-69c7-44bc-a088-95ef95dcab7a", "comment": "Malware payload", "value": "fea41cb849d7c4b1a0cbb349e7b83cd9db8ac6eeeba56287e6cde720cf82c402", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627925, "uuid": "416aa250-2d8e-47f5-bf9b-20ed192b8d15", "comment": "Malware payload", "value": "5bbe60808aecacb0fe69de067e87162adec04151", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627925, "uuid": "3a495ca2-1278-4bb9-a739-e22c729174ca", "comment": "Malware payload", "value": "a10062a5bcc4f752792b5d20fb986eef1a68a4889eb121accf24b4b12fac330dc49447596dc276245ac7275720ff1ee1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627925, "uuid": "0d122a60-5e9f-4fd7-ad25-8a1972fc1d9a", "value": "T172C533B7C3261404CF513F346813A557A379883EFA750A3B353FA4A68D972D297E3262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627925, "uuid": "63540e2a-bcbe-4a6a-a260-629c5064c752", "value": "49152:AUA/rwKY8xNMIxZAHirg5IjJY/gyHhLSyf0ORhDqzGl2JP:AUGrjeKZAHiruIjJVyHhLSLOvub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627925, "uuid": "218b0c03-55b4-4404-82de-e0b0efc5d30c", "value": 2564963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627925, "uuid": "f1119a6c-74e2-42d5-8d0b-2132d884e05d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627925, "uuid": "3732aa99-d918-4de9-a187-f9446f434d3a", "value": "2023_project.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1a7969-17c4-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772627026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627026, "uuid": "3344c32d-36a9-4925-ba93-c62b7b507c6c", "comment": "Malware payload (QuasarRAT)", "value": "f011482eb55e1c6927426dbc95d3fdd7", "object_relation": "md5", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627026, "uuid": "5185b9a1-517a-4a1c-b9e9-f2ba3cdee636", "comment": "Malware payload (QuasarRAT)", "value": "ff4dbb67ca25bc5e18bc25bfd9ccfeb56caf1eb625e5db797e9d489456de7777", "object_relation": "sha256", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627026, "uuid": "2bde9896-b07d-4d76-b0aa-5e1eb1db2204", "comment": "Malware payload (QuasarRAT)", "value": "933f5124ae59b10920b8db28a436412be8256445", "object_relation": "sha1", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772627026, "uuid": "a6358865-a072-47bb-bd0e-9ff7ab8c388e", "comment": "Malware payload (QuasarRAT)", "value": "a6293c093df32e0b6b4066bf2f3b805cdc117a3b0e3b51a47f234a5bc7b0d3edc2411645766f396c49841c85361ff794", "object_relation": "sha3-384", "Tag": [ { "name": "91-124-98-29", "colour": "#F6DAAF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--evilgrou-tech", "colour": "#3E0AF0", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627026, "uuid": "c0b09633-ac4e-4871-ae64-ff0c3358842c", "value": "T1FAF0C0325E19191C0911C05BEA1A9D6CFCBB10EDF22946F332F44C5CC09756D473B59C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627026, "uuid": "3bf79a8a-4835-4f35-985c-4db422155cd1", "value": "12:/A2Nv3YyCr98okG3MMGJfQH5Drn2qYKEpannaomYydX6A1y:/A29TCnR3MMGKH5Dj2xK0In3mvdqAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772627026, "uuid": "d9b29f44-36f2-4976-8c03-dab22fdf1ff1", "value": 538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772627026, "uuid": "e58e078a-1272-4f8a-91d6-742113ab9d08", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772627026, "uuid": "e69f6f9c-914f-42e3-8ac9-e24d84320784", "value": "launcher.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0633e5-178c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772602761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602761, "uuid": "0058465b-1296-49b1-a8fc-30d665968ec4", "comment": "Malware payload (Mirai)", "value": "1b32c8699ee2b828eccea67fea5e8baf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602761, "uuid": "d110dc54-8509-4d9c-8383-5d55ed53cd47", "comment": "Malware payload (Mirai)", "value": "ffc33a5918e23b96f28353cb5f5b84a5906c39d7fa5843d8d867360738109652", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602761, "uuid": "826dc403-f414-4e79-8bcf-155bf8f259b5", "comment": "Malware payload (Mirai)", "value": "2aa8cb3d9a1ca9d396220997b5e98d227e7ae077", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772602761, "uuid": "79fbef10-42a1-4c65-a320-e72c03ad9c30", "comment": "Malware payload (Mirai)", "value": "3f380cf2819503eb8b0911f4efc69014af598e8f71d374a83ef0987a4cdbcbe56144256253ee49b8be1eb672b257abc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602761, "uuid": "dee7419f-6781-4245-8c42-ff587ef0bde0", "value": "T18F53AE77C8396E64D25581B0B8748E792B53F88482571FFE1A99C27A8047EECF6483F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602761, "uuid": "6a6e197a-46cd-41f8-a423-03420b686268", "value": "1536:caCwtuAPFqcgdEcVeKU3AwHup+CSXHld5Zo:c58PMcgakRUHup+5FPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772602761, "uuid": "b65608b7-7ce7-447b-ad1b-86aa6e164000", "value": 62948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772602761, "uuid": "f3680e93-7dda-4fe0-9d9a-b710d6f3e0c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772602761, "uuid": "78f59d32-9506-45ee-8ab9-69766ead059a", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }