{ "Event": { "published": true, "date": "2026-02-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-11", "timestamp": 1770854582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8f26c42f-0a5b-43f5-9003-9e88352f64af", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be91a4a-077a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770835860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835860, "uuid": "976e796b-69bd-44ca-b434-c536d6fd9fdd", "comment": "Malware payload", "value": "234280b57992bb4a292c9f54dca3f336", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835860, "uuid": "d88c1bc1-a21d-4840-8498-9cb9fc4ee3d2", "comment": "Malware payload", "value": "0136d3c1f79f765bae98b7cd787e8dc3a86432e58c94da9851e4e142eced50cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835860, "uuid": "d9227d49-32b3-4b3d-a1e3-642ad5e75e40", "comment": "Malware payload", "value": "0e27c5a518efb4395e8a12c6d3b58a4b424d7438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835860, "uuid": "6274e4d7-723c-4e1d-a5aa-4bd6bdee4b23", "comment": "Malware payload", "value": "1b02927eed70910ef59a536b4e05a27740190e1275e5bbe527b18db8cd42e0b3649fdd41c46ce0ba9e5eeffe66995866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835860, "uuid": "5a131aa1-3fe5-4fb0-b7a2-683ede410259", "value": "T145F54D26BCA654BEE6BEF13490B05152B271749403313BD30AE9757A1E67BD82B3E34C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835860, "uuid": "e86c7cb7-fae4-44c1-953b-603f6dbd783e", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835860, "uuid": "facac0d9-fa02-4126-a5f9-02267c6f4055", "value": "49152:s/AdQ3qJ8KuiG2kE90XmHWSl4w/w/4a29rtubVW2TkfMOhfiTVLESfjIXm1pL9CD:cAm3EuDL9lBUb9WdU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770835860, "uuid": "9a681b4f-7edd-4065-9e40-5760117d36aa", "value": 3338240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770835860, "uuid": "4a4a0ab4-a075-4534-a7d4-aca987aa80b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835860, "uuid": "dd105576-8a9b-4b66-bac7-66f63239e056", "value": "S\u0435t_u\u0440 [U\u0420D].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d4f26b-074a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770815122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815122, "uuid": "f933c101-a698-4d0f-aff2-111d6342646b", "comment": "Malware payload (Mirai)", "value": "dd96301c5818a2d13874982f97baff0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815122, "uuid": "f1c2f87f-42b7-458d-9177-844f378e0cfb", "comment": "Malware payload (Mirai)", "value": "04cf120f680f21598b53a2e87b6b1aca562e3fe19a9ee6a122d8cdd48ab49074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815122, "uuid": "e415fa23-bfba-4dfa-8f23-cbcbf71a6568", "comment": "Malware payload (Mirai)", "value": "fd0aff2dc7b36acecb465c4c8edbeab535b4941f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815122, "uuid": "9f64325f-115a-4bb8-80a0-798fc888860c", "comment": "Malware payload (Mirai)", "value": "b2446d86c8b2b8cb22e726589853c84022b740c70b86a5bab7c29fc587e9419272b2231488a25de2b78e2f15f1a8201e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815122, "uuid": "8238fb97-2e55-4751-9d76-507efbf4ca3f", "value": "T120E2E1AE416EFFB5D9B3D230164B02C4FFABA8E76947873A05D831B488FB8406520F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815122, "uuid": "a06931ed-9a13-465b-85ea-2a1a196b929d", "value": "384:jlJVeJ6mSngQtNPdz0xOT37SGDbvbyZgNIZalF29o4XrKsTyaREj20VGlRnUxaVb:YBWgQpT5DbvbuHZal4nbKmRa204lRb8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770815122, "uuid": "0436a02c-db94-476f-ac6c-cc55064b2665", "value": 31556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770815122, "uuid": "eaf2134d-fd72-4aec-a577-a44593d73fbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815122, "uuid": "97e78fa4-7a3d-4aae-90a2-dc4480dbe4b5", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fd0c20-06e3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770770996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770996, "uuid": "1f4ca0a0-2646-43ff-9316-f0e5045bb1a1", "comment": "Malware payload (Mirai)", "value": "844b4c98def7295291175da0456b9e28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770996, "uuid": "2ffefe5e-c680-4f34-9b41-9e1fd9e75a72", "comment": "Malware payload (Mirai)", "value": "04daaadf7de6d63ee6ffee68dd9d64d20945f8ab0d89c4db9563f1f20c32e6e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770996, "uuid": "497ece76-ec70-4bba-9501-27a19edb28fd", "comment": "Malware payload (Mirai)", "value": "08259810d5f5d53481956580efcd260d2ef032e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770996, "uuid": "de2d76c5-42e8-46ad-af2d-e1afebcd21ca", "comment": "Malware payload (Mirai)", "value": "c97920725133566c966738ea644db78106a23eeb5989ceba97b18bd53e773617608729d2a561839d0a43e4093c61cdf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770996, "uuid": "2363d87d-1b19-45f9-a46d-a04e515bfce3", "value": "T140A3A54E6E219FBCFBA9833447B35B21975C33D526E1C684E19CE6011E7074E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770996, "uuid": "36075fcb-8b47-4a44-8ec6-829fc0ddf22c", "value": "1536:jzfNyrySWfab+luyAfeL3EL3l1L3Zj2k+99O4eiMipx4kbzcmoQeDp/uRVX:v1yrbWSbNyAGreiMiH4kbgmo1/il", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770770996, "uuid": "24bb95ca-b971-4c7f-b438-2f990e4d4291", "value": 100956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770770996, "uuid": "52f9ce87-4da4-478f-ae28-8a274bcdaeb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770996, "uuid": "419cffc5-203b-433d-8537-3a337161de44", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91691e4e-0749-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770814797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814797, "uuid": "ff2477db-776f-4abc-9240-ac7252706efa", "comment": "Malware payload (Vidar)", "value": "0823a4e007d6e5d129db61017d8287c6", "object_relation": "md5", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814797, "uuid": "a750b15d-4827-441c-b875-3db7adc91f18", "comment": "Malware payload (Vidar)", "value": "05bd72b5958eccfabf5ac94c6064d7b1cdb2061a17c4c9219ada1214680c7114", "object_relation": "sha256", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814797, "uuid": "f9024503-d670-4e80-9c03-e50b2775505a", "comment": "Malware payload (Vidar)", "value": "4cbcb98bbecbeaf11fd28190fb52189c36c34064", "object_relation": "sha1", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814797, "uuid": "27cc4dce-ffd6-4106-9b1d-32c7112d2a23", "comment": "Malware payload (Vidar)", "value": "3bf55e7ff2caa48f12e71bfbd953b95fe00af4fb94698ec50269df9295a03dd6ef45f3033ff111354e70f8699c65aaa6", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814797, "uuid": "3f920fc2-5b51-4b5d-9794-fd5610620db7", "value": "T1F50833D1846161A3EABEA03E253F42A21F1B48DD63CDA35266F1539822487DD6F3D37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814797, "uuid": "b4b7fa7d-e530-4c1e-8583-2d7085e77979", "value": "1572864:UGxF3jvKz2Vsbl+bVZ0FM1YEndx/J0NlRWGlXwM3vO4mGq9d86kJ0ZD3HjMKFU8:VxfVsb4bVyFMmc/CllP3JmGq8bkHMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770814797, "uuid": "c977a68d-acda-4078-aa6d-1d6a6e278a57", "value": 83038554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770814797, "uuid": "a67341e2-5a4a-44bd-a779-81e0d94f1b13", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814797, "uuid": "e67d01fc-c342-4c4e-aace-6014c72a26f3", "value": "up_boot_xw.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93cb28c6-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816519, "uuid": "548ff636-7e5c-447d-bc17-ca93e7b21d2a", "comment": "Malware payload (Mirai)", "value": "6de7dd900aee957ae55892d0cfd8f1ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816519, "uuid": "cc3ccccf-3a5b-4ca5-baea-6b2873150fe5", "comment": "Malware payload (Mirai)", "value": "067e00491266c33678339206beb5e5654ebb45e20a9629c6e8bcd45454b06043", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816519, "uuid": "dd7b86e7-966c-4b83-90f2-49dc2d6b1bc9", "comment": "Malware payload (Mirai)", "value": "8b62e7243c32d144c55a6b73b9c83e73b662f890", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816519, "uuid": "71426148-6678-4ec3-beee-82d22286e465", "comment": "Malware payload (Mirai)", "value": "6f999dc6ad15f58bd0b0a9f1bcf5c64d0a80a49b74c733946f098c92846861ee2039d1be98e820baa2b1af6aa0d968c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816519, "uuid": "5abc6c94-411a-4b1d-a1c8-4659d29ff080", "value": "T169F2E0CCC97C2DCCDC3D3D79C2D627188ED89181626D6F8E6714AC0AEA2611FB0CD866", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816519, "uuid": "560d0f56-7200-4b53-b6bc-13055f3f9ace", "value": "768:ONGfTREb7H/I4uLyBchuH/v36vlD0cG6/eaiaheuYWMP:LTRUHQFGc8fv3WD08Rdheus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816519, "uuid": "df01318c-a51d-4745-9d8e-b4b7c4e27ab0", "value": 36296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816519, "uuid": "c7b4ffe3-19f1-4da6-9bef-7902251e2423", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816519, "uuid": "3cf79387-326c-411b-adbd-3e749449d41b", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d00b2e5-075c-11f1-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1770822950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822950, "uuid": "1da84db1-640e-4119-a58b-61b6580ecf0b", "comment": "Malware payload (GenesisStealer)", "value": "e42396e8a7119838acf0819442ef960a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822950, "uuid": "d8868ed0-4ebb-483a-b3bb-ad415986e707", "comment": "Malware payload (GenesisStealer)", "value": "068dce8acf9157ba95ad04932f1f5bdebc3660d25ff0f002bf0ccfe6294a7ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822950, "uuid": "0f3f6817-5113-446e-aca8-d5051308e563", "comment": "Malware payload (GenesisStealer)", "value": "154a8690add615c6562818fba4eb63270c566f86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822950, "uuid": "9a72cf3d-0538-496a-80f2-381bbc317009", "comment": "Malware payload (GenesisStealer)", "value": "90000f206fb2aa3b1c410c01e28b192536e64702ddfc5377580c4fdf2485e5acb731736627fda47aa84d220b0404e493", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770822950, "uuid": "349f7ec3-2743-4ede-8ef0-8ab9b9b99572", "value": "T10D18337B6FABD41FC01931BB4AF936B115A265532E25E03F6266C0F9A4BCE32D530187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770822950, "uuid": "bbdf929a-566a-474f-96ac-762fda4eb6ef", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770822950, "uuid": "bcdbc3de-f7be-4320-acfe-29bf79e505f3", "value": "1572864:mW+BWMFDe45kJ6v/Q6hDRVOLJyD1KWHsPKhwC8coHhdXmaXALwpD/K7Fc:m3BFle45mWjhDRVzBKQ5wvS4pUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770822950, "uuid": "b8eba62c-6650-4b31-8c24-9958a32904b1", "value": 88029780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770822950, "uuid": "e862d711-51e4-4482-906a-a07cb28fc172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770822950, "uuid": "2beb0d81-e752-4ac9-b70c-d9a40f938662", "value": "Stellar_installer Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7643b4-0795-11f1-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1770847458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847458, "uuid": "0b1f434a-7f25-4bb5-abf2-e41c1f0e5590", "comment": "Malware payload (AmosStealer)", "value": "bf0cdddd435409bda71ee8272a7dfac6", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847458, "uuid": "dd986614-f0fe-4afa-8391-6821e63ebdcc", "comment": "Malware payload (AmosStealer)", "value": "07f54b728016549d0931d6b8ea0ed43b856f1273c1d768e65b972968998e9f50", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847458, "uuid": "88149ce9-2b76-4f02-be43-9166e8d44b41", "comment": "Malware payload (AmosStealer)", "value": "a66caa8035ab2d4566f081c45c2544df829706f4", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847458, "uuid": "762dd5af-3038-44ad-9369-b96e51ecd2f2", "comment": "Malware payload (AmosStealer)", "value": "f7d6061fcc6a629f2f6e939b029297f338963241647195dbd6cf394c7d0bb652ce1295fc7909af6391fa49fad35ac2c3", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847458, "uuid": "bb213984-dd93-4c6b-baed-75bbe2c01deb", "value": "T16CB419E7623855F2D98EFB7CF44F2227F971BD4019B8A5D05D820E114ED9370AA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847458, "uuid": "790b8289-f596-4dc9-b66b-38ee5464ec51", "value": "12288:D0l+NcArlEE9ncvJJQqlsgcXv8pBprQMxJVXWlnnnHuuu21uKb+AfI0m:D0qEk8pBtkfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847458, "uuid": "308e88f1-a430-4bcb-a7ff-6242696b27ef", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847458, "uuid": "1283bb3d-2186-4649-a8f1-19876d7a29e4", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847458, "uuid": "25129385-079f-431d-9a74-61ecda206723", "value": "07f54b728016549d0931d6b8ea0ed43b856f1273c1d768e65b972968998e9f50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c9cdaf-0777-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770834610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834610, "uuid": "037954f6-89a7-4092-ada2-ab2098e00f43", "comment": "Malware payload (AgentTesla)", "value": "8c9eb1aaccde7cc1a03f7d7d011cadf3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834610, "uuid": "b53a2c04-0e91-4f8f-bdf4-460c9057fa41", "comment": "Malware payload (AgentTesla)", "value": "0821ab66a63ff2fe4d38a825b7ff3c3104a89eeb88df640d3a705b95b634bf53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834610, "uuid": "3e24acce-55b1-4a43-9bbf-5e998392277c", "comment": "Malware payload (AgentTesla)", "value": "6411c03875e940e2b5dc6228f244a7bc74bb63ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834610, "uuid": "c0f58fe4-1ab8-42da-83d3-a90e51c2d663", "comment": "Malware payload (AgentTesla)", "value": "4ca769714e04894a839bbe75c0403bd9949e6e5a8f888b1393aef0af6a0e87bf59437d93c93f957180da6a493dee2ba9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834610, "uuid": "18bc3960-bcd6-458a-88ee-a1a4a2f7924d", "value": "T1C8552310224DEF02E86917F94272E379A3F55E8D5022E3168EFF5DEB759A7588C0831B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834610, "uuid": "51831870-25be-4cb8-b80a-414a074d994f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834610, "uuid": "1c9775cf-28b5-41db-9786-1422347a96d5", "value": "24576:+guQlVict3wHj5Xeeh15vvAU+OHeZSsBryYnu0iwOdb/7v7:3uWQcyXeehvnAhOHeZSmjubXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770834610, "uuid": "e920dca8-7f29-4b6d-843c-905bee1c2c41", "value": 1290752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770834610, "uuid": "89c5a9d4-fbe2-48dd-af78-b90c621b993f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834610, "uuid": "2665ecd6-f3b8-4171-bbe6-d6b5dea3a8e7", "value": "rSolicita____odePropostas_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b2fbf9-0744-11f1-a129-42010a9c0007", "comment": "Malware payload (UmbralStealer)", "timestamp": 1770812434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812434, "uuid": "ef7c35d5-88ae-47ad-b94f-d01f6e2bac3c", "comment": "Malware payload (UmbralStealer)", "value": "81548b6321ca950f015134ead1c5a7d8", "object_relation": "md5", "Tag": [ { "name": "pw-zensware", "colour": "#2C9B07", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812434, "uuid": "d2ccd1ae-61e2-482e-b252-003258b39147", "comment": "Malware payload (UmbralStealer)", "value": "082e737a6d49656a6bf49bee18d7d1641fe2d373cf50bf45669301966df1a5e9", "object_relation": "sha256", "Tag": [ { "name": "pw-zensware", "colour": "#2C9B07", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812434, "uuid": "080e957d-b1de-4706-818a-ee7aa8ac2993", "comment": "Malware payload (UmbralStealer)", "value": "a75343a30bb9319b62552ea8eb5e3e244084063d", "object_relation": "sha1", "Tag": [ { "name": "pw-zensware", "colour": "#2C9B07", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812434, "uuid": "ec1c4f90-c8f7-4b82-ac9b-2987e25ccc62", "comment": "Malware payload (UmbralStealer)", "value": "f323f0df890cdbb2fab8f2b4f6e86baddababf6e41ad9cf930e7b64eb6715f48267515380aa5752de8b2f55a2e6256e3", "object_relation": "sha3-384", "Tag": [ { "name": "pw-zensware", "colour": "#2C9B07", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812434, "uuid": "d6c83d77-0b0f-4cfb-ad30-5587c18a16e1", "value": "T1AB8312CFA3161152E457AE94DE620DC3F6BAE93DD0E8A9FE46FED0015A712E15C049CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812434, "uuid": "5a9473ed-536d-4aa7-abf8-5a4035513a37", "value": "1536:hWgxXlZxzXpyd+QrAVNoc+uyIul+AGHAf0a5hDGPXvzyJk/xa/UfSxEyahhM:h/XlXzXU+PVNocnypERa5h6vGJkbjhhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812434, "uuid": "020aba92-258f-4f18-bf77-ab92201ad01d", "value": 88743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812434, "uuid": "45199fd1-7117-4f79-83ea-22329d6956c5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812434, "uuid": "8509e824-76be-46f7-9d77-c86152dc8498", "value": "Zensware V1.2.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e661d07-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788110, "uuid": "d8ceea60-f4eb-4215-97b5-540c4b8f3aa2", "comment": "Malware payload (Mirai)", "value": "9789075b20cc81f66d1aca243bd2ba37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788110, "uuid": "90642701-4813-439c-90f4-8c2cd275df04", "comment": "Malware payload (Mirai)", "value": "094cb0bb8013c6ae41d88d878b163964d53ee9c98c366b21da3c5139e92c88d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788110, "uuid": "2ed792d1-3ec7-4391-8740-6c47fc31a665", "comment": "Malware payload (Mirai)", "value": "794e5c340e2e2c4bc535d47f21f4ad7025d03a0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788110, "uuid": "706114d7-271b-4171-b3dd-4a3373f77862", "comment": "Malware payload (Mirai)", "value": "5054ee73c874fecff18ca133a6c5e3e2f66b10ad3e78c6cbb257bd2ae571205297aaf39e9c2497e119af37f4bc50bce5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788110, "uuid": "297fe909-d2a5-4dea-9238-0ff903bb81a5", "value": "T1AB242A027B0D0F03D1432DF4267B0BE14B9BAD6138FAE681750AFEC957B1DB1654AA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788110, "uuid": "de38605e-5623-47bf-a852-76b98dab146a", "value": "3072:FPHhqVbmVjairxVqNWZsxthh9C51D8JrEhgXpj/snGKg:F2mJaUxJZsx/h9CbD81Ehcjag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788110, "uuid": "2fb7f917-e31d-4a3a-8137-a289c146c206", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788110, "uuid": "6a91aacc-ff06-4a69-b9dd-fec94db9e457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788110, "uuid": "c04651fc-dd2d-47a5-84a2-d1f7ff4c019c", "value": "bin.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5db7773-073e-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770810134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810134, "uuid": "febf21e8-e0e3-4a15-86e8-fa8953f87c65", "comment": "Malware payload (ConnectWise)", "value": "b3eef3eddbb6ae95367d212557ebd097", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810134, "uuid": "fb00f723-60cf-49a6-8c9f-9a5ea7ca67ba", "comment": "Malware payload (ConnectWise)", "value": "09caa8b26c9bd3cd001cdddcf74812c11aca525a4df8d63b4ad868024fd4bd8f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810134, "uuid": "df2e8cba-a440-41f7-a769-73c71f3ba4f3", "comment": "Malware payload (ConnectWise)", "value": "9d4ffc3f8b97bfb6fb8d175d8f3d9934034d4c9c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810134, "uuid": "b0a0600d-9ef8-4140-9eac-1e9aaff80f53", "comment": "Malware payload (ConnectWise)", "value": "8b52dc415cca79447ee7925ef268dcf01e1763868ef97a2d238fae54561f49f12f7ade71f35b0815dabfe02c46f07155", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770810134, "uuid": "3730b003-79d2-4c4a-855b-bd0cf5436f7a", "value": "T141F6230473F8A108F1B32B36ED3952F19C7A7C628D62D15E1658364E1AB0ED19AB3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770810134, "uuid": "c5808b45-c11b-4fec-84b7-aa50b829a86d", "value": "393216:pmkEdK03NldGmkEdLmkEdvmkEd9mkEdDmkEddmkEd:DEMcx6E7E/EhErEZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770810134, "uuid": "c9787020-4c86-46b9-9c39-12fc3c707612", "value": 15405056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770810134, "uuid": "a3f3172b-52eb-4cb3-8f7b-e492ee194965", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770810134, "uuid": "aafe4f8e-f042-4128-8a39-d027620577a9", "value": "LiveChat.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba2dfda-06df-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770769073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769073, "uuid": "4ce23bff-d16b-4019-9b15-ed8faafeebe9", "comment": "Malware payload (Mirai)", "value": "7df069214593f6f1a98bfa6d13b9b6a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769073, "uuid": "5dc69698-21e4-42ad-8514-d8b85ad2f506", "comment": "Malware payload (Mirai)", "value": "0a1d653f991e214523101bd5ff78b0721a4a539ee103c328aaf3e2c1e2a0ac4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769073, "uuid": "458d1ea1-a84a-4df8-bdd4-3705762ca424", "comment": "Malware payload (Mirai)", "value": "f2f08be84529fc2dcd1e8c14174db432e871b84c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769073, "uuid": "77213df5-8975-485d-b556-d4f20d28f254", "comment": "Malware payload (Mirai)", "value": "d278946d5d58054491d5d9ae2f2bec32beb3e12b431d54774c9cd8f1464239597d5bbc549466b006c65a7b0f89d34fac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769073, "uuid": "713e8119-20dc-4704-bd07-aedef5d87876", "value": "T144734A037B8084FDC499D1B4477B713AD43371BE1279B2AA2BC8FE262D49EA01F1D596", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769073, "uuid": "2f080eb8-6343-4793-9f25-63e648c6a416", "value": "1536:HvNR3cyrYxs1DtQ8zk6qxN2CdT+J77nJ+Yk3ND11L1FlaJ3NBL9EFd:lR3cbs1hQ/rSFnUYkF191FlarBLSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770769073, "uuid": "7c33d662-21de-4f19-b131-08c589f4834e", "value": 75712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770769073, "uuid": "b4096100-d3e9-4801-b843-4cad22fa42bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769073, "uuid": "2aa6c1f2-2a2c-4d00-b3a1-046ed58275ff", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f37a6df-076c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770829772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829772, "uuid": "ba4932fe-a03e-4833-ad6d-84a612beec97", "comment": "Malware payload", "value": "5619448d1ce456fdec9ba5103f730007", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829772, "uuid": "62232dd5-e468-4f8e-b515-501bdadb787e", "comment": "Malware payload", "value": "0a9c67652bf86bc155cf543b2afce513890c8a5bd43aca770f83e1612fcfcf56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829772, "uuid": "42ba3a94-d6e0-4342-84d4-75a698a2f274", "comment": "Malware payload", "value": "f6849fde08904dcb0144f218ca14ed8ec15394ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829772, "uuid": "71ec1bd6-4e38-4c7b-9f9c-ff901d736eb5", "comment": "Malware payload", "value": "701fc0dece96e69878c3afa30392d8fb893b9cf90fd2da7ae7fea335331d3da3ba38b3184321176306cdd010305c1fba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829772, "uuid": "6dba425d-ae58-4eed-9f62-0d4c35a3def8", "value": "T1AD35F931EE260B36C582E226FE57CC92EB6B72C755042BC0B99F604E20D745E817DADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829772, "uuid": "7a7b8312-4b6a-4aaa-967b-8bbbd9c30fde", "value": "6144:wN57TDt98qSowZwMJN5CN5bN5l02tTlzpFlmantjlPw7JlN26V:w7/t98qNMJCbtlzpFlmantjlPwNlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770829772, "uuid": "cc94f41c-dcc3-4586-a386-97fc49fa4a7c", "value": 1104207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770829772, "uuid": "63cea596-956e-4c4d-bb1f-9c7d4df0e0b0", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829772, "uuid": "a1894454-ae2d-4a51-8050-509c11dfb56d", "value": "0a9c67652bf86bc155cf543b2afce513890c8a5bd43aca770f83e1612fcfcf56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4ccd5b-0720-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770797314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797314, "uuid": "8cfdd39b-0590-4d02-b516-7d13fe340366", "comment": "Malware payload (PhantomStealer)", "value": "980eba9adc6c7cf930d60f5fc05d09c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797314, "uuid": "3d587815-d094-44f8-bce2-a490125e3cde", "comment": "Malware payload (PhantomStealer)", "value": "0ac8b9c2ef620938323a08f202ee0abab81df75aa8cf5726b2be528f80b62607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797314, "uuid": "aa6c2c7d-db56-4f9b-8f08-a3a971eba154", "comment": "Malware payload (PhantomStealer)", "value": "af5861890d89d2392b97b4e25b775feb03e858fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797314, "uuid": "cab79fd1-08db-4c4f-9610-7caf7126d703", "comment": "Malware payload (PhantomStealer)", "value": "70a5c366e2d840433f8576e8cfae8a8a390af30fd7e982530078b4ebb6fbfe76e5836036beef5172321a1c5427dabc6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797314, "uuid": "9d7cca65-f209-46f2-88f5-0f9a471c6e13", "value": "T1BB0512210B16944FE4934C71ACF1BB76E7A49E56336CC3C23680B9887D3A3568F693C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797314, "uuid": "4748cfa1-709a-4dd4-8bfa-b3b59b529126", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797314, "uuid": "77328aa8-54f4-4247-9ac1-ec870737c5d7", "value": "24576:JHO/MdQGPoRaK6FoGWdBz6kqd43jbz1HVkMIwSqLbBYNG0:JHO/uc3yjWdBGzKb0wSqp90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770797314, "uuid": "bb0dcc32-7716-41fa-af4d-39ff7627ac20", "value": 867296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770797314, "uuid": "ba63a660-4cdf-4826-ba82-3e9c03723d4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797314, "uuid": "13671abf-711b-4f99-a16d-1af49f598c7e", "value": "Bank Swift Payment Copy09_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d6bdad-06df-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770769436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769436, "uuid": "93612483-0ebe-4a77-833a-fcd166a7a6eb", "comment": "Malware payload (Mirai)", "value": "7cc9c71f1c39de22d3e978273189d309", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769436, "uuid": "54f937d2-5d7d-405f-a81e-14899ebb6c7a", "comment": "Malware payload (Mirai)", "value": "0bebc81246ae9d33e022fdd4d2264a521dbccb099cee4a0dc49d6b27cf440b34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769436, "uuid": "820857c3-d2e3-4ba1-8ef2-dc54330b31b4", "comment": "Malware payload (Mirai)", "value": "c6f2028b188b2b118e25eaec53e83abd6b47eef7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769436, "uuid": "12277551-a766-4c0f-8585-347a4e5f9fb5", "comment": "Malware payload (Mirai)", "value": "69757c299f72b887b4565dff61a6b2d0384c04e4867a62c7a39788c867d3c015198d4b821e578835c87de08e101db716", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769436, "uuid": "dd28a808-77db-4259-a666-c6e92483548f", "value": "T1A8732A84F98BC4F6D947483080A7F23FCB31E5794170C76DEF9AAE35DA77502A212299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769436, "uuid": "a7877b45-438b-410e-9f9e-8a4ab3a125cf", "value": "1536:2wBmufGsV9cr1kjyMGdJ7vpuzXIWc8m9eZs0kQLlkP:2wBjGsV9creOdJTEpNmcZszQZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770769436, "uuid": "cb759d39-143f-450b-ab05-1067f516d253", "value": 75216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770769436, "uuid": "fec4e10a-6f5d-40c9-b3b1-72cbd4f46855", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769436, "uuid": "0f808816-ca6d-4523-9d04-1101ae661aff", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11887b4-0758-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770821374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821374, "uuid": "6e81277a-717b-4df3-8c84-be24caa389ab", "comment": "Malware payload (Formbook)", "value": "7a023af69a900a8b99bf74b60d6689f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821374, "uuid": "fe9056db-9555-4786-abf4-e36b28f0000c", "comment": "Malware payload (Formbook)", "value": "0c82b648de097a84476eae0187e6ae187b4ec872a57cb2dd80aa2c5fdac05df3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821374, "uuid": "ab1aca87-64b9-4b1b-bcc2-00faab65e1c0", "comment": "Malware payload (Formbook)", "value": "5c8ba31c6fb309bdddae49bd00be52f3dec48b46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821374, "uuid": "87d6c64c-df0e-4214-8d20-017941b7dd3c", "comment": "Malware payload (Formbook)", "value": "6428450b5f3fc7df0171294b648c681296b7be42d341d68f7deac64fd4ce6c14b9cc4eeba1429f56694f501b479cf842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821374, "uuid": "29ee633b-705c-4c95-818d-60065b4c5e9b", "value": "T1A335124C7385BE55CE588B77D413220884F5D89FE572F3790AD52CF12FA9A89C48EA83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821374, "uuid": "bccf17e5-118a-4407-b38f-0cbc5b20bbe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821374, "uuid": "fca67887-24a8-4da9-98e4-9eb1af9e6481", "value": "24576:1ecDl2oRDrV4dyJGg3njZQX+1OI9ldPHU9cMiToV:XDAe14wJGOj8+1/9b0IU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770821374, "uuid": "4b3e1557-fafd-4425-abc9-a14e0b44d887", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770821374, "uuid": "886381b2-aa34-4970-975e-23014e98fb55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821374, "uuid": "7b624110-e62b-4b27-b361-f949d199a591", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e881536e-0795-11f1-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1770847585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847585, "uuid": "bed5c317-a27e-4966-850b-2efd713e4bc7", "comment": "Malware payload (AmosStealer)", "value": "0c76e33ddde228e9ce098edf3bf5f06a", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847585, "uuid": "d76724f9-1ccd-4d82-8ea1-b2b72d17051c", "comment": "Malware payload (AmosStealer)", "value": "0e52566ccff4830e30ef45d2ad804eefba4ffe42062919398bf1334aab74dd65", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847585, "uuid": "36d3576c-bad9-4048-a8cf-157374968d0a", "comment": "Malware payload (AmosStealer)", "value": "71f101a613cc57745d4a605d0ce6d3c1cd7a4229", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847585, "uuid": "f096cad2-c662-4646-bf05-a5afafbdea20", "comment": "Malware payload (AmosStealer)", "value": "9e5e695149f1c3245db474175bf5e36a326e93bdf9db0a89528377b2404d0e48f934e5dae2ff356a3392cf979eb23ae8", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847585, "uuid": "a1c527a7-79bb-4aa4-a5e7-95fcf3bd0a68", "value": "T117B409E3223859F2D98EF77CF00F2267F976BD4115B8A5D55E810E110ED9360EA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847585, "uuid": "64316ea4-bec7-4150-b076-0219755670a2", "value": "12288:j6TamwVU71+KFwT+Mbc3GmHPhBOGpLdhHEiU7777MMMroTZ6:j6TE8FpBOGpLLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847585, "uuid": "5a77fe90-0b23-47c2-9ff4-a4fa772d90fc", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847585, "uuid": "50b32a42-2419-423c-a811-044bf854d639", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847585, "uuid": "f4f2e045-2fe9-407c-95a3-1cf96edefb77", "value": "0e52566ccff4830e30ef45d2ad804eefba4ffe42062919398bf1334aab74dd65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77fe371-0758-11f1-a129-42010a9c0007", "comment": "Malware payload (XillenStealer)", "timestamp": 1770821411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821411, "uuid": "66c0b5bc-8311-4e55-ae54-95caf309d2ff", "comment": "Malware payload (XillenStealer)", "value": "c503d7e73e0ffa77fbfed9c7997b695d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821411, "uuid": "28beae9d-f599-4227-89fd-82d5dcc34b18", "comment": "Malware payload (XillenStealer)", "value": "0e5e342922cac7caf56c2934814bfbf99712b6342f7f07703712dd17da45fb6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821411, "uuid": "98c39609-2d03-43ee-b6ac-e955d491b840", "comment": "Malware payload (XillenStealer)", "value": "354209abaa08d16f4cf7c0f9a8c0b642d77880af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821411, "uuid": "dfbcf5dc-fbb8-4f8b-baa1-929a1ccf06f6", "comment": "Malware payload (XillenStealer)", "value": "a6c97f0bd7cb8a6daa3f45352dc73cd188bfa94d70a51bb0e6994b54aace6272b8206accc1303e781856f61692d2200a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821411, "uuid": "0c1206f7-8f27-4c12-bba0-6753fd5fb880", "value": "T173F34C03F6D644F9D467D1B4A69BA633B5B1F854533829AF0B90CA362D0DE30B22DF46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821411, "uuid": "0ed045a3-9dae-47d0-9304-c5062324910a", "value": "c411c22bbc58519d23851b4202b63f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821411, "uuid": "295e1551-fe54-4a18-b250-952493f2361c", "value": "3072:pbD/RiMuSDeKtlFF/Z4N/lnDTM4hbAGL3Kz:J/Ri1SDe8hm3k8bAGLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770821411, "uuid": "dffa60d0-c90b-4f64-b1fd-c718823ffc7f", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770821411, "uuid": "75bc1d28-b33e-499a-8999-1f2683ff11b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821411, "uuid": "dcc877a9-67df-48c1-b9b5-ed434a69c387", "value": "Payment confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8800812b-0720-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770797172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797172, "uuid": "ab5800e9-fec9-4323-940e-db7853e9afde", "comment": "Malware payload (SnakeKeylogger)", "value": "a5c1c1f3642f1166b19ce9ec6a25b3ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797172, "uuid": "6567afff-f40b-4b65-a373-9fb242ace6ca", "comment": "Malware payload (SnakeKeylogger)", "value": "105805695ed39400d28a06af3c31603941ed28c917b1e2601c0b6ee09cbf3037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797172, "uuid": "bc6d0e25-2815-405a-8f24-3de8c86b05bd", "comment": "Malware payload (SnakeKeylogger)", "value": "f5b9aa7eaf47371ed08ed6aee99bf2ca34d8d74c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797172, "uuid": "81970f47-bc19-48aa-88f7-0ef22d16112e", "comment": "Malware payload (SnakeKeylogger)", "value": "25648c136cbe38fb1cc40c00781149f2a40a91a9970fb18d0b73a9313fc0df10d4c0a7def3ce264ed1f63c00d5a788f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797172, "uuid": "1eb5f1d2-5b62-4522-be17-33e682872bd3", "value": "T16335124CB265B941C75E8BB7D513610483E3815FC672F35B0AD92CE02FAABE4C44EA97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797172, "uuid": "04081a60-56bb-4d49-96c1-163e470e8d7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797172, "uuid": "701f031b-e70c-4718-ac3d-7eb7226cfd35", "value": "24576:4jNNQO1Y4R1lfEGj22by1zSSsZZws+D59GE+uWIuIue+w3:47jY49E722sSEws+P5/uw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770797172, "uuid": "f2ae4310-edb0-4f11-ad5e-f1d519f954e2", "value": 1119752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770797172, "uuid": "e342f762-54b9-4f75-9dd0-9e639a911c9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797172, "uuid": "a7575a0e-a2e5-4fd5-aa9b-a0bdfdcc3dcd", "value": "ZEYNAP BAYAR FIYAT TEKLIFI 0067.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acacc5c6-075f-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770824292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824292, "uuid": "5d1e38c2-2651-4e2f-93f0-179d78e42a6a", "comment": "Malware payload (AsyncRAT)", "value": "b4c98bd53c87b3de2c6cb324e811e275", "object_relation": "md5", "Tag": [ { "name": "45-149-153-129", "colour": "#52A8B3", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824292, "uuid": "2db1f593-97fa-4426-a95d-41ca2a6e9298", "comment": "Malware payload (AsyncRAT)", "value": "1121801924fc4dc771878647702090a3f4caa624c8009cf725d3d5e3e385f07c", "object_relation": "sha256", "Tag": [ { "name": "45-149-153-129", "colour": "#52A8B3", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824292, "uuid": "9f364fc4-7277-4f9b-ad69-c05eb2076f30", "comment": "Malware payload (AsyncRAT)", "value": "c7fa769185700e5498772e1e407fb370ffbdcf42", "object_relation": "sha1", "Tag": [ { "name": "45-149-153-129", "colour": "#52A8B3", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824292, "uuid": "4aed71f3-1bdc-427b-b7f6-298382fe855f", "comment": "Malware payload (AsyncRAT)", "value": "2ef215ebf400f56ee517ca41f56e368a08e06dcf764ae945ae45f0e8d8fb75ab5d76898388ebb34d9bf7c75c1c224715", "object_relation": "sha3-384", "Tag": [ { "name": "45-149-153-129", "colour": "#52A8B3", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824292, "uuid": "171e7bfa-4cea-48c3-9a47-056da9447bba", "value": "T11DE22B4877E44712D6EEAFF12DF261061271D517E813EF9E0CE485A62B67AC047407E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824292, "uuid": "b8ce6cb8-92a5-40e8-b1df-f9ce2c46e913", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824292, "uuid": "a61190c8-93a2-493b-b694-e8541d321a54", "value": "768:+RPD9OQhx/BV3Tw49FzVFE9j3jOjh9bK:+d9OW/V3U49HFE9jTOjvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770824292, "uuid": "4f0977e8-f215-4c8d-b3fa-1d21468f31cf", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770824292, "uuid": "39294968-af9e-4248-a538-d8717782f96b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824292, "uuid": "94b1cf74-b023-4a84-9d33-07e7bc5bf674", "value": "chk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96397686-06e5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770771856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770771856, "uuid": "823a6eb2-098e-4389-b117-7351ca47abf0", "comment": "Malware payload (Mirai)", "value": "900c01a17ad134bd9ca48864618e97a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770771856, "uuid": "bdeb2f7a-70ca-4a8e-a6e1-1438e858c036", "comment": "Malware payload (Mirai)", "value": "1295dcbefbb2821cf61def07d6abd383fff1a98fd48c32b3219f754df1a373da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770771856, "uuid": "29237a48-0b15-4021-899c-82dfeb450738", "comment": "Malware payload (Mirai)", "value": "cab8cf169846af96bb9f0396c07ddafbbb039958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770771856, "uuid": "67fcb6b9-2ed4-4cd0-874a-00b599af703d", "comment": "Malware payload (Mirai)", "value": "638292bd4de0abed285d6fede9c16fdd27ffa8ed72d34ef768177cb8745783f1bb7d93cc19e6e99893a83aa040e030ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770771856, "uuid": "4b2cf162-baa7-45c2-b7f2-8ad06ab682f6", "value": "T1D0F34B17F4D180FDC496C1744B9FB63BDD32B1AD0238B29B67C4AB222E49E205E1DE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770771856, "uuid": "3623d03a-c545-49d6-9199-a33c73599039", "value": "3072:q0E0ROzq+VcH3J48kA2O4RvyZF7bPoK3g+wpuY7HOtdYh8Px:q0EAOzq+VcH3J488vUnZm5TOPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770771856, "uuid": "1f83e9d6-bd32-4877-a3fd-602beff204b8", "value": 161272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770771856, "uuid": "c7d3445c-ea00-4887-8277-23e2b4c42910", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770771856, "uuid": "c3a53ccd-62e0-4059-85bb-e9ecba3dfbd3", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c768b4ee-075a-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770822189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822189, "uuid": "287a9b80-2203-42e5-ac46-25aa5e361bb0", "comment": "Malware payload (Vidar)", "value": "c0202c82dec225d1f504a0db21be81ae", "object_relation": "md5", "Tag": [ { "name": "pw-lunex", "colour": "#16A322", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822189, "uuid": "f047ca6f-4444-4d9e-91d1-7fbd258e1415", "comment": "Malware payload (Vidar)", "value": "13a2dbe12e09bbd1a49d10d701b9b298c6bb905617e3ad2444c1658028e3dd6f", "object_relation": "sha256", "Tag": [ { "name": "pw-lunex", "colour": "#16A322", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822189, "uuid": "7b35ae7e-a8bf-486e-9543-ccbd34c6c283", "comment": "Malware payload (Vidar)", "value": "4dadb2a3840ae12fa027b93d7cec58e7b870b047", "object_relation": "sha1", "Tag": [ { "name": "pw-lunex", "colour": "#16A322", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822189, "uuid": "5b23d25c-474f-4e20-8171-ebc7971f3976", "comment": "Malware payload (Vidar)", "value": "d2f95b6c31f28742e8ab0fe9efda029f9f3348dfbd5d7a615544be2699ab31e4726379b065d245612f4a734bc30a7156", "object_relation": "sha3-384", "Tag": [ { "name": "pw-lunex", "colour": "#16A322", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770822189, "uuid": "657f9420-be15-48e7-b0eb-6d666814f752", "value": "T18518330A27DAFD1AE4AB787206DF5C84CBE222644BFE9E4F9F6227550AC1BDC450D341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770822189, "uuid": "add6a0b0-aea7-46e5-a1ec-e71d1b6a0580", "value": "1572864:4JcjXGxm12cYMi5IElbqyTR4VoN9ihy7m8zSZfFFgWf5XMxb6CbiHTGVcnHPGdPQ:4Jcjn12Dn5IElbrzDT7mZfFVf9MbN/VG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770822189, "uuid": "c0d5217d-e73a-448e-9b5f-729bfa1f3634", "value": 88685316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770822189, "uuid": "a72c9520-2684-4826-b6ba-e5f1827e2852", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770822189, "uuid": "acf00d18-780b-46c5-afbf-9f34511a5356", "value": "LunX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974c5407-06e2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770770569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770569, "uuid": "bd8aaf84-656e-4b9a-a8a8-c554cc809c2e", "comment": "Malware payload", "value": "4c95d90e91f8648168ad2b8a0582042e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770569, "uuid": "ce0331a1-5b21-4411-a641-e9a76519a5fb", "comment": "Malware payload", "value": "13cf91bd40581b679efc85d109b1017772c5738bf8e342f54b31bd3466376a01", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770569, "uuid": "17f13e80-8aef-495e-a6d6-d8bdae2ce8a6", "comment": "Malware payload", "value": "f82ccac5bb56095253651171ad45dfea084bc3b9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770569, "uuid": "7c4af967-1ce4-4ad0-9848-8bbb25954f93", "comment": "Malware payload", "value": "77a8f73580710ffffa54bdbc4b5f8bebdb49d1255febdb1396e4a262dacfb8bdaa59dd4f469e3b34acc6ea4dffb94400", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770569, "uuid": "b309dd2b-0406-44d7-bfde-6e1c39460f64", "value": "T1BEF24B61F443C3B6F8C620FD83EAEEFB65940509176459E7EDD034E368222C7783AA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770569, "uuid": "844d232e-8d1d-4e6b-b38f-eda2cb81bb91", "value": "768:fkGIvSb2hvM4ZDoh/b95xflrcdOkn3etn2:fL/4ZcpbxflOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770770569, "uuid": "0075c027-1ac4-432a-8a80-b6abb27dddc1", "value": 35931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770770569, "uuid": "8abb4d88-9658-4d81-ae2b-2b6a7ca0f009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770569, "uuid": "91d670dc-c661-43a4-9d2a-74df090eab13", "value": "SecuriteInfo.com.Trojan.PWS.Amadey.851.7347.1720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f9f294-06e1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770770220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770220, "uuid": "76948ffc-2332-4f4a-83f6-91082d2a1d45", "comment": "Malware payload (Mirai)", "value": "f3f8353bc6d3a18c35f55c62e1d5b62a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770220, "uuid": "ca3bac65-ff6e-420c-927a-0c452c00383c", "comment": "Malware payload (Mirai)", "value": "13d825768357d9fdb976671ba57b81db981ee00a113c6699f6ff7d047573c91a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770220, "uuid": "39e5f4bf-48db-4337-aa95-beddf36723ff", "comment": "Malware payload (Mirai)", "value": "2e8c00f95bbac7c1053a9f973dc7cbe7c78df516", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770220, "uuid": "28a84406-7435-44ce-8d9e-fd52715319d4", "comment": "Malware payload (Mirai)", "value": "177633959d60c0a9027970779e9ebef8a952921edbc13c357eaa9fd8e32df0dce18dad52938615cf4fc27fb2e6b36df7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770220, "uuid": "acbad331-ece1-4fe8-9e87-5b6df09df0be", "value": "T183B31A89BC819B11D5D535BAFF0E518D33139BB8E3FA7113CE245B2A538A85B0B3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770220, "uuid": "bc197792-d52d-406a-97f3-9f4161df7e3b", "value": "3072:vZ6htwYDyvoKE4efjReQuYejOwAet5WnrbftsgF1N//VkAttB+X:nvRWRejYejcftsgF1B/Vkut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770770220, "uuid": "7293c06f-8f2e-47d9-a572-c0f294d58acf", "value": 117576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770770220, "uuid": "8197e2ce-1364-4119-8cb2-9ed35f58bf92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770220, "uuid": "6c653ddb-5603-4866-97b1-876521da4de0", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a360a64d-0777-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770834584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834584, "uuid": "7cbaa2bc-b9ed-4134-8713-45c065b3cf1e", "comment": "Malware payload (Mirai)", "value": "8c23c4b38fa1ed11af98f8d43b0e3ca3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834584, "uuid": "a3c23f32-e688-4d73-92e2-2cb7bf82f7e9", "comment": "Malware payload (Mirai)", "value": "143ba3399057705aec7cf3d3464b283ddce7a417a69a8c1ae1732d1b7f94ff3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834584, "uuid": "770233f1-7ebb-4cee-af24-da743e2bdabc", "comment": "Malware payload (Mirai)", "value": "bb4243a7f947eebc59c40f0d6fd320eeb3cf75b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834584, "uuid": "4d53780f-6014-496e-b627-9a130d07ad8e", "comment": "Malware payload (Mirai)", "value": "af923e7fd9b0437f94c291b08dc9a058c728e54c910f38331f9752ec93e4d8384d1fe2e58fb8241d62c6b86da76e400e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834584, "uuid": "e8a491a9-6810-4dc4-9b13-400ded5fbe2e", "value": "T1B2E2E17D99B62AD2C9DC4C7DD08B39529A0527C43E0F878E43218DC0EE5905BB6C752D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834584, "uuid": "0b04e0ad-fa9b-4771-82ca-fee4e0383614", "value": "384:beML9HdLy3BrOWyJlJRnIbhN1+JAxyfox7q/Xok4cQkRHzMKw0aXXR0q4RWGVCzp:j5dyRGJlJRwKAxyfox7qARuMKSMWWBQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770834584, "uuid": "61f2e312-23fe-43e8-81b4-3744e9e3eed8", "value": 32844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770834584, "uuid": "5f9a6659-4fc0-412b-b18e-79f807a2c2dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834584, "uuid": "2b2e9e40-3fd8-4640-bc67-e6d6e7e2be53", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8900a52d-071c-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770795456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795456, "uuid": "664fa1d9-037d-4276-a3de-a6ff1f1fbc5e", "comment": "Malware payload (NetSupport)", "value": "cb97cb7500c57bd7e711a16ec0f4612a", "object_relation": "md5", "Tag": [ { "name": "channelmanagerpms-com", "colour": "#4FE2AD", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hotelservicemonitor-com", "colour": "#77FE38", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795456, "uuid": "b5a2fa2b-f59f-4cf8-be43-873e8029e26c", "comment": "Malware payload (NetSupport)", "value": "1519912787556481c7307112701030bc850e1d53cdf8a0e1fee0934ef6a9957f", "object_relation": "sha256", "Tag": [ { "name": "channelmanagerpms-com", "colour": "#4FE2AD", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hotelservicemonitor-com", "colour": "#77FE38", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795456, "uuid": "efbc36cb-9c00-4109-ad5c-ad5baedfdf15", "comment": "Malware payload (NetSupport)", "value": "3cf51887417e15d35a92cc872b5a1d733486cb42", "object_relation": "sha1", "Tag": [ { "name": "channelmanagerpms-com", "colour": "#4FE2AD", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hotelservicemonitor-com", "colour": "#77FE38", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795456, "uuid": "642842bd-4018-4104-8432-2f37d4a48607", "comment": "Malware payload (NetSupport)", "value": "cc69ecc9bd621abeb56a7b3a1e55ec7c0145356b5efcbaa66501a5c10ae228d7233dd7f9a2637f220122cc351d7f900b", "object_relation": "sha3-384", "Tag": [ { "name": "channelmanagerpms-com", "colour": "#4FE2AD", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hotelservicemonitor-com", "colour": "#77FE38", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795456, "uuid": "d19988fd-a5e3-420f-86f9-0712aaed01f0", "value": "T195A2E1C5D8387643E00AC7BB6378968313676C99474F47B9F6EBB3502C160B85FEA415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795456, "uuid": "36ed02dc-542e-4c62-90f3-fb46c87b0f81", "value": "384:DRaScOps9u2j2UlY1Zi9pVL/0+Y3Ga7q749prswcOmrOR68bvELtPzEACR:DBcOp6u26UlSZEV/x3a7VlmrKMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770795456, "uuid": "9993e154-d5f4-416b-8a70-b76a42160bd4", "value": 22106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770795456, "uuid": "46faf72c-b4a4-4055-a11d-92e3e4c3a360", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795456, "uuid": "a283779c-0822-4290-abfc-c7bd39cc6757", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5d52ea-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788111, "uuid": "58f369db-68e5-4a7d-b906-ad89b7098145", "comment": "Malware payload (Mirai)", "value": "5dc1f6e55054abdecf86e4be49aa8ba2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788111, "uuid": "7012eeb7-d379-46ce-ad58-2ca4219774aa", "comment": "Malware payload (Mirai)", "value": "154b5e4e2a18ab34cdbc7c9b08ef69e1f62ca9da48e62f347d28532d55a5fcb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788111, "uuid": "246a17e1-c750-43a2-9b0f-1a702479efb7", "comment": "Malware payload (Mirai)", "value": "53d92ec51962318896c7a6894fba03f6e988f97e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788111, "uuid": "2535a2d2-f838-40c0-86a1-eac960bc27fd", "comment": "Malware payload (Mirai)", "value": "4b4e0838624f9fa1aab81c6dfc8183e26dcef88d1c02f252ca9777dd9dce05757ecae63ffdccbb4be6835c19b9002ee2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788111, "uuid": "dbd4104a-e00a-4c1f-9317-8c894c5cfc50", "value": "T100244A02770D0E03C1532EF0263B1BE15BEFFDA128B5E681755EBEC59271DF22489A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788111, "uuid": "461af914-eba8-4e77-8483-eddefeb01188", "value": "3072:jbcIyzNIN+02tWxeeTTc5ooxoCNsc7ZnGVlS8IRjl4nGc/:GNIgnYeMQ5zxBsc7ZnGzSjj6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788111, "uuid": "cac99d64-cabd-4ef1-8ee5-e1405ebb4361", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788111, "uuid": "e5a1626e-524d-4dd2-a116-34c4ae9c7157", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788111, "uuid": "c3b4229c-c9ce-4103-8caa-70fa0571b25d", "value": "bin.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7bd40f-0758-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770821366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821366, "uuid": "3da9c919-20b5-47ee-975d-17cea0e668e8", "comment": "Malware payload (CoinMiner)", "value": "755e4c468c03f7bb843de1f124df9994", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821366, "uuid": "4d005bbd-94b5-4ec0-b67f-8c0484190be7", "comment": "Malware payload (CoinMiner)", "value": "16477487dcabd96bfe805d0e98378516cba21e75158908cb9d61c8d7a2037a9f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821366, "uuid": "2b4c224e-2ba7-401c-ae8f-623bad036a51", "comment": "Malware payload (CoinMiner)", "value": "fbeda59f4de7b4787b2a03f2b102e2ef589d150a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821366, "uuid": "59ff0ee3-0d55-4a5f-ae81-fa47ddcc236b", "comment": "Malware payload (CoinMiner)", "value": "1ca2bf21bf408cf9ef0f7c92f9a000ef485b07ebe268e4979391d7dcacdde648c1ba3f7d1d402754821b66dea2824e45", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821366, "uuid": "983f9753-57c2-42a6-97d1-5ddea10dbe58", "value": "T1EE563337FB8371C5C0EC86F4997850F37911ACA65212473BA5B4F3277E6234AB236A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821366, "uuid": "2b1181ad-eb2b-43ed-b9ad-c190891f9189", "value": "aa3da34fa4c3cabd66e2b6b4763f7d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821366, "uuid": "2c93658d-20f8-402c-ab59-10916193d995", "value": "98304:I8xwuGjfaJNExHq/o6MsC5PBTwrx6jxCS9p21tyP/8wK0sItf/4IJftB5qUw:I5uG4N8HqgBBTyapGyP/8w4Itf/v1zHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770821366, "uuid": "3ce31295-3694-49ec-b762-f66abb691edc", "value": 5926686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770821366, "uuid": "484996af-c54f-4d9d-a350-b0ad63ad876d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821366, "uuid": "3302354f-38f9-4386-90bd-3de1d4acccaa", "value": "U7Q7R23U7669.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1208d93a-071b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770794827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794827, "uuid": "6a116263-0a7d-48aa-b76c-6544c0e8b39f", "comment": "Malware payload (Mirai)", "value": "2e63807706e02f1260b242f4b783d31d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794827, "uuid": "3b8a482d-dadc-4393-aac0-d7f9770db770", "comment": "Malware payload (Mirai)", "value": "172b680dd39f1e21e86dff4061eee2ff8598d11c679d886e8b04909ccecf2287", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794827, "uuid": "980a8d77-2be9-46a9-aa33-202caceef8e1", "comment": "Malware payload (Mirai)", "value": "aaadf1d05563586e75950c1423382e2bb91e90ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794827, "uuid": "f9bf13a3-a21b-492d-9f14-25ea8b799e2e", "comment": "Malware payload (Mirai)", "value": "b696fb7bde6c7251e92786ee95804302316a909e10bc9152fb1e0c395a27c5a9e8c8e482395eeea48d1eea3c5671bf5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794827, "uuid": "0cf858c5-d066-4e03-b3de-13ccd9a4929f", "value": "T1E2D2E121E3D5A917FF67B6B93CFDD1C033400A4439568CE1A6586B8E4A277339B04DEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794827, "uuid": "40dfec9b-9f7c-42b0-9be5-689939e6f717", "value": "768:mE+uhp5D0J9Lpdn0QQDK1mbQ4uVcqgw0retb:XxhLu8K1m84u+qgw0r6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770794827, "uuid": "c0de48b3-ea7f-442d-af15-3a3e20b290ce", "value": 28688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770794827, "uuid": "f2ebd27f-c3c5-4e21-bbe5-fbd6fb654579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794827, "uuid": "829a5b58-d7ba-4a68-9c5a-5bb148cd2d9e", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6b656d-0757-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770820802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770820802, "uuid": "a4415d24-6b83-4c10-bac6-e251c3a3617c", "comment": "Malware payload (DarkTortilla)", "value": "7710fc4511a1bd6e7f5cf7ae58da300e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770820802, "uuid": "90fe2089-851a-4a78-99f1-04eb2416d75c", "comment": "Malware payload (DarkTortilla)", "value": "17b4b64cc0981196a5e53ef62d692b39af394ad5de609a76bb3d4dfb5efa979f", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770820802, "uuid": "b8356841-3e8e-43b8-9bb6-a79a93d17d87", "comment": "Malware payload (DarkTortilla)", "value": "deb333fef9664ad345c137995271dad863ee1956", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770820802, "uuid": "eb872b8e-12b5-4298-9234-7fa48ea58b84", "comment": "Malware payload (DarkTortilla)", "value": "a31f176c2eaaf408a29f6b6a29bc5b9bf25425083730bea8f95de1419343fca54e93a397f36004da76abd414d2c988ac", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770820802, "uuid": "aa76eb71-1c2f-4718-8105-f69e89b555e8", "value": "T17CF4BF1523D84B68F8BFE7387439511587F2F81E9722EA2EAF5950E90825F4CC662733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770820802, "uuid": "5c140a17-e6c8-4004-93e3-d1b1398425b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770820802, "uuid": "b53fbe34-989d-4c92-a035-a0ec7a3b9040", "value": "12288:10TlE/roSUdKxuNHK67OUXEsJCW4AIjXLzuhruQSujyFIERc:v/kfd1HK6/XZfSLwpSujyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770820802, "uuid": "03e8240b-0514-402c-8cbd-0723a3fd66a1", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770820802, "uuid": "1b7e9c73-a536-44d5-a782-aa2962ff482b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770820802, "uuid": "24180490-f032-4c19-bb28-ed94bb4ff641", "value": "Solicitud de cotizacion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda9d99b-0702-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770784431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770784431, "uuid": "e96370f8-e674-4055-9518-c60698d7d007", "comment": "Malware payload (ValleyRAT)", "value": "b18bf64cc251b8ba499cee734079205c", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770784431, "uuid": "6a4e9a52-d3ec-4d30-9107-38cb2653f076", "comment": "Malware payload (ValleyRAT)", "value": "17fcec681ed933736cdfc468db18ec3599d8e9933b710fd93c34f2d004546b14", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770784431, "uuid": "6925f6b1-c335-4320-84e4-af82d72d3df1", "comment": "Malware payload (ValleyRAT)", "value": "c632a582342bec348d7cdfe9998130ef79e09002", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770784431, "uuid": "dd13976d-3378-4abc-abf3-2b27809c60ca", "comment": "Malware payload (ValleyRAT)", "value": "57376f5ea24d816a5380159c4091ce34caf1dc8aefe85ffbea6dad57a2162843a89f085619f8fa236728a8683c6b53ca", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770784431, "uuid": "5d41ff4b-98a4-46ca-bca9-d1b1bfc4742f", "value": "T1D9473321A3CBC631E15D0477D82EEE0D9432BDA7033151DB63F4B95E5E728C1927EAA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770784431, "uuid": "8fb045a4-b6fd-4763-8b99-3c1eb4b539cf", "value": "786432:F1PjWfWoQTrrh5aLiaLwt/U5KJsVgkQjAcSq:F1PjS7QTrzGbS/Uz2kQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770784431, "uuid": "49024a5c-2c7f-4f13-a6a9-1569bbc96b0b", "value": 26227200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770784431, "uuid": "af81aefe-8556-484f-a072-0acd749053e5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770784431, "uuid": "1732fc8b-3aa8-40ed-903c-7c920b651e07", "value": "Dwglyznr.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3c8b83-072b-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770801900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770801900, "uuid": "8767c030-3d3d-47d9-a0f7-09f499dc469b", "comment": "Malware payload (GuLoader)", "value": "73113762422b8132acb7b85f663574c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770801900, "uuid": "e4dd3fb5-8af7-4a1c-9f9b-620c1f5a110c", "comment": "Malware payload (GuLoader)", "value": "18e587495a58ffbfe288844d6875a10b81eb6f834e5617d51328423e8805a982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770801900, "uuid": "a6d22eef-9bce-4caa-a917-eb48d673da5f", "comment": "Malware payload (GuLoader)", "value": "9ae7b53ef481666230cc413019180e3faa7cf58d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770801900, "uuid": "3eccd1c1-e52a-4e8c-b180-77450318cbf4", "comment": "Malware payload (GuLoader)", "value": "11580f8e217ef459b5f74411fd3b1cddedbacf7c34686ac59bafaf9c5d9a1b87fe09eb66ce4274cfd08a5f4568694742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770801900, "uuid": "c455dd35-55ac-4605-b75c-736fe6e3dd50", "value": "T18A74129262D0CC63CAE41A713EB04AB5D7B7DD9104A2A7076F11BE877E77AF1420A1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770801900, "uuid": "eba132ad-e430-4f81-b593-5200b81e54a9", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770801900, "uuid": "35fba73f-695f-411a-bf0b-aaa8c0433154", "value": "6144:aDfePIuZvwDfOuXuDrKTSmJywCvdrEp11LBtoYEnqby//oZXSjDDHKYPeByY:6MIu5wzOguvKNoPlojGqio6KYPev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770801900, "uuid": "721b003d-221f-440f-9cb5-b5627ac00f9c", "value": 350328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770801900, "uuid": "3bf52d8d-4878-4b6a-aed4-fa4c401dbeff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770801900, "uuid": "a6152027-f733-4287-b9fc-ee440d017dc8", "value": "Transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76075ed1-0762-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770825489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825489, "uuid": "3bf6bf78-2fbe-44f0-9e9d-f754f8e77433", "comment": "Malware payload", "value": "c32d89ef366f5e2731f3a14bd8a9f397", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825489, "uuid": "b6d9ab56-8825-4e77-8a35-239a2889bae9", "comment": "Malware payload", "value": "19c5078cad1fe4f60932b4f1ffe77db55fbf6e3fc10e993eb114829608e1ee92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825489, "uuid": "f1c1a7b8-72c1-4d61-85bf-08657e3fc004", "comment": "Malware payload", "value": "f8dad3925ad556aa21de58b1f16b2df2c9ff52c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825489, "uuid": "c6cf766e-b26a-46c1-9665-f553079c569b", "comment": "Malware payload", "value": "4f7c6945e02c3f6929dc199ef2d327760c0956fa44f73eb629a092315395efc772889458350a8ecbeaa66f61e23cf31d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825489, "uuid": "7f7d7d41-1864-41dd-bdda-efab5d20dc60", "value": "T1B4B5AE65F3D821D9E47BDA788B41A323D1B178220772A4CF0696074A1FB7ED25BBB311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825489, "uuid": "8a9d7e47-d7be-4754-8018-754637108e88", "value": "eb9e9371f86d1a2b7087447f1a343e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825489, "uuid": "c82bdcd0-ccb9-4c3a-8e90-e1d51fd12497", "value": "49152:u4X2N1f2HZJ2GPTdVj2O6rZEFDI6i39SWmUCw:I1fmF+raFDI6i39SWmUCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770825489, "uuid": "d0be70dc-ae06-4142-b97d-08383637ded3", "value": 2304000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770825489, "uuid": "6c8f3b2f-11fb-4a4f-b351-5662b2ae15cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825489, "uuid": "885dd5f5-26b1-4dcc-b4d4-8366204ea3b2", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57ed17b-0763-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770825998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825998, "uuid": "33883e6c-14a3-4bf5-a956-67fdc43040cf", "comment": "Malware payload (Vidar)", "value": "64457b1f5a2befa5cbed0c0df771f0b4", "object_relation": "md5", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825998, "uuid": "c593bb22-ebb3-4b11-ae8b-d2a8cc32ec04", "comment": "Malware payload (Vidar)", "value": "19c5a07c3523e8fe4c7fd1d28810e77ce25f4def48a7a53071855f645e995dc1", "object_relation": "sha256", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825998, "uuid": "768ca313-7384-4662-bf2f-0fd11cd0a58f", "comment": "Malware payload (Vidar)", "value": "5845f7d256cd5e3a785e1b6416295ba42629aebd", "object_relation": "sha1", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825998, "uuid": "64589366-4f31-48fd-9d2a-5925147d645f", "comment": "Malware payload (Vidar)", "value": "beb86581361d78aa5eb0de07f6593a15a875b1bb482b56cb333b76f485f3829afaa0f20ec39eee272960c75444b68f66", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825998, "uuid": "67ca7076-0567-41ac-b791-cfcdf85f98c5", "value": "T1BA463344030B0FABDB2653BA7A31C5EC1FCE531C8E78E1F137A2E276196D705568BA49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825998, "uuid": "313d3100-7165-47c9-8468-33f0b8a473c9", "value": "98304:HGkUAwI6vvPVnxX4NlyHr4Go28JuNogPp7MXwv2yH8rel:HG1NI6/LXb4L28JeofXwv2yH8Kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770825998, "uuid": "e3ed7c19-33a0-438f-a2fb-7b169b41bb19", "value": 5542698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770825998, "uuid": "a1771b56-a040-415e-9491-757e41765d6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825998, "uuid": "982eb9fe-286d-4d85-af3c-802a53aa1ec4", "value": "Velost\u0430\u0440\u0440\u0435\u0433 v1.0.1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67599366-06f9-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770780367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770780367, "uuid": "f294a521-d4f1-4b03-bf89-31ccf2f68c31", "comment": "Malware payload (Formbook)", "value": "f794482754ca4e671c3e71bad6645d37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770780367, "uuid": "49caca6d-4a1b-4cbd-80d3-cd117a1565c5", "comment": "Malware payload (Formbook)", "value": "19f603600c47be0ac17a012ce28e7fe35daebc45c1792ae58465b6de74f040e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770780367, "uuid": "bd616ebc-56e8-42d8-8e54-e56b228b77e1", "comment": "Malware payload (Formbook)", "value": "0c89d57a1d99b9a03eb123e5fde01c7df8ecb488", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770780367, "uuid": "5c2b17a8-0091-46d8-9186-3c3b740c2074", "comment": "Malware payload (Formbook)", "value": "2e39619a7a662765bab3fe29175506ac88e45b2ddba7b0d2a1093bb69d865c5290ecf45490f334ac7016d04961f70ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770780367, "uuid": "2e3298d4-1cfd-4243-a233-8f8619d8a14f", "value": "T147552325328CCE16C66513F216B2D37613709E2BA412D31BDEEA6DEFB996711281D3C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770780367, "uuid": "db3daf17-0254-4fa9-b853-8157e773e0fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770780367, "uuid": "8deeb9c4-8bc8-4a2c-bea6-fe95364f5454", "value": "24576:nguQNyg2Z2y0f9vubf5vQTwVjdm5Bv4S6QmdKtv0GVict:gukZ59vm54Tw65BvhM0tsGQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770780367, "uuid": "ce1051a9-fd3b-45f3-a10d-fa92bceb8f0f", "value": 1302528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770780367, "uuid": "1ed1329a-ecbc-4190-9398-15f8fca13da8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770780367, "uuid": "7ddd7b65-74fb-4a39-a1a9-0264208af0c6", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353dff91-0776-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770833970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770833970, "uuid": "c33b348a-be22-4ec0-b116-4b15a25ac241", "comment": "Malware payload (Mirai)", "value": "97f2b08e9199f6c10531e3ea72b72303", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770833970, "uuid": "02a6d520-6ef3-4d1a-a46d-2b3a0931fdb5", "comment": "Malware payload (Mirai)", "value": "1ae1d202181a75baf69c17c731a5747295a4a738b33d79d24894e5705ba90e02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770833970, "uuid": "75052b1b-f7ad-4a11-bda1-941cfb6318c4", "comment": "Malware payload (Mirai)", "value": "ee72aff86525be1c1652a0ee077ea004ad7fcc50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770833970, "uuid": "1b808a7b-0e65-4c02-a07f-d042be0fb834", "comment": "Malware payload (Mirai)", "value": "c2f95647494800aca83511d4856ccfcf816d22b7b1944347d7511aa87a2ccc703953912d71550b5be63cd785793c4126", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770833970, "uuid": "f2ea8aba-c686-4d2d-bf95-7fb765a5c424", "value": "T1AAF2F1834A08E83DEDB92C30FA72414235677E35F261767D3016AB8B86E14DE33B5283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770833970, "uuid": "f1b5fbcc-323d-470a-864e-8aa44a6d02ff", "value": "768:Gq92awSjk+2AqriHPGCOj85RTpnkOgscrj8Z73U03wfa3:DYaRD2AqmHPGkRThDK4kf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770833970, "uuid": "2885ce81-b7c1-4215-9130-3fe941f9fa09", "value": 35152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770833970, "uuid": "299b29b0-d671-4a46-a19b-8b34bb3fa745", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770833970, "uuid": "bb5986ec-f179-4f47-ab9c-af059598a9f9", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953e1261-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816522, "uuid": "cd54493c-428b-473e-b897-7220b75195e3", "comment": "Malware payload (Mirai)", "value": "ece5c35a6e0a6b94c97405c8b5a3d4dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816522, "uuid": "7cd89ea6-31aa-4308-a695-af519ebf96b5", "comment": "Malware payload (Mirai)", "value": "1aefe461b71d7242db0ad4fdd74985109e8b2e9daaa02d520e5865a8dd4874f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816522, "uuid": "7cddc396-169d-43b7-a3f6-dd74391997e2", "comment": "Malware payload (Mirai)", "value": "552b94c340940ff18287030fe1021f50de3eb355", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816522, "uuid": "28b97821-1e04-4036-8274-8247807cd916", "comment": "Malware payload (Mirai)", "value": "24d5332dbcc1f3ea677e0ed519504142a9360dde943516dd3fe462e530cce48bed1926aa7eec1bfed9c2834c1d7190cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816522, "uuid": "1cb98181-cfb6-44e8-82a4-8dd2929fc0c6", "value": "T1D5B39EDBB7075291C86186F00BCB4BED3E2333128F67C9E76D0E297A59391DE4A06791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816522, "uuid": "a8b437a1-93d7-4bd8-b802-7e6ddc4d2bd3", "value": "1536:TCsRDmt6cqe28xb115RUCkTyTmzgl/d/LWm:VRDmBLLxpHDkTyTmzgFdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816522, "uuid": "71b5035e-5528-47a0-b0b5-c6d3005874a0", "value": 107804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816522, "uuid": "4c0f91fa-e2f3-4932-8cf7-92ed719d6b38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816522, "uuid": "7369685e-45ab-4208-a673-593b310a8114", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2685ff7-0711-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770790881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790881, "uuid": "443b1ab7-6e3a-4473-8bab-e2490c6b42fd", "comment": "Malware payload (Mirai)", "value": "e414db2e3814a9df4872a1d0e1883d67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790881, "uuid": "196c67ee-c0cd-41f9-8734-46c7175b0d6a", "comment": "Malware payload (Mirai)", "value": "1d7f65f53ce62e4a28b5c32d1c57819812ef1cb59cc1db743ae4764e82ce8dd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790881, "uuid": "d4706cf5-5f62-40fc-8fb3-2f316df191f3", "comment": "Malware payload (Mirai)", "value": "a633eecb22184471e2150d9622b50543f3589bda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790881, "uuid": "ca5b18d1-4232-4ecb-b4a3-c714928d4f6e", "comment": "Malware payload (Mirai)", "value": "963db108506f20dba1ab02e971f0797752f8cc97983ee3445ef5bbcb2b426ba6228a67f1e6ddc31d1ec67aabe796d21b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790881, "uuid": "70b1fd16-4379-4ee0-aa82-04d1a745c326", "value": "T18D3302A2EC164E85CFBBEE911498D6C167B0CB0532E1CCABA207DD929333D7A1185DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790881, "uuid": "a633ee41-c765-4e5f-93f4-bfcd212d2ed3", "value": "1536:r8pD4rRO6D5TWlGYM23570aty4ZBw2B0pkW/4u+qgw09k:rMsrRjqGtWlt3m2BqV4u+qgwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770790881, "uuid": "4c608a5e-3672-4d3f-8bc0-823b05fb754e", "value": 52980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770790881, "uuid": "dc9ba090-4fb8-4704-872b-7739f4983af3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790881, "uuid": "8e683bc3-90e1-4453-8443-b5e7d44120a3", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91cfc1a-075f-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770824367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824367, "uuid": "8f314fbc-5401-4c97-8e65-75eb4bee4082", "comment": "Malware payload (AsyncRAT)", "value": "907ed91586859a7094b8bf8b6000a710", "object_relation": "md5", "Tag": [ { "name": "45-149-153-129", "colour": "#52A8B3", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824367, "uuid": "e25fb226-c709-4212-857a-4429e9c3491c", "comment": "Malware payload (AsyncRAT)", "value": "1dd7b7e9053c7cbdf0ef9e53aafe8a4f0d75591c69c0d3e463a76243ab9b4499", "object_relation": "sha256", "Tag": [ { "name": "45-149-153-129", "colour": "#52A8B3", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824367, "uuid": "3b6d8243-f3c2-405f-90f3-48a4e19cb112", "comment": "Malware payload (AsyncRAT)", "value": "0d1178781796832e2da1cba58e9a0d9bd53107f7", "object_relation": "sha1", "Tag": [ { "name": "45-149-153-129", "colour": "#52A8B3", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824367, "uuid": "5943b442-5ae5-4a7d-ad40-80d3548461be", "comment": "Malware payload (AsyncRAT)", "value": "c5cbcdc72b3b8ba0be6a746c7b9491b69cc38ed2f5683407a8edd93231d307e4e792e37f99c4e5df7dd6827437df0611", "object_relation": "sha3-384", "Tag": [ { "name": "45-149-153-129", "colour": "#52A8B3", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824367, "uuid": "78c99926-52c0-4abc-b088-5f7de35cbddf", "value": "T162E23B4877E44626DAEE6FF528F391050270D917C923EFAE0CE485DA2B67AC187407F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824367, "uuid": "160c9794-e5f4-4988-bb36-78ecf8008f9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824367, "uuid": "41804474-3c8c-490d-b720-e50637a235d3", "value": "384:Zx+PkjD9+E5MFs7iui8L7zKM42pfL3iB7OxVqWsRApkFXBLTsOZwpGN2v99Ikuir:n+CD93W03v42JiB70OVF49jjkOjhTbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770824367, "uuid": "baf0d8b8-eba5-4cb2-95cd-3167cf339473", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770824367, "uuid": "90928d36-51c9-47df-b9f2-5de3a0d590e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824367, "uuid": "a97d15e6-084b-4228-b332-6a28b6e9abc0", "value": "semcaixa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89c3367-0795-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770847532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847532, "uuid": "8aadb00f-e9b5-4173-9bdc-0709f1eb1a95", "comment": "Malware payload", "value": "8611dfd731c27ac1592de60a31c66634", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847532, "uuid": "a42986ec-af70-473c-8783-6dbede4992d4", "comment": "Malware payload", "value": "1e6d4b0538558429422b71d1f4d724c8ce31be92d299df33a8339e32316e2298", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847532, "uuid": "f7c367a3-38c1-49d6-bd85-7b92dd9ddaaf", "comment": "Malware payload", "value": "8a5a5ff3663c4a530cfe975e66a0257f308368c6", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847532, "uuid": "50d40760-f19d-47bc-a6a7-73122651a987", "comment": "Malware payload", "value": "3ef392ea935da8b88d4806d1ae6cb4dee37765f19c00108c335835cee16c1a0fbaf4abd73faf319803073e99a28d1c8d", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847532, "uuid": "2ec0b2b1-829f-4c6a-b162-ec4560d8967e", "value": "T1C9B409E3223859F2D98EF77CF00F2267F976BD4115B8A5D55E810E110ED9360EA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847532, "uuid": "05d00ac4-53e5-47bd-aaa1-7129953cfa05", "value": "12288:j6TamwVU71+KFwT+Mbc3GmHghBOGpLdhHEiU7777MMMroTZ6:j6TE8FyBOGpLLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847532, "uuid": "37d0e343-7e9e-46f4-98f0-4264f524f037", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847532, "uuid": "6fbb4507-96b1-4306-a633-423f8a410037", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847532, "uuid": "98a0780f-dc1d-406c-9804-7de9d444ede8", "value": "1e6d4b0538558429422b71d1f4d724c8ce31be92d299df33a8339e32316e2298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76060fdf-0744-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770812604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812604, "uuid": "7b6ed504-c9ad-4a7a-8126-513c1cadb629", "comment": "Malware payload (Mirai)", "value": "31cbf067cc6b8a1951bc1e6469f5f676", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812604, "uuid": "86378de1-2219-4c30-b370-6907e245730c", "comment": "Malware payload (Mirai)", "value": "1eca735e83ca4a397981184f6c231915db12bf19aacd9a8ad1fdb2aef4388a0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812604, "uuid": "14cf73b8-d0ee-47a4-978e-bf1071c4f132", "comment": "Malware payload (Mirai)", "value": "c5837cb37c3b2fe213b253161f07be3be5b4da5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812604, "uuid": "a957f76f-919f-40c7-a1c0-fe55a96d8b15", "comment": "Malware payload (Mirai)", "value": "63cdebe716b46c5674f91548bef007dc4bbc34e2e0cf39b9267b0eb68806d1fd2e82bb8807e660f815664ed3b5c7b499", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812604, "uuid": "d71d9e81-19ff-45ad-89e2-23388c5272bd", "value": "T12893D60ABF600EF7EC9AEC7345EA1B46249D592620AD6F79B530D814F14F24F2AD3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812604, "uuid": "cae57dd9-e20c-4ced-a9c0-3a9a042a5430", "value": "1536:XTyyF5K0SHqQhQPOtd2hztgLka1c9qyEGPlakYZqhL1:X9F5K0Sfjtd2h5g9XkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812604, "uuid": "d83fd35d-662d-4b2c-ade4-6ec3b0857e43", "value": 92820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812604, "uuid": "844589ee-ac21-4fc1-8323-7b604e2b5f0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812604, "uuid": "8f174c3c-204c-49b5-a944-fb3b7c3c25b3", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc83885-071c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770795491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795491, "uuid": "6ffd36b5-1b88-4769-b1cc-099003779edb", "comment": "Malware payload (Mirai)", "value": "c8dd47de10dba19bc4e6642c33c84c16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795491, "uuid": "996f9664-a26c-4314-a640-62dfef3ceee4", "comment": "Malware payload (Mirai)", "value": "2098d9e240b9fefa1142398a765d9841ccda144ebdf5aaedc368d884853271f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795491, "uuid": "61731253-482b-4f41-b5ba-54910e49ad1f", "comment": "Malware payload (Mirai)", "value": "7f46bf7ca415e2239005a480c70152975485bafb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795491, "uuid": "c7f3978c-d180-414d-9cad-e339882b5536", "comment": "Malware payload (Mirai)", "value": "1dcea61c445859122be7aacd7361e51689a023a58b5a35486d7ae1263bebb94468754f30fa41453ac5d553726deaf51d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795491, "uuid": "4099355a-0029-444e-96b6-ef0fe53c1cda", "value": "T122D2D1B8655190E1D36388B827721FC217760FF3B447EDCCB6AACA875E2126631F24D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795491, "uuid": "3a699459-a5ea-45a6-99c9-d3c5337bdb65", "value": "768:sr3OPpxdB81eq3ZZq8FiEKpQod4LjYeXoxqJgGlzDpjcc:sr3kpfW1NLxiNpHd4gQWOV1cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770795491, "uuid": "8e5f979e-17b2-407e-bbb8-80df22c2693b", "value": 30896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770795491, "uuid": "66568873-af10-40a8-9001-40b2987ba5a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795491, "uuid": "ef97e7fb-e0f5-4372-a3db-3ca1a5066486", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7575d08-071c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770795507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795507, "uuid": "aee6a748-f49e-4928-9bc0-87ec331575a2", "comment": "Malware payload (Mirai)", "value": "548af541fc32cc1fd08dd9aa15f18f94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795507, "uuid": "37ea3213-1f99-4290-af2f-b6632af81275", "comment": "Malware payload (Mirai)", "value": "20b791b02ff499eb386a6eb43e16c6155babfddfd073f90b147569961db1047e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795507, "uuid": "11d87306-eb24-4e18-8eb5-f8ee5f26fb94", "comment": "Malware payload (Mirai)", "value": "705c1a36d54eecb23065ac2a9c843ddb9b3cfa4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795507, "uuid": "9a05ae65-5b8e-42e5-854d-d86d8d9508dd", "comment": "Malware payload (Mirai)", "value": "fb03110f58aa8e9b664d8ec2443bd665e4bf13536c7aa8a9302e7141bf2a1a7c66b5a2834a962147fd7fe6813e74902f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795507, "uuid": "ae19593a-8a9a-4cb7-9f75-3619ec4ae170", "value": "T165E33B85B8514F13C5C616BBFBAD428D3B1627B8D3EF72039D265F24378686B0E3A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795507, "uuid": "a53415d4-e05b-46a3-94d4-7c00b5686cac", "value": "3072:DOWSdRCq464mdIpd9jQl4cUeqUq3NjB9:DOWSPCNmdIpnj24cLqUq5B9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770795507, "uuid": "9e5a25b7-af4f-4354-af2e-3a050fdbbd90", "value": 154272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770795507, "uuid": "046a2a75-6685-49bc-a120-3f39db835fe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795507, "uuid": "de928be9-d21c-4e4b-9c8a-8925d11a4a65", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5a729b-071c-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770795465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795465, "uuid": "f0ec0d5b-f736-4150-82ea-ed52e5c3f5ad", "comment": "Malware payload (NetSupport)", "value": "65ceed5931cf50d09ad5342198763e13", "object_relation": "md5", "Tag": [ { "name": "channelmanagerpms-com", "colour": "#4FE2AD", "exportable": true, "hide_tag": false }, { "name": "hotelservicemonitor-com", "colour": "#77FE38", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795465, "uuid": "ef8cad29-9cd3-4ea7-87b6-9c654ffba4b4", "comment": "Malware payload (NetSupport)", "value": "21067525900bde1b88cbd99b7e2f4df234f7069311585fd986bd5a598ec98d25", "object_relation": "sha256", "Tag": [ { "name": "channelmanagerpms-com", "colour": "#4FE2AD", "exportable": true, "hide_tag": false }, { "name": "hotelservicemonitor-com", "colour": "#77FE38", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795465, "uuid": "44b7cf62-70aa-4db0-b4f0-20224dcd28a4", "comment": "Malware payload (NetSupport)", "value": "96a4fe26c1c8b416c8a9b85b44484a93be21a972", "object_relation": "sha1", "Tag": [ { "name": "channelmanagerpms-com", "colour": "#4FE2AD", "exportable": true, "hide_tag": false }, { "name": "hotelservicemonitor-com", "colour": "#77FE38", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795465, "uuid": "5af7ba4c-d251-4202-9297-6d8154dc3aa8", "comment": "Malware payload (NetSupport)", "value": "769a548f109520a2479f87fda0c0e291d498cb37b15e424c2b6f7070b7e62cb64123cd4d6776b7882fa7bd9a59b7eb37", "object_relation": "sha3-384", "Tag": [ { "name": "channelmanagerpms-com", "colour": "#4FE2AD", "exportable": true, "hide_tag": false }, { "name": "hotelservicemonitor-com", "colour": "#77FE38", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795465, "uuid": "0faf7857-6f67-4a42-ad02-620f75b4d995", "value": "T1B0D66A649B84974EAEAE194BE07C662F66F33F61D4D272FC16633703256FC086639C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795465, "uuid": "f5e551b3-c454-4c20-9993-75bf6a6fdd20", "value": "49152:lQ+hy0MxEwZ1/9GXEAcIqi5toyr/pcNCf+18RYwaRjd+FfIM3Yf25ygCZOBtrR99:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770795465, "uuid": "61f9773e-bbe1-4be2-bd4c-523cf2fb3330", "value": 13264556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770795465, "uuid": "1ade9af8-38fc-405f-be00-f611dc837b8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795465, "uuid": "1c822c2b-dd5d-4385-8525-572acd86fef0", "value": "21067525900bde1b88cbd99b7e2f4df234f7069311585fd986bd5a598ec98d25.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82ee403-0746-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770813681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813681, "uuid": "01d821dc-fc87-48b9-b93a-317d8be5d299", "comment": "Malware payload (Mirai)", "value": "6bfd796110f92f6e001ff6ee922643ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813681, "uuid": "91bfaf0f-0608-4bca-bf46-8d6acf5dfe51", "comment": "Malware payload (Mirai)", "value": "217a7ac442c06eae22d00a6de18cf58198a9ac2fb8d47e80ef1acf7a813653ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813681, "uuid": "7a9d7581-0bd0-47ed-905e-ab1bbd310035", "comment": "Malware payload (Mirai)", "value": "8babc63598bf656b498cbb73fb050a81b7158ab9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813681, "uuid": "c68124d6-7c79-4fe1-b74b-85c7fda82e7b", "comment": "Malware payload (Mirai)", "value": "3468cf20394cf22ebc7cf9083c82e946a0b59f974a0dbef13259ae748c5442e1f0ff9bf64c408a38e532dbc7bce41345", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813681, "uuid": "606154b9-8d05-48ee-b203-1d8c4b4d0933", "value": "T147536C0173988E0BE9D51EF8393F17E583AFED5122E5B185A90F9B474235E73484AE8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813681, "uuid": "63ae5344-5d4d-4ec9-b969-ce2a3f38040e", "value": "1536:ppGO6hNlzzODujn88/fD5KQViTl4xIoHFSVX:n6hNBOwnvXD5Kos4xIoHFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770813681, "uuid": "dce70b1b-3931-4ac8-abab-b86b2ef7f108", "value": 66648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770813681, "uuid": "4ce82437-2184-4741-a2c0-195ba804a4f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813681, "uuid": "7874585f-f35e-4273-b115-b3b0e8eb10c4", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd39cb9-0745-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770812909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812909, "uuid": "5e1dbc9a-097b-4c35-b40e-148699f8904c", "comment": "Malware payload (Mirai)", "value": "50d08234485a7a413d3f40239845b795", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812909, "uuid": "86ad0d96-bd05-44a9-910d-4a72fa1cc803", "comment": "Malware payload (Mirai)", "value": "22e12db7e04901e4d00f574f2db3012d33bf3a5a3270de06be83fe53d176741c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812909, "uuid": "683bf2f4-2267-4963-b263-2974dc31fc97", "comment": "Malware payload (Mirai)", "value": "f7a4efbeaa716c06466b5bf5bdb2310540306357", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812909, "uuid": "a30e600a-f7a6-411d-88a2-ed520741bdca", "comment": "Malware payload (Mirai)", "value": "8716961cd2fe57884f3ff8b3cdcb477d815320ef447d8d9d29fdaf5e2361e305217c0763e6c86599037c1e951aff792b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812909, "uuid": "a69c9e71-bfcf-4378-8af9-91f745ab7760", "value": "T1A3244C41AA808E63C1D1277BAA9F414A33329758E3DBB2078E1C5FB437CBA5E5E37505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812909, "uuid": "16bfac11-e83b-4ce4-b28a-253cd5162e3a", "value": "6144:GCIZAEXMOKajoLmpMguHcUDVUHalw7W1uH0ssfCnPnPzwCZcxjf0lq33noM/9EKp:GCIZAEXMOXjoLmpMguHcyVUHalw7W1uS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812909, "uuid": "a6f58d1f-22ba-48bf-9465-14013196328d", "value": 212847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812909, "uuid": "0393fa86-1248-4d22-a981-63b4b6c3f098", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812909, "uuid": "bdb655ae-b51e-49f2-a44b-0a8c224921dc", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac2875d-0720-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770797338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797338, "uuid": "74ff1d3d-0431-4fc1-8644-3d760ea8b26f", "comment": "Malware payload (RemcosRAT)", "value": "8c29c72b32e0c5a76d45d50bf2d1ce80", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797338, "uuid": "b2352ad6-0253-4128-928d-6e8a7af7c899", "comment": "Malware payload (RemcosRAT)", "value": "24717cde9fd77e7688501252d9615f94376e30a006f734bed82e04f384094069", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797338, "uuid": "5d41cbd8-a7a9-476e-8e7b-3d75750a46da", "comment": "Malware payload (RemcosRAT)", "value": "bfd4b3fa8792ab79e3d12f4c2e8f9893f40cf326", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797338, "uuid": "5662a528-832d-4afa-b26b-7b1c5f743ebb", "comment": "Malware payload (RemcosRAT)", "value": "a567fbc131504ac8be8c20d1fd8feb0b83bce7fe73da0aed07cb36e199ae29fb2b31eddbcab10a429154b196f08c7475", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797338, "uuid": "1e8f49ba-4da6-47dd-9b40-0592f762b119", "value": "T10FC282C83DC2F2B5077A34B3296FA0DAE67F8F64340C4557C256BDA1B9A470CD2A7618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797338, "uuid": "3683f4aa-e63f-4879-816a-5b2d08a86819", "value": "384:O2uJhi4SzjtI0lg7S8vHsBYps2k4ebJwmKswowiaPkIl2znOb9OfP+U1O37Xdb:Oj0jaL/vUFPus7wiaPV9U2LX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770797338, "uuid": "e3681c4d-7264-4742-9e66-dd104a1821f6", "value": 27218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770797338, "uuid": "e7fc0798-7d78-4a09-9e4b-ac619b3f7c4b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797338, "uuid": "1942bec2-7d5b-44c0-900a-94a36f1f8a20", "value": "PO-73829321.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cf2e4f-074a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770815120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815120, "uuid": "adec2dc2-56df-42ab-b402-492b5088dfb1", "comment": "Malware payload (Mirai)", "value": "f03744cbeede7ff88274e58c534d65b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815120, "uuid": "c433ade9-9c19-4e39-9ec7-59e56ea83d8a", "comment": "Malware payload (Mirai)", "value": "2678c7eeee24800e73bbd59dd2acdeb631c6e0f85514b6524aef2c93c7c7d9dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815120, "uuid": "d3b2283d-3779-4323-954b-52febcbd5d88", "comment": "Malware payload (Mirai)", "value": "63b376b0fe5681029f513f25170e6d25356eb362", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815120, "uuid": "3510a7c8-5ea5-4bd0-9fce-395fd1fbbf61", "comment": "Malware payload (Mirai)", "value": "026367735cee9748b8dea4c3123d1c9a11bebe2d1fc53d2e0b7e14ba7d55b15352e225e84770f2f6e1fb4e7dfb79a181", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815120, "uuid": "973b0766-0936-4ed3-bb5e-c6d2e3242d45", "value": "T1C8E2E05EE0A55B18D0FA503654BF3A0EC0F0F66E1C4A82B0D6ECA5C76DD6B53210C7A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815120, "uuid": "eeb64e6d-78fe-4b11-8f24-9bb801daf9bf", "value": "768:h0yYNWpcnhXZUqmKbE8kdKUPA0KipqEy6NTT6fnbcuyD7UM7yl:hVYNWpQZe4E/FDKiurnouy8Vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770815120, "uuid": "ff1a6590-9532-4b6f-aeed-b583b26aaa9e", "value": 31152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770815120, "uuid": "4c6ed7f5-0ddb-4d2c-94cb-37101ec5a3b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815120, "uuid": "fef9da0d-7e73-4695-bccc-8db883021012", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70640271-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788113, "uuid": "13226e43-1314-48a4-a102-4a6095cb0d25", "comment": "Malware payload (Mirai)", "value": "44748ca401c96d80899c8ca5bb557e0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788113, "uuid": "d03d182a-e43d-41e1-b321-21d74c985ad4", "comment": "Malware payload (Mirai)", "value": "26a135b4e6dedb38cd7d8725f918776cd49e0250ad7419a86b0550c503d994e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788113, "uuid": "3f61ac27-fdc5-42b2-a5d5-01c3dd3a0985", "comment": "Malware payload (Mirai)", "value": "61f620b69d1edc97a4027d0c4310695f2bdaab4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788113, "uuid": "c7e88be8-889f-47d4-b749-fa690cbbc13d", "comment": "Malware payload (Mirai)", "value": "397b1db6fe92086121a0677ea139c4a25d9235dbc32b9cdd7bdbaa36597e3f31fd979c9f68eaa5e6b390537f9be8d3c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788113, "uuid": "1371b9e8-518c-45b4-88ff-9cdf4b2cf352", "value": "T1D0143B45B643CEF3E45304F111B3963E0B31ED394826D595EBA8BEB4DA33AC166163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788113, "uuid": "41558558-cc93-4878-8953-6d8ef19b3761", "value": "3072:7UoWnXHc2U9aqu2Zhs6LF5hAh60a6q1U9C1Jlpzi:7XW3bcaQhDUMUC1Zzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788113, "uuid": "d6abe153-7546-4ae5-b92a-b0ec03aad702", "value": 192996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788113, "uuid": "aa1ab89a-2c5f-4dd0-a8e6-f6013bf4d8aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788113, "uuid": "2ef817d7-aef3-48ee-ada0-ca2ef4170859", "value": "bin.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f06fb6-077f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770837914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837914, "uuid": "a734d741-17bb-4607-a47a-1b4258f1e0ab", "comment": "Malware payload", "value": "c63e81ad806a0feeef913baf7b914c4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reynolds", "colour": "#66C8C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837914, "uuid": "dcff39b9-3ed1-46a8-8c01-2de3ad40ae05", "comment": "Malware payload", "value": "278593da28e45476a4a784af9841c5522a23aed62c14ce1ddba2b4ce5705c574", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reynolds", "colour": "#66C8C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837914, "uuid": "dd647096-bf84-49d2-b1e9-b5aa6b11ca0d", "comment": "Malware payload", "value": "4eb5c4c0e809cb696d6ad4f7ec5b12d22db034f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reynolds", "colour": "#66C8C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837914, "uuid": "1aa57d78-73ac-4b67-acf5-055a5222c5c7", "comment": "Malware payload", "value": "9b4e1ad76d243549b37b85cbfa8cbb0ce700ace6fc2020eea09005c62e6cc407f248d42c8241712979f9571d4f2254ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reynolds", "colour": "#66C8C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837914, "uuid": "517aab1b-c882-4ca5-be7c-bda68d57b409", "value": "T16B249F5477E500F9F5B382748AA55A06EA72784507609BEF03A443B1EF237E0DD3EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837914, "uuid": "5f106f6e-e977-4b2f-989d-45cef514545f", "value": "f95447fde4c485647d5c7abd65443558", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837914, "uuid": "2b80ede5-e18b-4349-96e9-718b75220faf", "value": "3072:fVwEjye5w9AiBj8VmwV754kwUB6VuhcE6nWCXFHF3QuVB+B2L:fVwE+e5wpuhVnjigchl3HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770837914, "uuid": "4a01ef02-f6f1-4870-b014-6d1122029f4b", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770837914, "uuid": "934ff9c3-ff1c-4f62-acb1-9ee3a238fcd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837914, "uuid": "18628d0d-290a-4306-a60e-1573dcde7ae9", "value": "278593da28e45476a4a784af9841c5522a23aed62c14ce1ddba2b4ce5705c574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f1b843-071a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770794429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794429, "uuid": "9495a546-b9c0-486e-8b64-746b93225503", "comment": "Malware payload (Mirai)", "value": "6bdacba8411a9d6dc347b3e6a3284320", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794429, "uuid": "0404301f-8ce7-4a64-b1c2-ce294381bc91", "comment": "Malware payload (Mirai)", "value": "27adcfec160021f964eb9a3a334638c8c7d471f5530ba0ca9f9f5690061caa08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794429, "uuid": "8fe1768e-c257-4398-9737-5af17976c797", "comment": "Malware payload (Mirai)", "value": "f581be863ddf69be32b3864c54b60f4cddfa8797", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794429, "uuid": "0c45d7f7-8367-4521-8c60-aaf2cfa31537", "comment": "Malware payload (Mirai)", "value": "84901eb3a0965b9d870199ebf2d98c7d6265f36c856755aa38478aeb8e612d31584b5de243153320381ad6034a47fb29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794429, "uuid": "a2d9a91e-8d2b-4344-a4aa-436a434bbff1", "value": "T1F4F30956F8814B16C5D101BEFE2D114E37132BB8E2DF72229D249F74778A87B0E3A919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794429, "uuid": "8bdce35d-5089-449e-ac2d-00216b658a79", "value": "3072:84l3f8GO21Ds0T/GTahJXnTqd5gGUI0VgnaaZD6+Coc2:8GEO1iT8X65gY0VgnaaZFc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770794429, "uuid": "02c721ff-0619-4d3f-8b6c-bbbce50fca34", "value": 163740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770794429, "uuid": "c5b0c0d0-bf39-4fec-a61a-bba717b5d4bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794429, "uuid": "d3884112-6f53-4475-84e8-43173936f9b1", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fc4bbe-0730-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770804180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770804180, "uuid": "740ba979-677f-4b9f-ad96-7462b4cb2582", "comment": "Malware payload", "value": "8df467c2d640e245993fa0757b2cfa0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770804180, "uuid": "58cf75f2-ac6a-4295-b6bc-5288f4816611", "comment": "Malware payload", "value": "28cb4cbc37734617044eb9cf492df8adb7dd857d907a800a13db7a12b20de4c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770804180, "uuid": "ae352964-44fb-4fc4-88a9-4cd65d152047", "comment": "Malware payload", "value": "733ae0cadd98411e5a3498e134b9528d61021a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770804180, "uuid": "c61a335c-ac46-441c-858f-98aedc453646", "comment": "Malware payload", "value": "e2b73379bef6a0d534f3abf97b7d5e9294256b3010550bfe09e774339935d5d4b1746854ef589f8dbdd9db3bec4f8512", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770804180, "uuid": "49ac5975-6471-474d-a461-60a3ae5024da", "value": "T16537940256ACBCD2C136A234E7BB8FF1C769EC559128C24F1481FA477D3A64379272E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770804180, "uuid": "326aa874-bfdc-488a-a04d-41696ac1d077", "value": "72accde3257df29a00800c19ca169a74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770804180, "uuid": "821fa511-c0ae-47fd-b5b9-25e105d8a767", "value": "196608:WjLwiiOHUZ0xXlq/hVemBsCsnPwaWA9LU/iyhcCG280DME:kx5HUKxXY/hAmRdv/B2L28JE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770804180, "uuid": "8e66d32d-d92b-41a2-a972-1a214c3a0ea3", "value": 23899648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770804180, "uuid": "d1ac552c-4ea0-4a5e-b51d-abcbcb502525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770804180, "uuid": "ea54cd77-6613-4697-9c9e-ebe0a260e347", "value": "Client.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df0a8be-0751-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770818201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818201, "uuid": "d3866cbe-dbb7-4e5d-9e72-19ef5c53dfc1", "comment": "Malware payload (Mirai)", "value": "0783d2a69405d60e383f93f02cd7725e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818201, "uuid": "2d93fd6c-5f26-4411-9771-1cca93980c3c", "comment": "Malware payload (Mirai)", "value": "29f64215c33d9c99a6d0ed75c483ccd39e83318ea8b03bb5846f76f90df3a06c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818201, "uuid": "3884fd80-e5c0-48c7-bd68-f2331760ed13", "comment": "Malware payload (Mirai)", "value": "ae958a3eddf54462d85766618cc970fd6add44aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818201, "uuid": "b1dbc690-86a2-4a00-b24f-c43bffdd3a96", "comment": "Malware payload (Mirai)", "value": "1997430040d1141f60fea4c1a94dfb6c2f54b2006ec8f09c5fde2249f249bf40bd9715d69c021df67e3d171d7e9597b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818201, "uuid": "40145514-cdd5-43ad-8f34-2524890411d4", "value": "T1E6332807B58185FDC4A9C17443B7B13AD472357E123DB2EA6BC8BE1A2D46E601F6C8D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818201, "uuid": "714b6702-04c5-4ec0-96e4-a4d5999861de", "value": "768:ENUYvkxwSf0+fVlACmQZoM+JTXilBV3P7uISjsyUTq0LvifHOgY:iFMqwfVlDmQyM+JDiB9aICs/Tq0sHOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770818201, "uuid": "dfc4d35d-0568-46c2-9d1b-c2a37d16386a", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770818201, "uuid": "fae2b281-6423-4b4f-947d-4a7e0ce438ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818201, "uuid": "4d4006a4-bc83-4708-91e9-b5db9d26761d", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d976b2a4-0746-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770813630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813630, "uuid": "77a315e8-69a8-4a02-b637-49cf6b4a2c17", "comment": "Malware payload (Mirai)", "value": "15a87f10f813d2e2409fd2fc9a02a6e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813630, "uuid": "f32f267e-19ed-4ffd-b260-86f265938c8d", "comment": "Malware payload (Mirai)", "value": "2a2fc1f72125f166f6dae44c89b1f0f515fb8033bec651c2361ae7124d17f234", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813630, "uuid": "b2f4b005-74ed-4ea7-8123-7d1b3133945e", "comment": "Malware payload (Mirai)", "value": "19ac2f29336b3402e4307255c0b87d688de51b8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813630, "uuid": "d6d040e3-8777-43d3-9fa1-22cdf59520bd", "comment": "Malware payload (Mirai)", "value": "2dc5518c5d7d5271d76f1d33eb0f0c008e5a6a3f89e6605e387fbee6183e3ef4f58fcca461d192fb70b30bdb5f5d5f94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813630, "uuid": "b0e1bb70-0023-4377-9b2a-84c08466a205", "value": "T11AD2E05ED4CD4E0BFDBA7CF5196DD188A3E4070935F30DD19EB85A843AD2232226ACD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813630, "uuid": "06263337-e80a-43c4-9ed9-238cc200da4b", "value": "768:gtAEBpRBFO8ioi2EmAlkM4uVcqgw0retv:gPpRBM8Fi2ulh4u+qgw0rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770813630, "uuid": "38065cc9-ca5f-4294-9e72-d8840c766731", "value": 28728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770813630, "uuid": "4cd5f058-ce83-43ec-8ad0-60dd5df036a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813630, "uuid": "5867bc87-c3d3-416a-931d-a0f475a5e585", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef5073c-0713-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770791708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791708, "uuid": "0a93a951-124b-4b8d-8d99-14634fbc0451", "comment": "Malware payload (ValleyRAT)", "value": "116eda2a0148f4d4c8bba59873230e97", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791708, "uuid": "398baa24-561b-46bf-a5e1-f88be993f940", "comment": "Malware payload (ValleyRAT)", "value": "2ba206aa03fbf06adedaaedf1a8199fb470a1dcb1531073bac0ebfc21cfc5a0c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791708, "uuid": "a49db6b6-3b47-472c-a2ba-1feb0a0a5035", "comment": "Malware payload (ValleyRAT)", "value": "dfa8785bbc07f921900f8fd6f7ba27979656c0ba", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791708, "uuid": "8e4967e4-96b2-4a9a-8ec5-1a0ba0f26bb0", "comment": "Malware payload (ValleyRAT)", "value": "a0d32227d1af23f625753132e61bcd1b1dc669d98fc5ed30b9abb84ac520f4ba5f6ce7fab5c820c976a018c170a81dff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791708, "uuid": "9f329502-9bcd-4dd8-9d65-ac00399a493c", "value": "T1D9C46C56A6E009FCD467C278CE975252EBF6B8190360BAEB07D199661F27BF1833D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791708, "uuid": "71e80c28-a084-4184-ab1c-4bf4526ab969", "value": "0917732f0e5310ae388f37234828aa79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791708, "uuid": "b3b21620-e9e0-4251-a229-55a90ed0030d", "value": "6144:IjnyZmxhIxBSAwp9MXsJbIzvsmS1eAWpVv1ZrKgeFBJsP+FGcmiUGLcaMOm:mACp5JbIIAAmF1Zm5J4swom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770791708, "uuid": "2b1129b9-303c-4579-9309-09c116a56194", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770791708, "uuid": "f3be0904-d3dd-4776-af05-4b87872807ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791708, "uuid": "7e09de8d-cd0f-4b88-9c9c-315935f468f1", "value": "2ba206aa03fbf06adedaaedf1a8199fb470a1dcb15310.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e0004d-071a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770794665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794665, "uuid": "a05ff9a1-0010-4b38-818e-6943b4784dd4", "comment": "Malware payload (Mirai)", "value": "e9c1d6895af492cadd6c12438747aa87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794665, "uuid": "808e2cb2-22fa-427c-a2ea-b0a34abb761e", "comment": "Malware payload (Mirai)", "value": "2c73bea8aeeb5cd4777a1f16180d8dbad2237518b87f119dd90dbeb6c6b38758", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794665, "uuid": "7034d592-855b-46c9-8362-36f0b64c3fd8", "comment": "Malware payload (Mirai)", "value": "054cef1265fe595d40b5c9dda6c0b2d85d8fe872", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794665, "uuid": "c74fdc36-456c-46ce-8667-85fd6767359f", "comment": "Malware payload (Mirai)", "value": "13bfaee18a52806083954c60fe7968fc361d0686774d13df42635b31663a9e9c7930ac1bbc7f0272bc769c459f1a234d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794665, "uuid": "6ace62fc-876b-42ae-8558-99b2a1e65145", "value": "T19BF2F26797D99D4ACEA00D31B429064BE12E0BF490A5B0E160F97A3D7AF058EA2F4D13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794665, "uuid": "8cbd6055-ee3e-44f5-9911-0b8327d5dc96", "value": "768:2V0Chjqn3rD60UqQ4t4Q7yVZVcnG5qTyKcNGNMRH3U03wflD:KWPLLAVWNyKWROfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770794665, "uuid": "c863dffb-8175-4356-b931-79c2cc8859e5", "value": 34512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770794665, "uuid": "4eabf07c-f05f-4a06-9ac6-cd8af0869b5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794665, "uuid": "007fa1e6-615e-4f05-bce7-3005737bd37b", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617f755e-076c-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770829749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829749, "uuid": "d8dbe5d2-af07-4422-a856-a608c94f1d44", "comment": "Malware payload (SalatStealer)", "value": "fb2e864a5d53e584da38f1b873c42b90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oxijoiner", "colour": "#DDD3B5", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829749, "uuid": "0ba74412-cf9a-43ab-85a6-dd79d1a444dc", "comment": "Malware payload (SalatStealer)", "value": "2dd0a31a76548cdf6ac8d88a1499dbc3bcf5736393428d310a7a53a38223bdd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oxijoiner", "colour": "#DDD3B5", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829749, "uuid": "57a9c324-7933-4db8-89e2-2773be258331", "comment": "Malware payload (SalatStealer)", "value": "4b47fecd8246081aef19fd537184a7fbaf156688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oxijoiner", "colour": "#DDD3B5", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829749, "uuid": "54272f65-3868-4cfe-ada5-3576fde31209", "comment": "Malware payload (SalatStealer)", "value": "1ea2dd43c0b8c21c2f5c1c5d71e2724044d31590f80eff3ada2249202d1cbbca985e3bb6eb63b2a129ba0a1cd1078a16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oxijoiner", "colour": "#DDD3B5", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829749, "uuid": "40d3cf18-ad25-4bfc-babf-9aba33d90066", "value": "T1211733AA2165B67EF4B12C39A54FE339E27D7C818A0755838DD5ED63FCE0E00815F1A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829749, "uuid": "01232c98-03a7-4af5-96cc-429e4fdc64fb", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829749, "uuid": "db1fed06-f4bf-4044-a723-d3c369cfec05", "value": "393216:OIYGrHOgUe7Np8Q50fis/sme+jSnZc+EuPmjP1WTnXXTkWJbU:OD+HOg9Zl50fizGOq+TPm8TnXjkWRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770829749, "uuid": "eab52e6a-43cc-4f17-bfd2-ff224d9b0b64", "value": 19823104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770829749, "uuid": "3ecbb02a-2762-405c-8603-90674a108277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829749, "uuid": "153802d7-dddb-4192-8e4a-eb7b45e32cd4", "value": "2dd0a31a76548cdf6ac8d88a1499dbc3bcf5736393428d310a7a53a38223bdd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b962086-0743-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770812237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812237, "uuid": "935d2d14-f2f0-4ace-8b66-433b2598ae9d", "comment": "Malware payload (CoinMiner)", "value": "b806b48f24ea908350285941972e2a94", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812237, "uuid": "f837d24a-ce6d-4d4f-a0c5-35a54382af84", "comment": "Malware payload (CoinMiner)", "value": "2ddc60e198968b3b6a2c900fa225cec6ff3340e67972ebf3b94938423f3dd347", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812237, "uuid": "786817d8-9f30-46e7-93aa-3eebc36baa42", "comment": "Malware payload (CoinMiner)", "value": "4731feb01d22764ef8ac79e12b23541927487329", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812237, "uuid": "1adb2cbf-e97f-41d4-963b-5c01d7d7373a", "comment": "Malware payload (CoinMiner)", "value": "351ab3792b8e97d8dcca50dd7ad6ec4a7c758a040db277b3116064df9fcb4e5bca1c45763d39644ded08c2c62263080b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812237, "uuid": "7cfd39e8-aa97-4eaf-81a1-3209257f0cd7", "value": "T1B7177C269F805B8AF6DC0CABC07D1A1B6BF36780D0B3F2CD67926503269FE1C5729558", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812237, "uuid": "e3794f58-fa43-4696-bc9f-e24ad7db4d54", "value": "2b4a9a9cf090b9abc323b2037a41ed31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812237, "uuid": "524c8211-c68b-4e67-8078-103f9ad5c9b8", "value": "49152:vriz7S0kk0Q6Wda2C9Zpt44FIM2EScChdC1lhNiCyoQcJ7YR3L0HmJY18cJFk9nK:+CXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812237, "uuid": "3003748c-9383-4e0e-8322-fce9e1bc0606", "value": 18637824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812237, "uuid": "49b8679c-c90e-4335-acd7-c0802e41155b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812237, "uuid": "576cce74-aa39-4c45-aa2e-3ae6fe1d1537", "value": "hack_game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646a6750-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816440, "uuid": "c27e1257-9671-47e9-addd-4084e2c6bfd5", "comment": "Malware payload (Mirai)", "value": "6fec56a78de5e3ddda4a719ac9df4f19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816440, "uuid": "34743538-0d57-477f-8cb3-8a0dac5afebb", "comment": "Malware payload (Mirai)", "value": "2e036b1f7a104e839e517be8df152b2a297f983257d3914d5e2622bdd160db33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816440, "uuid": "a2c5001c-062f-49b3-b24c-0c0832abf8c0", "comment": "Malware payload (Mirai)", "value": "6b8aefe6a49ece27eebc48b56cd3e4e2068ab59e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816440, "uuid": "3c5325a7-b694-4c13-923b-a6ac6caabc9b", "comment": "Malware payload (Mirai)", "value": "f63806de74ec6d014ad2543a62cec6b9ef0257a2ea3b9b46f075c641650f7236c9da5862ae0a24dff998cfa56fa648f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816440, "uuid": "61a2c5a6-5c76-4eb7-8826-90f486826a1d", "value": "T135F2D0AF078346B9D82259B9427B07813F128D790DC71D0FC3192DA5AE925BFB4D3E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816440, "uuid": "a60c0bf1-ca73-4138-bdab-5b7e86d7e328", "value": "768:SqO53hLpBPh4WwWCq8bmSjfpLNScjPo7M7OvJgGlzDpUYs7:0hFBpMjnbDjfpL0ko7DtVqYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816440, "uuid": "03e1489d-201e-484e-83ba-1671e6ad92f4", "value": 34988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816440, "uuid": "5d0f18ea-95de-48a7-93c0-19308a2a4566", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816440, "uuid": "c9aecfa6-07f0-4866-9be6-b6b459287248", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebda045-0712-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770791063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791063, "uuid": "28f79156-4843-41bf-8089-b2f13bb6ba9a", "comment": "Malware payload (Mirai)", "value": "0e4643a56cd904f377ff4e26046440b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791063, "uuid": "66361a5e-ca2f-474b-be66-36c64933444d", "comment": "Malware payload (Mirai)", "value": "2e1934c3e181edae1dbd2473eb29ddb76f5c2627e2e3b0e259210c6195a96c96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791063, "uuid": "531c1f19-f613-4d77-9646-1b1a8195ba65", "comment": "Malware payload (Mirai)", "value": "bb6e36ab95b8590f0839ecb64773772d820915ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791063, "uuid": "e6d6f0c9-fafc-4eb4-a69e-45fc77af72f9", "comment": "Malware payload (Mirai)", "value": "b16d24116e19d5d2a7b403802457eb9f650a4be32bb3be10d93f6ee76e1f818eaaf1f7ca656084ca5d652f56abfcbe01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791063, "uuid": "907029b3-dc85-401d-91d2-bc73418fb4b2", "value": "T12304A71E6E228F7EF6A8873447B78D21976823D623D1D685D1ACC2141E2039E645FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791063, "uuid": "302513ea-b432-4e5a-be14-a15fac586e23", "value": "3072:ePD7oJXdwWQok8L5RHqDEMLvCtUlRqQU2:cD7oJXdwWBrKDHuUrq/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770791063, "uuid": "7c7b7969-20a5-4390-9b30-73d08e5b2251", "value": 181828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770791063, "uuid": "84429a71-800a-4aef-9f4b-04776407d85e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791063, "uuid": "6615a3d3-c5d2-4fed-a240-6a3609ad195e", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43620a57-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788038, "uuid": "f4b29d12-44f8-4cd4-ba0f-33dc460ce3cc", "comment": "Malware payload (Mirai)", "value": "846218b842a2cb117fd1ec42a08240f2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788038, "uuid": "f737c7e3-b8ee-4edc-a179-12147c4eccd7", "comment": "Malware payload (Mirai)", "value": "2e581136bb3d0caca689e3b69c7c3c39d41e38f2cb64990d19edf191743f0729", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788038, "uuid": "723a7248-9758-49c0-90be-f8c42a524273", "comment": "Malware payload (Mirai)", "value": "987579ed81ebc7e2b2959cb9fa2969c7168996c9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788038, "uuid": "c0a06d9a-d152-4e33-b738-031c44fbf919", "comment": "Malware payload (Mirai)", "value": "316f218b741ce35a60707cc99e8a6dd82c3da5d702e493956d6fbf7e5c9f76d5f36987b664ea1703343922357811417f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788038, "uuid": "bf42516c-8457-4761-a9ce-40cdf7b3fd71", "value": "T1DD4192D980619DA97D9D5D01707B8C40F0E1EDBA2A48DF066ECCB8B3DC8DF41282AB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788038, "uuid": "99d6b567-cd84-4d6b-8c95-30cfba59ef8b", "value": "48:9XeXBXCAXWXHXEX0XNXSX7X1QfXaXfXciXpiTXQXm:9XeXBXCAXWXHXEX0XNXSX7X1QfXaXfXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788038, "uuid": "a434741c-6989-42c8-9433-b5771fe1af47", "value": 1959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788038, "uuid": "bca9a21a-5fb3-4d9f-9981-684cccf58498", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788038, "uuid": "d0a5645a-e550-41cd-b32f-f4d5b7b5f789", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71524364-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788115, "uuid": "6cb0a87e-9cba-4162-a6e1-535682edf433", "comment": "Malware payload (Mirai)", "value": "95eb67a4ce356dd1fe5c984d9f2b42e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788115, "uuid": "3ae4a2a0-5dfb-40cf-9fe0-7a0fe61af152", "comment": "Malware payload (Mirai)", "value": "2fde3cc1e650ac0572d644e6464d8eea331f33abae4332e3a98d7b14366e6a97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788115, "uuid": "9c45dd7a-abae-46c4-a0c3-3746181ad2ce", "comment": "Malware payload (Mirai)", "value": "d09bf387b00ffdb032ad1c40a7861320f877de69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788115, "uuid": "df2214ab-bbf3-46e6-80a6-dfc8c9d639ad", "comment": "Malware payload (Mirai)", "value": "d8363aae6b0350fd5f8290f64584cb1d09c88b6bbb9478d0a0643a6acd5218c957e9fbea1a0ec31fc843afe26991be73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788115, "uuid": "7c9ff3e3-e8f4-41f1-950d-0df6ec70b542", "value": "T12224F947B991CF12C1C111BEFE5F418D37136FB8D2EA72029D246FA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788115, "uuid": "d84c329a-1125-4a66-9407-0bb39c9482bf", "value": "6144:Ip4nw6IdA1Twfl4ds0aVGGp8CwZ9YNJmh0jpP2:IKwi1Talz0aVEHZ9gmujp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788115, "uuid": "23caf9c6-a746-41c4-96df-949a975aefd4", "value": 221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788115, "uuid": "4aeb08af-dbd1-4904-adaf-b5fdc9c0e889", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788115, "uuid": "a0e366e8-59c9-45b4-a48c-9d056f26046c", "value": "bin.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741b0887-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788119, "uuid": "de498822-ed69-452d-b762-ea98cbc80c2a", "comment": "Malware payload (Mirai)", "value": "f0edbea2defaf9796c0329e5505b27d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788119, "uuid": "5f260d55-a916-4c13-a53c-4239eabc2f9c", "comment": "Malware payload (Mirai)", "value": "2ff1842ac3f7f21a55a8ae3fb748d46d7852f25fc3edef328ec6349302090c14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788119, "uuid": "9a39a3a6-49d7-4088-a8a7-58e4abaed12a", "comment": "Malware payload (Mirai)", "value": "c356c2b265f712e0f6dd8aced73ab92618eb7f2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788119, "uuid": "aaa59122-65d1-45c3-a38d-6e560306b82c", "comment": "Malware payload (Mirai)", "value": "bc16b4675895a1b407d1e0902fbdbfe214330fdaf63dc202315c4e52b10945ec1f054eaa8ad282ce34c37fdfb66fcc41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788119, "uuid": "7f686fb3-4fd7-4dfd-91a4-cfedcb5a53c0", "value": "T13174F8113B47EC6FFD6A43B40AF78A7477DC65A22561889AE26EBF4D1F310D10D08AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788119, "uuid": "8350b05f-5f34-48bc-aaa8-c2c8463a1f29", "value": "3072:C9Q3Rf4V+JKBLCwvanDIryZTl/BDftnpj1PR2bm47Y7+4T/sgqT9AtYPVpzHyGEQ:H4V+JKBLcnDImiSfhe5VptEex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788119, "uuid": "af2a149c-0dbe-409e-8bf2-af46e3041803", "value": 342256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788119, "uuid": "f0f0698d-c9e3-4ff6-a946-32842a37e56a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788119, "uuid": "e461c444-a3b0-42a0-b93f-f28b0ac56e4f", "value": "bin.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8495c32-0798-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770848847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848847, "uuid": "b871cf3c-742e-4980-a8d0-b74ba4bb2d6a", "comment": "Malware payload", "value": "7bf3ce1e5519eb5650667741927825b1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848847, "uuid": "bec3a0a8-1204-4902-b1fb-61b6f2d45b8f", "comment": "Malware payload", "value": "3260f9904459efbde89a42a10b6f3f9ec9536bff9375263bc4902ca9effa87dd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848847, "uuid": "e5898f80-0e44-4794-bf80-c183fbf211a6", "comment": "Malware payload", "value": "babba58908d0ce5bcf1bb85f2e9922a8ca3f52d9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848847, "uuid": "872cc849-cc07-407a-91ef-e37046bf4cf7", "comment": "Malware payload", "value": "789517cd2cbd1020dd0c0ccac31088db1c659c2155a6a4c9cc2ecbb64177bc43110462c0de2519dc2c372dead50da9e6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848847, "uuid": "aaba354c-254a-4ce1-9026-b33792ac66ed", "value": "T139447C1A77940CF9E977813C8952494AE7B2B8150B71DAEF0360835ADF376D09E3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848847, "uuid": "428665a2-176b-4205-9c9a-b1ab03d88eda", "value": "dbf3ebb395a90be1343821c7926930cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848847, "uuid": "866b7bd0-db0b-46cc-9cfc-c07e9b22b46d", "value": "6144:Ir/yG2cJOeRJTG+UuQdaVF3kqvohI+LmoqGG:M92cxtGez3kYoi+Mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770848847, "uuid": "a604331f-0ad4-49e1-8b5d-d2bca861a08c", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770848847, "uuid": "a0dd08e6-8e09-4961-bf6f-a04c8e34daf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848847, "uuid": "dfaf960e-f134-4950-a07a-f145dc1e7e6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c22bc86-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816507, "uuid": "b3229285-7b0b-45ce-b378-b710dbe80353", "comment": "Malware payload (Mirai)", "value": "16592af7bd78796a712b37f9f6606a5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816507, "uuid": "075bb7df-2b0d-47c5-b96c-9c0b9c3c428a", "comment": "Malware payload (Mirai)", "value": "32b0be421f8232d59a04c55923f61fd3057220e744e0ba5e904b86b868fff85f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816507, "uuid": "35175214-d627-4a1a-9b4d-cd2fc2992141", "comment": "Malware payload (Mirai)", "value": "554db384f826cfcf17ab89e9afe2772d7b73fad3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816507, "uuid": "480786be-f16a-4c65-b17a-bd8721180977", "comment": "Malware payload (Mirai)", "value": "9b9b708041085a01d5bbeef0f0802bbcafafd41750cb886956f4b96852ea01a50c83951200563965920ad0fc610f5990", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816507, "uuid": "10d2a8d9-c2d6-4f54-a65f-c83f7faca45b", "value": "T1A2A3850D7E258F7DFBAD863447B78F219248339A3AE1C684D15CE9012EB024E745FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816507, "uuid": "675a6693-cdf8-48b2-be44-b32bbccfd97e", "value": "1536:ENZUUyaccudSFwnlPTSMRVH1MNNn0XGFTOdcJnRnC1qVYKA0OBedl:rU7LudSmlPTSQ2NNnosRnCEVYKA00q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816507, "uuid": "5680aa97-ff01-410d-9804-299c1b5c4e50", "value": 104776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816507, "uuid": "b6a397f2-3afa-4bc6-af1c-1fe02ff99bdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816507, "uuid": "d3cee4ae-b029-438b-9539-cf4eff90ba4e", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5eebd0-0741-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770811142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770811142, "uuid": "fe995d5c-000d-4ac5-a3a2-727497edaff7", "comment": "Malware payload", "value": "dd08f6e60e91379d40814efd4a798ba8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770811142, "uuid": "c55f9363-6b81-4a13-90f4-ca338886afdf", "comment": "Malware payload", "value": "3311fd48e80bf8bfcfa5a76ca959c416340dac142fe0f96056c4909e7019f977", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770811142, "uuid": "38397473-db3c-45fb-9ba4-9112a82b4e08", "comment": "Malware payload", "value": "4ce3e7ce8a1d47c3a6a241364ab90fb6f7078a97", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770811142, "uuid": "aded59a6-8987-4d60-896e-e39318db1a10", "comment": "Malware payload", "value": "cb49e9c03abee3310dd896d794cfd4ccb7d181e7d69aa7004004a2e0c1f4065044546957734ba3b2155ef6b06bf26168", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770811142, "uuid": "f03a2a69-9e6a-4d5c-afbc-054c04bae322", "value": "T1A35633FBA635118AD93E57B697AC14A7B676B8DBD5054A7FBD3CF3232F216C88100801", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770811142, "uuid": "e1774e6f-5a19-4d73-961c-904f9419f09e", "value": "330d64f4c89cdab49a08a885a680fa73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770811142, "uuid": "0425df09-8951-4c16-a2fb-d7a034ae50af", "value": "98304:m4A/bIgtfCi9RlC0nXgXRW8Ec91BNFYsMiuNEdlE3JNKeUiFaowjkdP0g0yGWjX:m1t6AlTXgXRWYN3RuNCq3JVUPQP0xk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770811142, "uuid": "f2518ef8-5576-42d2-8934-0cadcfd1f020", "value": 5899732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770811142, "uuid": "68d53b8c-a130-4e22-8c2d-bacdc5ddefa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770811142, "uuid": "86c0743b-a694-4542-b8e8-c51434ce25e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb1c115-0747-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770813936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813936, "uuid": "68078bb1-4000-4573-8378-305d3b05b820", "comment": "Malware payload (Mirai)", "value": "7eb8db7900ad95730487d9f8aaa98157", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813936, "uuid": "3422ec15-a3dc-4fe6-8768-125f71a1adc7", "comment": "Malware payload (Mirai)", "value": "333eb16c661da3c7beb3b753bf29b166db45ee40e29ce0ec3c2e68c4e9187259", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813936, "uuid": "6092fdc2-bf8d-412d-b8e2-65c78b712358", "comment": "Malware payload (Mirai)", "value": "e63ce90b791db69fca6655b47bc80ffba74e83ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813936, "uuid": "901a4f4a-aca4-4485-853d-951712816726", "comment": "Malware payload (Mirai)", "value": "1d426c13627823898a6775d6f278e28289ab040344e0ad92a6ff82677618181c98f3f71a16b0ea65386bc47270dc58e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813936, "uuid": "2056c0ff-8127-45c2-87e4-633e75c23723", "value": "T12033F8C4FA8B85F5D907493040A7F23FCA32D97D4071DA9DEF8A9F35DA37942921224A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813936, "uuid": "81b5bafb-c086-4854-8559-900003c05e2a", "value": "1536:Rh24UVHA1JqOMnjoMGhlV9LNSaR0hws4+a:Rh2VHA1JqOYchT5NVR0hws4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770813936, "uuid": "0061009f-eafc-49a4-8bad-e7e35b7a8997", "value": 54064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770813936, "uuid": "37f7ddce-e7da-40af-9909-9882487ce644", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813936, "uuid": "3d6cfafb-2174-4351-809a-ea92bb0efd37", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63db6b25-0724-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770798830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798830, "uuid": "994bcd8c-4b3d-4bda-b51c-0d889d37bbf7", "comment": "Malware payload (NetSupport)", "value": "eab3ea4c4db24c548bba045765fb89a2", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "osdifbuertosisus-com", "colour": "#8CE672", "exportable": true, "hide_tag": false }, { "name": "trumbinostayu-com", "colour": "#6CC77F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798830, "uuid": "e5939f00-9554-48e5-b56f-e15997b29c05", "comment": "Malware payload (NetSupport)", "value": "339a56c0748ebfd8124ecddcf76b0f3684a0e6476040914a8a80347b0d5f4841", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "osdifbuertosisus-com", "colour": "#8CE672", "exportable": true, "hide_tag": false }, { "name": "trumbinostayu-com", "colour": "#6CC77F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798830, "uuid": "5d573e6c-9f3c-4db2-b623-433e728eb6ac", "comment": "Malware payload (NetSupport)", "value": "485f7cdedee2ff79e8eb4a13510821450295a41f", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "osdifbuertosisus-com", "colour": "#8CE672", "exportable": true, "hide_tag": false }, { "name": "trumbinostayu-com", "colour": "#6CC77F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798830, "uuid": "ab418825-e615-43f9-a789-35db53261839", "comment": "Malware payload (NetSupport)", "value": "4ee95001d506547d55daabfe0e1184edd33810ccbd5c80295943723751e41b1197ee357b6181a0ccaa42d2cfcb17cfc1", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "osdifbuertosisus-com", "colour": "#8CE672", "exportable": true, "hide_tag": false }, { "name": "trumbinostayu-com", "colour": "#6CC77F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798830, "uuid": "d68b28bf-1ec7-4d4e-81ef-76594dbf69e0", "value": "T130A2F2C6D8387603E00ACB7F2378924313A76C9D474F4B7AF5EBB3501D160655E9B81A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798830, "uuid": "077f4221-22ec-436e-ab5d-24813164aca7", "value": "384:15RaScOps9u2j2UlY1Zi9pVL/0+Y3Ga7q749prswcOmrOR68bvELtPjCI:jBcOp6u26UlSZEV/x3a7VlmrKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770798830, "uuid": "3a26bc95-51f2-4292-a8cb-833eaf96be2c", "value": 22103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770798830, "uuid": "0e8be053-9079-46a6-b6b9-335e63f1e471", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798830, "uuid": "561b379a-9086-4d95-bfe2-25c7d64b61b2", "value": "ns.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c668fcb-0764-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770826278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770826278, "uuid": "896836f1-ae98-4bc3-8e0a-731deed2a760", "comment": "Malware payload (Vidar)", "value": "aa9cc1820dbdcbd1b0c26457b9f7aee4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770826278, "uuid": "1c0d3aac-b256-4672-ba10-30bdc09a135b", "comment": "Malware payload (Vidar)", "value": "33cb9904dff99ead432d91d43e325f3eae9776ffbdda10027e5f45ca0b985015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770826278, "uuid": "77c68ac8-6f00-47e4-a334-ea40149d92d6", "comment": "Malware payload (Vidar)", "value": "2d4301d45b6e79cc15a9d82c9ce490b34d3e35bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770826278, "uuid": "0a70fa2a-3e28-4e44-b1cb-7f80c78ed170", "comment": "Malware payload (Vidar)", "value": "c5b018316f675038500d90000fea9898e5eb8df1928f6797990bbdea6a61c7e0c3f88d5df2193f3684a13c0c0860a7a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770826278, "uuid": "4e7ce5bf-68d7-47d0-82f3-ae4f59a63b94", "value": "T156F53A2AFC6954BED6BEF03895A05312773134644331BBD30A98647E1DA6AE85F3E31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770826278, "uuid": "e53fa4c3-f5e1-4377-a564-f6816838a743", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770826278, "uuid": "5d18092d-55da-455c-a6fe-4114be92b6c6", "value": "49152:JbdR3ylrh3iQgf47zBenM8opOoWFyXeJJNKHCct0/m1Qm4vQMCKzoY34aJwTI474:p/3j6f1/V+WH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770826278, "uuid": "2f654505-e70c-47a6-b021-02ae4c31849c", "value": 3345920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770826278, "uuid": "79d61083-32cd-483b-852e-355f78ba5213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770826278, "uuid": "19305886-9fe7-4de9-955f-bea05074d2a1", "value": "Bootst\u0430\u0440\u0440\u0435\u0433-\u0410\u0440\u0440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c97fe34-06e6-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770772162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770772162, "uuid": "74b1cf6c-d5e6-4d5c-bfac-441346e3de6c", "comment": "Malware payload (Mirai)", "value": "e883826c64f2e3e55bff45b60a232fce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770772162, "uuid": "30955905-eeb9-4f77-b7b6-3f66275efc7f", "comment": "Malware payload (Mirai)", "value": "33ee4b5006edf70264e6d66e759a320fb57e5955adf83b173fe01f8be27d922c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770772162, "uuid": "faf5be85-e6d9-469c-87f8-2b791e9045cb", "comment": "Malware payload (Mirai)", "value": "b19ad9cf01b2633ec3c80f80564be158cf412178", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770772162, "uuid": "507b2dde-7fe0-4745-8ef6-b456595cb9d3", "comment": "Malware payload (Mirai)", "value": "70e75ad903c9956282053d129c5a391d5166c6a4dc7727906db426da893d0df3f783a35f134c9da923457e981a948e50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770772162, "uuid": "dadc629a-0217-49e2-baf2-892af738e94f", "value": "T1F4F34C52EA814A13C0D6177AB6AF4245332397A5D3DB330699286FF43FC679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770772162, "uuid": "b357a26a-a6f0-4ad8-ba81-4093cde1a4ea", "value": "3072:EFDsEyM/Nm8L52U92obxlYasB8cjekiFob9MrtL/xNpM/9I2msU:ECNM/Nm8LwU9xHYasB8cjeDFbrtL/xDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770772162, "uuid": "9dc5843f-4814-4069-b908-1aac1b6b499c", "value": 169238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770772162, "uuid": "9676e974-c754-43cf-8a3d-d55343ace04b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770772162, "uuid": "2a7220a6-ca6b-4f6d-96b3-037e1762915e", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6e3be3-06ec-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770774663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770774663, "uuid": "cecb35d0-3ad8-4d82-9580-4ffb7c7905a7", "comment": "Malware payload (Mirai)", "value": "7d09c782b127c400e19acf980beed2c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770774663, "uuid": "93d7a87d-a703-4ad1-90c1-5fe66ff84988", "comment": "Malware payload (Mirai)", "value": "3402c1d5374d94180bc02fe35f8e482c6334aba619fe08c5062cf315e063a499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770774663, "uuid": "1bf91d35-4805-4a04-a76f-0b7d39b6561d", "comment": "Malware payload (Mirai)", "value": "da97f2f241bfdaa04329eef097eef45a70ff2c1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770774663, "uuid": "67e98d14-a691-4cab-a332-f3feb9707593", "comment": "Malware payload (Mirai)", "value": "ef42d079ac966095619e219ae3dd4bc84c73bdbb521d9cf4c3ea507f55d36edc41b24288b74da2ca9c4f6b330693ea6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770774663, "uuid": "cd3489b1-c6fe-4fdb-8d70-1bc10fcd2582", "value": "T13C833B46BD919613CAC513B7F71E02CD372663E8D2EE32139E219F21378A95B0D7B252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770774663, "uuid": "1be73b52-8e6c-4924-87f9-c3a2baa6a938", "value": "1536:MWWPxyYGhB5gFC6sbaSO0fbmhJ1XhW8cYtbN9lKRvid:MWoQBhBoCySOhhJHtbDm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770774663, "uuid": "0ddc3549-e06b-406a-9830-2e7557916bf0", "value": 81532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770774663, "uuid": "87b85303-4df1-43f2-a942-16b1a95e41cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770774663, "uuid": "83e29d0b-ae05-48b4-9a3e-15b141951431", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe996df-072d-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770802635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802635, "uuid": "9b3142e7-215a-4bd9-8936-b5829d82d8b0", "comment": "Malware payload (Formbook)", "value": "fa80695454c493733214eaf5495e0ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802635, "uuid": "ae3b2ca2-1e1b-4855-af33-a4659630b659", "comment": "Malware payload (Formbook)", "value": "35111880b1bc72eebb20a75cf21d611c6dfc2e3d68f27a7589b69677cec52b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802635, "uuid": "2983c6ee-e431-46aa-9943-40b72383c10e", "comment": "Malware payload (Formbook)", "value": "5b0e1c81eb5dcf8b26644d95240050f6a282cfe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802635, "uuid": "7b80e4db-51c0-4f9c-84eb-ac38e01b4985", "comment": "Malware payload (Formbook)", "value": "6bbc4729e6580d1d8402dc421128470fff0eb6c182abed89c0ea24ac8fd2a813a3a95faf81bb972f8d8b6561ca3c6ca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802635, "uuid": "50e55781-c8ce-42c2-b9a1-0fbd59a2f752", "value": "T1D105AF5DE5E260D1EC2288B30F5E97D18E1B7213A7965C9723B807044B934FB2E6EB17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802635, "uuid": "d732786e-cbf5-4265-bd62-a89bc60b0b4a", "value": "244ab0ad2291503631a7b67d57f64503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802635, "uuid": "f6e9aa68-86c0-4150-bd3f-a8c71283bd0a", "value": "24576:xXr4nGP59Wb/YVX8HQEFQcndnUk924tV:xXBP54r2MwESSnUkg4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770802635, "uuid": "dd053eda-672a-4617-bb0c-8fcc4ec86498", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770802635, "uuid": "f3b3f2ab-2d0d-4145-b137-a703f0e74fdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802635, "uuid": "f228a8bf-a8cf-4dc7-b475-e8f927fa7054", "value": "MT Stolt Endurance_Vessel_NEW-83882100292-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e31885-078f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770844915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844915, "uuid": "7cf9c20c-418b-42a8-9c5e-2e84fda76853", "comment": "Malware payload", "value": "ddf75cc7e322d75de77b17c8ec887975", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "hero-dll", "colour": "#1CD325", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844915, "uuid": "babc82e5-2a22-4e82-8e3b-19e32425d567", "comment": "Malware payload", "value": "3544ffefb2a38bf4faf6181aa4374f4c186d3c2a7b9b059244b65dce8d5688d9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "hero-dll", "colour": "#1CD325", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844915, "uuid": "ad4b37f4-cbf0-48c0-9298-8cc61803a0ac", "comment": "Malware payload", "value": "664e87fe1d01dfe6f03f6027c09fcfa117ffb27e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "hero-dll", "colour": "#1CD325", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844915, "uuid": "2825466d-e05d-4656-9cd5-f7e6d9982a37", "comment": "Malware payload", "value": "fb843fc0ef9db593be10f98b817533f264d97dee48b01ed53ffe123440f917dcbb95d7b1478f07705b763310b6ca21c7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "hero-dll", "colour": "#1CD325", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844915, "uuid": "1c056cbc-c76e-40ed-95e7-d04e32fde9d6", "value": "T1FE463A40FAD754B7EA03163014A7A2BF27306D054B26DB97EA14BF6AE8777D10D32B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844915, "uuid": "bb4ff298-5879-4503-837e-e524b7bbdbc1", "value": "ef2950805cfd017c3b005284a639e584", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844915, "uuid": "7dd3e1cb-9cde-4d5c-b01a-0611c6facacb", "value": "98304:mXWzne9GfzQDckzseTgxsSGs9KvwcqVT4dbhw:CWbnWKs2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770844915, "uuid": "84a80804-7e7d-4efc-aeae-7fb44d5b4575", "value": 5682336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770844915, "uuid": "e7ef2b9f-05c0-4dbb-9e4c-8472532a5196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844915, "uuid": "387ed217-4dca-4d24-9148-40e37dab1d88", "value": "hero.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5c26c9-0762-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1770825553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825553, "uuid": "31d344a5-7d31-4b60-90f5-6fa2d4be6ef9", "comment": "Malware payload (DarkCloud)", "value": "c4c087a7d50da536d7bbd1abf07e2515", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825553, "uuid": "bed1eb74-96eb-4951-ad71-56e8446e1e26", "comment": "Malware payload (DarkCloud)", "value": "379f70da9a5e49c82befae14511b69222ab8cef2f084876410be9621d5bf763b", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825553, "uuid": "cb493bec-2a46-4ff0-8c91-eaf5c2f56fca", "comment": "Malware payload (DarkCloud)", "value": "e8e0538bb0abff678319e71e03bf29ac3a648eba", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825553, "uuid": "37a72e37-56c5-407a-9a20-afc26b63b259", "comment": "Malware payload (DarkCloud)", "value": "43a31dc74fa208258cadc98cbed613df2f447160015a85a660f9974bceab7edcf4265721768cebc4016490dc4b099b85", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825553, "uuid": "57405dba-16ea-418d-b6d3-94b4dad65f88", "value": "T103F287CCFEF9C89E355B15C0E47CD6AD3D6F88A6B161685E9A90848BB931E470027C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825553, "uuid": "1b46b736-b2c0-494f-a840-1ff8e3bda646", "value": "384:PhOwSvEi9oj6/1mReyUdfZIf5R9cbZ5Lr2u:IwSvRt0ey4RY9cnXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770825553, "uuid": "200a5520-b5d9-467c-a05a-065b8afd0806", "value": 37424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770825553, "uuid": "18379281-ae91-4bf7-a071-0f20a85403e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825553, "uuid": "89f575a9-b3d1-476e-bc5a-dc5b651d94c2", "value": "INQUIRED ITEMS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78173efe-0776-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770834082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834082, "uuid": "2aecee98-52c0-432e-abe8-fb636e9f67c9", "comment": "Malware payload (Mirai)", "value": "bc5db5310680b4dc63f09fca4346c62e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834082, "uuid": "fa71b5a6-225f-4dad-bc47-fb0c6557ebbf", "comment": "Malware payload (Mirai)", "value": "37dc9883c67f2e6f6ad2f67c47e20419ac19fdd7118a287815586e5388169b88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834082, "uuid": "1a7dbe43-3c9b-4104-9d44-716be7016fb9", "comment": "Malware payload (Mirai)", "value": "93fe600a39d0ad79c838a714fc096507694501b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834082, "uuid": "1f0cb999-fd50-4621-b095-4b23028a214c", "comment": "Malware payload (Mirai)", "value": "fe7ffc2087da60839ddbbce44ed37b68685c2f3c67100920898a604e1fe5a99c4959916fa0827854fe2464a9e91cee80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834082, "uuid": "70da4faf-2311-4ca4-a341-77543702db21", "value": "T1D7E2E0EAB0F5CA61DCCE6078293D7AC65DA4C22D914C4CCAE484B97F9C523016E2CF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834082, "uuid": "88895507-0c1b-4b26-92b3-45ac6b4eb8da", "value": "768:Q2eyAsTynzYGvqqZydWSSiSdbSl97CF+xQnbcuyD7UM7z:QNw+YRVdWSSTbSl97CPnouy8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770834082, "uuid": "534eba3f-fafe-43e2-80c4-91c90b45415c", "value": 31756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770834082, "uuid": "fb75078f-6e0c-4a73-aa86-da7de9defcee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834082, "uuid": "ec1b6321-0523-46d2-986a-e64df3f6fa0a", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e21d921-0791-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770845716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845716, "uuid": "8193b4db-cdb3-4977-8a99-e890fccc476e", "comment": "Malware payload", "value": "5a6ccad09646dfd5835acec5a6a3f90c", "object_relation": "md5", "Tag": [ { "name": "7dg-exe", "colour": "#0D2FBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845716, "uuid": "ed35335b-2f57-4590-ab14-1dbabfae4c86", "comment": "Malware payload", "value": "3889adee3c6a2ff8660675b0aee8c419786529e05e82a5cca8e3e419c266990b", "object_relation": "sha256", "Tag": [ { "name": "7dg-exe", "colour": "#0D2FBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845716, "uuid": "ac0d770f-d3f7-4a0a-8b7d-d723ea9b2b24", "comment": "Malware payload", "value": "589b51cd971a4a1ffde72213dacdecd5f0ba0715", "object_relation": "sha1", "Tag": [ { "name": "7dg-exe", "colour": "#0D2FBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845716, "uuid": "7642cf6a-94e4-45f1-bf75-9d009acf44a1", "comment": "Malware payload", "value": "039a563e575e4d06442cac7c43f6025de2f2dfaf9a79c3f6d57929a06d99d48b195ee2b5799086b309b71dd52491ab2a", "object_relation": "sha3-384", "Tag": [ { "name": "7dg-exe", "colour": "#0D2FBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845716, "uuid": "e30776fe-3623-4780-b6b0-210b2c8b92e6", "value": "T156948D117BF4D43AE2520530CF59EBA1B4F5AAA88D344C4773D41E1D2B35D85E32AF2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845716, "uuid": "1b43c0fe-573d-4fd8-9fb6-bbf9d00d3d0a", "value": "22ea1ffd699e61d7e25f4ee69976acda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845716, "uuid": "9bf872bf-eadd-4db1-9ce3-0d06f08fd686", "value": "6144:PqZhz0SVuDygTkowcVTLEoMMKSwfcClp/Ui8WVCiCGyrLgjeliuSTWWJIy:Yhz05DyELwcJLEOx85p/UiQiC1otTWWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770845716, "uuid": "82b872ea-2662-4d9c-8ae9-5fd0a3c876e7", "value": 444376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770845716, "uuid": "e3146d5e-5bdd-4695-be10-2ad0d0b66de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845716, "uuid": "2ae974b3-e722-462d-b0c3-45c4ee089a51", "value": "3889adee3c6a2ff8660675b0aee8c419786529e05e82a5cca8e3e419c266990b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7b936f-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788108, "uuid": "c53c0b44-dd13-4912-b45c-8886bd534172", "comment": "Malware payload (Mirai)", "value": "046cbe01473c20632ea838cee866b347", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788108, "uuid": "fb40f757-fe91-4b9e-b52d-c1be08794a04", "comment": "Malware payload (Mirai)", "value": "3923ca2c9b70f8d55c3ebf4c977a2c2a26963f3f2b2c62530d30e9e58e7d3fe9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788108, "uuid": "1fcfdc50-8f24-4835-a29a-cdfc71127ed4", "comment": "Malware payload (Mirai)", "value": "d972e0b41fa259fcb74d33e4dc9facbbee333301", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788108, "uuid": "ccc6b059-f3fd-4014-a72b-8e5140a84306", "comment": "Malware payload (Mirai)", "value": "4eab52dd11e63e4ca6dd650dcc113c3e94977abb97817263f804649ef78160267edeb1edd33989ca3f6da78126d26d13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788108, "uuid": "1d49a224-3c86-4ffa-80c0-32428a069c95", "value": "T12914EA46BD518F23C6C311FAFB9F429C772667A8D6EB3102DD157FA437864DA093A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788108, "uuid": "9c73380c-0371-49b3-9fe6-0de128ec9c84", "value": "3072:pimS/z//o55nnTAHfWfib62OKTEADIN6kPLUrF6ZkgwJJgjjR7nG6gPL:fMzXInk+6e27TdDIN6ILDkxzgjj6PL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788108, "uuid": "77118177-5c4c-4521-824b-71a06505fe85", "value": 205404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788108, "uuid": "04aaa35c-aa4f-497e-a191-59d3621d4388", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788108, "uuid": "74fda9e6-dea6-4819-aee9-94800f0492ce", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7110af80-0738-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770807442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807442, "uuid": "dbb2fa2d-1ff3-47b3-8292-6bb13291988a", "comment": "Malware payload (Formbook)", "value": "bd114768aa1bacea1c5f54ff8c66d021", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807442, "uuid": "c8a50f60-1eb5-4137-86cf-efeeb24ffd4e", "comment": "Malware payload (Formbook)", "value": "39d4b2c2f232d51c44e28e77ef48a8f57803f053f7ab864de307f6a45fe5705e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807442, "uuid": "ef1d3708-b9d4-48e7-b745-8dd0868623ac", "comment": "Malware payload (Formbook)", "value": "18356f3d4b4791b4afe369bde8ef25fb469a15cf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807442, "uuid": "f5bfa1b5-991e-4635-a362-f4aa503046ff", "comment": "Malware payload (Formbook)", "value": "f126086729a0338dc8c57c08dc108df5285c7a11e778c97d95ca0ef3bafe239c73d67377e20f552947c84c831d045666", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770807442, "uuid": "00f9e0b4-da3f-4f47-ba32-db5a5a223d2f", "value": "T17F533E6081F505BB3770377099EFD6731BF9AE80EF51894827C63C9B8DCC6390A86A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770807442, "uuid": "0768f088-fc1c-4cce-acd5-a461dab597a4", "value": "384:oRzWfdSZimtLZMtoBLha8NIDcuqYWMMwoDqK19ZrTXt8pJRQK/lkITJoDR+z2f3Q:oRfFNIDcuLGvEQA7okUt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770807442, "uuid": "9e34f7f1-5b1e-4981-9aef-c7b7cf0b6285", "value": 64063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770807442, "uuid": "fb096f2c-89cc-4137-adb9-7ffdac6a2810", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770807442, "uuid": "ab00fda8-07fd-422e-8f8c-ed1ab5c4716b", "value": "Generalii-SB456365.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a36ca36-075d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770823375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823375, "uuid": "0dc0f984-bc2c-4b06-8ba1-c7cb8f7721cd", "comment": "Malware payload", "value": "58dfadc001b566f8d241da5340d1d91f", "object_relation": "md5", "Tag": [ { "name": "45-61-136-85", "colour": "#8A5B85", "exportable": true, "hide_tag": false }, { "name": "then-hclientesbr-com", "colour": "#294EC5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823375, "uuid": "d261a497-8022-449f-b458-32f8e771fd61", "comment": "Malware payload", "value": "39ee63943e5ed6e05a2b2d6aeb9b4885366a9a6c6b2365d4172ec053f85718d1", "object_relation": "sha256", "Tag": [ { "name": "45-61-136-85", "colour": "#8A5B85", "exportable": true, "hide_tag": false }, { "name": "then-hclientesbr-com", "colour": "#294EC5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823375, "uuid": "3fd709d8-9d63-4e68-ae9b-3011c1bed08e", "comment": "Malware payload", "value": "f401b4de33651d0b1f84489b6ce33ef056591786", "object_relation": "sha1", "Tag": [ { "name": "45-61-136-85", "colour": "#8A5B85", "exportable": true, "hide_tag": false }, { "name": "then-hclientesbr-com", "colour": "#294EC5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823375, "uuid": "433161bd-13cc-4f5b-b18e-018f11d783fa", "comment": "Malware payload", "value": "6faec9b99e4321ac155623a0d9ec4977592a05f720faef17de5fbcb162194af7eb4103685345c192d834784d62060f25", "object_relation": "sha3-384", "Tag": [ { "name": "45-61-136-85", "colour": "#8A5B85", "exportable": true, "hide_tag": false }, { "name": "then-hclientesbr-com", "colour": "#294EC5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823375, "uuid": "482cca90-be09-4ddf-b15e-034b7b37f62e", "value": "T19D514A16027DB358C1000DF4771A6BEB3677202420818EA927AB1DC51F9704398E3F71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823375, "uuid": "35917e94-6474-4abd-9dc0-f0ba62b09775", "value": "48:9+S3MfxwsvpVdlIg8DrLC6A94rJkyCfqHO6dl6qMLfWsQR1m6d4p3Z+TvMFWuOm:QMsvUgZ/wkuO6dkrARg6+UTzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770823375, "uuid": "2ed015a3-f802-4d10-8c49-c2679be356b7", "value": 2975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770823375, "uuid": "9909ba3e-316b-4e36-9e2a-a25501494d63", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823375, "uuid": "d2ac0b6d-206b-4340-8eff-efd5a6fb79f5", "value": "983393432362912.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12104bb-06e8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770773163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770773163, "uuid": "2d1a669e-ccf7-4dca-b19f-6acf7f47956b", "comment": "Malware payload (Mirai)", "value": "75561bbbeb4469073f6f53a8d6e2ea3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770773163, "uuid": "a0d6ae60-fe04-4c9c-9293-a6092cc87845", "comment": "Malware payload (Mirai)", "value": "3d104532c24411fcfbcffc3581c37b12a91ddf3d362600d4153793a29fe9c9c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770773163, "uuid": "75ff290b-8b57-4291-a963-3246a3de39e2", "comment": "Malware payload (Mirai)", "value": "9900e87532a86cc4ea3ed7c93822601f15d36c40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770773163, "uuid": "57d45f29-77e7-43e5-863a-7cb4bb9cb551", "comment": "Malware payload (Mirai)", "value": "a98403d32eb7d6684db2d866bb68e9560431072fc42c8cc2b3c5254ae6b2b312de9042a39f586b8f5d71f6e1cc23b580", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770773163, "uuid": "47302f8e-965e-4147-84ec-9d1c8f51622c", "value": "T1FDE31A41FC414E27C6D622B7FB5E428D3B2A17E9D2DE71079D215F20378685B0E7BA82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770773163, "uuid": "75571241-bfca-4253-8c09-28998aa28923", "value": "1536:wYjaXQG+/p8iSy4fT6QaFsIXB0QR1ssAhzhTM2zDv4VDi31TbHfp2Y7Ev5ZxW1yQ:wYtG+Txd4tTMi4olPp2sEpyVowVek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770773163, "uuid": "0822081e-e24d-4529-a969-72075cb108f1", "value": 155264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770773163, "uuid": "4e348410-55d8-4fba-bfdf-38acf658823f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770773163, "uuid": "f4a00559-806b-440e-9514-64b034b14294", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa9b32c-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816504, "uuid": "f5d22ed7-b87f-4c45-bbe5-b04f14ca1f08", "comment": "Malware payload (Mirai)", "value": "0f5f267e769785126a153ec04141eae2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816504, "uuid": "7644fa1b-6197-4501-bd19-77edc287af3a", "comment": "Malware payload (Mirai)", "value": "3e016415f6eb02d1f5c21abe546938084fa9d73286678c52137e10d5acbe687c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816504, "uuid": "7e0b7e14-7e5a-4b87-bd5c-d9ea5f5171fb", "comment": "Malware payload (Mirai)", "value": "5fd1b1c6bd7a32e68c3903a4c61efaca5dd21f3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816504, "uuid": "7f9f46a8-59ff-4629-adcb-5ecc7c771cf2", "comment": "Malware payload (Mirai)", "value": "ba733d0af6c8a91da1dd0218acbfe01094b6da131778ade0280c5be0f4d0978ef1d1dadf84e389cbfc1ff83dc32ec94e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816504, "uuid": "5d0dfa48-3102-42b2-8fef-e9b35bbe0296", "value": "T184734B0276580E43E5625EF4283F17E093BEFD9025F0F6892A0FDB1A4635E732586F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816504, "uuid": "e2a38974-adcb-4034-9b64-ca167991f496", "value": "1536:ejW1Yg0EQ7T/uLkznu6Pik6/eDU6dcISsST:CW5V8u6D6GDcIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816504, "uuid": "580efef5-66c7-4681-a571-dc43270adc99", "value": 77152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816504, "uuid": "56226c68-ce47-48c3-9fc2-c9664a8d5d80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816504, "uuid": "d8e708c8-97d1-4469-92ec-d86e7ad9e2d7", "value": "db0fa4b8db0333367e9bda3ab68b8042.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4867a9d4-0723-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770798354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798354, "uuid": "618cc623-d85c-4703-8fa3-ad80600d625e", "comment": "Malware payload (NetSupport)", "value": "ac019d44897e15a643de5603d823f016", "object_relation": "md5", "Tag": [ { "name": "av-srvcn-com", "colour": "#3F219E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "srvc-mcrst-com", "colour": "#F58405", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798354, "uuid": "83bab868-5a18-498c-828d-b4e7b64c1775", "comment": "Malware payload (NetSupport)", "value": "3f086a8f38bc7c2ec689c7c454d9fab8363eb5e9da325632c3b64d1a90261e53", "object_relation": "sha256", "Tag": [ { "name": "av-srvcn-com", "colour": "#3F219E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "srvc-mcrst-com", "colour": "#F58405", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798354, "uuid": "4f99cb8d-afed-44c1-bf2a-9a01f1837658", "comment": "Malware payload (NetSupport)", "value": "8410928da10147343c9472cea6cb677b64978059", "object_relation": "sha1", "Tag": [ { "name": "av-srvcn-com", "colour": "#3F219E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "srvc-mcrst-com", "colour": "#F58405", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798354, "uuid": "8921237e-4a53-4fbb-96a8-7932db7eb53a", "comment": "Malware payload (NetSupport)", "value": "13b53bf01399d0f4f06379b0ef48ce91540c67fa57a50c4fb56a9d4826b0a3c9612728bd7dffe3751589c9eceb59d295", "object_relation": "sha3-384", "Tag": [ { "name": "av-srvcn-com", "colour": "#3F219E", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "srvc-mcrst-com", "colour": "#F58405", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798354, "uuid": "ad995154-5da6-4d6d-af66-01cbc3b62bda", "value": "T12A41340CF2A598B591C6174EECEA1904958F4CDF05061E10B54C64C93F33E3DCA6D39A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798354, "uuid": "64f5c8de-a9a2-49f2-895d-a61f885faeb4", "value": "48:JHBJBA1BHUPw7B5qaF5Z01DRPAKKdLoMKbFiKyEMEQUFLOEyCy:JHlaUoBkvLFiK1zcE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770798354, "uuid": "cbbd01d2-d7be-4958-be04-bb9087581bca", "value": 2009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770798354, "uuid": "f228860a-9cb6-474f-b1d4-740715667233", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798354, "uuid": "13df366e-1c77-4e9c-a5c8-22ed23de612b", "value": "3f086a8f38bc7c2ec689c7c454d9fab8363eb5e9da325632c3b64d1a90261e53.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58700826-0749-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770814702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814702, "uuid": "a4ee6d8b-29dd-4086-8bfd-0d0ebd8c9a25", "comment": "Malware payload (SalatStealer)", "value": "2093d2a4a806096dc41a246fe6e0dab9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814702, "uuid": "76f97c36-0841-4908-a2f7-48977f9d3269", "comment": "Malware payload (SalatStealer)", "value": "3ffe92d3d355f775ecc44e4f224b965dcfdaf4d546193d577aa013043223c03a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814702, "uuid": "9d6c943f-35aa-4801-8cb1-751f15b269d4", "comment": "Malware payload (SalatStealer)", "value": "ef60c54648c4d48df8e5a82477c295898a413745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814702, "uuid": "b7eed26c-1c3b-4547-a793-6ca5fce526aa", "comment": "Malware payload (SalatStealer)", "value": "c7612e130578d6bfac99e749873bc4bc8aca8ec0c91fa2e5b3591d30a00098cd921156889db9bc15ef4ac9b8cca566a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814702, "uuid": "16b86375-3761-4338-afe7-66b9aac62363", "value": "T13DC64B11FA8B54F5E9031831415BB23F33355E048B28DBEBEB547F6AFC7B681296A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814702, "uuid": "c377e32e-9cfd-4b64-be4e-275203d28a1e", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814702, "uuid": "298b6bd3-8857-43e0-acfd-6b9c7a68a084", "value": "49152:FIt3h61mnLbfZ9NOvoBUlXozvevIFOD98Q7chRU6FNv+UienIIV/EF4kUu32NxhI:uFh61WZNiORUY+ULZE+pRLHqlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770814702, "uuid": "02286db8-aa81-4e0e-8096-5b09f12972cf", "value": 11669504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770814702, "uuid": "4387bd66-fced-4891-ba3f-4892b967ccf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814702, "uuid": "53cae735-09cd-4f5b-8b50-b91726295ee7", "value": "qqq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c01cb11-078f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770844853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844853, "uuid": "8b14f361-e407-4973-bf3b-737d80199dcc", "comment": "Malware payload", "value": "63396fa92aa010e543e21cd8cb1bcccc", "object_relation": "md5", "Tag": [ { "name": "7zipinstall", "colour": "#62E79F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844853, "uuid": "3e11dbf2-4448-4696-8b5b-76e97649453e", "comment": "Malware payload", "value": "408a89bc9966e76f3a192ecbf47b36fdc8ddaa4067aaee753c0bd6ae502f5cea", "object_relation": "sha256", "Tag": [ { "name": "7zipinstall", "colour": "#62E79F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844853, "uuid": "9dd97a72-10ef-46a4-a94c-a0eccdb085fb", "comment": "Malware payload", "value": "03fdd8da539e6fb077ded128fb9b0855cc88f224", "object_relation": "sha1", "Tag": [ { "name": "7zipinstall", "colour": "#62E79F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844853, "uuid": "b7aa3757-849d-4d8b-b016-81e576a6755b", "comment": "Malware payload", "value": "a29e3978d365d014bd49a4823c0dbe3df56fbdaa1f273fb91f46b4095483324100be92b4dd45b82cfa11d88c257aee28", "object_relation": "sha3-384", "Tag": [ { "name": "7zipinstall", "colour": "#62E79F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844853, "uuid": "8c40aab7-9b38-4404-8b74-0928d646bfd9", "value": "T18C262311BAD2C436C6B238308DF8D77669BEAD201E355E8723C45A396F30681D735A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844853, "uuid": "83183451-4178-47f5-98e0-1739e6a35457", "value": "0030b265fc944b472edd3a09a3d279ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844853, "uuid": "53726c05-484f-43b6-8f18-53108f814121", "value": "98304:2ZfouRK7UZcRIbPV2GdyvR61HiryQXX6eZtxRoWfNtlDGI3BACjCnO:2mecRIbPV2Gdyvv7hRHbeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770844853, "uuid": "6d98cfef-bb95-40a4-a012-5b0f42197996", "value": 4849112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770844853, "uuid": "fbc674a2-1541-4760-9f53-018f98490b8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844853, "uuid": "4be7a0ce-ad50-44a8-9a21-3323cc15a032", "value": "7zipInstall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa286251-0791-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770845763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845763, "uuid": "f13eefd6-55db-4285-b302-17d19ead6c5c", "comment": "Malware payload", "value": "718450bcbe44fb77323fba3aaa679854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845763, "uuid": "305e1b5f-685e-498b-92b7-66f110e90dff", "comment": "Malware payload", "value": "413276fecd002f6c58300546a3062d29e64f2fd981c55169b72aef6b5824b184", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845763, "uuid": "e25c2041-a851-47a1-b0c4-4ee7b41d25be", "comment": "Malware payload", "value": "0daf8ce5836d7e2b2927094ad291f03eb6a939b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845763, "uuid": "5e635f8d-3057-452c-aba7-8ecb3161cbe6", "comment": "Malware payload", "value": "b3dcfbf7e1277c8645d7f418ebdc5ef10acedaff3c9405d4cc6d974f617d5dcc9a365ac2646508613f19186ce4a2b37c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845763, "uuid": "961a9833-6466-4be3-b2a0-7bcb7ee6b9fe", "value": "T1AD2633227BF3897EC29214308DEC5B7B75FA9E441F694EC31180E63D6E346A6873485E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845763, "uuid": "6d792527-2f47-44f6-aaea-b8f48c74bab3", "value": "e5d2ec931648bb8ad5e500042e54a614", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845763, "uuid": "126b6fc1-30c4-4879-a583-1af5d1fcd610", "value": "98304:9RK7UZcRIbPV2GdyvR61HiryQXX6eZtxRoWfNtlDGI3BACjCG:SecRIbPV2Gdyvv7hRHbec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770845763, "uuid": "c7857f21-aa92-4de0-bd7f-c51a9a523912", "value": 4442096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770845763, "uuid": "53abf53c-10bb-498f-b4b4-7c6595ee3df9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845763, "uuid": "0ac60df4-e013-4a89-8e02-a81301cc8d1a", "value": "413276fecd002f6c58300546a3062d29e64f2fd981c55169b72aef6b5824b184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575ccc72-0762-11f1-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1770825437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825437, "uuid": "4054a0b3-a017-4bbf-8c98-b3bc429e9aaa", "comment": "Malware payload (GenesisStealer)", "value": "d89bcb4b2284d99f668d0bb2d312f949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825437, "uuid": "d6a762ce-9570-4f99-88fa-cd41b8f7bac1", "comment": "Malware payload (GenesisStealer)", "value": "422933a922c14907cf70a3b0d1a15ff9c765aa57ffe39656b1fd16a23d2a670b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825437, "uuid": "aaac295b-3893-47a4-8e17-b07446eace4a", "comment": "Malware payload (GenesisStealer)", "value": "6e6393639fb8198cdc0dc42e04317778b8526562", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825437, "uuid": "581dc98a-49c0-48ef-8495-2e52f63c99b0", "comment": "Malware payload (GenesisStealer)", "value": "b16100213047daa9c2335d59fb073a3f204ec5d1fec6d558d5addcff65b1f5e8ac4738587caf908117f5cdf707b9d777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825437, "uuid": "aad33e85-8548-41cc-a3f9-449afc62bf7f", "value": "T1DC18337E1FA6C41FC01274BB8BB926B154E7A5632E25E02B725AC0EDB5B4D30D6309C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825437, "uuid": "9003d29e-a217-476f-9d12-448f85df685c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825437, "uuid": "9c7867d7-925c-456a-b8e6-40222f8cd145", "value": "1572864:DF+BWMFDe45ky7OU6hDRVO3GyD1KWHsPKhwC8coHhdXmaXALwpD/h7Fk:DMBFle45B7QhDRVABKQ5wvS4pDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770825437, "uuid": "1b3a31bc-3e6a-4f91-9629-4e9a652bf9c4", "value": 88002028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770825437, "uuid": "3f043ef2-5a14-406c-b706-a294aed1db51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825437, "uuid": "5621f8d6-8963-4d11-94ff-598217289596", "value": "VBAudio Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fac852-0777-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770834619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834619, "uuid": "aeba67b7-48cf-49b7-b98f-e90ee35885d2", "comment": "Malware payload (AgentTesla)", "value": "68fd4e4ac178d08cacd62cd561a8ccda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834619, "uuid": "c771d4b1-9a70-42aa-8c0b-6b920a137589", "comment": "Malware payload (AgentTesla)", "value": "4418c3e088ce92eb82ea8885afba6926bdd12d3d5db65c96551ee4b7f4954f60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834619, "uuid": "0a1a1ad9-21ca-4def-bf2e-bff6d9336bdb", "comment": "Malware payload (AgentTesla)", "value": "91cbadb839af98eecc584739736eb91cd4af0f0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834619, "uuid": "3b183825-f07b-46f9-8c3a-9e8f5fb36dbc", "comment": "Malware payload (AgentTesla)", "value": "2ae20e3b725752416a0c8d86abec14d3bc73dfd0568c37936ee8ccfbb9cfd39709e74dbd4adcf81046f7e2413f55b0b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834619, "uuid": "7b1d8d96-7783-49b7-9e07-f80d01058d47", "value": "T1914533264A835D3C7AD72CC69C60750246CF8FF0EBEC5845D16902EB93B8FB96772909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834619, "uuid": "158e4a6d-d774-4fd5-89a9-4a4ca4bbedd6", "value": "24576:OrDXfDVDO7POyucz4hb/py6V/2hO8REoO6vu0q9yYGY8ra:OPLVUGXcz4hBy+wO8RfLvuFEYGTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770834619, "uuid": "6e143cb6-b5fb-4851-8a9d-91d657378cf4", "value": 1221417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770834619, "uuid": "b4ffbde7-48cf-4651-8ef8-f17a084ca887", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834619, "uuid": "10f03ace-e90b-4be5-a1b1-cb7b67bcd88e", "value": "nSolicita_E7_E3o_de.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff317f93-06dd-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770768596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770768596, "uuid": "d5d8fc7d-1713-4350-945b-5e69dfc893ae", "comment": "Malware payload (Mirai)", "value": "a9380aa3cbdc72625ca3a8a6065a18b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770768596, "uuid": "cf211372-8f3e-4620-be73-d86cf35d54b5", "comment": "Malware payload (Mirai)", "value": "4491064f430de4c0b389ed6fe6a326ed398804fd359184cd6fe3afe953862e9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770768596, "uuid": "933b01ab-88cd-4033-a2f8-3cc614e85e6a", "comment": "Malware payload (Mirai)", "value": "8e4e1fa2d5f147c6adcd49488b2b3375a9ba61c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770768596, "uuid": "dc0c28b8-4763-4015-b25b-706efc29b143", "comment": "Malware payload (Mirai)", "value": "997c5eb51b7dc75e933735d31fe2f32b481f2e34d0047f0e13fcc4f223befd2607dd79bdd1c455684ee0057eef4ee9aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770768596, "uuid": "a32e1f63-5b8d-4e39-a12d-ad935c72777a", "value": "T18614B80E6E228F7DF768873547B79E25975833D627E1D641E1ACC2106E2038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770768596, "uuid": "3dfedf58-dfdc-47cd-8b3a-b9fee4099fbb", "value": "3072:hg6LJByPSbkKT++Jj6dCja/foObwdESn2:hdLJg8TrwCefrbwdh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770768596, "uuid": "160e26be-c6b0-4041-9809-32da8b806786", "value": 202404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770768596, "uuid": "138b194a-7f0d-4ee3-8b40-f9df54faa007", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770768596, "uuid": "ac29bcbb-dca8-44eb-a23c-9febcb050964", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08de0357-077a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770835614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835614, "uuid": "3f365a07-34e0-4baf-a935-b496717720c1", "comment": "Malware payload", "value": "41cf8c5adec33c1a41af7ed3abfc4c81", "object_relation": "md5", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835614, "uuid": "7b53f962-928e-46ae-9938-2c0398469cfb", "comment": "Malware payload", "value": "48278288265cc767e66be344cf2a8f8b2c0f8bbd405ef6ac444286020a80534b", "object_relation": "sha256", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835614, "uuid": "47ad3188-b82d-46fd-94c9-bbd92131b0ed", "comment": "Malware payload", "value": "c4f0e34491582108854b17140ef4632f7c19ec41", "object_relation": "sha1", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835614, "uuid": "8fd5eb5f-fdc1-481e-8e46-85e84f7c8014", "comment": "Malware payload", "value": "d4a019d53fdc170287fe75e9c07d436dd5f6e032b348fd5f4a3e16535f35c03d5aa80fbf766e8035bd4001882753ce93", "object_relation": "sha3-384", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835614, "uuid": "04c62215-b349-4899-956b-6b3c66940873", "value": "T147183366D37F8348C0B85FF82491AD55BA72C0C991317E5FCBB8326A68EF154E2D9207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835614, "uuid": "fbaae8d4-aa57-40aa-9369-29ff9b6b5319", "value": "1572864:P9hf6w/ZTOIviOz+B+S5KdyrjpBjyDrkZ6nb/dCfQl7GwXmxWSd0FxxfkUoTBF:zfh/BOZOz+ksW0tlyDroCQYFGwWg//ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770835614, "uuid": "1938c88f-86c3-4a5d-b104-bafaf4e3e6da", "value": 90760049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770835614, "uuid": "ef35938d-7d81-4f6c-a10d-15e9f85223b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835614, "uuid": "5ba9997b-362d-4685-b406-5db2998cd63e", "value": "Cyrex.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be50c6e7-071d-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770795975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795975, "uuid": "ab330052-e514-487d-a7f6-37c42666db41", "comment": "Malware payload (NetSupport)", "value": "2b13c5d6d761411e4be5fbbd62efc4f4", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-com", "colour": "#793A60", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-net", "colour": "#2B0ACD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795975, "uuid": "5a4c91b7-b356-41ab-8258-c0334d224658", "comment": "Malware payload (NetSupport)", "value": "48361d527d3e71f9cdd9c695bf88f118cedcecf2156bcfd2611bc4dc2781c58e", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-com", "colour": "#793A60", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-net", "colour": "#2B0ACD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795975, "uuid": "d18e13a5-256d-463e-9da2-df20be9e5a30", "comment": "Malware payload (NetSupport)", "value": "60474b5e3557c5e88a7cc67fee618dd17309fc6e", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-com", "colour": "#793A60", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-net", "colour": "#2B0ACD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795975, "uuid": "37abcbc8-02d9-49be-b5f9-5010f5ca2c62", "comment": "Malware payload (NetSupport)", "value": "a7e52e4468cd72826ad1474852f770acff79f81f6a9c8989bc7f10d8893b0a08a7024490c47ba8cc3c8f4bd032055e73", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-com", "colour": "#793A60", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-net", "colour": "#2B0ACD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795975, "uuid": "0e296c14-b6b3-41d3-bf03-1718d003d425", "value": "T1FAA533E7766E0E5CB938B47DDE68B0B653360ACE20E03A25D16124873D55F84BB7488F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795975, "uuid": "2e1e9864-e062-4fdd-9502-8e21643ecdd5", "value": "49152:dP0dRWkEHBGevtOSod0vh70RqnK85GJ2f7jmcoTfflRDpHNIsvPIWW3:16CBGStOSj1tnGCWcoHoWPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770795975, "uuid": "2bb7d807-18dd-48b2-b97b-22331ddab89b", "value": 2262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770795975, "uuid": "53d8f5e1-4b2d-40d8-81d5-124ef0cc22cd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795975, "uuid": "70180ef0-f9b5-48ee-92ac-b0c7db5dd491", "value": "48361d527d3e71f9cdd9c695bf88f118cedcecf2156bcfd2611bc4dc2781c58e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f1a879-0751-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770818261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818261, "uuid": "82096ccc-531b-4b36-a0a0-ada0a85f8ea5", "comment": "Malware payload", "value": "63540a2a68948a3fb7d42b87001210cd", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818261, "uuid": "0321f6ee-bd07-48ab-9125-4cd05fc40870", "comment": "Malware payload", "value": "498ca144a4e8e7522e252269ef263968c4d6d94cbefa330033d88fe4afc01e57", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818261, "uuid": "00b6a3dc-34a5-4478-baaa-106d5e9aafe8", "comment": "Malware payload", "value": "414dcd9ab1425b1776c8ac54d56e5858e8d61d66", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818261, "uuid": "cb275cad-8749-4a17-ac65-659641163a4b", "comment": "Malware payload", "value": "b8686fce8545697653d587a6b6bfd12e4cff2fd4f752e54340e62647cf9ea9b74e288ca4e84323ea7086b30db5975d25", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818261, "uuid": "dd02aec1-ce99-430c-aa3c-df4ee6649c5a", "value": "T1E4F76B4267AA05D5F9F79A349AE65213D673BC067F3081CF324C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818261, "uuid": "62a518ec-6e70-4b51-9247-ba683c59d98a", "value": "c26e33877abaa94e37e0b8ae3c8d27f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818261, "uuid": "f770781a-0739-43e7-b357-9c32bb41b150", "value": "393216:cfUJsRJDQVZpWWWrGc/d0ULRRQcKPxeUSp3LJpbRQSI8wxSvDazn1N5VRoEY7SmQ:cfvTRQtRe5+asRv/UpgPVlcmTMip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770818261, "uuid": "6261d7d4-ae60-448f-af27-b65b407b4009", "value": 72888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770818261, "uuid": "02f58f33-8ae6-4650-b78b-846eb6764251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818261, "uuid": "ad9cde43-7ca5-4d55-a413-93081b39a6e8", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e5b743-06df-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770769377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769377, "uuid": "eebc6c0c-e673-46de-a537-6e672fad5712", "comment": "Malware payload (Mirai)", "value": "d4a15f2a7bd8161412e1f6669e5f6e31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769377, "uuid": "4d1abcdb-c5e8-4f02-8f0a-699bcd5b73cb", "comment": "Malware payload (Mirai)", "value": "499f966552bd3953c2dbef72eea0978975a596630c7c800727caaab3cc159c52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769377, "uuid": "fbff854e-f649-47a5-ab4c-f24d14ee4afa", "comment": "Malware payload (Mirai)", "value": "c49b78813b7c7810c5b944618d2eaae423734cb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769377, "uuid": "eb0ff7db-7932-4eee-9966-c3ddfbe61f8e", "comment": "Malware payload (Mirai)", "value": "640e9a4e0158c44c60ea45041e738a85ec67e8feb164b3f69b1068759ce0ed7b54e200faf1924116fc7080bed5e0867a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769377, "uuid": "487d8e9b-6970-4bb7-bdc0-809b7f6d54b3", "value": "T1D9A3C609AF511FF7E86FDC3B4AE9170525CC651B22A83B797934D828F24B24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769377, "uuid": "6fd889cf-a5db-4bf7-8b9d-055c56df7802", "value": "1536:4JBVm21KYklsBd2MFBOQgcpi7dxJRR/FQCBFzWOxZLMm1eIWCgn2ID:4JBVm21KYpd2MFBCnB9Vx1pI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770769377, "uuid": "75624d33-fbaa-4371-8fd3-a182193e597d", "value": 101964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770769377, "uuid": "cc400da4-c5b7-4435-8ad6-c3bd0241c10f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769377, "uuid": "8f945f1f-e094-4271-b166-14ae49c751ff", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65472ad5-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816441, "uuid": "56a8d31e-ca70-4bc1-a8bb-68b1352760bb", "comment": "Malware payload (Mirai)", "value": "2406a297c39c17ce0df104cde787234a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816441, "uuid": "74c89eea-f075-4656-a8f4-99ac7609a4c4", "comment": "Malware payload (Mirai)", "value": "49ad411dfabc291f6404950a4700b79863bb9a24eccd86ba9c9a2ed359ffe09a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816441, "uuid": "2fd9a398-2777-437d-a75f-c5df946a901c", "comment": "Malware payload (Mirai)", "value": "62d7cc0514f287b809274ed190a7761d1f6b6a89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816441, "uuid": "587ab0c3-8aa9-4d92-b17d-3a8ce1af13e8", "comment": "Malware payload (Mirai)", "value": "c567bf26ef9bfa22aaebae6e0b6f546e72e5fbd3139ab80f16fabe1eefd17f51a744453a0f10addc6f8804b9187012e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816441, "uuid": "85a38254-100b-4507-9070-9b6b4102a828", "value": "T107F47D02FB1C4573D9631EF01E7F03E6C365595304F9E51A260EA7A61632E3E9AD338A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816441, "uuid": "cdd867e3-1378-4ef4-a64f-636445a78f25", "value": "12288:Y3JRDogjJI4/+Bimd1QUxVuQIhHS/MyYuPIPjApfDipUzIEKECuVpozfs:EoC0QSuZnTkpfZdKNuV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816441, "uuid": "005f37d2-1a39-4952-a568-2634198d9fe6", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816441, "uuid": "dfc22dc9-e655-451e-9cb3-4dcd8202e085", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816441, "uuid": "3c862a1b-a6c4-48ba-a645-e325b808faef", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec026d03-0706-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770786173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770786173, "uuid": "7255030e-2eed-4df9-8189-7b900add0d10", "comment": "Malware payload (PhantomStealer)", "value": "2b6a04fe17efacaac9cef9f251590d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770786173, "uuid": "48ddb8b1-e277-4ed9-a99c-30b4db613b5b", "comment": "Malware payload (PhantomStealer)", "value": "49c7caba0e93c51ed5fb1f246fc884b944d95a5ee19a3c7e9bbb43f7eed5255d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770786173, "uuid": "8c60edee-0f3a-441f-9c92-e845a4aac538", "comment": "Malware payload (PhantomStealer)", "value": "80f276e9d632a38c8f95788c9d36bbfcb0134abf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770786173, "uuid": "f739f756-039d-47fe-883b-5e8bc009a250", "comment": "Malware payload (PhantomStealer)", "value": "eea82807b065ba9d4b9054bf8c2e0e4b6eff1bce33679423c91c5618d06f4e31c4ec69a560c41a27466692c92815e784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770786173, "uuid": "b045b3f0-b014-45bb-a62a-c14d08720ae1", "value": "T1CA1512605752944EE0530874ACE23776E7D8AE6637AEC38277C0B59C7D2B75A4F283C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770786173, "uuid": "469fff33-3cf4-4b84-847a-8f124c955eff", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770786173, "uuid": "16ef54e2-4ef1-4b42-8bea-c1e04d04b2f5", "value": "24576:mHO/MdQiqo48IIqWdBz6kqd43jbz1HVkMIwSqLbBYNGA:mHO/ueIqWdBGzKb0wSqp9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770786173, "uuid": "31a6b350-846f-4838-970e-8f6a905356dc", "value": 911452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770786173, "uuid": "1aa417d1-d010-4e28-9c75-e9c06bfe463b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770786173, "uuid": "2ca79a55-3125-4883-92c3-2401bd939c55", "value": "Sales Order Invoice Reconfirm bank details", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743cd9a7-075f-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770824197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824197, "uuid": "7477c4d1-24c1-4bf9-b035-3e3b0aa302a8", "comment": "Malware payload (AsyncRAT)", "value": "a6439796b3ce6cf9ab3483c4a42ffdf6", "object_relation": "md5", "Tag": [ { "name": "45-149-153-129", "colour": "#52A8B3", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824197, "uuid": "a8f3ba58-89ee-4734-91f4-037af3c7d732", "comment": "Malware payload (AsyncRAT)", "value": "49cce6d849281f873fb62e59012b7efad79b886190db150efd06b4b82dcec279", "object_relation": "sha256", "Tag": [ { "name": "45-149-153-129", "colour": "#52A8B3", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824197, "uuid": "b5451d9a-cf06-474a-8bb3-d52f0a358dd7", "comment": "Malware payload (AsyncRAT)", "value": "48593661984e2f712f7fe700f9cf7d58e30c52e6", "object_relation": "sha1", "Tag": [ { "name": "45-149-153-129", "colour": "#52A8B3", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824197, "uuid": "95d297bf-9f6c-40dd-b204-daba6cbe5523", "comment": "Malware payload (AsyncRAT)", "value": "becabd1360068334f2009d7174753d01b00c3c0f1b781f3a141a49290e8e461fcd1ee97fdd724dec6f7af044152f3fa1", "object_relation": "sha3-384", "Tag": [ { "name": "45-149-153-129", "colour": "#52A8B3", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824197, "uuid": "59400591-d481-44c8-9840-8435b600564f", "value": "T197E24B4877A44626DAEE6FF528F351050274D917CC23EFAE0CE485EA2B67AC187407F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824197, "uuid": "77e46af6-6f0b-4ebb-89b4-9e0429ab8333", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824197, "uuid": "17508cfe-eaf3-4035-babb-80efe2004cc6", "value": "384:xx+PkjD9+E5MFs7iui8L7zKM42pfL3iB7OxVqW1RApkFXBLTsOZwpGN2v99IkuiM:f+CD93W03v42JiB70LVF49j8OjhFbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770824197, "uuid": "3809f54e-c3ce-4608-998d-96bfd1560bed", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770824197, "uuid": "f2a144aa-090b-435e-bfeb-26461842d42f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824197, "uuid": "216a0830-414e-4ffa-85e9-c646f0d6a38f", "value": "gg.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1db13d-0797-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770848078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848078, "uuid": "86aee238-e0cf-4176-a0df-eb2d54aef353", "comment": "Malware payload (Mirai)", "value": "e98342dff065883a30df245d96c4a1a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848078, "uuid": "3e22599e-05cd-43a3-a359-dfc2b7520100", "comment": "Malware payload (Mirai)", "value": "4b874520d6ae91eb409ab6a6ff48b1eeaeac75c6d6f431f0d337792f70636671", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848078, "uuid": "f58839c0-4427-449d-b3af-4cb8963be566", "comment": "Malware payload (Mirai)", "value": "ea27d9637f8116519ba6bb1b0baff8189bf84f82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848078, "uuid": "5d910d60-6ff5-42e3-9240-cd49dc0601a4", "comment": "Malware payload (Mirai)", "value": "5ab754a7748a1aa58c94fabc52b6f3eaa4e8d3ad067e9d0e67c77a0bf5da556704c3dd2a2ab19f6e343db6caa5a19522", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848078, "uuid": "fd292cba-cbcb-44b9-be61-6f9295e5087f", "value": "T1EF144A47EE890EDFC81BCDB086AE839B29E7559B48D1F1F5487CCC0C755D28A46E3688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848078, "uuid": "729390ff-d898-428c-ba74-bfe774ca3db8", "value": "3072:WSLZLI3IMNbJvF1JRfxTZZNLsuEsmyeUIFcye6ffkspHSYsqw:hqJZzdesmyeJFcyT3pHSYsqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770848078, "uuid": "d42c4ed3-1761-47b6-b079-6c241118a096", "value": 197192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770848078, "uuid": "93420da6-69a6-457e-9608-674ca59f03b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848078, "uuid": "0a034d18-0669-4e5b-953c-ebd8bda49862", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6feecc-0799-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770848958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848958, "uuid": "005f5fb4-b75b-466c-b546-eea62955ff22", "comment": "Malware payload", "value": "8b0b03bf1d37ff9af78f7709b1bfe5b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848958, "uuid": "82ce4f1a-7f80-47fd-82b0-a95116eb6d8b", "comment": "Malware payload", "value": "4c768d78a4cb6610fab547bad404fa4cf9e8577e795e286e3154e6684910ff79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848958, "uuid": "0a5356c1-3823-4462-9670-4d86f6cccf83", "comment": "Malware payload", "value": "ac4ad287648ecafd0a66ee2179f3c9eb010154d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848958, "uuid": "b6c5ef54-7fb3-436f-aced-3e7f9db87d64", "comment": "Malware payload", "value": "4777fdfb8212f124e0869be89a502f5c9838c40b3c3b8b47b85810039b2ea1b55aed73ee11fa6e157edc59d5738da116", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848958, "uuid": "5478edf5-db2a-455e-bda2-9c81d7fd32a7", "value": "T1623722EA55D912F4E8E34B70B28F63DE70D0715646AA9C2F36C51C025A32EE7854AF33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848958, "uuid": "e8a264be-851f-475d-9b79-4e22818123be", "value": "8739de86cd836ae1476705562c069cc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848958, "uuid": "77c931f8-ec4c-4008-9931-403333083319", "value": "393216:ttCW3GGazbDAzQoJc2ERa5vX2Q7Fq2H4wXr0L4fE7mw:ttCWWpzbPcc2ERa5Pnk/Qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770848958, "uuid": "1ae94aa4-f6b2-46b3-bdfd-1749cb00c7e1", "value": 23651328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770848958, "uuid": "55b02948-4440-40d6-ac5a-eb16c1a5ee03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848958, "uuid": "e68d5be9-364a-4542-9bf9-aa59ccfc107f", "value": "4c768d78a4cb6610fab547bad404fa4cf9e8577e795e286e3154e6684910ff79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f7d83d-06e2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770770570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770570, "uuid": "5830ef33-4cf5-49d8-8b53-49645a3551f8", "comment": "Malware payload", "value": "60e56104724ad20bc8d7941a8a910fe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770570, "uuid": "dcfbf96f-58e7-4860-963a-ed03ba230574", "comment": "Malware payload", "value": "4d5aed46af449c5ba9e5855f6916a262b690a5b9425d656d2c49edcae5dc0548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770570, "uuid": "3949e073-dbc2-4891-befc-4665bde9ea83", "comment": "Malware payload", "value": "0ad0c34450d4a7c2de5341d997e2093d31ee9805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770570, "uuid": "01571d74-3284-4aec-a0df-c511fc6addb6", "comment": "Malware payload", "value": "de1d709f2a1a05e55a627e57574c5d7cde3647a715743bd01ccc85826af10bec418781df2187048e40100ab3c95595f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770570, "uuid": "7c20c709-2a02-421e-bda9-0cda883e4534", "value": "T1D3F23A1EE26902B5D475E2F8C6973396ED32B0A613213DE709A053794F3BEF4063EA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770570, "uuid": "4863d603-5a46-4854-835f-8dd55f7bbabe", "value": "768:jHNMcigPcCG8yL+YvEMz3DOQ7e/OxmQVlflN+PRcavyQ7q:jKcib8ySBM3OQ7Hxhp0NV7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770770570, "uuid": "4f575916-5b56-453a-8209-78353456d357", "value": 35931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770770570, "uuid": "9b09c818-3906-4d4d-b6e3-a134a7caf004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770570, "uuid": "f92fbe40-49dd-4715-ba15-9fa5784b1763", "value": "SecuriteInfo.com.Trojan.PWS.Amadey.833.15068.7014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6bf32c-071e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770796294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796294, "uuid": "603ded81-18cd-4e2a-a71a-cea16fbf6ed1", "comment": "Malware payload (Mirai)", "value": "cdbf97ad022479c464822a2fad1b7b3e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796294, "uuid": "ea9a8ed5-1b9b-4e20-ad37-0de55cebb90c", "comment": "Malware payload (Mirai)", "value": "4db9d223e1a4d7a90f008f376a180ef18e45cedfa5af276edb5e0a1bed3b6af3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796294, "uuid": "31a4fc66-27e6-457b-9387-6444c9a32b5d", "comment": "Malware payload (Mirai)", "value": "95ca1f5031aa912c4903f3366c10bb9f62d6c844", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796294, "uuid": "5a76e66f-5416-43e0-a961-de4b55a62710", "comment": "Malware payload (Mirai)", "value": "8b81656758e1596153f1d58eea2e4347b78dc6d00caa6f7cc826cde3b633d9038aaf072337e709321dd31719a8428e16", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796294, "uuid": "e52a124a-14f8-46de-8cdd-285ca8ea01ff", "value": "T1405138CE33974838EF7559A672F48105B49090B7BAC4AD84D8FC78EDE44CE0A38E1742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796294, "uuid": "89fcc173-4720-4ffb-8e53-e0644c0ea697", "value": "12:JCkp0FQiHuKp0Fnth2Kp0FYC42Kp0FE6ZKp0F6kdlKp0F3exNetRfKp0FmTiEkNe:It+8lZZp3eLejDmT3kahktEnBTp3voyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770796294, "uuid": "be9c5ea6-48ec-4d07-b110-564901f8b481", "value": 2824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770796294, "uuid": "ac2bf494-8655-438a-9bcc-3470d3094ac1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796294, "uuid": "f9346313-bbd2-4df6-8137-e27f233c59da", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73269ebf-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788118, "uuid": "ee826352-65da-4400-9aa1-885de8134c63", "comment": "Malware payload (Mirai)", "value": "c96501033a1520475408995e6d79b0e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788118, "uuid": "4181c1ac-cb3a-48d2-95c7-65af70de1780", "comment": "Malware payload (Mirai)", "value": "4dfa6b414f4833c202e39c40ea6345d8907d15e21b59b4e7bed2a62c7fa04cb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788118, "uuid": "3aa05726-602e-4fe7-9414-8a7b4665b5f3", "comment": "Malware payload (Mirai)", "value": "7a99909c89526d0d92df1d59ccdf390d43d829ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788118, "uuid": "2595e9d9-564c-47c2-88fc-45338f0f1769", "comment": "Malware payload (Mirai)", "value": "9db65b592c5e01291a368a7e3c1373e0b84c5fe8ec16dd052bc40e3c4738fdfc6dffc410395587025ef3043c82925b70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788118, "uuid": "6c087dd9-287e-400d-b1a9-bbba29c5ec71", "value": "T1E214074AB9919F11D5D231FEFA9F419833136BA8D7FA7102DD206F6033C699B0B7A112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788118, "uuid": "639074f3-4739-4c76-bb24-224a93a0b446", "value": "6144:0d425iSP/c88zc/vCcSaU/MvNL1QH0hP14iWXjO6i:0d4To/Nqc/vCZaUcNL1QHGeiWXjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788118, "uuid": "b540f49b-19c0-46a3-a92e-9c83ae597e17", "value": 201416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788118, "uuid": "7e176689-a003-4974-84b4-2d8d6c5e69ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788118, "uuid": "0a7654d3-0f72-4fc7-afc2-5d3e9cf0269f", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616ebcaf-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816435, "uuid": "3a5ca7bb-65a3-4bdb-91a9-eea22a98b241", "comment": "Malware payload (Mirai)", "value": "8da963fb034e00c7055e0bd05c2449e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816435, "uuid": "6f3c2e9c-b142-4c74-b495-d81479167d7c", "comment": "Malware payload (Mirai)", "value": "4eaa32f40f0759d38420abf84370f74b54fd373ca6388decd8e0b74247badc40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816435, "uuid": "9ffc4827-a77a-4a47-9342-8bc2f738bf9c", "comment": "Malware payload (Mirai)", "value": "a49c845a75e7c1f22682e49730c6c9de603d0a45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816435, "uuid": "d7c2e743-2468-4090-80a6-01f7144d48ae", "comment": "Malware payload (Mirai)", "value": "91b08d85d4ae9040c2eae574b37360dde1ac8dc5c234a5041b41898d7d99cb78647b86b485d4bac3371609ee932c30d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816435, "uuid": "0d109c93-9b82-4ada-9bae-d6a5c3e6079f", "value": "T185E2E171C0C24594C9D93E7DD968494A61AD63BAE5CE71716E3603ACFFA840172FB701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816435, "uuid": "6fe2a719-6324-4ac0-87f5-c32a63a9183a", "value": "768:f4zFk8R4Zx3kqgmIitt6gVqnPTkh2B5iLZeCvl6ygDjgUwU3UF:f4ze8mx0/mIitt6FnPa2+leoAZDjXwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816435, "uuid": "8e17d031-2e92-40e2-84d8-1557f87e4161", "value": 33412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816435, "uuid": "64dba685-651c-451a-88b0-ca889f861730", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816435, "uuid": "131fbe06-d2bf-4bf0-9fc6-a24ebba73327", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea458c9-071c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770795251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795251, "uuid": "1e7f20b0-2678-41bb-a640-fd7d3c810a30", "comment": "Malware payload (Mirai)", "value": "4e9d9eb0aeaeea37f47b1aa4cd07d7cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795251, "uuid": "268ac692-9b1f-45c6-ac8b-e5a2824bcf0f", "comment": "Malware payload (Mirai)", "value": "4f1b2e957fda44f7762edb9be0777ba1d2504ef23bc20231b6ae643dcc85c06e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795251, "uuid": "68a42877-9b63-4dcb-884d-5e618cb1eba0", "comment": "Malware payload (Mirai)", "value": "96965e349e238592496404b52b1a9a8cd24750e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795251, "uuid": "3b1d42e8-4596-4d73-a34f-471c1516d5ba", "comment": "Malware payload (Mirai)", "value": "35e5157e7c2dc4033a455e5b6e74978f9683731b998c013a0ab96c1ee014ee3c7aad09c77a2bbc51735ad36078cec344", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795251, "uuid": "60e6a5b1-00ee-4ac5-9226-f5d2cb26bd55", "value": "T190E3D75E7E318F7DF3A8823447B38F31975927D626E1C685E26CE5101E6038D291FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795251, "uuid": "19adba65-7c21-4cdb-ba4e-f35db7fa62a1", "value": "3072:aJyYkY8uxPaiuKd6hocuJMB5CGnmKyd3CWaFr/6d:aJWY8a6TuA5CGnAZCL16d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770795251, "uuid": "575474da-7b2d-417b-97e5-7c8a25f588f1", "value": 152792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770795251, "uuid": "9e1bf891-c935-4d41-bc29-90f060b173bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795251, "uuid": "e9cb9c22-d4d3-4b07-bc34-7ca24202fa25", "value": "mips.nigge", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90752c5-06de-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770768961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770768961, "uuid": "e39ba713-d728-4e0a-a784-cf6b246b9826", "comment": "Malware payload (Mirai)", "value": "8d8e444e200ec8dc23671a26846b1a44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770768961, "uuid": "f2d23ece-9e8e-41d2-8ed2-9c64530b45bc", "comment": "Malware payload (Mirai)", "value": "4f330938c57041f14a43f3a2e5173fd163b23cbf72e5ea9c8a3d115e6512a3d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770768961, "uuid": "aabfee7a-84ff-4230-8fde-753b04109c5d", "comment": "Malware payload (Mirai)", "value": "02c4c17d8c98ec22645548cc74f21dd0065fe1cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770768961, "uuid": "75911a2b-3176-4ef5-aab8-279e5fe75cbb", "comment": "Malware payload (Mirai)", "value": "b2735c9ef29e91ba5d13241e36873f0d797cfd8029648adba494d3e9c29a3387e07a46f304354af26d9068437279f0ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770768961, "uuid": "5aff78d9-ad26-485a-a92c-1c2ebad03155", "value": "T1E4733A46BD819612CAC113B7FB1E01CD372663E8D2EE32139D25AF21378696F0D7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770768961, "uuid": "ee9bd02d-d700-48b7-8598-dd33054abe68", "value": "1536:huaxQ6nO0L3hoqIx1SSdNU9GDSe432zWx4t0Fpd:huaxQ6ndL3ThSdtDSczS4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770768961, "uuid": "200eb5c7-1d1a-4840-a376-f595a678cce9", "value": 79164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770768961, "uuid": "9f0344c7-a949-418b-b644-24c19130210c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770768961, "uuid": "a4f0db9b-5f46-4c45-be21-51618828a38a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7a5b36-0744-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770812506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812506, "uuid": "d3f1cfbc-98c5-4ecd-b38b-c3ff8ebedfd4", "comment": "Malware payload (GuLoader)", "value": "bc5c6ddfc38c0e8221f7de28877919f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812506, "uuid": "b8346e0e-e087-4500-8868-11ae6a3981e6", "comment": "Malware payload (GuLoader)", "value": "506177840e9f435f736c19b1c5cb011a4e0eb88924c6fc726f3d72a0147b9a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812506, "uuid": "d33f512b-aecd-4022-b301-3746aea925a0", "comment": "Malware payload (GuLoader)", "value": "557e32e3c3dadfa744431aaf8a1a749b5e219f19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812506, "uuid": "000e48ad-4b9f-4167-8831-d62a120f3dfd", "comment": "Malware payload (GuLoader)", "value": "d1b617bb4690cfb5dbfc1a60b4f4d273f175a941f7f330a7455e15d79716f61254935a6de13b92a98d90df1ddb43c691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812506, "uuid": "43c1cba8-345d-496a-970a-b3c2cf13fef2", "value": "T1E9E4236DA575C61FC463A8306D29573F1BE95D0A2E06A3EBB3157F186D303207E0A379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812506, "uuid": "f0462769-7031-4c5c-8284-fd8167b452b3", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812506, "uuid": "4c3907eb-c20c-433f-8873-fd23b4d02bb9", "value": "12288:rDujdEIMnv8wIovMQN7+pHkZ6N7dcNsJZWbf6y2w+kgeVpMKNooT7tFf0dw:rDUFlRovMQCTZd14fp2xEpxGoHtFf0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812506, "uuid": "7a83873d-f79a-499f-91e4-00abf4fe4f6b", "value": 705336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812506, "uuid": "a58e88d3-b3a4-40de-b920-b956fa901995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812506, "uuid": "4f7befbb-4b21-491f-88e0-f38cca7af26d", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b2ad1f-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770816390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816390, "uuid": "dc19ef83-736a-4053-9941-94da54eec356", "comment": "Malware payload (SalatStealer)", "value": "5827c85946bdd67b4b5ed4b2616cdf74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816390, "uuid": "b3615850-4fcd-4aec-b821-a8d39567211f", "comment": "Malware payload (SalatStealer)", "value": "518057ecbf02e66e0d922a1546c47ba3cf4413f39442ece80629556362bf5dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816390, "uuid": "14079a0c-5eaa-4706-add9-37ce6bab212a", "comment": "Malware payload (SalatStealer)", "value": "167afabbfa9a13c1d9180e542f71f5180e59bd84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816390, "uuid": "60542c39-1183-42da-b7f8-7642d5963707", "comment": "Malware payload (SalatStealer)", "value": "932add807852b27399f30e9be6e03edfb60719fd177a0c4ac7897032624f81b6f70cadfbdaaa85aadd10370c04501997", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816390, "uuid": "594a7806-feee-42e0-a742-5ffe663377af", "value": "T1B6C65B41FA8B94F5E9031831416BB23F63355D048B28DBE7FB543F6AFC7B6921926209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816390, "uuid": "35e039be-101a-47d6-8975-6c8c1f89bb16", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816390, "uuid": "d858ad83-0372-48fa-aeb7-60a4f7dec55b", "value": "49152:oL1bs/bcpOtf8CG2LCE0N+dBAJZtNSepZinpp4qvN6aPql5x7h6i2OqRriSiFevb:qFs/b98GqOp4jaPY0Ri5RfFKuqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816390, "uuid": "e819c90d-2999-4853-9a33-a3436f21e6df", "value": 11671552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816390, "uuid": "8f5b33f6-a4df-4f0f-be1d-c3ed0a89cdac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816390, "uuid": "ef5c8b04-77aa-4fff-8bd1-92bba3d3da1b", "value": "OBXODeac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb102980-072d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770802922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802922, "uuid": "60752282-6105-419f-8c12-f8262936fbac", "comment": "Malware payload", "value": "5e0fbf55604d2af3ff96f1edc11f78a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802922, "uuid": "c3cf7635-1a1c-4de3-96fa-d2aa8b79bbae", "comment": "Malware payload", "value": "52795f75ff8f2d33f568b5beea3947e12db63271599b43e0f1c8299c99834b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802922, "uuid": "5a240243-8fb7-4ace-a36e-0fc86191241b", "comment": "Malware payload", "value": "726443850ab38cc831b8d17e2eb09cdebd69bc77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802922, "uuid": "f3383934-e575-4d9e-acff-695478a558d9", "comment": "Malware payload", "value": "09b8d4490988a81a6b9e0e06ca939a83b222ef3fd6079647a997fa1cb5580a8cb4a5515bb395f5f6e059d76aa9f4f4ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802922, "uuid": "fc28a865-2e9b-4443-b934-ff8bb64ab639", "value": "T1A5D7AE1667E211AAE577C178CBD76203EA72B0471330CBDB329C03A51F63AD459BBB64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802922, "uuid": "1892ff24-1357-42da-a8db-3b214a1c1362", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802922, "uuid": "2506d4dc-0500-43e0-a9d6-d7d09e9bb089", "value": "786432:x1VDG3sSMiP2aCCTt3IUf/zUNUgPV1jz3:HVDG5MiP2aVxUXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770802922, "uuid": "2915d6e4-d1ca-4861-a88b-84c2f8f2cf45", "value": 59358083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770802922, "uuid": "cfd3ab26-9f6d-4287-adf3-49f19f33fbb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802922, "uuid": "e9a253d1-e028-473d-a511-74d90f0ebc9d", "value": "KittysCrafts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed766a1e-075d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770823542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823542, "uuid": "cbdbbd99-2a25-42d5-a091-dc413dd8caef", "comment": "Malware payload (Mirai)", "value": "4d99226ed34af9f97717552634df055d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823542, "uuid": "8538e76f-300e-4766-a8e4-09a6921b0bbc", "comment": "Malware payload (Mirai)", "value": "528a4b863276bcc3e157c227cbfdb0f7ae9448b81849bd8773c68c5c49aa840a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823542, "uuid": "d3b8b9ab-8d8f-4f76-b78b-75edaf6879b8", "comment": "Malware payload (Mirai)", "value": "0dabd00cddd4b20674b6a9360c0e5105d867be36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823542, "uuid": "19f54ff6-c53e-4c6c-8d37-ce04a5a74edf", "comment": "Malware payload (Mirai)", "value": "fb076d47ecbf7a0e09fb7b4cc614b05dd49247b458107eecf14253e2077dd5af5817655976991f1277f32e8e1979e44e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823542, "uuid": "3b270319-d81e-4be3-adb8-802c10515fb2", "value": "T17683B549FA649B2DC7E272FFF74912CE332B1B98B7DA71259E305A4533C8BA65424130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823542, "uuid": "6e44a0e0-458c-492f-a8cc-aa685b1d35b7", "value": "1536:/lnsFxdCK/9Y9KqCLcQ99eHXtecGX79hLQTMciJSkNSxrPkf:aEu96KqCXWXUF9SkNSxr8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770823542, "uuid": "d17b2890-688c-4a4f-9fd6-ca1c706db63a", "value": 81708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770823542, "uuid": "83cedd61-1378-429d-93f8-b0b1860dc36d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823542, "uuid": "b481beae-34d2-4da7-96fe-4ead79d24019", "value": "nexus.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd153ce-0720-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1770797259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797259, "uuid": "566f3de8-1fff-4a06-b77d-35fbaa056c9c", "comment": "Malware payload (DonutLoader)", "value": "fe3db013b6fc151be012259e38f9e7b4", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797259, "uuid": "b4ca3fcf-a2b4-411b-91da-b8808b4b73a3", "comment": "Malware payload (DonutLoader)", "value": "537f35139e405acd24cd9511259e9a8ad92150d02f6ed82d9140b00e15dd8410", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797259, "uuid": "7d535cb9-604c-4401-916a-730c2eb34b43", "comment": "Malware payload (DonutLoader)", "value": "2239fc0a0dc8fd56fe11b42251084453e399eb26", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797259, "uuid": "a6b5fbc7-5b0b-4407-9726-9bcf131f68ef", "comment": "Malware payload (DonutLoader)", "value": "507a0638396ee4aeb2aef217cac37ff6760134ab3aad1780ab7c23692f27d9819c32579a5378acaa305e7227c62fc546", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797259, "uuid": "06653595-6c04-485e-acf6-efef14630027", "value": "T1C8835EE31A35C1F263554D1E81CD343AF5BABF23D2E5FD54A062A6908187927F24EA3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797259, "uuid": "bf22285e-4724-46bb-aef5-f208cb59961e", "value": "1536:6wREyERwREyERwREyEBUwIclQH+t9Qv7IVddFtYH:6wWyMwWyMwWyKI9HwysVddAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770797259, "uuid": "33e7a192-6a59-4c69-8755-695733af4f5d", "value": 81903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770797259, "uuid": "6bb0ea6d-b450-4d51-923a-e3c429450050", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797259, "uuid": "70f7c20b-8735-441e-91a5-9e755f40206d", "value": "New-offer Documents-01210JDJE00103020226.CMD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c953613e-0794-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770847103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847103, "uuid": "8ed89e5e-746c-4704-a3c4-1a8ac2f184ef", "comment": "Malware payload", "value": "f3ccffdf74bd0145ff177ae59eeceb81", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "Markdown", "colour": "#0056D8", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false }, { "name": "PolySkill", "colour": "#49A988", "exportable": true, "hide_tag": false }, { "name": "Skills", "colour": "#CA8F4E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847103, "uuid": "05eddc5d-b229-4c68-b6e0-18aa32dd591f", "comment": "Malware payload", "value": "53cba51776f65f64214698c99ec3aefe24bb78a111287b0a0d71ac096b0b530f", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "Markdown", "colour": "#0056D8", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false }, { "name": "PolySkill", "colour": "#49A988", "exportable": true, "hide_tag": false }, { "name": "Skills", "colour": "#CA8F4E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847103, "uuid": "faa31037-6e5c-4589-8ebb-e2958b489496", "comment": "Malware payload", "value": "e38a8d3bd1cc2b41ac2d14d12ac23ae50e4bfc90", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "Markdown", "colour": "#0056D8", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false }, { "name": "PolySkill", "colour": "#49A988", "exportable": true, "hide_tag": false }, { "name": "Skills", "colour": "#CA8F4E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847103, "uuid": "d8ab519c-c2cd-4b15-9922-d45e639b6fa9", "comment": "Malware payload", "value": "be518c47d754518a0d43a0197abc7acb1b8a47fcb5ac0fbb39fbd103753a3a086d93117d8d214793557970444fc61cdc", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "Markdown", "colour": "#0056D8", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false }, { "name": "PolySkill", "colour": "#49A988", "exportable": true, "hide_tag": false }, { "name": "Skills", "colour": "#CA8F4E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847103, "uuid": "4d822715-1e98-45ea-807b-6e57a479b129", "value": "T16A21D8A0990FED9DD125E135583825A2C7C6C6EA284F5CCB49BD1095404529B5B11CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847103, "uuid": "0d20598a-f32b-4194-be9b-e2c23d2a566f", "value": "24:9z40DFUbCAtLGKz5rtsViNGti5FDLPMz4e81U59Sv7cs6PJb9IV2TDEMa:9s1bxcw5rtsViSi//PMz181Uiv7cvPJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847103, "uuid": "7b7a9dd6-25dc-4164-91de-0aeb82c87419", "value": 1424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847103, "uuid": "6f08a35a-991d-4cbd-9401-e56afd3bf51c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847103, "uuid": "ce75ff3c-b249-403f-9b3b-402fb5da7920", "value": "skill.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5132d4b5-072d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770802664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802664, "uuid": "f1ebacb9-07b2-41fc-a6f5-ed89b51ca991", "comment": "Malware payload", "value": "ddf1a1955052124d1ce4d26d0f4491b8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802664, "uuid": "db364726-bc81-4d20-bb4f-4c7633eba988", "comment": "Malware payload", "value": "5446b24959c1c2707accfc257aaac61819c01d1ed65bca910a7e8be1787d200f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802664, "uuid": "92dd173b-99ae-49af-8c16-61e75919885a", "comment": "Malware payload", "value": "034f6183c4eb929012757df1cf6367b981315743", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802664, "uuid": "75c8dfd8-2b66-4808-bb26-73bb44f7f282", "comment": "Malware payload", "value": "74a99a00115eade5e32d19cb117d503b40b8e5a9003cf5fd4548b3da137673c8dd95dedce931159a25311da4b54c91cc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802664, "uuid": "c403f7d8-f88e-4ca6-88ef-adc927324eb0", "value": "T1BBC4DBDD2EC1F2AE0F816933F11AF06EE4F498F0536A4C59A0DD2C48F8A56D4BD29635", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802664, "uuid": "a4c9a3f4-3ddb-48fa-afb8-a25e09f9ab18", "value": "6144:MpT8eQQvHx7G7wae6NPfU5FEx4Y+JveXVOAP:Mh8eQyHx7Cwa5HU5k4Y+JsVOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770802664, "uuid": "d3497e79-fb81-42ab-8d9e-bafed672ce45", "value": 554051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770802664, "uuid": "5708294a-ad18-49d8-a134-77f5d6984310", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802664, "uuid": "c3901968-bf27-4f36-a813-7f95c3d55a7d", "value": "PURCHASE ORDER_12258.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0fb9ea9-0747-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770814099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814099, "uuid": "64469513-98c8-472a-969f-71d0cbf7f97f", "comment": "Malware payload (Mirai)", "value": "027f93d5e4f4f5d1f50093e769b6d1e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814099, "uuid": "08ac247e-3997-4197-8f15-6ed0fde72dc0", "comment": "Malware payload (Mirai)", "value": "549594e169a810006f637a2b00bfbcd14806c18d482c58d4b3bfe349d57b3d51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814099, "uuid": "1b725247-3d13-4ba9-9491-4e2e71cfaf68", "comment": "Malware payload (Mirai)", "value": "19ebafae72b731a1218dfd1bf16708ca65608aa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814099, "uuid": "633f26a4-fa41-4eb9-a64d-92466ac17c45", "comment": "Malware payload (Mirai)", "value": "e4eb4f0c19545eec2a46bb539cdf0d1e4537b07d7881ff3381bba53daa0a097637cc3060f96422ec8e77bef12037c2e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814099, "uuid": "a737b077-1adb-4d1e-a4ff-2d793b91cd2b", "value": "T1A0332985BC919A12C9C42377F62E01CD372663E8E1DF32179E226F1177CA92F0E67546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814099, "uuid": "ff9db2ea-ae98-4070-a0b3-2221f1f496c7", "value": "768:pQMyeC/OJyrlrpxpv0MHUnbe5Sv960onfqBNABNO8R1uTg/Rm9yg:ryeC/lrZpxpv0Tbe5Sl6vunT+GF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770814099, "uuid": "4abc8779-1d28-40ea-b89f-e77fe00f376e", "value": 54860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770814099, "uuid": "20283ee1-6de5-494f-bfc0-f091e5d6a032", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814099, "uuid": "0cd10778-687d-4bcf-9e03-1fbda2a114f1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee91858a-076e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770830845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770830845, "uuid": "69d2ed15-e7c2-4c98-a307-8b304ebdc18d", "comment": "Malware payload", "value": "46933fba5d4356f994827a80552e0190", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770830845, "uuid": "8c017790-5b2d-4350-b4b1-bbcedcd122f2", "comment": "Malware payload", "value": "54a6cf3a2bf81965cf80976f96b7a5bdac7605424419a200e97b0a31760920ae", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770830845, "uuid": "62f45ea4-f9bf-424c-949d-7559ade3629f", "comment": "Malware payload", "value": "d9164ec82cd9ece85e9454a66f43b837de5fa626", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770830845, "uuid": "6098b438-8769-4f3f-ad21-23c4132b9d57", "comment": "Malware payload", "value": "65c1787161473ea7e2864f4ae4ed44849f83aecc5dc20d9e9fe36a3c0714a01c5995fe8df9bdb8cfce51c49087f2d48c", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770830845, "uuid": "c1fe5a6e-77f3-44c5-a020-9cdc80f13471", "value": "T106C08CB32D000C0501B174BA7192A26C001361000E2999CBD8A5003326492984F83340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770830845, "uuid": "6e3f88fe-d6d0-4cdf-ba14-731e20a8a7ff", "value": "3:qTkooMB3tdtoAcMBBXbvmJRIE6LWLoSyDv4IBXIMBcacWWGu:qTWW3td0MPvGIE6FT74JMWXfGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770830845, "uuid": "6c1490c6-424d-437b-9c88-c48de4314714", "value": 146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770830845, "uuid": "7599c42c-d1b3-40b8-8556-7aef21884497", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770830845, "uuid": "eb6858e8-6736-4908-8548-c66d2c7af360", "value": "rechnung_htkr26_0000655_279842.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3665aa50-071b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770794888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794888, "uuid": "23b20576-9d40-495e-8ed0-d6dc259834b8", "comment": "Malware payload (Mirai)", "value": "b8860eae14483ea47951f75554718893", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794888, "uuid": "4abd9e3b-be50-4b64-b7c1-eede88e3664f", "comment": "Malware payload (Mirai)", "value": "5547e4f1a0d15e432b8e2e3c021956cc84b771a1ca97a4961d2c4f45111ea1c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794888, "uuid": "84585faf-61a9-44bb-b2b0-ee33162e3fc7", "comment": "Malware payload (Mirai)", "value": "aecfc5ff440da291c217d70fcb3cd981e76b865d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794888, "uuid": "cecefa52-087c-43cd-8bcf-b669c7f375ac", "comment": "Malware payload (Mirai)", "value": "e002ede23ecc829f845f9ec8564d3c084d6d8fc3018a4eeaabd69f9f3573d26a14fc80a11bc0f95e0769a864e2efd881", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794888, "uuid": "f9dbdd8f-0452-4691-b46d-7bc3eb997c80", "value": "T1DAE34ACBF800DEFEF80AE33648570909B130B7E155925A373257797BAD3B1990927E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794888, "uuid": "a5cfe5b3-3d86-4b81-b2b5-8ab4ca30ac52", "value": "3072:YW4IA5GpX7urF7xoxgg3zE6VYjbioLn1sj8LTkoADg7fymGhQRL:14IEG5C7xYBzEPLn1eQqEymo6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770794888, "uuid": "4c21774e-ce6e-44c8-8178-66caad0f65ff", "value": 154496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770794888, "uuid": "d653a5aa-cfe7-403d-bdf9-e8a0d6ff7d1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794888, "uuid": "d1780925-df6f-4f68-b25f-0f5956f4b58e", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031d843b-0790-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770845053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845053, "uuid": "62182516-10a0-4acb-823c-f59c3b4f5bd8", "comment": "Malware payload", "value": "a76101f9cfd0c2c5e5528d61641c896c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845053, "uuid": "7cdd6010-f797-46bb-aab3-5583b0e7dcd9", "comment": "Malware payload", "value": "55812940435d04a1df71f916ed4332c6f06f0802045a857abe46683c762e1fc9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845053, "uuid": "157a7ea9-885e-4796-9f9c-54893c04860c", "comment": "Malware payload", "value": "fbca17b4c9b8143f5cbfe644bc9e21036fe5227c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845053, "uuid": "38cfbe2e-2728-40d4-b7fb-d7c9bc9b93de", "comment": "Malware payload", "value": "fba8e99947805711967119081db5af246005350db221fe5bc4912f0eab95e1722311fc654b89b62b53c49b9d39a08483", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845053, "uuid": "e48aa012-bba5-4a0b-9d4a-57d375284a42", "value": "T1CA753332193C5C8EDE11C8E923EBFB803ADA53374CD6C69B17AA08B9702A4B1555F4D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845053, "uuid": "4f6abd31-22bf-41ce-ad22-0fc840d8ca46", "value": "49152:wMq3AMUY5zNW1RSGkglqXAMfxeVWnrIs3:EAPIzADWglqX9fxrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770845053, "uuid": "f8850b5f-c0d9-4db1-9811-a5386d65befd", "value": 1636340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770845053, "uuid": "075ff140-4d04-46b1-9161-90d0f746df13", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845053, "uuid": "0fdeda8a-dc41-44e2-949d-0b3ce6b99437", "value": "dupe1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb59a24-0745-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770813152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813152, "uuid": "cb56da13-0f06-4e21-baf2-e4a02ea40c12", "comment": "Malware payload", "value": "fcca1c613e0792fa5473cde4ee74d539", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813152, "uuid": "07af4842-679b-4142-82a7-d4b59a41c2ac", "comment": "Malware payload", "value": "5626e2a59f161cbd625b82154d7ffa212a242143ee53ec0102e6d54cdca70824", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813152, "uuid": "d9f76632-8e4e-4c8d-9dda-063d99f13130", "comment": "Malware payload", "value": "5e2e8d495e635de71a5f453cd752d4077c30c903", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813152, "uuid": "0d753092-9ee1-497f-80f7-54b7963e15ee", "comment": "Malware payload", "value": "4b21b603d89586d9e493b2e3900d6a503eff7352efc7353ca5d8ae407e8bb6c2594a60e4f632eae20e4516c3000a809d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813152, "uuid": "00f56f61-7f85-4cf5-b8cd-b7aa99e51e80", "value": "T14E1373A117D9BA3902671219CC313D4DA8B49F624E8DE58BEF33B1E181BC142F646BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813152, "uuid": "edf8d109-c38e-473f-ba92-348ae5b52e44", "value": "768:TPwGxr8IywCPM1ASqGY/96GKJVfj5KcvWioKBV36Zqi6GuYcAGDX:TPwGxr8IywCPMnY/cGKJV75KcvWioKBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770813152, "uuid": "b76bd70e-e10e-43c0-8583-5db6eb587fce", "value": 43667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770813152, "uuid": "b0bc576f-b29c-4272-82d6-b40bb7faea43", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813152, "uuid": "8b306d01-bc15-4bf6-98c4-ade793f2dc85", "value": "99b1dc4e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e8d1d0-0762-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770825328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825328, "uuid": "5f87deb9-5c65-4c40-b118-5442a9324b4d", "comment": "Malware payload", "value": "92358bfcc9314589872ef0c2eb0c8513", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825328, "uuid": "7f52da40-571c-4a8b-ad3b-a96198d7ab00", "comment": "Malware payload", "value": "575f1eb708f954f07fed7fff977355a83496ba7b22bfbb33723725fd1080bee2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825328, "uuid": "06d3cf8b-5ccd-465d-9d00-3a03d6f146d1", "comment": "Malware payload", "value": "0b5b0bc8ac24d82c8b7333783d8c683e9952f6b6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825328, "uuid": "10981dab-5eca-4a14-9f37-d9f708e4d125", "comment": "Malware payload", "value": "9d7173411fea1b094ff407ee588df64f523707a4a9305519a6c4e1409409a687ff7617e3f90650900b771dab48d0a060", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825328, "uuid": "ba3e4fd4-7169-4d3b-ba1b-0a3854577193", "value": "T1B54423ACF1428499E9CB33785E64AFA7CB333A48B92C58896C569D1D4C560FE3650C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825328, "uuid": "4201e13c-9574-4fd4-9b11-91afb524f527", "value": "6144:U4ulMtvQpPYaYmDJmRim3TLzBDMkYnMHrT6wzsVM6I8ar4:oGtJMDJmRxLlDMfnMHrvsZaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770825328, "uuid": "9f82cd00-a65e-4a09-a1c6-94928e83de0d", "value": 272324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770825328, "uuid": "f0eb2bea-79ec-476e-a521-a039d321bd69", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825328, "uuid": "ba5e9a7c-6077-41ea-9d1f-3e0be7ae7262", "value": "LISTA MCPIN INTERACTIVA I 110226.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4feb6ad-0795-11f1-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1770847472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847472, "uuid": "25e3e948-aa7b-4a28-a923-50a154014ba8", "comment": "Malware payload (AmosStealer)", "value": "796478a86a5b8aab173f07b2b3bad59a", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847472, "uuid": "0682e317-6815-44fe-8986-0f40b090c501", "comment": "Malware payload (AmosStealer)", "value": "57adcdc436988224fbbfb68463f0aaf911135885302550b7df76ef5bdac7dbdf", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847472, "uuid": "452664d4-3d66-407a-b0cb-0ae25cab2986", "comment": "Malware payload (AmosStealer)", "value": "7ca4547650cddcf2c2833f093d913b1b1611d28a", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847472, "uuid": "0d60b0da-a9c2-4899-85d9-c86a264f0053", "comment": "Malware payload (AmosStealer)", "value": "17665a859863a6076423a6a306f41ebd0903043e6acb4c1d835c40e7102d0c60329702c4cb577e6e9a19a07e15dac340", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847472, "uuid": "a11979bc-08f1-4365-b506-f4e5b3b5f82c", "value": "T122B419E7623855F2D98EFB7CF44F2226F971BD4019B8B5D05D820E114ED9370AA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847472, "uuid": "cc9f3882-c717-4206-a0a0-ff4cb50359c2", "value": "12288:D0l+NcArlEE9ncvJJQqlsgcPv8pBprQMxJVXWlnnnHuuu21uKb+AfI0m:D0qEU8pBtkfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847472, "uuid": "393fb721-822a-4809-a431-ac162d92c0a1", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847472, "uuid": "1c2154d2-beea-4e4d-9e1e-29d8a3362319", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847472, "uuid": "c1584c37-3ed2-4607-9ffa-a5145fcc6d72", "value": "57adcdc436988224fbbfb68463f0aaf911135885302550b7df76ef5bdac7dbdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3401c9-0785-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770840609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770840609, "uuid": "d55c975e-446d-446a-ba40-68f906e590a4", "comment": "Malware payload", "value": "e641d2d098c01d9ea8cefef904a0ea4e", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "casadoconector-online", "colour": "#73C7D2", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770840609, "uuid": "32f26a61-3356-40e2-87b9-d995356c6d03", "comment": "Malware payload", "value": "58966e71b3fe254548d817b08c72be38576057350ef71781bf4ab076b71a736b", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "casadoconector-online", "colour": "#73C7D2", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770840609, "uuid": "b71d4059-543a-46d7-ae78-0197aff67f36", "comment": "Malware payload", "value": "692b0976a17206529c91b992443550aaf328f85a", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "casadoconector-online", "colour": "#73C7D2", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770840609, "uuid": "50e24bfc-80c6-4dc2-bc21-f9ac4869f809", "comment": "Malware payload", "value": "6160b9973444f3a524a01b714db231c05c0b062facd205e86ee2dadebb8e0f37fd0da3dd13aa41ee18f6e832c05ba13f", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "casadoconector-online", "colour": "#73C7D2", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770840609, "uuid": "1b3c6b9b-52cf-4877-b513-b9c7a3647287", "value": "T1F9F4560D6C69E9524704EB937043A3C74E8569FFF272B977F31A18498C588C31ABB6C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770840609, "uuid": "fd68641b-714e-4d08-84d4-6c1cb49bff76", "value": "384:3YLZpEGIw9owf10PKNzQpjqEbGfHGtiOgO2Woz61IuC5epz//UPml6qQcRABkrJh:/E9/A7rM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770840609, "uuid": "6d0164d2-7da5-43b5-9577-cd577d0bef69", "value": 756450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770840609, "uuid": "8eaf0802-6b96-4616-adcf-8cece8c535ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770840609, "uuid": "1bd44577-9d60-42cf-96cb-19d93198b182", "value": "58966e71b3fe254548d817b08c72be38576057350ef71781bf4ab076b71a736b.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51622428-071e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770796222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796222, "uuid": "5c14628d-da0f-4c9b-8a38-db373b915652", "comment": "Malware payload (Mirai)", "value": "862136700e6929d4a30f075d52221633", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796222, "uuid": "437f8922-9a62-462c-9fb8-d2e8d6a4566f", "comment": "Malware payload (Mirai)", "value": "58c57c67afa9d55aae8273ea5979ffe464b618506dafd45f378ffe9976d0adfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796222, "uuid": "65070ecb-c726-430b-ac6b-bc22bda292c7", "comment": "Malware payload (Mirai)", "value": "b0119cf3c82061dedf23bb246b6c5602efad307c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796222, "uuid": "581c6a28-b309-4f07-afb6-6a719f274acc", "comment": "Malware payload (Mirai)", "value": "e53920a40957954af28e1ef40575a2c20681bd150d890861ee3b03aecfdb080a58d75d7960f3c70aca6d74a6611c24e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796222, "uuid": "1eba5b30-3b79-4b76-abb2-361c6b2a2064", "value": "T1EA5301C4DB4CE8B7CE7E697D72E31B514A28755462B5036CF3128D8AE748E17E9CA018", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796222, "uuid": "14cf55ce-1336-44e2-b04d-2f2e3332514d", "value": "768:Q57JdYlFga7zF7l8PR5+JPcnjk/U0ON3ukO98OD6/VqZEkgviqXLFTVKoa4/Xo9j:QhJ4ndJEngc0kM98xbqaft/XynF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770796222, "uuid": "e60b337a-5e41-42cd-882d-be204e9714ee", "value": 61568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770796222, "uuid": "80d67fb7-8e42-4ec9-817c-a49c23aab328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796222, "uuid": "acfae513-7617-481f-96b4-fd652b3c53c6", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48406199-0762-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770825412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825412, "uuid": "bbec3131-c7b0-411e-8f30-6c34222c9a28", "comment": "Malware payload", "value": "7620dffb4274bc19dec5a4fd566103b0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825412, "uuid": "9caa5195-6223-458c-a4e4-af85315a7349", "comment": "Malware payload", "value": "59ecdacad403e1fea285f25bab95455ebe2dbd3e4bc52f0d17176a811d358a8f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825412, "uuid": "fad2cb44-34f3-4f5b-834c-9240e4dbebda", "comment": "Malware payload", "value": "7d81dbafa03b4be8193796302e69c28cc4dd70f7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825412, "uuid": "e8b30963-0d5a-404b-b6a0-37fb0a24d566", "comment": "Malware payload", "value": "e413bb4df02564d028df647f30da419d76b22a399d1d1b45e5a7ae3fa7765069ef6aaf4651235dc866d04d450dc6b86d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825412, "uuid": "78341487-10f5-4920-bc72-5adc6d756c45", "value": "T1A7A38D6EE74F0914DF5697B7035A4A4A06FCB33DB38140B139AC97343BAD92E466287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825412, "uuid": "9070f34d-6249-4cf4-806d-7235fc9dfa8d", "value": "1536:jzGf4UF7YLGIF4gurFH2Qjc9qGKUjrdAtYSRBGwVQq2:jFUF7YiIFlurFH2QoWordYYSrGw+q2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770825412, "uuid": "7f099781-e686-4fec-953d-c737df4a23a7", "value": 99109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770825412, "uuid": "c0d09182-733b-4b61-90c6-ec867e58beab", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825412, "uuid": "79ecc8fb-1ffe-460b-baee-4218e781b421", "value": "cv.doC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf49fec-0725-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770799353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799353, "uuid": "15481c60-fab1-4d50-bc8f-f3dbd0f1d75a", "comment": "Malware payload (ConnectWise)", "value": "60883b803e1b75a5542f765335e22896", "object_relation": "md5", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799353, "uuid": "35fb6b74-cd1f-47d5-b6ee-00318ba027eb", "comment": "Malware payload (ConnectWise)", "value": "5a00ba097f8fe4c6b583f0aed574a2ef62bf6bcddab0224c006ed017a8f7af9e", "object_relation": "sha256", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799353, "uuid": "0ff6a280-f339-4074-a135-b4ddd281b48d", "comment": "Malware payload (ConnectWise)", "value": "6e01fe68b0e7a1b4808d316ce49b5631d87ceacb", "object_relation": "sha1", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799353, "uuid": "a83d1ec1-a197-452e-8b4f-65c33d6ee521", "comment": "Malware payload (ConnectWise)", "value": "1b0db3b47426e125a8335c792e274ff1fa4b18006e89685817b5beda088bd886efc56c9c2a97474d688aa87c9efc562c", "object_relation": "sha3-384", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770799353, "uuid": "5d473066-bd53-4e75-ba0c-49efd7efb670", "value": "T1A0C1410FBE0BA6306933433796977D1EEAA1645312120C25B9DE8187DF35658F7212FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770799353, "uuid": "a8342879-bec6-4966-aec2-d6aa92ff65f0", "value": "96:IazR41mGBg6lNBXmUjhivcVV/ic34M7p/+1aC/imi2w6/f42dD/Km/Jcy4pj:1zRWlIoV/iDYp/+p/df/goD/Km/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770799353, "uuid": "52310ebe-b04d-41a5-aa0b-0371964c5114", "value": 6078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770799353, "uuid": "176fd56e-fd70-4fb0-ab19-0cce0ce6ee21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770799353, "uuid": "359ac890-ae92-4992-abc3-e9e308660400", "value": "5a00ba097f8fe4c6b583f0aed574a2ef62bf6bcddab0224c006ed017a8f7af9e.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76798630-0711-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770790700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790700, "uuid": "89c4f2ba-af4c-443e-bd76-0b84ecc54508", "comment": "Malware payload (Mirai)", "value": "5acc63f0fbc74c695c4f896fe34f0904", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790700, "uuid": "ec980c09-968c-4173-b7fa-6a260b545aa3", "comment": "Malware payload (Mirai)", "value": "5abef5a5d3968a154ec35979d1143fc16f583456b4c301e2647a3fb1cd1719ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790700, "uuid": "cc089708-802f-44f0-b2ca-2c5f1abde101", "comment": "Malware payload (Mirai)", "value": "b4bcd3975cebaede0a0aa5c37441d826f35de96e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790700, "uuid": "227f514d-710c-4f6b-b57c-98052060f7ab", "comment": "Malware payload (Mirai)", "value": "aca35b1b11c318d4e9a2e28fe9ff921d0a07fa02374cc0a222d7d82bac7611ada9f5c98d60a502827238d98beb35d443", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790700, "uuid": "3dc9bd6b-365c-47c2-877b-6e3c5de89907", "value": "T183D35C56EA414B13C4E21779BEFF41053323B7B593DB731659289FB43F427AA0E2290A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790700, "uuid": "a51dcb10-6cca-45a2-b17f-e7cd96a4b420", "value": "3072:7l4lpf8GO21DzFJgiTZe4ry8Sqx7Y6VpM/9p4jE8rnh:7lGuO19KiTZe4G8V7R3M/96nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770790700, "uuid": "9632ede3-6433-4781-b8c4-bebfce0f5b6e", "value": 140903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770790700, "uuid": "d686f3c6-964c-44e7-8a14-b71029e1a09e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790700, "uuid": "22f12967-1c59-42fb-92d0-365ef7d32c6c", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5513c3f8-072a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770801382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770801382, "uuid": "c8cf2c1f-09f2-45d7-aa32-bbb9cf9fcc2c", "comment": "Malware payload", "value": "4daa26577c7e2e884e95ee1e8773588c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "randsomewar", "colour": "#5BDE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770801382, "uuid": "aa29cb65-7224-4ac6-aac4-e988074321a6", "comment": "Malware payload", "value": "5bdc678ba73a3c444b2961894dfdd8f0b09dd83f2a2208d136cee96f841a097a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "randsomewar", "colour": "#5BDE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770801382, "uuid": "9d7f94b6-cedc-4cc8-a735-3e7e238abb2b", "comment": "Malware payload", "value": "78031e30a8f81bd8f861d2c9264d2c1c3c42bed0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "randsomewar", "colour": "#5BDE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770801382, "uuid": "7eb7a465-8422-4bf5-9910-0677286cdc43", "comment": "Malware payload", "value": "33dc557552c4d912ab7319c4ec261b9686d2e1be839e25b3c7074c8d2a6974d5663f1db4e3021605c512e48408e34381", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "randsomewar", "colour": "#5BDE98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770801382, "uuid": "089b33a6-9007-4a72-b195-9e866c4414cc", "value": "T1D6854B27B9A604FDC1EED030965FC0B2D960B4A803617A7B3785EE313E66E605F1E791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770801382, "uuid": "2e92958a-15a2-4b2f-b6cd-96818f41221e", "value": "24576:hZfWEJCdQkltvuBsj4y/jzSs5ujDakhiMgZvm4q:DWEIdTl0BsjzjYHakhiMkvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770801382, "uuid": "eb264784-92c6-4c07-8e16-8b00cddc5625", "value": 1792128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770801382, "uuid": "c7eb29da-938c-4a13-8109-dec01a49c4cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770801382, "uuid": "dd11ff81-f5be-45fd-a168-0c5a7e6fa187", "value": "return25.out", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d089c557-0745-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770813185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813185, "uuid": "20668299-5237-43d8-8610-c60341bbf573", "comment": "Malware payload", "value": "b525618dbcced9fa775ad231e4f5bacd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813185, "uuid": "055b2e4f-399b-4d10-96e7-8778c4702eae", "comment": "Malware payload", "value": "5cc826e901e5acc9e0918b0f8c748e57d642e9a431c2754e5d57ccf4a1eb5ec4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813185, "uuid": "2a65ab4f-561e-4c16-98dd-7d11cbf678e3", "comment": "Malware payload", "value": "f80a43951a649aa453b0bce4cb7612b166ca185c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813185, "uuid": "c44b50b0-cf0c-4981-98a2-e6d025ac8959", "comment": "Malware payload", "value": "9a3fd74e4c13569600f0cfd4e1337f583e63335ce54ac3d737a32716847e93c861f33216b4253a5f612d1ec9612c5736", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813185, "uuid": "f198f76e-cb2f-4400-a3be-b880bc5f77f5", "value": "T16E7533133BB511F8C62AD7B462F51875AA23B48488A78F1F33665B303FC7251AE36B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813185, "uuid": "2920725c-2538-46db-b0d5-c9199059a2d6", "value": "9b7ee852ff6777ca28f0846d1c7cad24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813185, "uuid": "8209eea1-2e49-41ec-a2d5-14e9298a2098", "value": "49152:ufaa9N9awx9Mq/URlH3xBqQ29JdBC5jSJOslylRjZOuPA:uSqTZ/UXXxwQQrC5Psl6jZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770813185, "uuid": "41248779-0ff9-4e5d-b4a5-3df775377875", "value": 1691056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770813185, "uuid": "4aea4126-35b4-4bf6-aa2f-e2ae43beefe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813185, "uuid": "b481808f-2b80-4727-9859-7609ac37a97f", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296defd0-06e6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770772103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770772103, "uuid": "7836d69c-8d9a-4cca-bfea-4e70a110a8d8", "comment": "Malware payload", "value": "0f6ed0d0daf561019473cc3af4a3dde5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770772103, "uuid": "d849ad05-a473-420b-a585-b8f4ac29b29f", "comment": "Malware payload", "value": "5d4b5b4019bc3b3277a05dbc640aced20b6b3d89aef7fb4252fc58cf84cd7c5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770772103, "uuid": "3405e0b9-d7af-4e88-8669-e8dd36175f15", "comment": "Malware payload", "value": "5a5c73e6cf735c8de51246df1194f1b9ebd93fa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770772103, "uuid": "5916ba45-5a89-49e7-9093-be1e75a3998e", "comment": "Malware payload", "value": "8d42950cff81f0c06e13e45f142dea4ea54ca7989335dae75e08c5021163977a555933d8f98ad4e38e67b53608e0d61c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770772103, "uuid": "5d881988-d666-4739-a9a1-2f261a5c890e", "value": "T1FA942339E1820D19257E1FFC8342A217B68DBF828142F642A62DF5FA1D4112D636E5FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770772103, "uuid": "5d8aa7c1-99d2-4f84-a05f-f88eb20f32ec", "value": "6144:urBRcNGGJ7hhmPP9WoetzAKl0A0iyM9fuWRJj/7hwf1njH3yl81Caxcj1Km6xjGv:1TJ7ePVOtbMPMxTF8nD3f1CyQ11Rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770772103, "uuid": "5803145f-766a-44cd-923f-108a1fdba803", "value": 409340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770772103, "uuid": "7348a680-7ae4-4639-ac49-beef90c1c56b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770772103, "uuid": "f8aa68e9-5235-42a5-b4dc-883fcc16c063", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bacfceb-078d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770843859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770843859, "uuid": "b3e8b6b7-c89f-49c5-9e1f-a88e0557fe93", "comment": "Malware payload", "value": "9a036fa24c12b0cc3be26844bd35e899", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770843859, "uuid": "0e570dd0-af3a-4160-b3fe-c9587fea42e2", "comment": "Malware payload", "value": "5da61b3899b872509b13f7609f8fb471b4d2e67f20fcf0dc2adc755f2cce9eab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770843859, "uuid": "05199482-7fc1-4605-b0a0-64f8901387a3", "comment": "Malware payload", "value": "e513b30409724250252ef041cec2c4efbfe02a8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770843859, "uuid": "c48bd544-b116-47c0-8854-46ea9c77f406", "comment": "Malware payload", "value": "d76a5881c4c4b6da672eedae4539328ff5b0617178ee4f944369ead3986254a770593ea7f17aa8008a5153c213363b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770843859, "uuid": "e252a45b-044a-4900-904a-2b5525d521a7", "value": "T1E25633BBEB5329D4C5FC81F08DDA00B321516CB749812A7B7A79B3161ED432BBA30975", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770843859, "uuid": "3b1240b8-17ec-43fb-9548-7f0d3727eaa4", "value": "06393bc523c17d0a8c45d0ce945d9d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770843859, "uuid": "3d1bacad-ba02-46e4-8730-105874101eb5", "value": "98304:O8xwW9SznzzXLI/T7G8iyG81eiPKyld7bcFzc+BzYX3tdWAp20pHPdaMT/g/sMjz:O5W9Wzz7KTri0ii3cFzciu9dfp20Pddu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770843859, "uuid": "9e2246a8-cf5a-47d6-8eb0-24cfab587da7", "value": 6001694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770843859, "uuid": "93c13306-94c5-40c1-a77d-faf06871663d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770843859, "uuid": "c7a539c4-2d23-45f5-98cb-fe06bd73bb7d", "value": "BoosterX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88063e46-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816500, "uuid": "59b3f8bf-df8f-4458-93b6-025020d2b6b7", "comment": "Malware payload (Mirai)", "value": "8b0215e172716fd069a338f166209e62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816500, "uuid": "21bc7e92-0762-46c3-99b7-736ce58d4cdf", "comment": "Malware payload (Mirai)", "value": "5ddb4340ad8bb33c3b772cf14d9e0bc98a55ca11d3aa1cb8cdf88b3b6aeb45de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816500, "uuid": "e9df2359-9188-4138-880c-bbac9400ca27", "comment": "Malware payload (Mirai)", "value": "7832cd4f7952e3530daf74632b9e36691c76517a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816500, "uuid": "d35207d6-60b7-4a97-a786-4a96fd6f7dd1", "comment": "Malware payload (Mirai)", "value": "96987e3ed72e0816b88f6ab026d9fdb9d3a14bc8c7e1f005661556baf2fc7f5600c8ebd1abaae508752c71229ff51a98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816500, "uuid": "3e3119e9-2575-4b1c-b766-545e67856f29", "value": "T19B831746BCD2CA12C6D423BAFA2E518D332563E8E1EE7207DD205F1437CA92E0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816500, "uuid": "b6fa9763-6461-4c35-91a3-eea1c6dd09f7", "value": "1536:VUo009mvvkrkbw1C14d5X91P8w5EVAUHkk3ykAWptGNM3S:VUoFmvvkrkj21QniTWptj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816500, "uuid": "cf9e0977-c68d-48eb-baf4-e428930a828a", "value": 83000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816500, "uuid": "aa7345d8-46d3-4f38-ab5b-a7f8abeb85c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816500, "uuid": "51320cfa-c0cb-4223-9ebb-815586fd5275", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67330caf-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770788098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788098, "uuid": "2210dcd1-8f3f-489f-a763-d4adc7be1409", "comment": "Malware payload (ConnectWise)", "value": "2f7ccef8433ec2bb682a481a67055db6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788098, "uuid": "67dbf690-9eb9-4f86-a9e5-180fd571a5b0", "comment": "Malware payload (ConnectWise)", "value": "5e9a1f1ae858880c5175635dc546bc816dcaed2c13e1d72359487e0c95653bad", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788098, "uuid": "772ff032-4423-43d3-93ed-e52738c3d91e", "comment": "Malware payload (ConnectWise)", "value": "2706fe27059e650988c5720477a9625014330a77", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788098, "uuid": "594c3c19-deb2-435f-bc74-931200ce2856", "comment": "Malware payload (ConnectWise)", "value": "edfb3d8887658e5f469f780371cbeaeadea8917ee01d1055837e9c9f50d0d9669e93da3f19cd4b830d847238606c83a8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788098, "uuid": "3ce193d3-399b-472a-9dc7-e0db76399821", "value": "T17CA6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788098, "uuid": "c092937f-f9e6-455f-ae5e-e38a1e2b7301", "value": "196608:OKaLNkbg2i4QqKaLNkbgRKaLNkbgpKaLNkbg:wWg2iH8Wg1WgNWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788098, "uuid": "0bc5a947-4d2c-4945-bab0-f650eba9d1f8", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788098, "uuid": "344b095b-470b-4695-b077-11b435783550", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788098, "uuid": "eed72f9c-5f2d-4e88-b3be-2cfacf867403", "value": "ADOBE_NEW.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683e7b75-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788100, "uuid": "3aa66765-2e28-44b8-8193-f2325244dbc9", "comment": "Malware payload (Mirai)", "value": "7a12e4e466e7c611a970437ad6935bee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788100, "uuid": "cffbc61c-f091-4d43-859f-c34c1b78a6ac", "comment": "Malware payload (Mirai)", "value": "5f17d3a2354e1153dfbc1a926b6cdce42cc524dfb0ace45088c5fdc756912e59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788100, "uuid": "c197d943-cadb-41dc-a9ac-142c8484dcec", "comment": "Malware payload (Mirai)", "value": "d4968f86ac9e57fff7b9e2adf8482f26333ce688", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788100, "uuid": "591dfad5-3792-44fe-a6e2-c86e451dc3bd", "comment": "Malware payload (Mirai)", "value": "76f2dcb3627f5dd493165eac9e3a09bd4d7c64b5bf1c1fdf926eef1cadd316664c4d817af461b767f76f0fe7101a8f62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788100, "uuid": "cfbac39c-bc19-472b-b835-dd6604d3a58c", "value": "T1BF045B22DD25AF8AC416A1F0B1F18E789F12BD2549470FF9A5B6EAF44143DC8F1097B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788100, "uuid": "37db96a2-6328-4a98-8384-ad1ac9a8ca9b", "value": "3072:NHihjk6GE7VHjcMLjuvAfztkWzJW7kfco0yjj7nGw:NHihjTGEJHjcMLj314IfwyjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788100, "uuid": "a78450f5-6f52-4afd-a6ce-a71903101227", "value": 189492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788100, "uuid": "c911977e-0702-4fa1-b94e-48191eb23680", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788100, "uuid": "8173e3e2-f6a8-446a-b95f-3e64715e0f2d", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c007a64-0714-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770792025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792025, "uuid": "c993b260-2402-4a84-9f23-8948ed6eb486", "comment": "Malware payload (Mirai)", "value": "23a2e2e74baa23ab943b10e283bd66f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792025, "uuid": "b0c602dd-c95b-44c6-a4dc-24b5b4795f21", "comment": "Malware payload (Mirai)", "value": "5fde0a9c4f0ccf81b458861a1428e9ab13ce8450f996750ecc0222c3948f8d78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792025, "uuid": "ade3ba3b-b22d-42d1-85be-2920f62e0b59", "comment": "Malware payload (Mirai)", "value": "71169c7379727af19baaf3c2a9bfe67747319068", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792025, "uuid": "7774a6c9-8b30-431f-9aa6-15952c5b084f", "comment": "Malware payload (Mirai)", "value": "e35390cf9eb5fdc95e37440b3c2d9b4c61b5abe961f9220934684087d4190e652e23f64ba4a0ecb97ac43de467be9959", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770792025, "uuid": "a39fc15a-b875-496b-ac68-7ca6e7c1ad01", "value": "T1C493E60A7B600EF7ECABDC3705EA2B05249D992A25AD6F75B130D818F14F24F1BD3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770792025, "uuid": "0f60d528-341e-41af-819b-ec8da21e3939", "value": "1536:d/3A+amD+/xGr29wswj8drP9iznKvrT+DEZKIfh:dymwR9+JDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770792025, "uuid": "f1164697-20a1-490d-9529-b1d14bf6f65d", "value": 92816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770792025, "uuid": "1f45fbdc-da0e-421d-a23d-c495a7249d1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770792025, "uuid": "8d118317-9d8f-4af6-8301-44dcd8c2a5b5", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89220bae-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816501, "uuid": "77c45929-fd6c-4b15-a71b-700d98f76647", "comment": "Malware payload (Mirai)", "value": "7bb2253aa4d41fd70358015d16d40044", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816501, "uuid": "00fde653-0ba6-4b7f-9a21-9cbc9ef6e362", "comment": "Malware payload (Mirai)", "value": "602626fe1ba29c59a2263aa99dc5c6199cc49fb79b21ee588ea6be44fa563c6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816501, "uuid": "d829ab04-de21-4f66-b9f8-d8f29a6472e8", "comment": "Malware payload (Mirai)", "value": "4392ed80ca1e766f2c51f84b2dfca46555cb4756", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816501, "uuid": "8aab2f7d-ab49-4af4-8c7b-2b152675fd7f", "comment": "Malware payload (Mirai)", "value": "eab397597061c0bdc1d36acfa5a07e4f62008ce050142476d0468afc5b2513b1cbd35d8af5ee9d53feb15035f2912348", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816501, "uuid": "0ea74b94-4be1-4e5f-a5b0-f09ffad5cd74", "value": "T19193F846BC918E11C5D422BAFA2E118D331263B8E2DFB223DD105F6477CAA2F0E77556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816501, "uuid": "6d3d141f-f4e8-4e57-8186-c720b7a7e4b5", "value": "1536:5nwnqIujUiDclVivygksCJ158591ifwIl/0ITiJHptDc1IHigwof4Aa4S:51IgyV8y5s4WBiVNuJRwof4Aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816501, "uuid": "a8c773de-2b24-4dc8-88e5-fa849f042827", "value": 91500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816501, "uuid": "1c576f93-f21f-4627-a9cf-137d54862756", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816501, "uuid": "172f17c5-de62-42f4-8ca4-781de4999ba2", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901c1e0e-0711-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770790743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790743, "uuid": "630bd528-d136-4a78-b432-0eed518d4474", "comment": "Malware payload (Mirai)", "value": "fd60231ce5a17a9c51eef3d6a3f6d7d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790743, "uuid": "33cbbded-8799-47aa-99c1-f9fafe1bda70", "comment": "Malware payload (Mirai)", "value": "6087de4c25529b98f2839803654d6a259e8118eb1d3db0f2d94dbb584110a655", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790743, "uuid": "d94af8c1-8a2b-420d-9918-928a277a368f", "comment": "Malware payload (Mirai)", "value": "7353fa7addb8794cfe2b8680c82aaa4b42f5c0e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790743, "uuid": "0e8d24f2-dd1b-4e6e-87e1-ae11a4cbe294", "comment": "Malware payload (Mirai)", "value": "fb08c8396edfce217f5329d19a5af6ae22e4908b98c9566c39b6dfa3da0398693936f3c6c271f5eae9fb89523e79264e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790743, "uuid": "fbffb946-67d6-43e3-bb23-1e0db18bc99f", "value": "T172C36B77CC297E68C964C0B0B1748E792B5395C0418B2FFA6AA7CA758443CCDF54A7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790743, "uuid": "666b8fa9-af62-4c11-b79e-df77ab05a74f", "value": "1536:IaQxnskIxddBcO83Y6xE65yoC0aDkDYhWnLSrKEKxk6C3GHP:Ihx4HSO83txEroEDk8hWLSOE+HP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770790743, "uuid": "aea502d8-2642-49e5-a16b-459609f737a7", "value": 129732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770790743, "uuid": "2a326999-bb34-45e9-a80d-71065888da59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790743, "uuid": "78e1e5da-8f9a-4bcc-a7b5-d67f0421102c", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97200f4-073e-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770810140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810140, "uuid": "da5d7c3f-a631-43fb-99c4-9c5bd41d38d0", "comment": "Malware payload (ConnectWise)", "value": "e69c9a6742466a2770711804291f3fcf", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810140, "uuid": "545f3c51-6c99-4783-9a60-37ff8106ceb2", "comment": "Malware payload (ConnectWise)", "value": "60d40df5336eadff150590b25c72183e6f4a0d3bb7733bb7d1929b86b1ea2d65", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810140, "uuid": "1d6bf954-c773-4b88-8ab7-fc0c27d794da", "comment": "Malware payload (ConnectWise)", "value": "64036bd9cdf9ace2b64e8ef11d8a179077425ee4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810140, "uuid": "33cebb9e-5107-4853-b5da-4a44fd9cec94", "comment": "Malware payload (ConnectWise)", "value": "d8676b519f435d522923a2954af2911ef5a69f9abfdeb7c173fa08aa691296002c1a5dc886532f3e20d077e165d9e299", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770810140, "uuid": "1cc5a25b-743f-43f6-810c-e396bbc5f6a1", "value": "T193F6230473F8A109F1B32A3AED3956F19C777C628D62D15E1659364E1AB0EC18AB3733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770810140, "uuid": "41b3c467-8771-4757-b8db-cdabc9f6abc5", "value": "393216:MmkEd503NldBmkEdLmkEdvmkEdFmkEdEmkEdbmkEd:0EXcx7E7E/EZE+EnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770810140, "uuid": "3df89892-a0d1-4075-892b-8a0d5f5c5176", "value": 15458304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770810140, "uuid": "7f8c3016-47a0-473d-a2e0-fdb29e4444b3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770810140, "uuid": "5ba17432-d7c2-4a4a-9807-26b842e46a04", "value": "LiveChat.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f441f7-0776-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770834028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834028, "uuid": "355b8014-94bf-4103-a722-a87f386e2506", "comment": "Malware payload (Mirai)", "value": "45689823147e0b4eb85e0d1655582da4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834028, "uuid": "0550d584-26ba-4a19-acc9-ddb6a4117b5c", "comment": "Malware payload (Mirai)", "value": "610e27b822a0385d87cd7b91f7f7d05f42bc56b6353b70d597ec46a6ee5140b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834028, "uuid": "8fb89156-a5cc-4fe8-9e5f-f449c35f94ec", "comment": "Malware payload (Mirai)", "value": "31857f116fd73550868a294fa1267607681e28eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834028, "uuid": "da3cdb48-9210-4e0a-8fee-2d47892650b5", "comment": "Malware payload (Mirai)", "value": "6b4267be12fa6021192b9e9a3a582dd22e38df1b3d2061f8ac6ce872cac0159343cf040cf1778079aad7db3c9d765583", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834028, "uuid": "630b3911-7644-4c0c-8738-23a3c1066290", "value": "T19A93B54E2E218F7DFFA9C23857B749619208239627E1C585D1ACEF115EA038E341FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834028, "uuid": "3d4ea643-a87f-4903-b8dc-e757cb27df79", "value": "1536:1X4/Xaafe3q7QfpTpXIVegdHHZzETljrl6Q5aUyblsTiNqAr/Joabwk:1XKXlfeOQM1ZzIjrl6Q5ZpQ/JoaUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770834028, "uuid": "98c82fa3-4386-4c0e-8c01-19ad5ba89f7c", "value": 92848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770834028, "uuid": "cb4ccab6-e533-4ce4-af5f-ef500b8dea82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834028, "uuid": "94e3f160-e6ae-462a-ac93-2e3efc92d486", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f344f9-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788102, "uuid": "6e1aff8e-a0d8-4fa0-a83a-eeff8dc5934f", "comment": "Malware payload (Mirai)", "value": "b87d9d2c426ef1115f8eb5ea1f646474", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788102, "uuid": "62f978f0-7f3f-4f91-bde5-2c6a7da3124a", "comment": "Malware payload (Mirai)", "value": "61d7b6965abddd9050b70f0f05ab7bb3930406082e52872a7c90bd04c7813613", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788102, "uuid": "cbe8f1a7-6361-4551-8d57-1ac6c587056b", "comment": "Malware payload (Mirai)", "value": "7a79eaabab9d2171b160d49c0be6cf13ecbcbd33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788102, "uuid": "38582343-bbcc-4775-a06d-b96ccc5b7dbe", "comment": "Malware payload (Mirai)", "value": "6e65185cfd6e10d67543b12fc54e257762af3fa809cfbc2b92efc303a887c115bbb5e6a8e29f79b12e95397c35cf98af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788102, "uuid": "6febeedc-3cca-48da-9caf-9132cf39ae7c", "value": "T1F8040842EA43DEB3E55310F202B787310E71ED7A6C66D542E3BCBCB4A9615D1A60A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788102, "uuid": "07c9197d-bb5b-420a-a953-8d02c31b1312", "value": "3072:nfmM6+/g5eOSSSvk4sOmdc6AIFX3PElOxi32KpzyPN7GE/IlpGe:nxk5eOLLgIFhA32OuFT/mGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788102, "uuid": "63c6d0c6-e43f-4d36-88f0-cba2fdbec4aa", "value": 188900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788102, "uuid": "23a3c4a3-6043-4073-bbeb-850f1fd288ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788102, "uuid": "888f04fa-729c-4117-9681-7024f03f8cac", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb56847-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788105, "uuid": "a77ec04a-b783-4c68-bd3b-1ff567726e88", "comment": "Malware payload (Mirai)", "value": "e2a782aa063b1bcab79b3494ef091f97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788105, "uuid": "8d87df3f-df50-4d8f-9792-297b08b0a5bf", "comment": "Malware payload (Mirai)", "value": "6285197b5bf2b12051296f7ae07482d3dce2f4f2822b860be64779b80555d703", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788105, "uuid": "84ff2ac0-0b68-4c26-a3fc-83eaefe52814", "comment": "Malware payload (Mirai)", "value": "d5e1df25274d15fabe19392d055453fc74947b46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788105, "uuid": "d9899af8-4fce-4f57-9bb5-6494bb512f52", "comment": "Malware payload (Mirai)", "value": "d1ec9c57aca13fccc499f8e1801e93fefc0d4079d088e61caef85f859ae6b1af73683e6f61a029fbaa02ca2896b33e70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788105, "uuid": "8dc4e9e1-c204-498c-a75e-6cf4b55a85c0", "value": "T1B2242B037A81C9FEC496D1F04BEBA5319978F82D0635714B3794FFB12B49EA02B6D618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788105, "uuid": "f49b1d2a-0594-4a89-b800-19636d6f2f12", "value": "6144:KBbbTJgbFZIeT6XlrPG2er/+PlNzs/4X9:KgJT6Xl62er/B/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788105, "uuid": "4683e7a4-b00d-4aef-8827-7211e3c1f9bb", "value": 213456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788105, "uuid": "fc23d5ab-a9ae-40de-a82e-e76ea81da8d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788105, "uuid": "b7a6e81a-dc60-4b58-a35d-2944ef93c53a", "value": "bin.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723ad197-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788116, "uuid": "c9353803-88d5-4117-bb67-098508170e14", "comment": "Malware payload (Mirai)", "value": "6ab3f168d8a10c45c1c2914dcce68587", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788116, "uuid": "39d455ca-7dbe-424f-aeb6-c48000de3760", "comment": "Malware payload (Mirai)", "value": "631d4550e114bebdd5e6da4f9360d963e8aea4521c3437fb17de763fadd53300", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788116, "uuid": "7849bbbd-8940-4b69-8e86-97a435b13b9d", "comment": "Malware payload (Mirai)", "value": "9dbea69f5102df50e9d7b8dfe67a899429623952", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788116, "uuid": "5539ce8f-1ead-4f0c-9bb9-c09ef17050d4", "comment": "Malware payload (Mirai)", "value": "b50edfa86bac1335407e3227b5fd70cab8055bce81d6145cffce330593ccb192ee7d3eafa3bd0d51260343e6d879fbd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788116, "uuid": "42dcd940-8e35-4d1f-a5f8-162ba63a6c49", "value": "T13354D60A7B519EF7D46FCD3305F98B0128CCB45335642B7A3670EA5DB62A58B0AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788116, "uuid": "a09b1606-c575-497e-8f32-c362df0dbba1", "value": "3072:FXb0nryFoAuINHwtxiN2asQdzD7WPtOrTqBkE7S6VjHpnGqpLmT4Zm:FAr/AuINHwhEJDx/JEFjXJmTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788116, "uuid": "68aced44-5547-4a91-b465-13b7b1f58cfd", "value": 305548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788116, "uuid": "252e1fe5-ff53-49ef-87e0-369cf989bffe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788116, "uuid": "09d70c3b-0d0a-442d-8712-5d882190dda4", "value": "bin.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f731569-0727-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770800138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770800138, "uuid": "1a63508a-4101-4806-93cc-cb8b40bfeaaf", "comment": "Malware payload (Gh0stRAT)", "value": "6bb88c61e7f8db077c4266fb0bd271e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770800138, "uuid": "5aac65a9-3a2a-4766-9a77-cf9868cad547", "comment": "Malware payload (Gh0stRAT)", "value": "63bd2535fa047323b76cb578c8d57b16d568bc5aa3c39249ef7fde2448b336ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770800138, "uuid": "30eb7b5f-3ad6-4a98-8718-84ba8e5c77c9", "comment": "Malware payload (Gh0stRAT)", "value": "b0b065dc3046fc3f96f1d8cd7c86125a1523d965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770800138, "uuid": "5a1fca8f-b022-41ce-a440-1b34b1c8de9b", "comment": "Malware payload (Gh0stRAT)", "value": "1972b8b414cad494c52ea10221bb14c9936bb739a29ca539eabcd0f8b49a97b8d1e05749e09b1ad61b74fe6f76f3feb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770800138, "uuid": "2bb8c75d-35c8-4a14-9077-07b4c0b7aa66", "value": "T1FD67333BE1AB5739F06A597539B2AA60047F797071264C1AA6E0E4CCCF370710D3E76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770800138, "uuid": "76b5f057-dd70-421d-9e60-f9acd0e621bb", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770800138, "uuid": "30ff5d9a-d581-4382-9d26-1e3c975ee9bd", "value": "786432:9RE7fZlsAplsf9TYYlX80LId2IyWq+vTkKWtrIct/0kn17tH58Aw:9RE7fLpl09TlXYd2Iy6vTkKWZ19mAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770800138, "uuid": "4cb8d6c0-84b6-4bf2-b9cd-2556c3b02665", "value": 31757135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770800138, "uuid": "7da817bf-a678-45ff-b8a1-3dbfba827492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770800138, "uuid": "9f69a095-a3a1-40d0-a4d0-cfe355b49ad4", "value": "4XLZjC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7840de41-074a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770815185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815185, "uuid": "f052969d-8f1f-440b-b475-f876ab71d52a", "comment": "Malware payload (Mirai)", "value": "976858bc850e95dcd4f0065e63a07873", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815185, "uuid": "515501fb-245d-4ac4-8307-481b2c56218a", "comment": "Malware payload (Mirai)", "value": "63e36c6e402c284d8ec5e6548e4bb7b53d21163e426efedce69dab94c42806ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815185, "uuid": "3208ae56-84ea-438d-84bd-0820868e88da", "comment": "Malware payload (Mirai)", "value": "b2defec33ebe80101a5359aa7580df3682837cf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815185, "uuid": "90d05c4d-dcd7-49f4-bbc9-c8c54c3b61f6", "comment": "Malware payload (Mirai)", "value": "649756f5907736a17f74d46df72df4ca27afff8caf320b69e0a6892f2d1274edc47a87a108c683acd9e0fa4dafa07bd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815185, "uuid": "4c770956-96be-4e6d-96ab-fb593a5f2431", "value": "T12763194BA98580FCD199D13442BBB13AD863F47D133EB69627C4BF1A2909FB01F6E509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815185, "uuid": "f3e5f9f3-4e94-495a-8a90-454865b47f0c", "value": "1536:+kFgaP73+Vv5B/bDx0Ma2xtGh76iH7B2UOUd7Ns9nGm:+AgaD3+VRBJ0M5mh9H7BdOk7NEGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770815185, "uuid": "3d6936db-e584-4cba-8b97-034831cb2afa", "value": 70912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770815185, "uuid": "88e1f64b-9e10-4c7d-b79f-eb31a0474288", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815185, "uuid": "8511abef-ac70-4083-96f4-9dff8e6785bc", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621eb2c9-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816436, "uuid": "8fca993b-71b5-40d6-a1c3-878985dfaf2b", "comment": "Malware payload (Mirai)", "value": "9f757e70419791f7dcb7997f9f29ee1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816436, "uuid": "7bd61a11-8464-464f-9db6-769f2764f61d", "comment": "Malware payload (Mirai)", "value": "64cfda125eb92d8d7b13e0a9f4c5b577d70db4f77b65f96b241ebc9c3a525545", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816436, "uuid": "45f5fb87-5772-49ef-8fad-a4bf7e831e43", "comment": "Malware payload (Mirai)", "value": "b148fb38d345fbff30d103b482cac28b6336149a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816436, "uuid": "c055dc59-cb6f-4c5d-8a3b-7430fb736d58", "comment": "Malware payload (Mirai)", "value": "1594eee069f5adc6d326432fa794cc1363c541db9d4c09b389e1c6b4ea094565f808055e4cc7b4f029400d56efd79d29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816436, "uuid": "00e851f1-9b49-408b-9842-d6c4209bb3e6", "value": "T1B003E17670E791B0D6904C34E473894F70BE1E64DACAF956D2AE0B1B7C15C87A6A8F02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816436, "uuid": "cf611ecb-b6c4-447d-ad20-5a58c9397fe3", "value": "768:2Ct8xQyKEXdvcsU2fPmjtoDS12POkIC2uj7GK+4aqHwIIP/q3UIRZ:2GSzJsvj+OoICJ7GKTaqH34Qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816436, "uuid": "0057b6f9-a07a-4365-949c-3291717d9fa9", "value": 37872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816436, "uuid": "a8fbf885-bea3-4ed5-8bdc-d1c7ea164211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816436, "uuid": "817d5b4e-5553-4798-a39d-8f8674d331a0", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3383456c-0721-11f1-a129-42010a9c0007", "comment": "Malware payload (StrelaStealer)", "timestamp": 1770797460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797460, "uuid": "6748618e-8fa8-4926-8a65-c7896ed2a2f1", "comment": "Malware payload (StrelaStealer)", "value": "2023d262c24674c7ccf9267a805e3b8c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797460, "uuid": "858377cc-2341-4967-a8f8-267d7a1552b8", "comment": "Malware payload (StrelaStealer)", "value": "655ff3bad595190e1ba824b4809b7be96df7bcf8c148bb7d33ac9638fd451b1e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797460, "uuid": "b1b05368-2c96-49c6-918d-584da8e7f576", "comment": "Malware payload (StrelaStealer)", "value": "2710931b174c7523e591cf60af52743c7d4c3e12", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797460, "uuid": "15326d37-51a4-4fb3-9c12-77c80bca4bb5", "comment": "Malware payload (StrelaStealer)", "value": "b702e2e4cec7f1616979a5835fd60a73aab6cba1b2bee8199e28b1f79312ec6797eda60cec9079cc2457ccdc052bed1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797460, "uuid": "da15f8ca-2ca3-4602-9b01-a3f661b92796", "value": "T1C145175004AF1235750F3BA6E642239DEFBCA665A1135F6DB00F5DEC8D129B83A17B2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797460, "uuid": "ca0e1ba9-65cd-4a0c-b524-b2b83f4b544b", "value": "384:vHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHk:Ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770797460, "uuid": "dfadc437-dea8-459e-8be1-efb29b6bfc9f", "value": 1214079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770797460, "uuid": "9edc3fcd-d1a5-4ab4-9667-edab977a005a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797460, "uuid": "c05eb5a6-f871-4454-800a-5451cfd60531", "value": "ORDER7950597695858432.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae31a8be-071a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770794659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794659, "uuid": "89d99f38-314e-4b3c-9951-d64995ca1bce", "comment": "Malware payload (Mirai)", "value": "aa4a000785f32d861e7e5aad07ac048c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794659, "uuid": "f2a0fe75-88f7-4ac2-8887-5900af08311f", "comment": "Malware payload (Mirai)", "value": "67905aed92cd43fcb277b0794a3e44d0101ad3f53b01b56ae69ca4d8b5abdd25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794659, "uuid": "7d7236b9-8066-4e2d-97d5-f4f6be39efee", "comment": "Malware payload (Mirai)", "value": "190d87bda9ede819503afc956bb2de9dd539d67e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794659, "uuid": "4093a95b-c575-4512-ba54-655c4fe41609", "comment": "Malware payload (Mirai)", "value": "5726eff6ea1cccc6d674f38341637e70d25055d96e97bfb54d8ba4e85f1c0adc4ab1ac28816f038ff6676a484d416dde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794659, "uuid": "4c044963-0f88-4435-b664-662591d72a7b", "value": "T126432895B8824A1BD9D00A78BABE594D375233F1D3DB7223CCA38B34278556F0D66F09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794659, "uuid": "aa39848f-36fc-47ad-be47-ff029d1a2345", "value": "768:/tvquEAZCKTUbkA5Qk/Ddk53ZedCiNNvQqGFAzox4spjLZ4ClbGHoqiuDCAypect:/xqGZ6Qk/D+mdCifuAdUJ4ClNcT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770794659, "uuid": "6b63c0dc-d162-4151-a466-7e0730c0628f", "value": 56792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770794659, "uuid": "ca8e19a9-a7b6-4aaf-afcb-3f8ed849d3c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794659, "uuid": "789a213b-dfca-424b-8c72-6bbeb75e1fe0", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5bfac5-0762-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770825421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825421, "uuid": "04fe8b54-9f4d-4d22-89d4-e80719cd0707", "comment": "Malware payload (PureLogsStealer)", "value": "0b4640a59e11e55033e7c5bd3c52c7e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825421, "uuid": "f2fc429a-b394-48dc-8080-c2a964cfd92a", "comment": "Malware payload (PureLogsStealer)", "value": "67bd881dd24ce7d974ca3b59c9464236ad9382962731b923d1287a85c5e173e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825421, "uuid": "d602f55d-7cf9-4b7f-ab0f-6465399c3c53", "comment": "Malware payload (PureLogsStealer)", "value": "5b28528060f8dd08bf292d7b20581bff4fc810e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825421, "uuid": "e41a6cdf-9671-4eb5-9588-76e157cb18ef", "comment": "Malware payload (PureLogsStealer)", "value": "553fb9c3d67d87ed0199f9067d364d825951906428383590be1be903260e9507fd8e9429170fc65aa89818061e7bbda6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825421, "uuid": "dbb36820-7b05-4535-af57-519282539df7", "value": "T1A6C48D1B7755CD20C548A637D1CB4500E3F19596B263E70EBA88235A1E073BFEE4A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825421, "uuid": "65ebca9f-1849-447d-9578-8cd9bdbe1047", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825421, "uuid": "03791b0c-2e41-4681-95a1-cbaa5136e429", "value": "12288:BG6asp/QnFzYs4phdHsr1wjcmmLZAShDaThNRKZkv:Osp/Id3cHHspnLZR+5KZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770825421, "uuid": "a692b75c-fd94-4480-94d6-0ac2c12bfb10", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770825421, "uuid": "9cae42f0-d9e7-41ac-970c-1c24e055539d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825421, "uuid": "3f5c78a5-ae4c-4ae2-a815-8c19b86d2ab0", "value": "ccw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc02d24-075d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770823541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823541, "uuid": "730328ab-943e-4160-b197-aeea5059c879", "comment": "Malware payload (Mirai)", "value": "e35ba778e046c104a201f6d9eb1e0b07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823541, "uuid": "a15820ba-06d1-417e-9986-d33f01b02fc4", "comment": "Malware payload (Mirai)", "value": "67c5d63b9b0a98d24640848fcf273833045fb19bc98a2cace3afb4d5dd875ddc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823541, "uuid": "22e0059f-2df2-466b-b105-7bc4086939e8", "comment": "Malware payload (Mirai)", "value": "af917de1290d2c1a2e867d59c05e337e4ed9ccc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823541, "uuid": "09541bbd-627d-4f2a-88c7-6a17ec677498", "comment": "Malware payload (Mirai)", "value": "826a0b6aa0b4c052b72d146d7995b37c10e4665f7dc3b0c81be56cda8de03649a668f09931f0435af531b2f2a7e4e9de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823541, "uuid": "c12d1bfb-1b42-4cc1-802e-030fc19eedd5", "value": "T19943720ABF600EF7E86FCD3745B91B45348CA40A21A97F767934D428FA1A54F09E3CA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823541, "uuid": "28283cc4-0ea6-447f-9df2-a7ab0e3e7a78", "value": "768:uiwOJE1JKm+JCriPKvU72djlUWUebneEQeSe7cCKZxxjXiu0b7S8xdbs:uiwcE1JKWU6LyKnxQJe7OZxx47pPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770823541, "uuid": "b50f397f-4462-456d-bae9-6f208122ca96", "value": 56972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770823541, "uuid": "f055d4f3-a29d-472c-abe5-d01993207182", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823541, "uuid": "47ba4e21-ac91-42ca-a962-0fc66d30f829", "value": "nexus.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74efa1bb-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788121, "uuid": "29951421-6ca5-4d33-9b55-19018d73f039", "comment": "Malware payload (Mirai)", "value": "34f71035deb7dbd290653fab57ad9003", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788121, "uuid": "933ccb76-a1f4-42e8-a560-8a59256b6e4c", "comment": "Malware payload (Mirai)", "value": "68917c76aef394bce019bc70fa8d907f53fe635918fa29ecea2bd23439ed54df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788121, "uuid": "94f882f6-021a-4cf3-91e2-44fffca37fb9", "comment": "Malware payload (Mirai)", "value": "7157e4fdeae3b426ff0ba46be47bc7d3cb59f5a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788121, "uuid": "8c92eee3-a297-4483-baf1-5fa22e6e0735", "comment": "Malware payload (Mirai)", "value": "462b8a86edf6794e8e33c9e13e54a306bcc163f97439f97a0adc2c23025a2a30a12449e80780ed0e035a3f2696170cba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788121, "uuid": "2b7377b7-e882-4278-af47-d3b866b61152", "value": "T14854891A3E22DF7FF66D867047B78930569876D62AE1D584F16CE60C1F2028E241F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788121, "uuid": "4dcf1959-5520-4e1f-987c-c3d8bdc06ca2", "value": "6144:MILlMEl/9nUy+MtLy58TrMJ/VSwwsfFqjMI:z9nUIJjrqojMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788121, "uuid": "0ac6ad1e-6269-4f06-bb16-2241440728c5", "value": 304652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788121, "uuid": "70b7136a-6a46-485e-9f06-4856a4698e59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788121, "uuid": "f911f7b7-3a8e-4b83-b8e4-edf5461f35b9", "value": "bin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e299cc2-078f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770844884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844884, "uuid": "85f47b84-479a-44c3-b88d-6dfb7334eeb3", "comment": "Malware payload", "value": "51be61d4415007e21ef6cca607b9e87e", "object_relation": "md5", "Tag": [ { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844884, "uuid": "08d17fbb-842c-436a-903c-db2d35d709d6", "comment": "Malware payload", "value": "692156d0eedc173f87900de467e30ca6b646000619dd33cda45bdcb30d3b771b", "object_relation": "sha256", "Tag": [ { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844884, "uuid": "77f7ea6d-aa76-4af7-9c15-b8d0bf2e0e71", "comment": "Malware payload", "value": "f66fb156bdf797ced5bea53a3bf545b2f9884ac2", "object_relation": "sha1", "Tag": [ { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844884, "uuid": "f63e637c-3ed7-4956-8abf-72f6a0920581", "comment": "Malware payload", "value": "cba69ce2595b72e5e58b1b2ed7403cd584f941b3b0bef8545f15d5da444b3274919e58311c4fa44e061af725fc3a8e3d", "object_relation": "sha3-384", "Tag": [ { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844884, "uuid": "1f130f59-4bab-4535-a8f3-fb66f59be88c", "value": "T1D20633DE385AA9159B58092FCAD03AA36CC67E5B422614CB41B336D3B0E03DF9CDDC64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844884, "uuid": "cfbc4449-75e0-4587-ad3c-3591f50cb145", "value": "98304:H+jR1dkVJSlrU3VVSp9KixsT8gx8qbQwT+S0+J6rfBXCAyVYr1:u2JSlmVVSpLKXrbQwkbrpXjyVYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770844884, "uuid": "3a13692c-bbe3-45d7-90f5-ec43c2c6a513", "value": 3708993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770844884, "uuid": "ec707dda-b4a7-49fd-9fae-b25e864d29f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844884, "uuid": "cd591d4d-1ad2-4a54-a83c-13bdbb606dc8", "value": "ZIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3e7f29-078b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770843320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770843320, "uuid": "9e756c79-092f-418d-ad1d-1ed2bab189b4", "comment": "Malware payload", "value": "4238323bd3cfdd1d07a9df028da0a5af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770843320, "uuid": "149b6284-062e-45d2-9192-bb1930844f20", "comment": "Malware payload", "value": "6a804f64c2799a94782d7d219d34c9c6f843c713f2971db04a4d9a2eb9e263b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770843320, "uuid": "b3535540-1b81-406b-ba32-e018de2f3f71", "comment": "Malware payload", "value": "7a0927f79c5b7917f6b38ece9fc29556b5459bd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770843320, "uuid": "4c7f6a5d-8996-415f-a475-7c6e19dd0623", "comment": "Malware payload", "value": "2eb7c6d354bcaa7f827937cc339952b4a31e0a11d771639b5eb80a6a2a3ff6d0ed50d6d2795450d26b3cc64e539ea1a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770843320, "uuid": "96107395-ecb5-47d2-b371-827aa00e28ef", "value": "T123F7338877941DE2EA54833B0617B94CAF59F50D67C9880FE7E871292CDF38A59FE900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770843320, "uuid": "4b3f9c6f-6f68-4f5b-a2e0-b52ac50e4285", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770843320, "uuid": "89ad490d-cd26-4df7-b867-f14c9c40f82f", "value": "1572864:bm67R7EWod80izXUb9jETHPQmMpnx9luHY7otnq/2jNN3oeSqjQnPXTH5H:bTR7EWod9jcvPOn36SeSqjQnPXL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770843320, "uuid": "58a67de6-01a0-450a-88c5-82e5ba957672", "value": 76613003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770843320, "uuid": "a69e5c78-095b-4746-b2ef-23de3c000844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770843320, "uuid": "8408f278-c209-4dd2-9dba-d6215ba1bdfe", "value": "Task.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5267cd87-0723-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770798371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798371, "uuid": "01c9821f-0655-4731-beb2-76bddec27eb5", "comment": "Malware payload (NetSupport)", "value": "32148491e6baa2f03e75b00311cd284d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "av-srvcn-com", "colour": "#3F219E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ppp", "colour": "#641FD5", "exportable": true, "hide_tag": false }, { "name": "pw-ppp", "colour": "#46779B", "exportable": true, "hide_tag": false }, { "name": "srvc-mcrst-com", "colour": "#F58405", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798371, "uuid": "d36f3681-d7e2-4798-96a8-d4d6fb13a636", "comment": "Malware payload (NetSupport)", "value": "6bb3744eea075770fbcb8dfe024ead506e02f232333e1470f55fd501f2efbd17", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "av-srvcn-com", "colour": "#3F219E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ppp", "colour": "#641FD5", "exportable": true, "hide_tag": false }, { "name": "pw-ppp", "colour": "#46779B", "exportable": true, "hide_tag": false }, { "name": "srvc-mcrst-com", "colour": "#F58405", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798371, "uuid": "faf6d4ea-e268-400d-b4c0-80fd2a30258e", "comment": "Malware payload (NetSupport)", "value": "989402720d35074f7fd91be6f5433532b5578ab2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "av-srvcn-com", "colour": "#3F219E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ppp", "colour": "#641FD5", "exportable": true, "hide_tag": false }, { "name": "pw-ppp", "colour": "#46779B", "exportable": true, "hide_tag": false }, { "name": "srvc-mcrst-com", "colour": "#F58405", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798371, "uuid": "5b6a2e16-28f6-4013-9659-976871d255fa", "comment": "Malware payload (NetSupport)", "value": "7a9d4db61402d26d5893395367446493769a93e36824812d0974c5ada9ba5e66575604999a9dbe197ec57fa8dfb229f0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "av-srvcn-com", "colour": "#3F219E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ppp", "colour": "#641FD5", "exportable": true, "hide_tag": false }, { "name": "pw-ppp", "colour": "#46779B", "exportable": true, "hide_tag": false }, { "name": "srvc-mcrst-com", "colour": "#F58405", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798371, "uuid": "0cecc031-4c99-4483-a60d-dc2a6c2751f1", "value": "T14DE533972F6453C9731465F075FDF3A856FD8E1C88F20AC9F126A2ABB4B548062AD01F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798371, "uuid": "27c90bf7-1af6-4401-abdf-0a6303fe6459", "value": "49152:Vdt4ieo0csSXSTuGaLNOuQsy4pC3w0uCLfx/NZ7AdUk7R8BblmCWUuuISKRSwGui:RleQS63zhCgopPzBrFWrlSDRub2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770798371, "uuid": "6a0926b0-98fc-4b62-bccd-ae9346aea0a9", "value": 3025041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770798371, "uuid": "9272251b-a38e-4469-821b-69be2c60bebc", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798371, "uuid": "32350646-efa6-4319-bb3d-de801ffe28cb", "value": "6bb3744eea075770fbcb8dfe024ead506e02f232333e1470f55fd501f2efbd17.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc447398-0793-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770846652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846652, "uuid": "c96d6595-5b53-4c8d-8654-26169fc25b5a", "comment": "Malware payload", "value": "f9dd2c605c574e0dd4eaffc35603d53b", "object_relation": "md5", "Tag": [ { "name": "nanafafa-myvnc-com", "colour": "#010770", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846652, "uuid": "51265770-ffa0-4020-b3b8-aa7e7ff2ef4a", "comment": "Malware payload", "value": "6bd13eb3a9f3fe5eb5a309bd2fa8462f6f9d30ab408229e3b3a928d8393be9f2", "object_relation": "sha256", "Tag": [ { "name": "nanafafa-myvnc-com", "colour": "#010770", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846652, "uuid": "b139d2e9-c1b0-44eb-814b-4430dff52f22", "comment": "Malware payload", "value": "d96085040a3bdd4dc7e360232f1afe5d1772ba80", "object_relation": "sha1", "Tag": [ { "name": "nanafafa-myvnc-com", "colour": "#010770", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846652, "uuid": "d124e1ba-9519-4b86-8180-8ab8c3800032", "comment": "Malware payload", "value": "27f349a569335fcfccc0a956c19ffedecf7e8e05bb92812c659a4985883550bc841682511ecdf56c027112407430e94f", "object_relation": "sha3-384", "Tag": [ { "name": "nanafafa-myvnc-com", "colour": "#010770", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770846652, "uuid": "fe16888e-a207-4ef8-8c98-841034845005", "value": "T1C2B5334CBAFB0E1395D3B9C8F1F2A42E6759FC61FD6BC38D6E288185546C2521A01DE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770846652, "uuid": "974e89f0-037b-4cd7-b420-7a9f14c1f5ae", "value": "49152:aPFiMXzMkV9dB/3xVjxU76DH6zDkYkhPB75qp:aPFiot/BnU66WJBtqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770846652, "uuid": "fed3278f-b2c6-4583-af5b-b66202d40d7d", "value": 2281591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770846652, "uuid": "0f96a1ac-6299-4424-8109-47606805eadd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770846652, "uuid": "35e8c1b3-4a3d-4dfc-97e5-96c6f5a297a9", "value": "PEDIDO DE COMPRA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb6ab39-077c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770836776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836776, "uuid": "7837d7d4-4c57-45fc-b807-010d81e3d3be", "comment": "Malware payload", "value": "72b3c03d84ff2b0585f1866807396bf0", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836776, "uuid": "cc726e7f-84b8-4a1b-be62-2594eaa1dc9f", "comment": "Malware payload", "value": "6c1693c10b7854937aa44762631fef48c42ab99e062c59c907f4f503cbd5982f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836776, "uuid": "febfcf9c-d713-48b6-b181-2b9752ee7233", "comment": "Malware payload", "value": "94f5473d4bad36966db1ce8a82b5bd86ee91177f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836776, "uuid": "d348be65-0aed-4bbe-b46b-31e9ff46e8ef", "comment": "Malware payload", "value": "13080d4df7e8f215a015875e645be41cf368ee9b620535e54c01f0f515ba00231c1c10a749770f926817bef92688eb62", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836776, "uuid": "a9ee0531-a53b-4893-a2e1-45253cf6f93d", "value": "T11641EE213BE90B25E3B78E7141BBA7208A77F856DE56C31D0140418828D6B2CE93EF63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836776, "uuid": "f45bbfe9-a24e-41d4-bba4-a50d047c3036", "value": "24:8qbVJhkQk5NTNA4Ax+//TddNXuHY8OGIxH938BqS3Im:8qB/kvTGTKdLXuHCGIxdeTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770836776, "uuid": "f39cea95-1668-497d-b0b3-854805305884", "value": 2173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770836776, "uuid": "249a8d7d-4de9-4887-b982-df520c99bab0", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836776, "uuid": "e9192ab5-7ee5-4d42-8f86-3d5726ac0b59", "value": "R9VT3Z0.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bff7369-06e3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770770765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770765, "uuid": "0d47ff20-a43c-448a-9119-490ae4ad6e0c", "comment": "Malware payload", "value": "1244e53900b66f58fe81654995dd58cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770765, "uuid": "41b8e51e-b852-4d06-b179-4cbdc973cd4d", "comment": "Malware payload", "value": "6c5f4ef51057c9b265f4a40e1782b2db101fb70f4206a33c2dcc4e29de61f89a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770765, "uuid": "fb7bafea-04df-4c1d-b6c1-7d906927a9a7", "comment": "Malware payload", "value": "77763b6fc2ee9d96d959c630ab0028e5ce28f852", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770765, "uuid": "ff89fae7-5931-4988-b716-79dfc1495bec", "comment": "Malware payload", "value": "95b3abb6e67c7dcd8e17d260bc3dda46871e224516bc1a0b673a28cf0f6b55b5ff5cf49c19b60c48eaa41a90df2cb7a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770765, "uuid": "eef42d47-9110-4d1a-bc3a-22d60ca59925", "value": "T118E475A27F59AE0FC699323956A6C13473C77A41C1E07032CE93D7091FAE2B4D85ADD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770765, "uuid": "93cda0ff-f7ca-4f0c-a36c-562a3eab4445", "value": "6144:8pXzT1Af7gjEXMc4FpAePthg5mh+cQa43H4gnmWDimt2fDabOEAOhcelD:8NzT1gkjE8cOPth0n3H4gd2f2HCelD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770770765, "uuid": "41fdf678-8063-4f47-a4a8-725968ca3c72", "value": 697907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770770765, "uuid": "805b5b91-5c96-4364-9be7-31eb78cf9ac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770765, "uuid": "a03ffc42-2389-4b06-b761-615531111881", "value": "bizy.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23538bec-0745-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770812895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812895, "uuid": "751be029-4c26-4146-8f1e-bbdfb0a76675", "comment": "Malware payload (Mirai)", "value": "66e959cd2ade5020a1e53cfed70a1d1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812895, "uuid": "8e0cb360-90e0-4aef-9727-98d90d441447", "comment": "Malware payload (Mirai)", "value": "6d0131bab7a5f69d9161fb6ffc8924687578086cc34e38e2987e45c4df2020ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812895, "uuid": "7decbf04-9e3f-4967-9839-a5d5064e4745", "comment": "Malware payload (Mirai)", "value": "d55eed59e5dac3abedce04bc146d1494043edcd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812895, "uuid": "96e0b452-fbce-4de5-a4a3-4b2e5f4895df", "comment": "Malware payload (Mirai)", "value": "050c08a8214df122c045a5858d91feb29b0a2a13c38796e64ff9a837abb54edf93964c370b282833a076b713c124889a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812895, "uuid": "85bae66a-75ed-4185-9e93-86a8ba0ebb8a", "value": "T161630150F40FFF3DC2D248B2F86C9091D10E547CA01971AAA2E9AD99B599E491F3D341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812895, "uuid": "862e856d-6716-493a-96c6-5d9d3a2fbd40", "value": "1536:/dZqOS/TQi78QIvUMAug8PTSjRyZ4zvLfjN/7N0CulaIEA:uOS/zZQ0U2RC4fLz0PlVEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812895, "uuid": "cc0d9a15-c03a-4e0d-8ef8-5306f0f57c04", "value": 66984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812895, "uuid": "632f88b8-00a0-4cb3-9ef9-de9af09fa8a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812895, "uuid": "0a637d5b-9bba-493e-866f-642770b143b7", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d6163e-0796-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770847853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847853, "uuid": "5f882e2e-f97e-402d-9714-bb4b47e55871", "comment": "Malware payload", "value": "910cb9d07466d6e74f357403a0c9b0ac", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Markdown", "colour": "#0056D8", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false }, { "name": "PolySkill", "colour": "#49A988", "exportable": true, "hide_tag": false }, { "name": "Skills", "colour": "#CA8F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847853, "uuid": "7c9b4e00-c05f-461c-b37b-b6ec3a252dcb", "comment": "Malware payload", "value": "6d86b174b5d354e5ead745f0a10bec628c8e36208d71a0ded48c36fa40f2cb92", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Markdown", "colour": "#0056D8", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false }, { "name": "PolySkill", "colour": "#49A988", "exportable": true, "hide_tag": false }, { "name": "Skills", "colour": "#CA8F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847853, "uuid": "1f607f6c-e816-4813-974c-a698742f16ea", "comment": "Malware payload", "value": "5ec0aee2b65a8bbd680370dc2928ef9e30fe2935", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Markdown", "colour": "#0056D8", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false }, { "name": "PolySkill", "colour": "#49A988", "exportable": true, "hide_tag": false }, { "name": "Skills", "colour": "#CA8F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847853, "uuid": "cbefb882-e5b7-4e25-8a45-c389daecec9f", "comment": "Malware payload", "value": "8ebe16d80d6a84737aa8b0dc2c6747b3713c83752cc4d9ee1c06aa03c3d213a0ac95c6ea62e6c97c1d716f34db6d92ed", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Markdown", "colour": "#0056D8", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false }, { "name": "PolySkill", "colour": "#49A988", "exportable": true, "hide_tag": false }, { "name": "Skills", "colour": "#CA8F4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847853, "uuid": "3f320499-1f33-4f45-b784-1d0d938c6937", "value": "T12E41A55A5BC163B427C78E777946FBFA7F34E11CC20090D893A803A87107BE2864E1AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847853, "uuid": "2eb2f7ca-d649-4ee3-a773-c5566a702a29", "value": "24:/Esd1uC1SpnvhOxloMXVQ1q9mvKnBrvVxjgeSLqSqgp2fhG+4R7l01AttysnR7Cb:seS1QNDsQBLoLnYfhGJUyn0Q8k8NzbRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847853, "uuid": "65e025c8-d29e-444b-beab-122501c768f6", "value": 2116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847853, "uuid": "d5eece16-5888-4382-a192-4bc5d36c5f53", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847853, "uuid": "ec1b5a8e-2aa4-49ea-b34f-331490715dd9", "value": "SKILL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15dc787-0743-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770812355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812355, "uuid": "7943dceb-39b3-4e08-a918-c6bcbfb25e06", "comment": "Malware payload (Mirai)", "value": "d807a56fe6f82a4dbc8352524ed321c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812355, "uuid": "a2809f6b-c475-48e9-9ed8-dcf8755e5b4a", "comment": "Malware payload (Mirai)", "value": "6f4fb383a38d813063c29e4d6fffe25fa93a24fa2f11ae1eff212acd2775b424", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812355, "uuid": "25acb422-729a-427d-a382-8bed0a9ba82e", "comment": "Malware payload (Mirai)", "value": "0d9c316baa17f1108fa96da98fe499a582375624", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812355, "uuid": "ed874b96-7b47-46f0-a43b-094a6ca2278d", "comment": "Malware payload (Mirai)", "value": "9fc94c4cb58fb733816b9226e8cbae1562fe76977c2a41134df1eade043c9124970641447932e26cb26797e93f32cc45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812355, "uuid": "5f72bf5b-bbd4-4aa0-ad5b-c184d55d0741", "value": "T1C3C44A59F8809F61CAC5257AF75D829C33134779C3EBB20699245B343ADB86B0F3E642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812355, "uuid": "ae17cb86-7317-45f3-9bc7-53b963c5acf7", "value": "12288:imq6jjTf4ug0X/uP3tE7jbDwgIJ/gpEoriiX:zjvATP36PbD/IJUGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812355, "uuid": "39bf97f9-07bc-412c-b1d6-cba3001bb2a0", "value": 575212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812355, "uuid": "810e1c9e-dfc1-47da-9c68-3a5787ee54bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812355, "uuid": "341870ca-6877-4696-83b0-90c52cc97d62", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2f530d-0726-11f1-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1770799807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799807, "uuid": "9f3dd832-56ba-4bee-94ee-1d7d51d76e3d", "comment": "Malware payload (Loki)", "value": "660400b6c0fe49e186bbd0a185db0443", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799807, "uuid": "359b24f1-aba3-4c3d-88b4-ed72c0131c8a", "comment": "Malware payload (Loki)", "value": "6f9d54ef5d053a976a180e0b24d35b54992acc9c65443ca11951c28222cd5afc", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799807, "uuid": "e09afcc5-6b33-4a0f-b47f-5c3198a221c4", "comment": "Malware payload (Loki)", "value": "565dc30dacc3af117fbb38ece7ed7a8444fb7c92", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799807, "uuid": "bfef3c3e-06b6-4b7b-804d-bdd4c3f1a7f3", "comment": "Malware payload (Loki)", "value": "eef2da39767ab8cb31ecbcb1dd8b32389233aa0aedf0de2939ca0a3be7cb764ac70b0df6de21c985df15a1a137beabab", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770799807, "uuid": "a654517c-100d-4caf-8d9b-4db8931a81fe", "value": "T18D1394EA22C6B5744B26317BA93F68C3F16E8E90D65C80D4C35E5CD4BE9435CC47A878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770799807, "uuid": "1969cdf4-d595-4b7f-bd8f-9fd87b1be878", "value": "768:WnEvcTw1YVs3meK3Es+0/h03VdLGHheaRK3VtNdiCKZjZxPSZsuw:WEUGYVLiEDqvCjZxeXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770799807, "uuid": "a73c6d88-be44-4873-afec-719c3eb61a7c", "value": 42925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770799807, "uuid": "59a51627-b814-49f6-81e0-7cccbbff92c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770799807, "uuid": "f4f5b906-6fd1-422f-8d23-410bcd8f059d", "value": "Mod 347 CIF.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e720c9a-073e-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770810068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810068, "uuid": "79dc3276-58e4-45cb-8697-cdc1b8ccad9f", "comment": "Malware payload (ConnectWise)", "value": "363d0614c8b31186e3751962f78e7d2c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810068, "uuid": "0c731435-e653-482a-85a4-8d3697ca4c54", "comment": "Malware payload (ConnectWise)", "value": "6fe56405a789d8d093c01573d6af9096794a71f40026c96c7acae7d06470824c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810068, "uuid": "21cb5f78-13c0-458c-9d38-2b76cbc7c247", "comment": "Malware payload (ConnectWise)", "value": "ceb694c3ce87488277e1145d8723934895733b66", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810068, "uuid": "3a09ee15-61d2-4257-8ae6-83866482ee48", "comment": "Malware payload (ConnectWise)", "value": "ad6f1aa51c51e05c9d0eac697e64261935e859afb044c425f176343f8f4aab0634198f22c3712d3f13abc25ed1300b36", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770810068, "uuid": "9f5c032e-cf77-4398-b7dd-d73317fa781d", "value": "T16DF6230563FCA109F1B32A3AED3951F19C7B7C228D62D15E1658364E1AB0ED19AB3733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770810068, "uuid": "b0e89878-fa62-4a7b-a5e4-5a694f803a73", "value": "393216:NmkEd703Nld1mkEdLmkEdvmkEdhmkEddmkEdWmkEd:fEhcxnE7E/EBEpEkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770810068, "uuid": "84b7b0aa-c94d-46b1-b64e-f783abe5d741", "value": 15441920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770810068, "uuid": "57b781ae-cf8f-4968-a43e-6e86340cf744", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770810068, "uuid": "5a41711d-0694-46aa-a2e2-83586717038e", "value": "LiveChat.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af3dde0-0744-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770812505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812505, "uuid": "34caf2fb-cb98-4b05-8735-f6b2f7fcc747", "comment": "Malware payload (Mirai)", "value": "8cf05fc542338cbe36d8cd65a2657f36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812505, "uuid": "179442ea-ab4b-439e-9e64-d7e01df53809", "comment": "Malware payload (Mirai)", "value": "70e99ec28abad786a2c7a22dae7527cc1e149422990d59052d320a231ce45095", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812505, "uuid": "5b66e456-bc76-4d3f-9f0f-defe84fff241", "comment": "Malware payload (Mirai)", "value": "5f95814760843b39b1e127b5c4ba82cd41ccb0fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812505, "uuid": "763bd94d-1f8c-467a-8da7-06ede2322dc7", "comment": "Malware payload (Mirai)", "value": "93bb9785a5c2491b0d7729cb6d08810a396f5500d967239e2f1d5343e3551b5ce4510fcef99988779deaf19865a292f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812505, "uuid": "22e51cdf-76ad-44b9-8ab7-0998acf9c2cc", "value": "T153D2E11DEB5584D7D5639CF7966A1770BB380FA2B01A1E022AA11D87E7508E27233FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812505, "uuid": "20234fd3-4f64-47ff-89a8-2fba0e631b8b", "value": "768:M8d+Nu2viLhKFWvckyBzdjq526IZUrFvm29SJgGlzDpjc4:M8d+NuEi42yR4EIFvmUWV1c4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812505, "uuid": "f92af2e6-8fa9-488d-8d2d-64c53042ea81", "value": 30944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812505, "uuid": "586d6ffa-3bf8-4b0e-920d-da6b638753ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812505, "uuid": "1b9539b2-6809-46e0-89d7-25f7e300e325", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f263f7-0791-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770845779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845779, "uuid": "69dd1604-4983-45ef-ada9-24428176af16", "comment": "Malware payload", "value": "6de184c96ce985e64cee9209c68aa940", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845779, "uuid": "de200bc3-e570-4b61-8f02-8818c59b02fb", "comment": "Malware payload", "value": "7156c187c58f9b6e070be3ebec5c3b7f97d015acc3d452259bc5c6967185b1da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845779, "uuid": "b5679cc6-f70d-4439-b0b2-74657d8c9a24", "comment": "Malware payload", "value": "6b849b5d1bb8f6341bf97e72f7d9ff48d86a69fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845779, "uuid": "b4ed0117-6659-437e-94c5-261fd7440fa1", "comment": "Malware payload", "value": "b95318786ab065f4f67d9f63a1957f93fabb57942c99db6a964f7ffc37d915c2038c64d4593f68ae5f0b3d2d65f7d310", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845779, "uuid": "d5858b3e-8772-45a0-9ed9-8e6dfcfbbe01", "value": "T116736B0336A4C8B5E75A4A34FDD8E772A4FDBC55ADD0848337913B4E1E31AA2E25460B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845779, "uuid": "8c3bb51c-d0e4-4c51-8523-1146a5c3307f", "value": "6340889ba59301b71870a620dca1c9b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845779, "uuid": "af849a09-aaec-480c-afd2-802d4aabd321", "value": "1536:uCs91uvnkG8Y55Ko8Q0YwlmjG69+5gXPZGUswRjzS:7oekxYHVyS9nXPZGUThzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770845779, "uuid": "bc8cbd0f-a3ee-4a85-bbbe-cd506aa1f320", "value": 76248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770845779, "uuid": "89886d22-f241-4df7-923d-b57edd447395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845779, "uuid": "c1e11a0e-dea3-45c7-9bb0-7dd9c1c639f6", "value": "7156c187c58f9b6e070be3ebec5c3b7f97d015acc3d452259bc5c6967185b1da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813aeb0a-0793-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770846553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846553, "uuid": "d9d085f6-09fa-40ca-bce9-b63f3c0096c4", "comment": "Malware payload", "value": "3600fe2ee95082ba6746b7d9ef2403b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "razr", "colour": "#A7398C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846553, "uuid": "6de6d720-085b-45e7-a022-263a1019f40f", "comment": "Malware payload", "value": "7191e6d25e427c33b0979c2765441158c19d8e97bdc7c462f29dc20899ccceb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "razr", "colour": "#A7398C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846553, "uuid": "5abbdcd7-cb90-4239-9237-bbb33aaff5ed", "comment": "Malware payload", "value": "cd41bd38ed712016014a8fbdbcecac69194ad495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "razr", "colour": "#A7398C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846553, "uuid": "e85220df-6dae-4ea1-9b47-b4347aee43cd", "comment": "Malware payload", "value": "c4b8d2517913985099644b826a9b5e2f70aaf6d389ed7b75ce34aea0c42fecb9d8a7d3f13b7dfc1259d60056a727eb49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "razr", "colour": "#A7398C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770846553, "uuid": "ee95ba99-0fe6-4331-a888-2e1a426711a7", "value": "T1E7646D81FBC59DE6CA04423669EB43796334F7D12A935727283832700F53AE07E9B75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770846553, "uuid": "b18709c0-0cfd-48d9-9c9c-a2f895bcd081", "value": "ac606969a54b4845cf02f6ed33b940c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770846553, "uuid": "28e12353-91fd-4caf-bde5-2f7aae0f5706", "value": "3072:xmdrzVOn7xO5Wcr+qhNOJ2cHkxpFVepeNOr3NnuA0B62Ulwj/3jJrLt1LWxl1+fH:xMG0tn8eNk9n6TjqlkfjLG0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770846553, "uuid": "fdd520c5-d3ec-492d-90ad-e01d771da5eb", "value": 321799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770846553, "uuid": "30eaa556-1d01-43b3-a687-2aae43832880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770846553, "uuid": "ab653557-07bf-447d-acd6-f8df4b1a9843", "value": "goy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28c58fb-0701-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770783983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770783983, "uuid": "a8f1bd84-363b-4ca1-bc27-ddcda63a29af", "comment": "Malware payload (ValleyRAT)", "value": "72f276f1da2b415feac05494b64fbab7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenKryptik", "colour": "#DBB467", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770783983, "uuid": "0b1cefb5-9926-49db-8e57-03d0bf278632", "comment": "Malware payload (ValleyRAT)", "value": "749e1e2345b5a6c236eec818b5a358a15a913da8eb569cdc1147d0307f6b7055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenKryptik", "colour": "#DBB467", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770783983, "uuid": "ebb0292a-f7cd-4942-a221-fad7d4745104", "comment": "Malware payload (ValleyRAT)", "value": "cc2484eed551e22aee48db0f8f964dc5d8703681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenKryptik", "colour": "#DBB467", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770783983, "uuid": "b19566c1-ddd0-4aa2-bab5-fd27eb89e06f", "comment": "Malware payload (ValleyRAT)", "value": "f82630eeea6e78a90b1f8e6992ad751a05c0b708820ea9597e0554e8932f1156c5cc23693c4073202a6172942a7c8959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenKryptik", "colour": "#DBB467", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770783983, "uuid": "d2bd6c9a-a5f7-4d0d-b0ce-fd039e283405", "value": "T17147339345844DABEA244F3FD553214D5935BA373901713FBA858A81BC2321EF37AEB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770783983, "uuid": "0b5bdf4c-a93c-444c-90c3-ec9ad259b08e", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770783983, "uuid": "c1330883-19db-42ea-a438-d63e72856fea", "value": "786432:5bHTyYuOAW8viZ/vhRIJpu+Q9VVvYJhjaN0b5AC:tuYug9Z/vgALYJvbCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770783983, "uuid": "c1c1511c-cda0-42c2-9d7f-b626c6cefc83", "value": 26209147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770783983, "uuid": "70ecf750-d1d2-430a-9c85-b862487c4560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770783983, "uuid": "7fa9b3cf-8a12-4912-8ea2-97545f5cfb65", "value": "Chrorne0cdd-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1960a4e2-071b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770794839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794839, "uuid": "386e6542-9d0d-4263-a50b-f4584370e307", "comment": "Malware payload (Mirai)", "value": "92fb5de6cd5148cdcf27c320ccd7845d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794839, "uuid": "3f42611c-37e6-467e-8546-f376f89d584d", "comment": "Malware payload (Mirai)", "value": "7578efef119d5fe695b48bb1caaa47e57cdf302f363bc1321ae08f0a431404cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794839, "uuid": "33dbb10f-c2c5-4f56-a8d2-168284569146", "comment": "Malware payload (Mirai)", "value": "a9b564c450c92b6c237466b014baf8b986bc3729", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794839, "uuid": "7d91d80f-e4f2-4b65-9243-6580e1984edc", "comment": "Malware payload (Mirai)", "value": "af63c5de2f726e51edee9f0abfda2014bc70a3dbaf412746c9fac22d07c842276ac61a6d474e0595da8301d0cd601a5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794839, "uuid": "b89b545d-b8ff-4c73-93c0-1ce25733f20f", "value": "T11A537C0173988E0BF9D51AF4383F17E583AFED5122E5B189A90F9B464235E33484EE8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794839, "uuid": "98ebf3fa-9347-47df-babe-12341191b2e5", "value": "1536:tS2YtrcxI7iZT5DGDn8zzYKmcgtw72oxIHzFBVg:AFcxI765onwpmZt9oxIHzFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770794839, "uuid": "bc154d6f-942e-4367-b9e0-9f6ac68cdad0", "value": 66648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770794839, "uuid": "98a7c862-ee9f-4eba-bf4b-f12a077dd70e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794839, "uuid": "3a317c48-71b2-44b6-8842-acd37aa0fd89", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f516b1-0776-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770833971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770833971, "uuid": "9763f1f6-c0d3-43ed-a87e-f3f3a4d1a7ab", "comment": "Malware payload (Mirai)", "value": "4e91bcd0974d148d7dd42e9c0d0c5423", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770833971, "uuid": "a4cea958-6d04-48e1-8883-d13c7a85a8d7", "comment": "Malware payload (Mirai)", "value": "76a26b871f958c65eea81937584986f094356ac50e3770ab89af69758c74a686", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770833971, "uuid": "4031f1b2-a290-45af-ba22-6d427766d4a7", "comment": "Malware payload (Mirai)", "value": "ba1e5a7cd56a8c70595efdebeeeadcfc61169c76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770833971, "uuid": "7edc8a4a-e6f2-4279-aa0b-49da70dc5818", "comment": "Malware payload (Mirai)", "value": "ea8d085642e5ea09f3149db4e873b1a2c8c6ca83cdc1a49ff00a80038913190e4eb4e466a8911ee6abf976223e7364da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770833971, "uuid": "aedbe5ec-9f46-4612-b940-d431aeeb2455", "value": "T11CE2F12D4DC6DAD2DA3398BC032505C23F7A5B77A01AC44A93A99782C2D36C4BD776DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770833971, "uuid": "a47c48ef-eb63-4f47-9d60-a5840bedd193", "value": "768:IcIM/myOpbjvnhb8F/+7yhi6HvTk5W+6uz+JgGlzDpjc7:I0/mBpbb0/DQgvQ5UuzqV1c7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770833971, "uuid": "f9b6158b-f008-4b4a-bb28-b59d92fed000", "value": 31612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770833971, "uuid": "cbf7953f-e63d-4219-90b7-6a2b11a991de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770833971, "uuid": "a911a3c3-467b-4109-b15f-74b69dd596e5", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce64c7cc-0711-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770790848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790848, "uuid": "65be5c52-b3c9-4994-af94-3060cae1202a", "comment": "Malware payload (AsyncRAT)", "value": "553a7d56a1499fd875943362055be951", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790848, "uuid": "ca3e9e6b-75e8-4a71-ade2-d234458dbfe5", "comment": "Malware payload (AsyncRAT)", "value": "77ce2ff19d2bf37e2099e2dbad7dfc8a587501a6d310acee4010b2078f43cfe9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790848, "uuid": "b69cd5c4-b33f-4f2e-b275-39f693d6c988", "comment": "Malware payload (AsyncRAT)", "value": "12d48d50b432837485fb13ae51f4e569f2518c0b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790848, "uuid": "ebbd2717-e328-4d3b-87fb-e7477a2576c5", "comment": "Malware payload (AsyncRAT)", "value": "ac0f7466028e1223be0ab12d898364e8ae26554575703ee17cedc4b16d44447c7118fcaa1ac25ec2676a09322719eb74", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790848, "uuid": "d19fa018-618a-4a96-bd66-babb0ebfa2d2", "value": "T139D24B08B3D48561E1FD57B94D7292048771EE4BA973DB9D1FC444AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790848, "uuid": "cf611d08-dc25-4a5b-bd72-1c0ed944757c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790848, "uuid": "6d741531-02ae-40d6-a337-93c565726e1b", "value": "768:xGpRXAAytMQ0Ag/cIRGqoG/Rb7fB/dTS/+:4pRXRytMQ0Z1iYRbN/M/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770790848, "uuid": "e235fc1b-21f3-46a4-ba02-e49bc60c9c68", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770790848, "uuid": "43bdc22f-56b1-4925-a83a-1ba062717d20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790848, "uuid": "b80ab609-85c8-454e-9892-d7c6d3366cdd", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94a7bf0-0795-11f1-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1770847506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847506, "uuid": "aa7f8f5c-0192-4c19-94ba-4b00867807a8", "comment": "Malware payload (AmosStealer)", "value": "fcc6a879a800e96a901052c67d609fef", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847506, "uuid": "1c4882ce-b78d-42be-8515-4f14584f8e83", "comment": "Malware payload (AmosStealer)", "value": "77d3ccb2ed3d0dd7cda49a0aed4da7c46278e70995d8e6768b2188fedcb78703", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847506, "uuid": "ee5a7803-0b34-45ae-830e-408d2c439de9", "comment": "Malware payload (AmosStealer)", "value": "25545754ad2736ac7d1d3163c6fdb269273a7398", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847506, "uuid": "1322c862-8eb8-4d64-8df2-b2731d2d5d77", "comment": "Malware payload (AmosStealer)", "value": "9086d6255484072f6bb437cc121c1b37c12ca20e02a8c3c4ec0086cfdeb55afb45b62a9ffed9d77b7586267354dad6da", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847506, "uuid": "aaca3420-e499-409e-ac25-2e51bf5fccdb", "value": "T14FB419E7623855F2D98EFB7CF44F2226F971BD4019B8B5D05D820E114ED9370AA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847506, "uuid": "25433e24-2c2e-48e8-9745-54ec743e18b6", "value": "12288:D0l+NcArlEE9ncvJJQqlsgcCv8pBprQMxJVXWlnnnHuuu21uKb+AfI0m:D0qEl8pBtkfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847506, "uuid": "6be873fb-aa11-4841-88b2-cafc7a194c4e", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847506, "uuid": "96966722-1ccb-45fb-86e3-d6cdd5e2b595", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847506, "uuid": "99cd106e-40d4-4b56-8b0f-4a51cd156f94", "value": "77d3ccb2ed3d0dd7cda49a0aed4da7c46278e70995d8e6768b2188fedcb78703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a76003-06eb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770774537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770774537, "uuid": "26b6bfaa-7ccc-4df7-9c0f-685d075d4377", "comment": "Malware payload (Mirai)", "value": "0f33871afdc7f9a6af14dbfb2b025e87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770774537, "uuid": "52d21c63-2839-4ee1-a5d8-87cd0bc476fa", "comment": "Malware payload (Mirai)", "value": "79b6218c92cd7f19ca796d06f41d2349b7750b920b91ac401a1c9418a8e52c59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770774537, "uuid": "100348d0-f322-4872-9353-daefc8f0ea39", "comment": "Malware payload (Mirai)", "value": "7180daeeb128a6812bc52d68098c7b34f885c6f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770774537, "uuid": "21cb7575-189c-4523-9a81-42a4b76db8ea", "comment": "Malware payload (Mirai)", "value": "23ec029af981efc280751362358db11839674bf631677f320b317a136950cde4ccf4427ae67dbe68e65ac15ef39b06db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770774537, "uuid": "652aa9bb-4ab5-4fb6-8609-2943a8d86ec9", "value": "T19163ADB3C43A7D84D588893875A48F785723E94492072EFB1596C2B9904BEFCF60A3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770774537, "uuid": "4275405f-1bcd-4831-af4e-06fd3fbd7667", "value": "1536:1aG/OZa+PanNh/rBLoTLfKcNybyES1CJKwbd:1rW4X91oTec/ES1+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770774537, "uuid": "07ab4d0c-7f9a-440a-9fbe-28e00c050809", "value": 71028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770774537, "uuid": "9b4ec752-4d42-4449-87e1-f6608936b866", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770774537, "uuid": "0014e42f-d490-490d-b2f4-f1dd0c8510d8", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770ee27c-074a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770815183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815183, "uuid": "2f3df618-5044-4410-b2c9-b9a8f5d95c37", "comment": "Malware payload (Mirai)", "value": "17e35277aac3c0b704d8b954a978b173", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815183, "uuid": "51417c1f-5cb1-43bd-86a2-438233818cae", "comment": "Malware payload (Mirai)", "value": "7a728c1cc3baeec75b19cf736098a63a23c654e0c4f85ee3e2820538787b293c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815183, "uuid": "db630e95-dbe7-4ff0-85b2-941ea4d8d870", "comment": "Malware payload (Mirai)", "value": "8d17225207fc2fa761972b24aee4f534ec668c07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815183, "uuid": "4483387d-45c3-4b45-9b2b-68995577eb3e", "comment": "Malware payload (Mirai)", "value": "7268c788bb48c64f8a6f6c0a8ce8b48eeca197dfc879c44cf2471dfffab9b8e008fa38bfa9a0ebf52d62a4e233857d7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815183, "uuid": "b8b089c4-43e5-4390-aa89-864675e09a4d", "value": "T1AD731B85F98B81F5C41B493460AEF33FDA32E57580B09BADEF5A9F32CB276412112356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815183, "uuid": "52d8295e-1bcb-478f-95a1-1df40fa1600c", "value": "1536:6FZh8GdNbvXDgK0DxYc7FzYjljhfNrlEDVZjgwHt4iE:6FZh8GdNbvXDgKAxYbHBmZjJHt4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770815183, "uuid": "bbab25a6-0f41-45b3-8514-b01b60c4d772", "value": 74512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770815183, "uuid": "c23bf2b5-3e8b-4c0b-8101-d5bf59647107", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815183, "uuid": "65f764fb-5cb4-4103-80ba-6c7ec9a0d3c6", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd9c87a-0788-11f1-a129-42010a9c0007", "comment": "Malware payload (SilentCryptoMiner)", "timestamp": 1770841934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770841934, "uuid": "26e65daf-9028-4455-aa38-49ac017b541d", "comment": "Malware payload (SilentCryptoMiner)", "value": "a9e27a3631e978a16614b3521fa42d27", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770841934, "uuid": "1ddb570d-3d15-4e81-8adc-71d68faf8916", "comment": "Malware payload (SilentCryptoMiner)", "value": "7c570f984ba898964c9ac70e11474ce3a0161472566d1961fcbacfe3d24e1dd3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770841934, "uuid": "178dc2f3-23b0-4e9e-a139-960df36ff2a3", "comment": "Malware payload (SilentCryptoMiner)", "value": "d0d5f922277df80d4780b464aed20b46ca361023", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770841934, "uuid": "39b7372d-b434-4f31-b952-824b1efaa9c0", "comment": "Malware payload (SilentCryptoMiner)", "value": "533f8ce254ef27a66c7d2aa8019a2f7b09b0f1a2ee5eff475ca50b8e7423dac98cdb8583d23413973173f5e299cf71b4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770841934, "uuid": "0ec8616f-5326-4adc-ab05-f99dcfdac804", "value": "T1A90733E24514FF4ED842BA7A4F7A2D5993010C2B78E46DFD8347765E8EA070A1E638F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770841934, "uuid": "e4b813ba-b709-4eb9-8f67-b2c0bc63c94e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770841934, "uuid": "d9246ab3-0f47-40cf-a92f-cf417a2a7f4d", "value": "393216:kdvJHs+oku0YYE6zpcFJd9qwn091R5QmEe6wZzv4:kdvJ59eZEyFtqd35zzBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770841934, "uuid": "2904c0e5-3f3c-4b47-a9a4-665d47bf9428", "value": 16882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770841934, "uuid": "70f4055e-7e23-479f-8558-d61b18b472af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770841934, "uuid": "81d033f5-424d-4a06-bb9f-f965bbc07ce6", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0e37b1-075d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770823539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823539, "uuid": "706396d4-98c2-4647-845f-91b002563f23", "comment": "Malware payload (Mirai)", "value": "d0013608f0d82e0f8af918d0c84857ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823539, "uuid": "37eb3ab8-284c-4216-9c1f-301fcbf841f0", "comment": "Malware payload (Mirai)", "value": "7c966b000472b75f6ebda7643ad178fc9b3370fafe9659ecb8adf7e5034a652f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823539, "uuid": "e5a0c214-c9e7-47b3-9dcb-47b8af299f4d", "comment": "Malware payload (Mirai)", "value": "c2b29a89c1d631d0c9a1109b8a00ca9080d7d7c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823539, "uuid": "300679c7-331b-45a9-bfc6-20026d4fde3e", "comment": "Malware payload (Mirai)", "value": "9a5024b398de9d93350517415f9b0e6e6b85c26677d253e3344a588cccef6f37fbc77fc78d2b54ebdb047e9823d71efc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823539, "uuid": "69bb819b-0001-4bae-8629-1e45bbdae239", "value": "T1CD43A20B2E658FEDF76D863887B74E219359338326E1C685D15CF9001FB024EA45FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823539, "uuid": "dd6c13df-7b3b-40cd-a440-8e8ce4436bf1", "value": "1536:EZvJZ22DK5SOw+c0oWD5XqB7IgxUUQF0p6URcl9Wz:0t/O/c0oWk6URsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770823539, "uuid": "71c2fb95-f52a-4557-9de9-1e0e0527ec50", "value": 55720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770823539, "uuid": "ddbbd81c-1195-4316-83a9-2ee97298fc11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823539, "uuid": "2574f428-a737-4ced-b640-a9cc1c6b2dd0", "value": "nexus.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b26faa1-0793-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770846435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846435, "uuid": "51c68a18-6664-4e24-80e7-7729498da08b", "comment": "Malware payload", "value": "bc11e3781ae33ce7f6bf085789b8c6da", "object_relation": "md5", "Tag": [ { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "nanafafa-myvnc-com", "colour": "#010770", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846435, "uuid": "6f793426-54dc-464f-ac48-46495e8a7e52", "comment": "Malware payload", "value": "7dcd5eb98eb2e6dc887ff0f6a65ebd2261533b69b86122849e305cebd27e67ec", "object_relation": "sha256", "Tag": [ { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "nanafafa-myvnc-com", "colour": "#010770", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846435, "uuid": "4979e011-8e98-4d95-a407-086444e37fad", "comment": "Malware payload", "value": "9d824d5ae8be7d068fb53bf780ae1d4cb07bad2b", "object_relation": "sha1", "Tag": [ { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "nanafafa-myvnc-com", "colour": "#010770", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846435, "uuid": "4f771b3c-acb3-4310-ba72-f5dd40cca3d7", "comment": "Malware payload", "value": "0069f7ade4897ede4eec1226f2f30f32ffbf7aae198fd23d5f40201d89aa0236e77d1b425c55a32a27bcae82bfa44243", "object_relation": "sha3-384", "Tag": [ { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "nanafafa-myvnc-com", "colour": "#010770", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770846435, "uuid": "6ebda673-fb09-4ece-9b2a-6b376992f489", "value": "T127E5F1004EA63F748FA8061958FD2ACE97AD079E40592DCDA727BFC5DFD798842CA0C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770846435, "uuid": "460c913f-b023-4b2f-9a7a-b0a9b4174919", "value": "49152:oUZJE1hi/slE4wBKctSH6b2YXaETipr/HfK1ZMquI26y:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770846435, "uuid": "7ed65bf1-f6cb-4e8e-8a14-6b61f75e27eb", "value": 3290645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770846435, "uuid": "e1890367-1119-402f-acb0-2997799b0773", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770846435, "uuid": "46cf235b-57af-4b2f-8045-434e2ba8d4bc", "value": "BONIFICO \u20ac 12.104,09.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8198d2b-0714-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770792099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792099, "uuid": "9430a3ba-77ff-460f-9e56-7c38bd9f9267", "comment": "Malware payload (Mirai)", "value": "c6db8d211de8aa11e57ca2094ec9ee41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792099, "uuid": "1e60bb03-6bc3-43fa-9c3a-65aa7f3ec842", "comment": "Malware payload (Mirai)", "value": "7eb86aba89885cfeded0521d29ca2c7c072b8eee5bc33f16f017000ad48dda7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792099, "uuid": "e63eb3ba-d4a9-4441-bee2-ba09ca96e3ff", "comment": "Malware payload (Mirai)", "value": "e22c55e06ffd17e8b4c6fe0084e4e2870c8859be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792099, "uuid": "43ea03db-ebbe-4ccd-b470-aca4422ff493", "comment": "Malware payload (Mirai)", "value": "d3df067b5faa33d8745da7d75f365eb8cc703624c3b46f1354d5a8eaf0931303184157d65201f19c8acad87c0963047e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770792099, "uuid": "b0d309a5-7e4f-44ff-915f-cb82c5e367bc", "value": "T109B3ADDBF2571580C86647F00BC74BAD3EAB62019F27C8E73C1E6539983A5DE89067D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770792099, "uuid": "43891154-ecdf-4d1f-87a5-66c4e17acb2f", "value": "3072:8aN6ZGUh0ABjGfd0eI254u71vnTiNgwgRq:8U6ZGYjY0u79+WPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770792099, "uuid": "be035a7d-37b7-4578-9040-22e7db489f10", "value": 107896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770792099, "uuid": "693ff881-bdce-4f7c-b58f-56a748f71ca6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770792099, "uuid": "9bb71250-b06b-45f3-a1e0-0a052f0bf5e4", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da783b0d-0738-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770807619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807619, "uuid": "51154275-c3d1-4363-92e1-09bd3620888d", "comment": "Malware payload (PureLogsStealer)", "value": "2142114d88a1043a0567f3f5c4544a7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807619, "uuid": "c23db6ce-ab71-4b51-b4aa-e628e1096a33", "comment": "Malware payload (PureLogsStealer)", "value": "7efe07ba2161d28093a9939ee5796b9bf1204233854e1afa66920fc25cf70d8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807619, "uuid": "68649c51-f0c5-49e3-9e27-9c2bb16597fb", "comment": "Malware payload (PureLogsStealer)", "value": "7e457375e107a6a563964e05e5b0c669612dabb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807619, "uuid": "47cf31c6-4a0e-425d-ab8c-5c2c6ea560f5", "comment": "Malware payload (PureLogsStealer)", "value": "27eeaafb20e6ee7fe4f69a22429d0404508d062a27e5645461b83d7817935760fe815dfe1a6f2740a72936f9aef736aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770807619, "uuid": "e45b1255-aea5-45bd-96a4-a968a55b1f23", "value": "T149D4AF1B77488E21C5486237D1CB4511D3F1A5E6B673E70EBAC923560A073BEEE0A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770807619, "uuid": "75d321a3-0390-417a-bf4c-c4dff8bbb1b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770807619, "uuid": "93a0a4fb-732e-4ecc-989d-d08b990350e1", "value": "12288:x+0KKelEamXMafkYyrjmluvqZfU3xi2pw:nKKelEadtFjmluSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770807619, "uuid": "b2d6c560-5599-496f-af2e-b712bd343798", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770807619, "uuid": "8bbc0745-3173-4bb2-b895-1aafe6c5d260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770807619, "uuid": "f04b1b7e-cd2b-480e-9d5b-57ad63668b5f", "value": "2142114d88a1043a0567f3f5c4544a7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12a1805-0795-11f1-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1770847466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847466, "uuid": "74651612-0526-473d-a06d-88d2e0e75e0a", "comment": "Malware payload (AmosStealer)", "value": "28b0f89b41842ee0a0564ba330f468aa", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847466, "uuid": "c7f0a888-3c64-44a9-9d6d-66a1563ac820", "comment": "Malware payload (AmosStealer)", "value": "7f0582f2f33464e703c0c99bb425f5caaf796533bd4748d9e125791ccebb78d5", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847466, "uuid": "57ac203f-1153-411a-9715-5d30e0dba675", "comment": "Malware payload (AmosStealer)", "value": "36e895368e21b7858d8c4a236faeeb2daab5b7c5", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847466, "uuid": "59a516c0-1aa9-4bc1-a8d1-255c7b7af505", "comment": "Malware payload (AmosStealer)", "value": "9e11f099d25c9290ca66f630ee6411416fe8445f03f8adae8d0677410011b4c639b6eda11a18ca1668f1083c2b23c6f2", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847466, "uuid": "e9d7b800-de03-41ab-9443-c3bc6d6cb633", "value": "T114B419E7623855F2D98EFB7CF44F2227F971BD4019B8A5D05D820E114ED9370AA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847466, "uuid": "1211a91a-7b65-458f-842d-8b551a3e2061", "value": "12288:D0l+NcArlEE9ncvJJQqlsgcZv8pBprQMxJVXWlnnnHuuu21uKb+AfI0m:D0qEa8pBtkfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847466, "uuid": "e140c9d9-4b7a-4906-a2bb-d6f3289bd950", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847466, "uuid": "55ce2b2d-efd6-40ae-9853-a4efe6388a6b", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847466, "uuid": "e8ae8a96-cd08-419b-abbd-b4b3e5ebd2ac", "value": "7f0582f2f33464e703c0c99bb425f5caaf796533bd4748d9e125791ccebb78d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1687be0-0795-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770847493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847493, "uuid": "8ab9c6b9-924f-4050-a7e3-21d74f2e8aa0", "comment": "Malware payload", "value": "aee83b504ea3276934b8c49e4b70a549", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847493, "uuid": "242b7301-9338-4d31-93e9-7365d1633f99", "comment": "Malware payload", "value": "7f46ccf29724254e228cef0ca8fdef705702059381ca980b653b55da1683cb61", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847493, "uuid": "b5d1630c-a5f7-4f04-8f75-1720ac432dad", "comment": "Malware payload", "value": "ca23cd34b876f3208f16b7bbc501a62a157e0f31", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847493, "uuid": "61505827-2824-422e-9992-cc32376aa07b", "comment": "Malware payload", "value": "857626070cb45e847a90ab7770fa4a55490cc994f4d75810a0e9663ba6b68209451cfd44721ddd0337b46fc2f67c5966", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847493, "uuid": "d069426d-b5ec-4ce5-b8e0-65bccddeec47", "value": "T1C2B419E7623855F2D98EFB7CF44F2226F971BD4019B8B5D05D820E114ED9370AA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847493, "uuid": "84200497-f805-45d5-b66a-196263726227", "value": "12288:D0l+NcArlEE9ncvJJQqlsgcEv8pBprQMxJVXWlnnnHuuu21uKb+AfI0m:D0qEP8pBtkfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847493, "uuid": "78ee3689-1402-435d-8f11-35ac7c89db77", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847493, "uuid": "2b3ac0e2-77e1-4013-a284-8590e14bba35", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847493, "uuid": "8b9bff13-7892-455e-8762-d561e5091846", "value": "7f46ccf29724254e228cef0ca8fdef705702059381ca980b653b55da1683cb61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edd8217-06e0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770769615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769615, "uuid": "4b40b6ed-8340-4ccb-8fa7-0078e010afc5", "comment": "Malware payload (Mirai)", "value": "9f9aeea1b6b4b5ed7c53c9e98f0b9897", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769615, "uuid": "beb022d5-05ba-4122-9a67-2c1927fb7836", "comment": "Malware payload (Mirai)", "value": "7f734e1f8981bfd6f384be75f43ff62c70db8cd4929979ee0c22bbeebb92b845", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769615, "uuid": "56383e08-2e4f-47b9-8a2e-76877e9f374e", "comment": "Malware payload (Mirai)", "value": "b79247e150537d5c678a442043a9657e4d16b26e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769615, "uuid": "8fe6219f-75f8-4dd5-9436-d97bee007bb1", "comment": "Malware payload (Mirai)", "value": "a44deced6cc0934b19a8f70fc15f1caf8adeaabcd4261aaed1534ecec8c6c4a0a9bbe347d661cb653558069e8dfca625", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769615, "uuid": "c87db4a5-e3d9-487d-90c3-4c760128c6b8", "value": "T1ABF33B47EB814B03C4D627B5BA9F424533239764D3EB33069918AFB43F867AE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769615, "uuid": "a1309ade-2d39-4078-a83f-f4808372b567", "value": "3072:3n83zHAN81pfpF0alBki1GfF/s66Xs9QlprrTsOxVzM2xKK9W:3n8Amffj0a3ki1GfZs6xKdrTsOxVzKKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770769615, "uuid": "6a34a057-b396-4111-b3d7-fc40162ccdf9", "value": 163325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770769615, "uuid": "ef1ac3d3-c1de-479d-a511-2a7d0c374101", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769615, "uuid": "fdbe0727-717d-4502-ad9e-441721ba00a6", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b447ab-078c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770843576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770843576, "uuid": "f0385068-4112-43ed-a27d-a36fbed7416d", "comment": "Malware payload", "value": "0618b4ffee02195afb83944332789b49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770843576, "uuid": "cc819720-3fc9-4179-9286-258b9b67c91c", "comment": "Malware payload", "value": "7f783e0f1bd867467ea24569d36a3e02a549476fc5ebee4d60359c20e6e82513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770843576, "uuid": "2575c07c-d21f-4f43-bfa1-f518e7bba375", "comment": "Malware payload", "value": "56f4697755fec11d3478a4feb00a48e519dfcb99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770843576, "uuid": "b73e974c-27b6-4f0d-8200-3fece9706d10", "comment": "Malware payload", "value": "ee77ca3674e02e802cc2f279cf22dd47b0f07faaac8d8f3f5e13478ca8af565d2b46013f60305bdafccb0db30f26bc55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770843576, "uuid": "18f1d18f-62e2-4e3d-a766-56146d1dd520", "value": "T15A463372FA8374D1C8FCCAF14CAD10F526016C674A490B7BBA79B6181B87526393BD38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770843576, "uuid": "f8096d78-b6d1-448f-87ab-4ddcef535287", "value": "400b008ad8643db3563987514d25b143", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770843576, "uuid": "29ecc9a4-90c2-45f2-bbb8-579ab6a62979", "value": "98304:/8xwtV5uxhhoaRUNpQw/6wmQUssqWcOOew7CEwkZK4QlDidpC2cWeMJRNs0:/5xGIaR+T6wLsWOOeE3ZTvdYme060", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770843576, "uuid": "e8ff8dc2-1b36-4a75-8d88-336441120b9b", "value": 5873172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770843576, "uuid": "d22a9edd-2eca-4802-a909-be9a015005b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770843576, "uuid": "9786fc29-755b-42ce-8a93-acb5de5b7912", "value": "FpsBooster.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0568053-077a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770836002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836002, "uuid": "3d2c5717-fbd6-4bef-93a4-9021dbfbbf34", "comment": "Malware payload", "value": "af3ef570599cee079b43a9b0587390eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836002, "uuid": "2490e4e3-dd26-4e05-b811-00e4c13902f4", "comment": "Malware payload", "value": "7f82d05eea8adffa6c181cd3d8f5555263b8fdf2c20387fe27acf10b4d34ad36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836002, "uuid": "7ee81db5-ae9d-4feb-8d45-c45963bd423d", "comment": "Malware payload", "value": "bd812266722bd846cbcf752ade1e4cb54a945ba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836002, "uuid": "6338ac9e-cbbc-4841-9fea-f462d37af103", "comment": "Malware payload", "value": "59ed63eb4d9ae2b1e4c58b64458f08678860dcfed68e40bf4527d14e2526574eb84ea2df651993f1d89e7634482c7102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836002, "uuid": "e8b10b21-b151-48eb-bda5-13820f2928ec", "value": "T1CA463367F793F0C2C4F981B54C9921EB66609CB78B001A7B6B7DB6521FE0316BA30536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836002, "uuid": "5fe7a471-0354-4a0d-859c-c8bab814af83", "value": "dcaec1d8e87c24fa36ff06ff51f17517", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836002, "uuid": "40079ea7-93f9-47de-bf75-1441217213a3", "value": "98304:u8xweYpxuGZ4I/aLihOK2Ve1mlcbZY72b3RUrfu1LE5H5fHltpbqHRAfCHH3:u5eYbuM4I/U+OKC422jN145ZPltpWm4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770836002, "uuid": "86ae6434-e357-41db-bb28-ed5d941b13bd", "value": 5498268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770836002, "uuid": "2f8aedb8-65c8-4298-b282-0c1a3a24bdf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836002, "uuid": "2e643ec3-56d8-48ff-af05-8eaf64d7c2a1", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fd4a8a-078f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770844893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844893, "uuid": "08c47450-cfd0-4de3-abec-be758489df51", "comment": "Malware payload", "value": "8fa0dd9cafb06c17304303407200f439", "object_relation": "md5", "Tag": [ { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844893, "uuid": "06b4f157-e7f6-4d55-8e9f-05879bcdf473", "comment": "Malware payload", "value": "81bba5bc2596e4315d6ef380f569d05b9093e5e0fc48618941e9c31f9d7683ca", "object_relation": "sha256", "Tag": [ { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844893, "uuid": "72c40c44-e12e-4e71-9a06-b936512840c8", "comment": "Malware payload", "value": "ede65bce5420a0b943a933be2ccae28af58099e3", "object_relation": "sha1", "Tag": [ { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844893, "uuid": "7bedd67f-6eb1-4447-9062-4584031dfbcb", "comment": "Malware payload", "value": "879f15ea990a5aee874e531dc2fdc0e2ff0554732bf9f888d6f2f7690cb9796e8433408e9b2b53ea6caf11df49cb0b7b", "object_relation": "sha3-384", "Tag": [ { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844893, "uuid": "fa56adda-efff-4501-81af-bd3567017a4d", "value": "T1244533EA0865E9D7D832949CA12B7839D614F7039AB12B134C1B29630BD7753ED3F81B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844893, "uuid": "0d127a66-ec79-4c8b-b33b-f188f2427519", "value": "24576:ieT+apBgy9MQ7e+z963pt0Zi9HQ6k0I2O9tw4R2K9T/P7Geb8kEla45:ieT+a19MmeYqp36tj2O/tR2W37f8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770844893, "uuid": "57da2e2c-cedb-4bcb-8ea6-277058d0b1bf", "value": 1165196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770844893, "uuid": "2ed9a2f0-ddab-44ff-9390-262a96a601b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844893, "uuid": "d9c16e9c-dec6-48f8-a454-64660345b9b3", "value": "Uphero.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57029d89-06e2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770770461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770461, "uuid": "d6188aa3-f5a3-46f0-b9f6-2b57498a87ed", "comment": "Malware payload (Mirai)", "value": "9569b360b150fda1caf74adcd44458cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770461, "uuid": "6de9e15b-74f8-47e5-824a-da9efba7baee", "comment": "Malware payload (Mirai)", "value": "8201c76afb4d5e4b96cfe7fb12e2ddd8c3a7ed604128443f594c18b8e7b52043", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770461, "uuid": "bdb579f3-20ef-41de-89e8-d760f76712d0", "comment": "Malware payload (Mirai)", "value": "65c9c1eccbd19990d3b7829998940938f6142ea2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770461, "uuid": "76d580fc-31e3-4e46-aaa8-5ab13c43b966", "comment": "Malware payload (Mirai)", "value": "ef0f49e64fbd0e3fcd57df3bf81ccb22f3545fff8021733ab19cb639e5b4d4cb199ceb078b441445fd6c66ba8acf20db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770461, "uuid": "5c5199fd-ad9d-4993-bdd6-b52f9c1048bf", "value": "T138B3AEDBFB4B60A0C85146F40BD75FEE2E633211CE5BA9E76C1E353A19791CB0A06381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770461, "uuid": "6df03492-194c-4585-b8bc-4e016e626f01", "value": "1536:4NMa27pwEUb4Yj8kNKxgygg7lr5BNZ5nUgYT/LWO:EMR7p4b4YQ+aWg7DBNZ5nUgOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770770461, "uuid": "631ee529-106f-439b-a3df-0f36f129e220", "value": 115996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770770461, "uuid": "ca3ca85e-7a93-453d-9917-1a5782c32101", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770461, "uuid": "a1bc7849-d2eb-4dff-a350-88532593c041", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a2f6c9-0778-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770835039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835039, "uuid": "d9cda883-337d-4c73-941e-8f97d5efb946", "comment": "Malware payload (Mirai)", "value": "19c88dad2372641e11c1a26af0dde917", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835039, "uuid": "883bbe96-4b2c-4591-8543-76924d6d58f5", "comment": "Malware payload (Mirai)", "value": "8204796b1897f90035457f84038c57b998d37281fb94594f58231761f3a20f59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835039, "uuid": "bab2b255-23e7-4d60-a1da-59f69a5eaafb", "comment": "Malware payload (Mirai)", "value": "9d4140326c5c7c7f9271784ddd6985da85d2c263", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835039, "uuid": "bc709ad0-2821-4b78-9db8-f0d68a0f8f3d", "comment": "Malware payload (Mirai)", "value": "e58455ad7e7db21fa4eadb736a6bffcb61d19790725b12fbf283664a4e77bb82805a4f67951e80c0fdfd68d5b9ed7f07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835039, "uuid": "645fe84c-d0a2-4823-97f5-1ab23df75d13", "value": "T1AAE2D0EBC1B5DDB5C0A2FA38B1590AC0F3156140DA58D78FE99436B4ECBBA035F01A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835039, "uuid": "58d8dce1-82b0-4568-a680-fce6b6709212", "value": "768:4q72Qt3sR6uTALvECmduz7705mrWqjgYybaOB:r7C7Tg8CcgM5HpYPOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770835039, "uuid": "2e56a57b-cfb9-4ba7-93ed-b3368199b945", "value": 31976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770835039, "uuid": "25d9930b-094a-4833-a917-11c8cf700fa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835039, "uuid": "185d990f-709c-41df-80e4-d2c0d4f2d9a3", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f5c7ab-0750-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770817602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770817602, "uuid": "28fd44eb-297e-4a22-b7b8-eaaed4d292de", "comment": "Malware payload (Mirai)", "value": "88eb31700dc5f8740c903d2d4d78a63f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770817602, "uuid": "749c6a04-fb1a-44e2-a805-db7ab5a10c2c", "comment": "Malware payload (Mirai)", "value": "821592afa5c6b56995af61ef4721dc49929c2c9cb239740b1e311f042ec3d6eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770817602, "uuid": "a9c5d07a-787c-4bba-adcb-6673e5fecdf8", "comment": "Malware payload (Mirai)", "value": "d99834a886083a14b94202c5a2dce47cdc4c274e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770817602, "uuid": "c6121423-5bd2-4923-9757-009af0a8dd1e", "comment": "Malware payload (Mirai)", "value": "52e2388d9e87f0da752928ebaa6cb09e407bddaac3058112c772863d0a1c08ccfeb09bcfd9054a64cc76697526da0ec5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770817602, "uuid": "1d98ea51-6539-48ac-a419-09e17a42a8d8", "value": "T1C5056C4BB2A374FDC117D43443ABCAB2A935B43502226E7B65C8D6303E67E701B19B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770817602, "uuid": "19f07c14-5a3d-4921-a0d3-103cba34db21", "value": "12288:OlDeSLCIQRZvhlf4sVoD/Pk4VAO1qWvDVvjoltWhu3jNmh4xmdzuFdEJykMWl689:ONeBz1R4sYk4VzZrV7oltLohxxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770817602, "uuid": "46af4217-265a-4b61-a9d9-5618001e9de7", "value": 866824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770817602, "uuid": "9182019e-9ce6-46e0-a2ab-74cd0ffd539c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770817602, "uuid": "8e006e5b-42f3-418c-8e15-76e631efab10", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366ec2b1-0793-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770846428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846428, "uuid": "949acce2-9678-46c2-80da-752d505400de", "comment": "Malware payload", "value": "b762e1e57e646ddb3fd3543c6056f60c", "object_relation": "md5", "Tag": [ { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "nanafafa-myvnc-com", "colour": "#010770", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846428, "uuid": "d66fa0ac-97cb-484f-b172-11175482afcf", "comment": "Malware payload", "value": "82727a7e702054de0c7b2c51a06d4d8109255382af56850a1b49f7337d353be1", "object_relation": "sha256", "Tag": [ { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "nanafafa-myvnc-com", "colour": "#010770", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846428, "uuid": "64647beb-b918-481b-a011-4ef75a27bc50", "comment": "Malware payload", "value": "1b1aff16232bad109ecd4e8e2241c0677846ea30", "object_relation": "sha1", "Tag": [ { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "nanafafa-myvnc-com", "colour": "#010770", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770846428, "uuid": "2af5f6ec-5007-421d-8305-526fc720086e", "comment": "Malware payload", "value": "a59b787e413b6aba185af5c8a3e8327b8a0f9de020311f67fb71e068a2118549b791d22120aa8f61a2c6a641f130da26", "object_relation": "sha3-384", "Tag": [ { "name": "D3LabIT", "colour": "#512875", "exportable": true, "hide_tag": false }, { "name": "nanafafa-myvnc-com", "colour": "#010770", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770846428, "uuid": "ddf51118-1e5d-48b2-892d-732f2ba42050", "value": "T174A533409989A93E2A3550149BE73554FFF6CFC1062CBC34AAE7D5AE8F04947CA8D03E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770846428, "uuid": "505d79a8-2f62-4bd7-b9a6-480fe2a43fed", "value": "49152:S+DaEVk1wEU0/uugF5m/2HPoWIFwSwEHKHnoo5snA:SMVk17U0/Bgy/2HQW2VwWlo5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770846428, "uuid": "e96c0a30-a43c-4047-b9f6-17c9592e4f66", "value": 2164880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770846428, "uuid": "5ecea626-dd05-42ab-986d-4e4addd50554", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770846428, "uuid": "900dad4b-e14a-410f-b801-9e4b58c2f6e6", "value": "BONIFICO \u20ac 12.104,09.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e73325-0776-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770834025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834025, "uuid": "be226674-d8a6-4bbd-8733-231ff03e426a", "comment": "Malware payload (Mirai)", "value": "9c9bdbc59593600ebfd250631076c198", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834025, "uuid": "cf885ca9-1b37-42d1-a5e1-cea924236814", "comment": "Malware payload (Mirai)", "value": "82e5ab68f34eed132ad3827cc1df3378cb1e6e27048dd9b10028ed8293b1c922", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834025, "uuid": "8fe238a4-2df8-4bb8-92b9-9d73f099ee13", "comment": "Malware payload (Mirai)", "value": "4a8700078bbf0e896e067a36e4dca55c8d0afa0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834025, "uuid": "81d8b17f-5ea9-4caa-b757-766c8f32878b", "comment": "Malware payload (Mirai)", "value": "3b0aea3162484dd50d6db0d49e43526dd8d3987f49a58c97ae873259575404137a18c5f7b92578d1ad3205b550e3eb35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834025, "uuid": "73ef91b2-4642-4cfa-bc61-76bf7b98a26c", "value": "T1B3832985B8819A20C6C5177BFA1F118E331757A8E2EEB3538D185F6477CAC1B0E37A19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834025, "uuid": "2e00c918-dd59-4cc7-a88c-73deff7d6369", "value": "1536:s2nSRXsaPbiRobMv6EyroLmpMguHcUxVUHalw7WLuH0IsfCZxGBtJb2E/tUsd6qr:8sQb0vKroLmpMguHcUxVUHalw7WLuH0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770834025, "uuid": "03dc5bd5-0692-42d1-9ac7-46a3e038d4e1", "value": 84184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770834025, "uuid": "54c53545-208d-4479-a7e5-d556945d6f2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834025, "uuid": "8b3c161a-8793-42d1-acb8-45fdfa1d74d0", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e5b918-075a-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770821868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821868, "uuid": "526a475d-1d1d-4eb9-9b06-6fc1a17c1c08", "comment": "Malware payload (ConnectWise)", "value": "d2d4ae9e8b57a862aba487de0a21f538", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821868, "uuid": "e4577a78-31c0-4cc2-bc02-6b54062e7c93", "comment": "Malware payload (ConnectWise)", "value": "834cf207f989791900ea0a4ce6ce9eb8f70230d4b6ab0486abbaeefe2cddf2f7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821868, "uuid": "816bb91f-d7a4-4578-a919-b2bf6bdec221", "comment": "Malware payload (ConnectWise)", "value": "372e12aa47837bae64edce4c9e2bbb2733aa0eec", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821868, "uuid": "29bd9576-add9-431c-ae88-52d3350c5426", "comment": "Malware payload (ConnectWise)", "value": "4b435e4b1573f8f370c180cd1584111bb0e49be64e91336c9c0cb12b1fa60b5d4d1ec03685bf1c88b11613d7a4e5607b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821868, "uuid": "f979af3a-38a6-4d06-a9c4-eb77d14ed3b3", "value": "T190A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821868, "uuid": "e1ca2aac-8d40-4791-a0a1-486eaacfb451", "value": "196608:4KaLNkbg7i4QmKaLNkbgRKaLNkbgdKaLNkbg:eWg7iHIWg1WgxWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770821868, "uuid": "fd21ef3f-f056-4914-88f6-3bba344b37fc", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770821868, "uuid": "11140646-f663-4122-8200-bfe8365fb5b9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821868, "uuid": "03ae23a6-7ffe-475a-9b52-e0f20a91662e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f6f3a6-076c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770829841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829841, "uuid": "f9b0308d-f7a3-4488-a3c7-aaa990bd8664", "comment": "Malware payload", "value": "f5fd35424c6eda258b42b0b0de036d32", "object_relation": "md5", "Tag": [ { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829841, "uuid": "eaffc2f4-26a0-405e-87f2-462bff35a222", "comment": "Malware payload", "value": "83539eb116098a8f8661409f088d61d553f83f379c92969b32bdebc26c8fd3a1", "object_relation": "sha256", "Tag": [ { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829841, "uuid": "677c8d85-7227-4418-98a0-6d0248cee5d4", "comment": "Malware payload", "value": "dc39140a408953976a0b8c2ef5395c25ef9d7358", "object_relation": "sha1", "Tag": [ { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829841, "uuid": "daebaff0-20f2-4af3-940a-01d9c0a90953", "comment": "Malware payload", "value": "b536ebc3c71cdd9b5b4df18bfbc17476bf0926cfa4443438b1aefd26aca6ced46a042240e9e4836343a8038264564bad", "object_relation": "sha3-384", "Tag": [ { "name": "ReverseLoader", "colour": "#427E41", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829841, "uuid": "91b3aa48-cd33-4e17-9528-157228300db1", "value": "T15F4564564F03341AE9C9AA61F9FDBEA627CD5B5B01C421B67899CBE03A1093D7014CFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829841, "uuid": "f5af83a8-fc6f-4e88-84ca-882b29d68d02", "value": "1536:+wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww2:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770829841, "uuid": "9defaa73-b9f9-4370-a8ad-1a9bbd7a1617", "value": 1179114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770829841, "uuid": "591b0ce5-c6f4-41af-adda-99a6268e8517", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829841, "uuid": "4ffd5aab-c6cd-4965-88de-545994184c4c", "value": "83539eb116098a8f8661409f088d61d553f83f379c92969b32bdebc26c8fd3a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4492e243-076c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770829701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829701, "uuid": "3eb08fa9-f521-4ae2-a277-b049fc44f973", "comment": "Malware payload", "value": "a8242128b853a51c3fd13b090dd047ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829701, "uuid": "59b269ba-d952-454e-8914-4da09484fc7c", "comment": "Malware payload", "value": "83672062a19240559cb292b5b5b7f8c8fb24ff466c9538bc1de4cc0eed0c155b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829701, "uuid": "025f15e5-f367-49d7-ad10-f5e32622ec61", "comment": "Malware payload", "value": "cc52e8aa6b398543e7b710cf6a2f1bed77bfce17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829701, "uuid": "41b939b4-9551-461c-8b5f-80734a31993b", "comment": "Malware payload", "value": "ebfbeb0320a48eb678ac5a61fec95bbbd6dd88604feb6fabe00f1b5dc4cbca45e8513c5f15843ebf52620ddaa81fa290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829701, "uuid": "20f62f43-14aa-4ccb-8d7a-e32bb95a535b", "value": "T1D4C4BF02B7D48076E4B30B30A66697959238BC219B21CF9F67C93E6D78311D09B31BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829701, "uuid": "c17aaaa5-f32e-4e0d-ace8-2fcb64397271", "value": "75e9596d74d063246ba6f3ac7c5369a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829701, "uuid": "6f09e8ba-10ef-4659-8e0f-de6944e26163", "value": "6144:cE+yclwQKjdn+WPtYVJIoBfR0SJFObkfJ3qVWZjsfXRJmAu8mdybrykQV8bu+:cBdlwHRn+WlYV+aDObo6VWBsfXKMSF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770829701, "uuid": "43e9ce75-a43c-4873-b7d1-3279a05e2f1e", "value": 561748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770829701, "uuid": "5e27c44e-518f-4b1b-912b-b4e42d168027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829701, "uuid": "b5ef1b48-05f4-4a5d-8f43-112ec588cb25", "value": "83672062a19240559cb292b5b5b7f8c8fb24ff466c9538bc1de4cc0eed0c155b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c903cf-0744-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770812547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812547, "uuid": "5b6ade22-ecec-4b5d-b6cf-47fb7e26ea89", "comment": "Malware payload (Mirai)", "value": "e292d8e3af09ea4b27d026a0029c0db8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812547, "uuid": "0abc78a5-5317-4863-9f7c-ec048c7d4fa8", "comment": "Malware payload (Mirai)", "value": "83ec4e8e8b6481d7b3f718286c79047a166dd058134b2d78c1c5c667827f68fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812547, "uuid": "ac3082f0-f275-45df-a0d4-a133d4a1b67a", "comment": "Malware payload (Mirai)", "value": "8319419db295d1eb3f437bbdc0300e3570cab62e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812547, "uuid": "b5fb9fd7-16e4-4358-86bb-62650369f5e1", "comment": "Malware payload (Mirai)", "value": "36854ff0bd18a0872481cb3df49bbe4faa9beafb60ed355e05563243080589362f074f6119d4c23247133cf7b53732b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812547, "uuid": "f05aa62b-6c41-459b-9313-addb7c996f26", "value": "T11293A74D2F319F7EFFA8D2385BB789609208339626E1D585D16CEA014E6034E742FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812547, "uuid": "9d9e0b1c-ecc5-4825-adc1-47672a9991aa", "value": "1536:HvcX/K2nhEmpfy3JjGcYr1xUc4Q2UvD8R1vyErcjdBpexK:HvO/hnhErUj4Q2UvD8XvyUudB8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812547, "uuid": "7a2683a4-aeb5-44dd-bf26-3f7b4403c6e5", "value": 92820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812547, "uuid": "2bd3dc00-a855-4556-802e-145c75660079", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812547, "uuid": "15b48b4a-3c4b-42c7-bded-ca453f709bc8", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b19c3a-0795-11f1-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1770847480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847480, "uuid": "c0c6453c-c37a-4480-808c-8d8db01517e7", "comment": "Malware payload (AmosStealer)", "value": "52360877c4359dc1aa86e8b168ebc9c9", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847480, "uuid": "6e7052da-cf0c-4bca-b241-f07fcb664421", "comment": "Malware payload (AmosStealer)", "value": "84a71a9dde6b087613f3036eefaf8ae53c575e0d067b3b5a8a68896438df3f6b", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847480, "uuid": "e477e7bf-7f0e-4085-ab20-dd94eb6cf77d", "comment": "Malware payload (AmosStealer)", "value": "a922c52f6478d2070cf7dbb47d3a34616b65d279", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847480, "uuid": "849988c7-c120-427c-9e70-5d4585093bbe", "comment": "Malware payload (AmosStealer)", "value": "a8e6973af3ced522d767600c8adb3ba152254969a12fcacaac61296234463d4c398e9322cc946c5935d5c54c61e7e6c5", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847480, "uuid": "6c3bda9e-fd4b-450c-9995-04be281abcfc", "value": "T1A3B419E7623855F2D98EFB7CF44F2226F971BD4019B8B5D05D820E114ED9370AA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847480, "uuid": "b42e75c1-f2c9-4b29-be4f-2693435ff457", "value": "12288:D0l+NcArlEE9ncvJJQqlsgcJv8pBprQMxJVXWlnnnHuuu21uKb+AfI0m:D0qEG8pBtkfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847480, "uuid": "eaec0ed9-5113-45ca-bdf1-de20591d7a0d", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847480, "uuid": "241b6661-31fd-468e-8d59-479c1aa8c044", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847480, "uuid": "4e417649-dcf0-42e5-935a-34a6c19fbe6c", "value": "84a71a9dde6b087613f3036eefaf8ae53c575e0d067b3b5a8a68896438df3f6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c75e78-071b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770795185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795185, "uuid": "51aaa9b4-11e1-416a-bf95-230fb99e2ed7", "comment": "Malware payload (Mirai)", "value": "691c48230411e0d5cd9fe47c18d7a6cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795185, "uuid": "ea0d29c4-5a10-4d2f-8294-48149fe7fdda", "comment": "Malware payload (Mirai)", "value": "854161dd4291d434e5c0f3a6e036a76cf94707ed53bd82fb670514dd494f83bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795185, "uuid": "30045ed5-0da1-435a-9047-ba865e84b6c7", "comment": "Malware payload (Mirai)", "value": "e3bed1df7d0caa24009d6878604bc6ed27cdce3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795185, "uuid": "784ae592-0954-4705-b3b1-050330e6b15f", "comment": "Malware payload (Mirai)", "value": "112649db0c69bcea2c9763ce58b3c5216425de77169f863d312d32b3a2307e6f438556f88bf44fe57829ad339b57ba1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795185, "uuid": "2763f726-0e34-4bb0-973f-1b27b639a94c", "value": "T1D4E3E749EF610EFBE86FCD3741EE0B0525CC591722A83B7A7570D928F24A24B1AD3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795185, "uuid": "5ffce025-0656-4364-975d-bd746d0c49ea", "value": "3072:XerAAkW+A6iU7WuMU9RwCA4Hpn2WSxcxE9+r86bt:KAAkTA6obU9RwCA4JNSmxE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770795185, "uuid": "86456aae-9995-449d-8937-63bae390d6aa", "value": 155992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770795185, "uuid": "10153a92-5cb0-4a42-8386-1a3b069f2672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795185, "uuid": "dee7aa00-e52f-43a1-bb8c-fb7fccee6678", "value": "mipsel.nigge", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb07f17f-077a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770835939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835939, "uuid": "997329af-d495-446d-8305-ef2965927667", "comment": "Malware payload (Mirai)", "value": "8c0d7249deb0838a8054e6e33c18b5a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835939, "uuid": "d8cb2f82-6080-47ea-b51d-8d542217e55d", "comment": "Malware payload (Mirai)", "value": "85c866d48a3addbd504f7021f40869e8161bfff8aef8a7902fc4856b1f340002", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835939, "uuid": "ea7d5a3f-d38c-4595-941b-6a2624305812", "comment": "Malware payload (Mirai)", "value": "82b24a3e1c87571ff6abe6138eab5fd5831c83b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835939, "uuid": "1a580b81-57c2-4837-bbd1-c4a4e26746d2", "comment": "Malware payload (Mirai)", "value": "3878460a0e58fbb8cc7ea6ceda59bc17036fcb2af3bb5f253ed28c9b25a6b9c9142cc15d8dcf48618587bc772677d732", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835939, "uuid": "ab2d6669-2153-4419-a79f-67ef450d3d1e", "value": "T16673024C57655DB955A7493AFC3F41889E2E8B31D2B2B394B622D03C9CC3EC689E03D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835939, "uuid": "32d8ca48-d632-4534-8c61-6ffb0c8e18e6", "value": "1536:JhByFD93cHimG1rCM+aicZERiItMFf4bdX1P8oIw36JTujvst:JPUrGM+aDCiIqFwbdXt8oIw36AUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770835939, "uuid": "3f98268d-6c74-43e6-a666-43877be7d6eb", "value": 78360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770835939, "uuid": "fba47bd5-a840-4e78-a94c-51537b2b2d81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835939, "uuid": "99bd6f76-d44e-4e51-b734-54d0e40a6b05", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b0904c-0798-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770848839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848839, "uuid": "a7842a13-91b7-4e11-8838-965898bb0a36", "comment": "Malware payload", "value": "f069abb6256ac765e97733b31e13d849", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848839, "uuid": "2ff7f701-fe4a-417e-bb3f-a20a6895449e", "comment": "Malware payload", "value": "864985a94d76130792e8a39a12e8547e0f8b8640fabfd7bc887ee57bb8d9a711", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848839, "uuid": "350b7eae-8bcc-47a3-b6d0-bf3c2a768de3", "comment": "Malware payload", "value": "0835171f30a52ffd550f22a3a726a30aaf108131", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848839, "uuid": "96b7eb83-6eb9-43d9-a000-e4f462adc920", "comment": "Malware payload", "value": "d4734e2c374829b196608c51dbcbc6e295005a36b096d4b986daec6006fadb54e3157ac36cba995bd9140e2734c52f68", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848839, "uuid": "be73abca-dd7d-4f73-80ef-2accb70b9990", "value": "T130747C56BAA418F9E57B853CC9530A06D7F2BC660760DBDF03A046961F277E08E3DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848839, "uuid": "41972381-75ea-4ca1-8b91-d96e5118c74d", "value": "c546646952cb160243a67da7651da44c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848839, "uuid": "c5d90299-7659-46c7-8f69-2aad37d33d29", "value": "6144:mnsuD9WKIz8H1/zVcTVQgvVHytj23vf/tRW00NnT5VxZ:mnsuhIz8HNDuVHytj2/tRWdNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770848839, "uuid": "4318231f-e822-4d1f-a77c-ce05977ea50f", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770848839, "uuid": "03c8ae6d-4981-4274-966a-4b6bf1d76010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848839, "uuid": "fafceed0-2a0f-486f-a903-ac13393b2ba7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4b0e20-075d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770823538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823538, "uuid": "0f0bcd41-b962-4283-866b-cdecf8d22e54", "comment": "Malware payload (Mirai)", "value": "719d6c26275d3680c855d168cef80271", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823538, "uuid": "310d8455-2282-47ec-a1dd-8f84ba7be3be", "comment": "Malware payload (Mirai)", "value": "87aaa7aece20072f8f085ac41b5eb17650a78c98a8dc6c7066f3a55fd1c38037", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823538, "uuid": "4ff9c271-c76d-49a3-82fe-db99091eea20", "comment": "Malware payload (Mirai)", "value": "a6b91dbe14f96be7ea177c9946dafb15a4c05026", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823538, "uuid": "dcd5fb1b-b4e8-407f-9f8b-c598beb0fbaa", "comment": "Malware payload (Mirai)", "value": "84f8f59ba72bb0ed39f2d727dfbb45f9ac52dba12ebc783fb89a8061127a84c759684b921d89602b362cafe1e85b9222", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823538, "uuid": "7025e9ad-9374-4371-a458-cf6e5b1afbb5", "value": "T11D93C54DF964AB29C7E232FEFB4D028E332B1BE8B7E6B011DD315A5533C8B965525120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823538, "uuid": "ba65e42c-0ef5-4383-b42f-2f59132bff5d", "value": "1536:JAnxiynr9rYUUE2CW1bjQpBw0DWXlVwGvVC/X4DQu3eI7+lJyUeiHb5SztjL7S:Q7r9rYrEnRdDWXnzC/X4DQu3Cnb5S5zS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770823538, "uuid": "60ec0da5-5e30-4d3a-913c-1f71868c04f6", "value": 94204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770823538, "uuid": "38da9e7a-5685-499d-b047-b61c8f7ec565", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823538, "uuid": "f5f6b912-8971-46e5-94c3-99395229df8e", "value": "nexus.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6754d26f-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788098, "uuid": "c958ce64-4df1-4204-bfae-b6ea478bcec7", "comment": "Malware payload (Mirai)", "value": "ac67724bc7c3a05147f106211540a0e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788098, "uuid": "40b5a2f3-d800-40bb-9ffe-138f30eed151", "comment": "Malware payload (Mirai)", "value": "8854cb8d59af4ff41fc8457e43b4effcaf61b985167c4d1dbb045d2e8e50edce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788098, "uuid": "6d612fdb-ba3f-46a8-9b13-b67d2668e1ff", "comment": "Malware payload (Mirai)", "value": "0f8a91c5229f0b0c5eb6210cb016ab14ea0e99c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788098, "uuid": "393e0524-92e5-4504-b1a1-e030ee4f9e96", "comment": "Malware payload (Mirai)", "value": "ff37c5aa169ddc8be45550dc15afc59121363def812594e319b6a82a8bab457ffcceae240c7f4759681516cc5223a3b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788098, "uuid": "0aa9794d-068b-4ce5-9090-af08ecc2bf18", "value": "T14124F947B991CF12C1C111BEFE5F418D37136FB8D2EA72029D246FA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788098, "uuid": "8cced39e-3856-4956-a934-01325d8c6b3a", "value": "6144:Iv4nw6IdA1Twfl4ds0aVGGp8CwZ9YNJmh0jHP2:IEwi1Talz0aVEHZ9gmujH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788098, "uuid": "245930d0-0a8b-4b36-8638-a4c12675da6f", "value": 221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788098, "uuid": "2c232dd9-a322-4faa-ad48-3366672d84af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788098, "uuid": "a1b20b9a-6448-4b89-9df9-9191be03ffc1", "value": "bin.armv4tl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e54a7b3-077c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770836723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836723, "uuid": "48eaec1d-aee8-40b7-aaa4-908b58869edc", "comment": "Malware payload", "value": "53056a55dc32535ce49c041380b56268", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836723, "uuid": "37c7df97-814b-4053-90aa-1f08737b4739", "comment": "Malware payload", "value": "8a7fd76f466762490154f25a067a2eec08e41346074181548fcc43ebac269fc4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836723, "uuid": "41931686-4d9b-48d7-9ca6-3001a3eef18d", "comment": "Malware payload", "value": "0036a9f0d9dc01cfd5776a570efe2839e2e98f67", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836723, "uuid": "85972805-fa0f-42d7-aa7d-44e393fd08a0", "comment": "Malware payload", "value": "822eb75e656463d9c0b898a883132277e4a76b3203eae86a4b9227d50ddd7bbef38e1e4cce12ed2e403fc117ee13cc70", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836723, "uuid": "20531ea1-964c-4be5-bd04-4408735f50b5", "value": "T14041FE122FF68A26F3B64E7186B7AB508F37FC454D42860D4064A1481CA1F58D83EBA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836723, "uuid": "0d45e22e-2478-4b9b-aa29-c0035ac9b95e", "value": "24:8j00J/EknFVVDAGuAJTddXCXuXto60hCG5cZxmplXuHY8/:8I0R5nVkG99d4XyP0hvyXklXuHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770836723, "uuid": "4abce99e-856c-46fc-83d2-14364b0a4229", "value": 2026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770836723, "uuid": "af9a7bd4-79de-49e8-816a-2537e11524a7", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836723, "uuid": "2de7bf2b-369e-4566-acb0-43da414e8864", "value": "Protokol_KUAP_121_3.1_0915-2026.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba469dd-0748-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770814466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814466, "uuid": "497e40d2-e881-47a7-805b-a2e9213c45b2", "comment": "Malware payload", "value": "eb3bd94f68da8381ed1b2ccd7842c09d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814466, "uuid": "f1c33ef2-0260-4e1c-94b6-b08c204343dc", "comment": "Malware payload", "value": "8aaf1eb9116a3cc7fe8471d2a875e655fb763c10a61a65f9b8ad0a4278589959", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814466, "uuid": "8dd45ae4-308e-4131-8b4c-77c67e888889", "comment": "Malware payload", "value": "2636a218029c370f5dd073996c33f0995208d88e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814466, "uuid": "2ffbea4a-b972-4d02-9e90-92733695727d", "comment": "Malware payload", "value": "c4793377fdec557dc7cc1109f854b81de35c20798e84fbb7b33d6c9444df68522c50d974033fcf0d44945b332bc7bc26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814466, "uuid": "670b4de9-8f5e-41ad-8c39-541ff0c5efb2", "value": "T120E2C4897886C46249E813FEF47D10DF335977A9D0CE7162D9820F12768BA1F48B7B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814466, "uuid": "932650ba-94ca-480b-9617-50520d228490", "value": "768:+/nvpten4U9vWYIxZM3Z0reIhsn35w0RZunVe10fT:+/nvpte4UtWYI0qreIhsnJxHRkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770814466, "uuid": "b71daef6-759b-4356-8544-f0cfaa5ec329", "value": 33039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770814466, "uuid": "52bf3ae4-6241-482d-bc04-dffadf3c911d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814466, "uuid": "0b666a68-2d2d-4706-9ce1-c9cfca2b7aab", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9825d5a9-078f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770844873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844873, "uuid": "48af3024-81fc-477c-aec0-2480ade4499c", "comment": "Malware payload", "value": "71ef28a08b5240b4962a3b474ab5cc44", "object_relation": "md5", "Tag": [ { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844873, "uuid": "2b4055db-c45f-46a6-aef2-3e8a612d536a", "comment": "Malware payload", "value": "8ee298af0be2d3fe17d0edef6b16eb7a83c1c671713b1511879c2de132bee33e", "object_relation": "sha256", "Tag": [ { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844873, "uuid": "aa43826d-6601-45ba-be42-2877dd6b9300", "comment": "Malware payload", "value": "a8ce359fe5314779822340f6e7c1543cea516b91", "object_relation": "sha1", "Tag": [ { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844873, "uuid": "fa24af02-7c4f-40a4-b3e9-d7a770ce6ad4", "comment": "Malware payload", "value": "dfd75e416d7ec06238ca70c34121d61099ee8ee5f76b82afe7429ba9450213bd35cae9109d953e17c3f70ed0ecb7146b", "object_relation": "sha3-384", "Tag": [ { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844873, "uuid": "6675744a-8358-4926-aa8f-0d8704f06b66", "value": "T10BB533AEC841D9D5E9BB010C853A29680CE164F3EFCC0787BA171DF6BAD5162C9BD8C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844873, "uuid": "d3d865b2-251a-462c-b5a1-ad2112257b2e", "value": "49152:TXkruiOzA0uLdHlF5/y9Tq0v1yrAWQRpQpsDkFD0Ybey69x:TUr+zAhvb/y9WDrAWQ7QOmD0Qey6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770844873, "uuid": "b4c87ddc-3ad2-4f08-93a0-350edfa474e4", "value": 2335157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770844873, "uuid": "a14d6b18-8a27-46f9-a79b-ef8eef3799f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844873, "uuid": "4853c92f-51d8-4dce-831d-88d343ef888f", "value": "hero.dll.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27016251-075e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770823638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823638, "uuid": "99822f4c-4bb3-43c8-9d07-9fa7c5484de3", "comment": "Malware payload (Mirai)", "value": "1a907dd4c92797996033348bf1be51fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823638, "uuid": "215764ce-b45a-489a-9918-1213a2bf657b", "comment": "Malware payload (Mirai)", "value": "8f663967a8c5e9d7e77356bde7d0b2d27199d955a39a624dd6fdbd09c6d0b635", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823638, "uuid": "9acfc208-198c-45d2-aa7f-d1b8d710537b", "comment": "Malware payload (Mirai)", "value": "edbaeae9318f97563a55eeced46a48441fbc44e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823638, "uuid": "853345c2-a6e1-40e0-a370-c153a5b318af", "comment": "Malware payload (Mirai)", "value": "14353db463dea5035a09d24cd8ac487f1895e795c4b028b54de3a7508ec2ef5eb472a2aa7781e324c3ca5b69d707ee14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823638, "uuid": "ac4891b3-2f9e-47bf-9731-11b4398e1108", "value": "T118F27CB38D3E3D6CD2165A74B524AF3C5F63E905D6471EFA846683229407E9CF82C2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823638, "uuid": "735bfec6-c6ae-442e-a16a-9d8a8ace24c9", "value": "384:nUcJHAanlda/C9RfmRfGReBxNrTNeRB3ifZeOiIGNslLIOaFqLAvsl6Cvmf7Dtad:nUcJga7z9R+ReRwheqKouy4ANiCcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770823638, "uuid": "05f5fefb-f4e2-476c-b8fb-9301cfdaeb61", "value": 34316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770823638, "uuid": "eb631020-06e5-4a46-a4d8-f96f90f8868c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823638, "uuid": "98a9168a-c976-454a-aaca-6cc99e25615e", "value": "nexus.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcd6a8f-0786-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770840830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770840830, "uuid": "db8a7129-b654-4e6e-ab7c-07ac5722bc06", "comment": "Malware payload", "value": "ddf10ddd6d25469784395bd88820d73a", "object_relation": "md5", "Tag": [ { "name": "casadoconector-online", "colour": "#73C7D2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770840830, "uuid": "30670287-807e-4d27-9bd4-d7b0ece93f9d", "comment": "Malware payload", "value": "8f683365ba958bd006fc4c75cea7c0a2aca53acefe785bf3a818941d4547eccc", "object_relation": "sha256", "Tag": [ { "name": "casadoconector-online", "colour": "#73C7D2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770840830, "uuid": "58992a16-5ad5-4aef-830f-e3b4a2a199fe", "comment": "Malware payload", "value": "56299499f2e96287bc01cdd7456da7dcd6c6d90b", "object_relation": "sha1", "Tag": [ { "name": "casadoconector-online", "colour": "#73C7D2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770840830, "uuid": "68bf82f7-aa07-42bd-9ceb-a37aecc095f5", "comment": "Malware payload", "value": "69dc1dba12bd399cdb49aa504623751863628d03032b26132e81585d18ec2eca9a805f2441b350837cd4ca2631b498b9", "object_relation": "sha3-384", "Tag": [ { "name": "casadoconector-online", "colour": "#73C7D2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "saborizerefeicoes34-store", "colour": "#AF0CAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770840830, "uuid": "0c08d28a-2cc3-4d6c-ae60-708a52b6e9f8", "value": "T19A07337BE4E14F2BEAA259708A93C84406E53CD8676FBA313396B7DD2FF245135A7010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770840830, "uuid": "626a8099-bd55-42bb-9f79-cf9c2605adbe", "value": "393216:cRpu9eatlcObJ/WFV0OjydhmNa62ruk/s616D0Ocg+OD17hP5k:cuIatl5/MjjyqI6cu2t16oON+OD5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770840830, "uuid": "ec6fb782-49fc-4fdb-9bba-e45c8802beb9", "value": 17252352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770840830, "uuid": "2feae4bf-2668-4417-9ae5-969ba9fa8be3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770840830, "uuid": "3b270d12-da89-4054-bb7f-114b5ef8f41f", "value": "installer2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998759d6-0776-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770834138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834138, "uuid": "655ed758-b22b-476f-b2c9-bf8c3388c7c1", "comment": "Malware payload (Mirai)", "value": "1bd904ccf59b7d9f80890b24dc7ec088", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834138, "uuid": "fce27baa-7a9f-43b8-aef8-b90c64219fe4", "comment": "Malware payload (Mirai)", "value": "8f73acce0d3f413e37c6ede1e9cc1d45b3db42c6335cd9f47e2c829df7a11ddc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834138, "uuid": "2d884a74-35f0-4295-aefb-d019d5f3afc7", "comment": "Malware payload (Mirai)", "value": "7ea83c3ac64eec6d1ae71d4a45333029aa78d70d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834138, "uuid": "12f4e9aa-520b-4788-bfae-e62d4628ec9b", "comment": "Malware payload (Mirai)", "value": "3fb11bda364c5c76662ab36e0f4681c139e8f8ac80f1e4c35792223b3e6155badf67faeb0578cdeebaf95a5279882a9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834138, "uuid": "ee1bb52f-aa9e-49c6-b4c2-44f495970f60", "value": "T11E732A84F98B81F5C4174D3450AAF73FDA32E53980B09BADEF9A9F32CB677015206256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834138, "uuid": "45c58f59-fa43-46f8-b9d9-a4cbe3224b8d", "value": "1536:1tAedLfUjKD5tu5UOczNjxAY5NrlRjrZa8L24KLsW:1+edLfUjQ5Q5wNLvZPL24K4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770834138, "uuid": "55390557-5eb5-4cd4-90d1-f22f991d5387", "value": 74512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770834138, "uuid": "a2671a11-1a3a-4c55-af81-a31df21facaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834138, "uuid": "eb27e3de-9184-4278-888a-6cd186a2e635", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a415d578-077f-11f1-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1770838022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838022, "uuid": "7281b807-bece-4a21-831a-2ac75522d03a", "comment": "Malware payload (SimpleHelp)", "value": "bf9e98e0661654e4d88f5bf7e3ad6131", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838022, "uuid": "0d8f21c3-3a34-436e-a6ff-f316859ff856", "comment": "Malware payload (SimpleHelp)", "value": "8f88a30d27607b9bd3699872e6555302326a407f2889f6de83c9670293a96e4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838022, "uuid": "a318748c-1f2e-4495-8601-98a88eea5d18", "comment": "Malware payload (SimpleHelp)", "value": "ea0e8ec1898f198be62f4c45c8207dabe17ba51c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838022, "uuid": "7d81ef48-a12e-4a2c-9872-93337e66a943", "comment": "Malware payload (SimpleHelp)", "value": "9011ed778f14a241c7be7cb67fd060d775f9bc7b342f512459ab6c0c7dad74e5d3813108226191c627415b642f6bdc93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838022, "uuid": "adc560c0-f9d6-4bb1-92a3-1b29f6671862", "value": "T12A873329F39599FECE33D0FCC0854487EA96B9E54385412717F085EA4E206E58A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838022, "uuid": "b2bf4b39-a719-48ec-97cd-956684a899b4", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838022, "uuid": "d2a8534d-534f-44c8-9504-66c180fde0ca", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1bO:/uRf+nAu2FuQd73XyFeDMnKTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770838022, "uuid": "98c2deb6-04b9-4c1d-9b21-0bc67da5ecd1", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770838022, "uuid": "b986aafe-f9bf-4132-97e5-ac1e91b71266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838022, "uuid": "479f4013-50cb-4457-b45d-a4143c177008", "value": "RSVP2026.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b1dd4b-0749-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770814637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814637, "uuid": "5b24a928-b27d-4f0b-a97b-546a64f23d60", "comment": "Malware payload (SalatStealer)", "value": "57d1581870454f17fce67ecbc499db79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814637, "uuid": "238a0ed1-b581-404b-9507-8aff99473380", "comment": "Malware payload (SalatStealer)", "value": "906dee640fbddc2f962085e2524f5a51f7fdd581a457071b70d89895da85e0d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814637, "uuid": "2cf623b8-0ab8-4891-9821-dfa17de926dd", "comment": "Malware payload (SalatStealer)", "value": "7cf475881d7e61288a6e5513a674b3245f2ed95f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814637, "uuid": "7973872b-1010-4494-9148-1b4775b5a7e6", "comment": "Malware payload (SalatStealer)", "value": "af72395d42182433a4dd25e706e4ec571894749c9356162278b0696f701d78b31ec8e91ecd187f171b5201f604060cc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814637, "uuid": "7624cd73-4a08-4b55-aa4f-9122e4f15b13", "value": "T1E4E5331504C8AAA1CAF714F3EE51CDA84DD0641D599DD294BEC28034BF3DAF9626ECF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814637, "uuid": "031fe1ca-b17f-42ab-9555-52cfced797ba", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814637, "uuid": "11db9a77-1bf9-4d1e-b0b2-c8e9311ac1f6", "value": "98304:7Ou+mD0334onXic5MRF4qwbURl6MvO58awC6OOx91F:7D4PqTubURTv7aG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770814637, "uuid": "baa74fbe-52ea-4886-bd53-a836e1babf31", "value": 3296256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770814637, "uuid": "a1c38369-ba78-4245-8839-3b32dd6b2ae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814637, "uuid": "5ebf813e-a075-4d45-b4de-90a9c3f5c49a", "value": "qqq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01a6d7e-0795-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770847544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847544, "uuid": "6bf857bb-4344-4f9a-ac00-79bef001b0c7", "comment": "Malware payload", "value": "7e51e4246f6cef27b9516fab3e78dd1f", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847544, "uuid": "f2376031-6959-49e4-98eb-236b5c5dcdbc", "comment": "Malware payload", "value": "9168298d34d75424a0e51f04258e80e1322bf0fe1f24729ca6c0c032c1298914", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847544, "uuid": "510db0c1-9a1d-4832-b379-fb4f02de930f", "comment": "Malware payload", "value": "8b0a7d16fa06455bf9091adadafdbb1c588bd72a", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847544, "uuid": "03173fd7-b1e0-4179-baf9-3de67765bc4c", "comment": "Malware payload", "value": "64b59116dc017b38074a4c03ac3f72170d32d390668f6e5f4d1accac2af88f81c2a41ab142fedc747f32a4e50cce66c5", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847544, "uuid": "2e6b6e79-6ffc-417d-86d1-dc03c6d92b3d", "value": "T1A2C048A5823C6D568D6BC51A72B2C3B04360F86937617C63648CECB098400A49982520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847544, "uuid": "4f43d0bc-6e3e-4f15-970a-28203d629728", "value": "3:ns3FV39C5XPSHXgaggQq3gaDaFOdJ0Xga+Pug+:WFV39Cf0XZQq3ZDa5Z35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847544, "uuid": "952b2490-abbe-4856-bd14-6aa2a15c968c", "value": 138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847544, "uuid": "d7954899-9832-4478-8f3b-f3f0a124a4ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847544, "uuid": "734b6461-4431-4bf2-a554-9e244f54e218", "value": "9168298d34d75424a0e51f04258e80e1322bf0fe1f24729ca6c0c032c1298914.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bd1d9b-071c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770795509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795509, "uuid": "c7680b36-970a-47da-987e-7d1690dd56f1", "comment": "Malware payload (Mirai)", "value": "5c55fb7952e9cb15ae3097788a3b79e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795509, "uuid": "a2b26e49-7e45-4417-9219-476a0879f693", "comment": "Malware payload (Mirai)", "value": "9206afc521a5ea75be6fa7ff734513db0fd09f798c47493ad56bc1b460626a7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795509, "uuid": "129cb979-7ab1-4348-a848-eb25ef35df33", "comment": "Malware payload (Mirai)", "value": "4a3d5063b42439c2a9dee95b9c2bc7e0be6f8636", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795509, "uuid": "26bf9354-a861-4820-ba41-0a396b8d272c", "comment": "Malware payload (Mirai)", "value": "81d1255fbe59aaa337001be26f0175c4a6cd6460b11be0ae881e3e944defb45a3047293eb246c60a7f05d976baef2e7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795509, "uuid": "70a9b802-c95c-4e44-9dc1-f6cabfac48b9", "value": "T12B93A74E6E219F7EFFA8C33897F749609208239622E1D585D16CEB111E6034E741FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795509, "uuid": "758a8008-b6f7-4bc7-80ba-498f90795ba7", "value": "1536:7rIbjW5PF0qpLODPj92pq4xuPb1y9iUOZXUKZLauIrJi++7bu:7rWjaPF0RB5LUOZXUKkuYA++Xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770795509, "uuid": "4219ede7-64e5-455f-87a3-857a0d9c26bd", "value": 92816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770795509, "uuid": "14aab0d4-15d1-45c2-b3e1-da619c0acaa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795509, "uuid": "9cda6db6-5a02-4325-89d0-f2e1674ab913", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0adbfde1-0783-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770839482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770839482, "uuid": "b71c4532-d65e-4c6b-ad5a-ac26f1e71d4b", "comment": "Malware payload (Mirai)", "value": "e35d364f14499ee2962d207b2d1c3275", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770839482, "uuid": "0e1980d7-a376-45b1-b667-5d59ea77dd35", "comment": "Malware payload (Mirai)", "value": "920fe55532997013320324c33ad5eb989529203a1e99aa5b8f372d425bfc4cf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770839482, "uuid": "1a889999-eb40-47ea-9506-9d321505673c", "comment": "Malware payload (Mirai)", "value": "2d6c46cc18150de89f7f92cf8fa9ab058c61e48c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770839482, "uuid": "1b9116e1-00c6-44eb-b3a3-ae96554c3511", "comment": "Malware payload (Mirai)", "value": "b61c967836c238b925e1606731ebe47a75397c64387998894149497b608b184396a47e1d52f3c05252e9baa0125c3700", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770839482, "uuid": "31b18ab3-d62a-4eaa-8920-5164a6117fb8", "value": "T11EF2E196F1148CB1FDE781F61E6CD7D21BB097683E73CCA38AD4BB364822578A1409D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770839482, "uuid": "535a4238-d339-46ab-90de-c5ea05880bc3", "value": "768:ryGts1/y6o5Jo3V138pDRhtXgDygHIbbygDR7mdy/IR2VyVMU4uVcqgw0retv:w1a6sy3V1K/XgLHtK//I0VEMU4u+qgw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770839482, "uuid": "12762d7b-3dae-4475-a96c-3daa19bedc2a", "value": 37040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770839482, "uuid": "055a466a-e38c-4f38-b115-1e173e3beec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770839482, "uuid": "1ff64fbf-fa38-4380-b303-7b8658f96071", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e216a833-0743-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770812356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812356, "uuid": "4f77042e-ad71-4149-842c-0ca0ad073af5", "comment": "Malware payload (Mirai)", "value": "d508c0a7faaf93611ace62228fd74463", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812356, "uuid": "cb8e088f-332c-49a6-bc20-6a6daa6f741e", "comment": "Malware payload (Mirai)", "value": "92b9fbaead880a7f2aba848b6385c6a42e82c9279a62670ad22eff273ceb9c09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812356, "uuid": "74d86404-8bbc-4866-b8cc-90a6a5fa0b5a", "comment": "Malware payload (Mirai)", "value": "8167c2ae599b5bb512ee4cc610083034565c63be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812356, "uuid": "f58272a6-19d1-41b2-94a0-d33df88afe5b", "comment": "Malware payload (Mirai)", "value": "66c59ade1ea9832bbfd8247788f37d23f3ca8df4ef22e2eb327940be4eabd7b6a133c51d2c7f038bd1a1fd92410bdaea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812356, "uuid": "1cc7a46b-8106-4e53-b90a-717d90a5f557", "value": "T19B637309BFA51FF7FCABDC374AE91B45258C551A21983B3ABD34D818B24B21E05E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812356, "uuid": "9a67223d-35f1-4bf3-9506-4d002cae541d", "value": "1536:syQI/HsV7QK9s2jCbI5ngdvkx+NnzambZ0ns1e:sTI/HsV7Qgjtuue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812356, "uuid": "963dbf98-30a9-4346-8b0d-5ad01d541e90", "value": 71668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812356, "uuid": "45973b8c-3469-47ae-bda7-72b38ed61c1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812356, "uuid": "ca937184-cf85-4160-8974-f52ecf335eb5", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ba10df-0723-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770798383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798383, "uuid": "dca7c8e6-dfbd-4ff9-b823-e9b30c833c64", "comment": "Malware payload (NetSupport)", "value": "431cfd43f23de2e03548d7cbdb76c6b3", "object_relation": "md5", "Tag": [ { "name": "av-srvcn-com", "colour": "#3F219E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "srvc-mcrst-com", "colour": "#F58405", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798383, "uuid": "4376127b-7a8d-4ecf-bf74-71cd8cffd038", "comment": "Malware payload (NetSupport)", "value": "92f96ffd125f997d8003913d849604724bdc18b24f8afce035e096b78b226613", "object_relation": "sha256", "Tag": [ { "name": "av-srvcn-com", "colour": "#3F219E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "srvc-mcrst-com", "colour": "#F58405", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798383, "uuid": "b86a56ba-6be3-460a-b355-6a0e42b66af1", "comment": "Malware payload (NetSupport)", "value": "29603a3481e06ec6a7cd46dc1cbdea19e6dc6640", "object_relation": "sha1", "Tag": [ { "name": "av-srvcn-com", "colour": "#3F219E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "srvc-mcrst-com", "colour": "#F58405", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798383, "uuid": "e1dca4aa-f8eb-4544-9002-e0e9c1bda8d9", "comment": "Malware payload (NetSupport)", "value": "dbbc7b32ab3d868ab87a18baa6fb500ca3a317ece5c260f685922a9f7bad26cb525b062da065e2144a50b73ff8da94d3", "object_relation": "sha3-384", "Tag": [ { "name": "av-srvcn-com", "colour": "#3F219E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "srvc-mcrst-com", "colour": "#F58405", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798383, "uuid": "bcd5289d-4fa0-453c-8113-5b1086226c9f", "value": "T1B3A2E2C6D4387643F00AC7BB2378924317677C99470F477AFAEBB2505C060699E97819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798383, "uuid": "d15bfba6-7d29-4376-a1ee-b5f4939b4b43", "value": "384:mRaScOps9u2j2UlY1Zi9pVL/0+Y3Ga7q749prswcOmrOR68bvELtPjCX:mBcOp6u26UlSZEV/x3a7VlmrKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770798383, "uuid": "a05d10b4-693b-4258-ac32-da4b34820a51", "value": 22129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770798383, "uuid": "0c1df1d4-0df1-48d0-aecf-247b245bd243", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798383, "uuid": "18bad95e-9511-42ff-abc4-3b2da8dc3eac", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64308eb3-06df-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770769195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769195, "uuid": "c9c0a62d-148e-4203-b905-37eb555304ef", "comment": "Malware payload (Mirai)", "value": "65fc70f8663c960fd7923802ff824cc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769195, "uuid": "a864ffd1-def9-4a06-92d5-5b47f6b02991", "comment": "Malware payload (Mirai)", "value": "9595ee3c29b4538c3058481fcf1ffe5bbefae640754a43ee335393e07674a45f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769195, "uuid": "f96517a5-b933-4a30-b407-5b464a0ce1a3", "comment": "Malware payload (Mirai)", "value": "4dc7d54fdba086ecdff1a42ce251fb279a99d2c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769195, "uuid": "c91eb458-ded0-4e7f-a541-6344713e3bac", "comment": "Malware payload (Mirai)", "value": "c6fcfa6c2ec871a46e983c4f69a4004dc578ba9ae543c5ce17090c4a87bdb727fd47a5374d027575b78bc97a3e83938f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769195, "uuid": "380624df-7681-4a84-a50b-8d528eb116b9", "value": "T15A14C706BB510FFBDCABCD3746E91B0129CC644B22A53B363674C924F54A64B5AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769195, "uuid": "df8d668f-05bf-4407-bff6-565b75c1b91f", "value": "6144:Z6TktulJQ9hfTPT0Oy/Rf6XS2Qm4TcZu/:MTktulJ+wZfz2WU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770769195, "uuid": "f8b4bb09-70ae-4b48-a0f1-01f9fa9ee36b", "value": 206500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770769195, "uuid": "d20d408b-b2ce-4ba6-bfb2-aa2d5688817d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769195, "uuid": "1b9a2920-b407-4250-b656-bc75b1d1893e", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa508d0-0791-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770845745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845745, "uuid": "97441dae-6da7-4eca-8ed2-f867e358e49f", "comment": "Malware payload", "value": "35f40fda1e4bcd156aeb86d36f09de91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845745, "uuid": "d8fe9575-4269-4d1c-90d1-8c78337ffff6", "comment": "Malware payload", "value": "95ad0c820faa99138c88a7814c7d276dd9c6addf6c0df1399e97a5da526efda4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845745, "uuid": "4de55827-5caf-4942-bd30-3e7c6f07dfac", "comment": "Malware payload", "value": "7bae52e8fe8ae3a99f1cab470be737c0a52f11b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845745, "uuid": "d62a1f85-86d3-4a18-bf30-a20d5400a3ae", "comment": "Malware payload", "value": "c130c4b9a8ee70899574ac44fbdc3c5ae15f685a10accb515c7f93879d60c27e944ff9186b1498b1cd23cfcc1096dd3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845745, "uuid": "416d5052-e016-4ceb-bd48-1784412d6473", "value": "T134747C133BF8D43AD6420231DB5A9BA5E0F9A36909740D4363C4096CAF749D6E379F2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845745, "uuid": "44a9c38c-7ac8-4c5e-b4ad-458552ed9ca8", "value": "b42d0ac4cbca0dc8c838e1de5e6e28b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845745, "uuid": "bf433c88-7e26-4dec-87bb-e2da1e1fdcbf", "value": "6144:UnzsyDn7PDS+FDflUjvJUkbEOyF1rOpsuCOuOff5k4F/lTRHAGk:U377SKfgvqkbFyFJCRRzHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770845745, "uuid": "6da28e4a-c38a-483b-9a4f-dec4e57acb2b", "value": 350680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770845745, "uuid": "09899e4b-9e1c-41b6-8b76-bc1e0072ae4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845745, "uuid": "e5ddf257-ae40-45f3-b53b-e1d54c32adcb", "value": "95ad0c820faa99138c88a7814c7d276dd9c6addf6c0df1399e97a5da526efda4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3472773-0795-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770847576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847576, "uuid": "4b291fcd-0cd1-43b0-bdca-a94039796a77", "comment": "Malware payload", "value": "80ab5ba94b8b4d135453f8cb58be209d", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847576, "uuid": "d05ad258-7332-45fe-be7c-c2bef3cadfc0", "comment": "Malware payload", "value": "95fb8f28d08e19090443bda8bd71bbb79f7c451288a2de6f1ca0ad6fee8b4569", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847576, "uuid": "1491aa82-f883-4248-83db-61b9ec24c71e", "comment": "Malware payload", "value": "c32d9638bc5c1249afc0ba5eac6ed5cc712b9df9", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847576, "uuid": "e97a0d97-ae81-4540-a334-fe8db90433a1", "comment": "Malware payload", "value": "3270c8964e200dde57b17af675eb076448c237a9ca6b65c46337837d98e378e67c14b3bc951fdc50fbc580449aadf3e8", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847576, "uuid": "a54b3569-708e-4269-b009-b5e7a46976d5", "value": "T1CEC04C4D40244F558E7389192339C1DA5180727D1FA240C8A8344410B8601DCB76A780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847576, "uuid": "1ca0fc8d-7bb5-4449-b1d4-29c87e01a018", "value": "3:ns3FV39C5SjGPX2tdyrQOMGPX2tGaaFOdXPX2tLHKPXS:WFV39CSKPGvqbMGPGxa0PG5HKPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847576, "uuid": "9c45a0de-4416-4318-b3db-9c15f7c74654", "value": 138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847576, "uuid": "2d1ad35a-02be-40e7-89a2-04cf1764e4a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847576, "uuid": "cf6ae02b-2c3b-41f3-9833-39b27b0841bb", "value": "95fb8f28d08e19090443bda8bd71bbb79f7c451288a2de6f1ca0ad6fee8b4569.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93f6894-0751-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770818408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818408, "uuid": "e512c83c-94f2-4772-b9e6-447fc2e71415", "comment": "Malware payload (AsyncRAT)", "value": "7f72a7c7c417264d71f5d62ccc6af480", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818408, "uuid": "d93f68e8-e86a-42c8-875f-cdccab950814", "comment": "Malware payload (AsyncRAT)", "value": "965655a4e816f10f193a93474deaa7c93465e84a44e20dae33e5a699651e77c5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818408, "uuid": "47a8dabe-4f1c-44f4-8816-7503515322a8", "comment": "Malware payload (AsyncRAT)", "value": "b2972c26a22a6c50bcbf496a13ce2a902c37cac5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818408, "uuid": "72164636-5633-4dad-8a6b-b3b80a8e01b5", "comment": "Malware payload (AsyncRAT)", "value": "425ef28b83d6ac7d26dadbaff7b7808ab4cfeaa7408762ddb7989f34080d1561a152e6ec10e35beff64f6ace7b4a7c97", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818408, "uuid": "11a2e550-93b0-4684-9802-75d36ddbfda8", "value": "T1774512CDA4400D241D373B13D21A5A1AFC10B33A10169DEFDE9BCF6922FDE527A685AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818408, "uuid": "6b4c0c72-a0fa-4b0c-ba52-986b8571d477", "value": "768:MrcejT5FbuvkDMaobJec6fNJmyZbtgXC76KLAfzTtFniL4x:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770818408, "uuid": "a422dfbb-2d41-4729-99e1-d5a0f3d4b64f", "value": 1215483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770818408, "uuid": "bbb76659-e11a-4057-91a7-2d21358f2fe5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818408, "uuid": "73bc9964-aaa8-4697-badf-77f55596c817", "value": "z1PEDIDODECOMPRAEPERFILDAEMPRESA.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b41943-076c-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770829761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829761, "uuid": "bceca2c1-de9a-4bfd-9266-cb48b6f7bc71", "comment": "Malware payload (ConnectWise)", "value": "5dc56e7daff297218d5026987737de21", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829761, "uuid": "e6d8d52e-6da7-4cae-a393-b5c16b5f0ca9", "comment": "Malware payload (ConnectWise)", "value": "967caa45398b3cdf986a13897548d419a4185eec7ae8c29176badb28fae1a821", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829761, "uuid": "21620b61-02ee-45f8-a11c-3e58ab861dc8", "comment": "Malware payload (ConnectWise)", "value": "f8796b20eee1a13d0d2cbb824c9cde09e0a12751", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829761, "uuid": "4ee8f207-a464-4aee-aa21-73ab57eddb76", "comment": "Malware payload (ConnectWise)", "value": "778b9f33bbad09934a6b352eae312458d61e4efb508a2f8edfa6ad0ba0a4784a8a3ef0f79f1eeba15435a68c5df3dbd4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829761, "uuid": "ce1e38b6-d1a9-4f06-9c7e-889d5b2643b0", "value": "T1D0A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829761, "uuid": "498215e7-ceca-4d01-8c10-cf8e51e5f501", "value": "196608:nKaLNkbgmi4QvKaLNkbgRKaLNkbgpKaLNkbg:/WgmiHHWg1WgNWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770829761, "uuid": "7aacffc5-6bc5-4d4d-8b44-c60faba5f1b5", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770829761, "uuid": "c1eaf5bf-1abc-4c4a-8928-72f825b68d41", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829761, "uuid": "b29a0b9b-18df-459c-9ed2-c9e5d776a249", "value": "967caa45398b3cdf986a13897548d419a4185eec7ae8c29176badb28fae1a821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2425f49e-0745-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770812896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812896, "uuid": "594e96f3-d738-4b02-ac5f-380cf08c2593", "comment": "Malware payload (Mirai)", "value": "70e81d9716b8588ba03924216e16e484", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812896, "uuid": "06fe54db-afb8-46df-b710-7d119e080add", "comment": "Malware payload (Mirai)", "value": "973fcbd7270eb7eb60915985fe52773c1cf181fe0af0a66e65cd96c4a6f5165e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812896, "uuid": "38e189a3-8a90-4485-bbb5-8dd3a38d6b78", "comment": "Malware payload (Mirai)", "value": "2d0947da961c9db2ba9aa05f6adc573a67a97973", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812896, "uuid": "d2fcefb7-d46b-4330-9756-7b33a80b1592", "comment": "Malware payload (Mirai)", "value": "02191c662ed150fdee75ee26b08d7b45460ccb857563fe263f7fcc5db4e1a8d93d124123815f0966c7ea192c6797a48f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812896, "uuid": "c5b80cf8-a1fa-4150-872a-09cda112650c", "value": "T155E47E9DFE4E3C42E2C7E2789E4D87E1731B75E4D32391A33982434CD5CA9D98BA1522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812896, "uuid": "a752728e-c557-4776-a25e-3bb4e5a5f62c", "value": "12288:dVGW4WMW43FhM9MZMzCneRZ9Ms4FcmelM9JhucoKgw5dzUU3wXRq:dVGW4WMz3FhyAeZ9h42m/9nFE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812896, "uuid": "01b6f9eb-3490-46cd-a0f0-d9cfa163026a", "value": 665664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812896, "uuid": "4d369f0d-e7cf-430c-b8f8-147ad95858b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812896, "uuid": "0f9716d2-e737-4afa-ba84-bc18c5082dbe", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e5f460-0746-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770813266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813266, "uuid": "fc63adeb-3f2c-4277-8b0d-4b5ba3f68534", "comment": "Malware payload (Mirai)", "value": "09789498236016a008516e21fc631236", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813266, "uuid": "a5d992f6-9cc0-4ce5-a37b-c649e6156064", "comment": "Malware payload (Mirai)", "value": "9759964916b8d3f9d3cbb95b40cca4934bf7757c6866e8c8c2cc63a3662a8901", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813266, "uuid": "d3d2a651-9bb0-4f9d-8526-41a08f5052c2", "comment": "Malware payload (Mirai)", "value": "719dee4dbbd052f55dc03fd0355354d907676489", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813266, "uuid": "14fb8484-dc0d-4c51-89d7-769f848e6870", "comment": "Malware payload (Mirai)", "value": "0b462170a93c53fb95b5de938dab2b47eadf74f58b45cf8af3bccfc4aeb4440f1f738cd6a71da7a432dd9f2f448c2d18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813266, "uuid": "03a8052a-4189-477a-83f5-337027137ba4", "value": "T1EFF2F286D590EA60E8520534FC748982F6DB1934EDE539343C646E146BC288973BDBDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813266, "uuid": "670a1b68-3d3e-4ef1-887b-d4fe37af9c5e", "value": "768:UPPWguYPWZ2qySRzyOhUP6N86ydEKWOLbZ6t3U03wfEH:UPOguYWrmnP6N86zhgxfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770813266, "uuid": "c470b1e9-2e86-44de-b6b6-4cbbdbd30aab", "value": 34552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770813266, "uuid": "4d2f7d65-a008-481f-b529-c29407f8b3cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813266, "uuid": "065a8b80-dfdb-4711-be0d-b0c7aabdbdda", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d6a2e3-077a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770835635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835635, "uuid": "11a09bd5-a893-4c76-95bd-f83d60fc42a2", "comment": "Malware payload", "value": "7134af2d603e07b80980f9f79b9296d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835635, "uuid": "ed2fd42e-97eb-4faa-919f-b6ec5543961c", "comment": "Malware payload", "value": "97663bcbf4af43410e32832771d0bea3af2b02effae40ed410281394d2fa29b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835635, "uuid": "0a2a0c2e-9907-4aa7-8443-1a57252bc4a5", "comment": "Malware payload", "value": "e8c964619b405df3ea001a5b83c19630a3e85878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835635, "uuid": "e76b9f5f-2b95-4131-88ba-ffc0a38455ef", "comment": "Malware payload", "value": "762085841d2da647f40646de1dceb6b62918b54958a9504f7e950cd9893a0b2547f4e60d6eac9d8403ab016466110633", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835635, "uuid": "b5a9cee0-e05a-42e1-b9e7-a1a7eca9105a", "value": "T12A26AF16F3C80E99D46ECE30C62FE332C3B2B8664672928B1565C7499E7BB514F3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835635, "uuid": "8e4a30f7-5ca7-43d1-8e66-bbeff8a632e8", "value": "9f5f418ac419b05d6e2d0b8d35cd84ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835635, "uuid": "4ba53a30-20f1-41fb-8e14-28f780335680", "value": "98304:WxnAPQTUBYHA15f2TjgOY4pIEAVLRrC0YFqL9/2+rz7n:WBSwA15eTjgOPTkLNC/Q9/2+/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770835635, "uuid": "baf7b6e6-2ec3-4335-9fe7-a55aaaf85b03", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770835635, "uuid": "62ba4bf0-f4ea-443e-9415-867de94e2093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835635, "uuid": "697406f2-b40a-4c6a-94f5-f19387445aa2", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286b9ccb-075e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770823641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823641, "uuid": "17d8f96b-b3f8-4271-96a3-f60e16aac309", "comment": "Malware payload (Mirai)", "value": "e5ef583618a4d70ca4f3628e0d062893", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823641, "uuid": "8a8ef7e7-62cd-42ff-9a13-d1914ae93b3f", "comment": "Malware payload (Mirai)", "value": "97c930e8605d5a185a7d93c4c407d424248f8bb8038ed232435f3c156cfaedb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823641, "uuid": "820d3e01-e195-446d-9bfe-44c30896599e", "comment": "Malware payload (Mirai)", "value": "820f92aa76fac1b401499612429110bb73dcff04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823641, "uuid": "1216b6b9-c01d-41d6-9b26-89cbe655baea", "comment": "Malware payload (Mirai)", "value": "87029d0627b9c76714fd42ccb81b4a0d8521434c9e16e683c40be7cd62b7cf088cadc934256efbc1f5a80be0d79f526e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823641, "uuid": "5c29ea21-753f-421d-bd4a-348ac65d2dec", "value": "T1BB13F584B8869E06C6C0537BFA0E82DD3B2973D8E2DD7303DD156F513BDBA2A096B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823641, "uuid": "c756f0dc-9dc4-4dd2-a4b5-e9e3ea08155b", "value": "768:5oXgKS/E5do3soaHo8zwESkBxl33hdQhLljkbsZV0w1Wbg5:CXgB0tUg7dXQ0bu/oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770823641, "uuid": "c1f69c47-e137-4f19-b15c-2cce4d95650a", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770823641, "uuid": "e87ad3e1-1ea3-4a7e-8040-600e1b4ed3f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823641, "uuid": "81e4f152-5a55-47ea-b2af-1b94a45f6064", "value": "nexus.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb2e59e-0742-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770811810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770811810, "uuid": "8b668124-e5c7-4883-8f61-dde7e7b0aed8", "comment": "Malware payload", "value": "06361e33a997b9c496e541da61979514", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770811810, "uuid": "4155e9b9-4bdf-4b21-ad74-853558ef9062", "comment": "Malware payload", "value": "9828b896e8e136814862e1bdce4ff41c15cb2789e17ea306911cb5974923ae7e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770811810, "uuid": "4880858c-2cf6-40bd-b592-26cb408e8869", "comment": "Malware payload", "value": "b0aeb0cb45dd3309f47595d200270fe6025ef705", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770811810, "uuid": "11b93115-4237-4baa-ac1f-7ce99b9a8238", "comment": "Malware payload", "value": "d6b8982dc3925241b01f8f60eb5384693449f5df2842b7f149aa84d2738a99c22f4d1e097dcbe9111902b90992dd49ae", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770811810, "uuid": "2b37df33-c3cd-42df-b8da-b9b198871e5e", "value": "T1BCE4D787F1209AC7F44FDABF10504310AEF0E0705607F2561B6E985A6FEB9C89E647E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770811810, "uuid": "8668796c-94f9-4e30-a91d-ebb2712b15c1", "value": "6144:O1eMX5Uh/W94gpr2T0PjhMoQpi/0zpXejmUm47bBQP4HUwHvc0/1Kp3x1Z4P:OtnmUlbTX/18I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770811810, "uuid": "0b739f34-f569-4f98-bc35-4d97289449e1", "value": 702365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770811810, "uuid": "3dfd7daa-1092-473d-8ae7-fae11ea08e7f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770811810, "uuid": "a2b21397-236d-438b-8256-c96bfe1a2f28", "value": "DonutDupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0752a2-0715-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770792272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792272, "uuid": "af80b416-56f6-425b-8fdb-344200aac5d0", "comment": "Malware payload (AsyncRAT)", "value": "4e782f09ad8bf47af00d28b0a652fc84", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792272, "uuid": "11d63f0b-d3d5-495a-8e0d-c55442bf9061", "comment": "Malware payload (AsyncRAT)", "value": "997661cf16bb3ced45b5c02a59ac7da02375471f90da7de37bc7620742796cb4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792272, "uuid": "55efedbe-a7d5-4e8e-8ecc-7f87804ce7fd", "comment": "Malware payload (AsyncRAT)", "value": "c893481061de81d187c655dae4f3518841c99b34", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792272, "uuid": "babe747d-093c-4b48-8062-9d581be94372", "comment": "Malware payload (AsyncRAT)", "value": "53af1ed58ee5a574c91adbc443afbf9ae2bf019c83099a89410c2c5033b5e579c64dcadccc11cf28136b3ce33df20bbc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770792272, "uuid": "eb0317cc-8573-454b-b82a-66ef60fb99f8", "value": "T192D24B08B3D48565E1FD56B94D7292048771EE4B9973DB9E1FC440AE2623B88CF15FE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770792272, "uuid": "351f1e9b-f8bf-44a6-b790-ce70e2625c0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770792272, "uuid": "28b230be-f480-4072-be94-93f4ecc2685f", "value": "768:T0oRXxvJ/qymYg/cIRGqo+/Rb7fB/dT0/+:4oRXD/qymB1iwRbN/e/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770792272, "uuid": "76a5b5c4-b8b5-44a1-9633-5b5222c3289d", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770792272, "uuid": "7a46123e-a55b-4de8-8f82-9070d0b4f70a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770792272, "uuid": "5589b760-ab5f-4da8-a948-0b7142a2d7c3", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94e984f-0795-11f1-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1770847613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847613, "uuid": "6168b289-8236-4885-9fb8-dd8cd92ac0fd", "comment": "Malware payload (AmosStealer)", "value": "a8ad1697e8c8823ac7b77557bcb85a24", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847613, "uuid": "9e0d7aef-cd98-400f-b8bd-0d3a530a51bd", "comment": "Malware payload (AmosStealer)", "value": "998c38b430097479b015a68d9435dc5b98684119739572a4dff11e085881187e", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847613, "uuid": "fedb41b7-36ce-40dc-b742-87c79cfad03f", "comment": "Malware payload (AmosStealer)", "value": "46a203240b7b06ec66058de2ab459d24c3545993", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847613, "uuid": "906f75f1-122b-4957-9154-c20117384761", "comment": "Malware payload (AmosStealer)", "value": "c4f405fa297d128b74b08e97c2e5ed8d4a48c2b3c7a68e86b641b7d980845e6b3858f2e8e65231dbc4f3f7edc473a41f", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847613, "uuid": "8ddbb292-65f9-4b8e-96c3-c7f34314a833", "value": "T11AB409E3223859F2D98EF77CF00F2267F976BD4115B8A5D55E810E110ED9360EA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847613, "uuid": "c9256c52-9108-42f8-bf6f-8f508b8f7594", "value": "12288:j6TamwVU71+KFwT+Mbc3GmH3hBOGpLdhHEiU7777MMMroTZ6:j6TE8FxBOGpLLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847613, "uuid": "41de7f91-c83f-47ac-abcd-af922a414b4f", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847613, "uuid": "e135a82f-ebfe-4089-82f7-502956f5b30f", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847613, "uuid": "6a154172-537d-4373-afd5-16358c880678", "value": "998c38b430097479b015a68d9435dc5b98684119739572a4dff11e085881187e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7a3ba6-0723-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770798309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798309, "uuid": "8f6ad9c3-4b3e-4fad-b419-e9675c433881", "comment": "Malware payload (ValleyRAT)", "value": "525678d3b1ff75158d06e72d8fb21810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798309, "uuid": "1ea5daed-6e65-4b87-be0a-9c445b50267e", "comment": "Malware payload (ValleyRAT)", "value": "99d28e8eef19a4c01ff66c143e6beb6fdd5862c8cf7c2254ed2df5b68b6b4175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798309, "uuid": "3260afe9-02a2-42dd-b16c-3b9c48574af7", "comment": "Malware payload (ValleyRAT)", "value": "6ea2ac8fd33db5f05a78b0b8a908e039611ca50c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798309, "uuid": "218f14b2-6a0f-480c-bc44-d07ac580a06e", "comment": "Malware payload (ValleyRAT)", "value": "ffd859035f2168d0e15bb85b6e04f1a9abf9f81b703272ffaee26a688536ebca2e3dc90a79ac97f5a750d4a041e38421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798309, "uuid": "9b43e4d6-c01a-4c65-bbaf-088217bc48c7", "value": "T1C4867B01FE8759F6E943263155A7B26F63349C054F36CBDBEB507B2AE8772D1183220A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798309, "uuid": "c476bca4-80a6-4a07-99ee-33f6cf5feeab", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798309, "uuid": "80d8dfc5-8ebd-4c64-95e3-d9f90e585d52", "value": "98304:M05qyR/YndW2xb7gugSu43ltTEfyx7RCfKQ9+mWAH9bQCoizoag/VFC:MWiJZe4VtA6ZRCB9ZPdbOiO/VFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770798309, "uuid": "1bc056d9-66da-433e-b98a-df0167ffea51", "value": 8323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770798309, "uuid": "365e5af5-e1f6-4243-86f3-7d7b108d4874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798309, "uuid": "f9297c69-cd6c-45ae-b7d2-e7d92023ff90", "value": "99d28e8eef19a4c01ff66c143e6beb6fdd5862c8cf7c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f12106-0777-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770834641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834641, "uuid": "1c5070d0-8a43-4090-aa9c-9ad6151945bd", "comment": "Malware payload (Mirai)", "value": "e0d4bd0deec97a95ae0852bc40081de8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834641, "uuid": "5cd0860b-f9bf-4f93-a8e3-38e5eca5952e", "comment": "Malware payload (Mirai)", "value": "9a6d47d838150f2056b86a432019671730615bd0506728be127244e2acd86032", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834641, "uuid": "6a5f8222-c52d-4176-83a2-18d2caa64682", "comment": "Malware payload (Mirai)", "value": "889ba0f1a6594fbd6b7f97c360bde5535b6a147d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834641, "uuid": "bb14d545-f9ad-4ba1-bef3-f044afefa0a1", "comment": "Malware payload (Mirai)", "value": "ddf7283c16c09adbb4b9d8a3f17ace11921b514ee6f38571ccbb91ec66121f9060e0a40a3f9574086897a321349d921b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834641, "uuid": "73c7aef0-54ac-4048-b0e1-e1fb6bc495a8", "value": "T1BF93C40A6F600EF7E8ABDC3305EA2B01249D952B25AD6F79B530D818F15F24F1AD3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834641, "uuid": "a51f0ae9-3a5a-48a7-8427-4f8f201b2fde", "value": "1536:kwqEbnGh1T0n85BYqEydBtka1MpR6AcNMh7+g2DZzvmoS2S:9bQTR5BYqEKB35g2DG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770834641, "uuid": "63600ad2-1f0a-4c5e-91d5-f738aca97cab", "value": 93856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770834641, "uuid": "2ff78199-197f-40ee-a39d-194d526d4638", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834641, "uuid": "a1a377cf-0aeb-4cba-b63f-2241efcd7573", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74cd8c04-071e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770796281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796281, "uuid": "8d2b738b-8529-4848-8e3d-f258758103d2", "comment": "Malware payload (Mirai)", "value": "1a368df557105505d7c50ee56b563940", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796281, "uuid": "5b817776-df37-4cd4-9805-0c37cb75b76f", "comment": "Malware payload (Mirai)", "value": "9cba7ecd134f08c310ffa64eaa92354989747550100914cbce7e5074444bc951", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796281, "uuid": "a10aa2c5-d2b1-4b82-8411-5ce831ab6e38", "comment": "Malware payload (Mirai)", "value": "2113ae6b20282b0ff571e6d1d536b178bfb7cd15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796281, "uuid": "e51d9fe3-9b3e-4cf8-b110-0a872ce46810", "comment": "Malware payload (Mirai)", "value": "e25c75f3270724215ee67a255b0f84b2e7fba6f33c72023927652a7a38747f42734d4f9dc9da7c76ad2e2b51f26f725a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796281, "uuid": "6d76c71e-9899-47f6-b146-b2dc3c0d6e08", "value": "T17914E705AF910EBBE8AFDD3306B91A013DCCA05762B53B353674D528F51EA0B59D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796281, "uuid": "d876278c-4688-432a-bca3-8b4a2db117bc", "value": "3072:Gjfo1dmkPXvfIlaQLD4bKxQFbiXQ+dBsxsb:Gjfo1dmwIlDD4b1qQLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770796281, "uuid": "618221bd-3943-4cff-ab1b-9bfc63463496", "value": 194116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770796281, "uuid": "cc166808-32a8-498c-91b4-f351ef9e549f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796281, "uuid": "8da7cc41-5882-429e-a3a2-38a6aa057250", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e278406a-075a-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770822235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822235, "uuid": "c6f5b952-2f60-49a5-b72c-ffda859cdb82", "comment": "Malware payload (Vidar)", "value": "7fa4439f492c5e8f3be9f0eacb438aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822235, "uuid": "42b55ce1-6255-4ce8-bab2-a1873f3d7d21", "comment": "Malware payload (Vidar)", "value": "9dd5e4635506cf8b7525e6dbbdbc85eb9c0c830d75ac5687aa3ea9135639ec0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822235, "uuid": "70ec7273-f498-43aa-970d-f6d879f26025", "comment": "Malware payload (Vidar)", "value": "379222cfc560eda0dd365cedb3fa766956dd3310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822235, "uuid": "53d88e3f-5d4b-4b27-948b-f3541a78463a", "comment": "Malware payload (Vidar)", "value": "d6bffacdb1c64a8d9b99e9d1b2cf36d2aac7a5bb48ba1f93bb6393cc2a7cdbfe6f36ae25a567b375bf6103393675029c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770822235, "uuid": "5fa3ba87-de22-4326-bc7c-16c607adfd7a", "value": "T13FD5BD15E3D901A8D537EB34CA619333DA71B8565730E68F0699D6162F33EA09B3F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770822235, "uuid": "6e54612a-ccac-45ca-a892-c5f07b90c791", "value": "b89ec12a4fbcd5d45b17be270fee7440", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770822235, "uuid": "b536f2c6-0aba-4173-ae39-3c0409348c55", "value": "49152:lIhi58bGl2sLfOLuMQpOq/5VWsdAR60GlXnWt4qtqM915sFppljPQTU:HcP6VhI6vlXWtw3tdPQTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770822235, "uuid": "aac145b4-8ac5-4a20-959c-cfb575ddb96a", "value": 2881536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770822235, "uuid": "b6bf54d2-f247-46e5-8c56-dc630c83e759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770822235, "uuid": "4f6b32d3-c37c-4918-a270-b4554d67bd79", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57db8cad-0750-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770817707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770817707, "uuid": "5ae988b6-afff-4766-ba0d-6f178221a5af", "comment": "Malware payload (Mirai)", "value": "b6dc9c18bcf7157055aa76be2682702f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770817707, "uuid": "28379881-f70c-4f27-92a1-726e3e16b449", "comment": "Malware payload (Mirai)", "value": "9ead819243ec234bcd49eca3baa0a2fcaab68d546415a788bdcccf8158338d12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770817707, "uuid": "4a8c7549-6a86-4491-bb77-8fef4f176eac", "comment": "Malware payload (Mirai)", "value": "7f29537ec1ae48524e73bd8bf8881c7c7d71883f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770817707, "uuid": "52b956ed-8b02-407a-99c2-aede48600747", "comment": "Malware payload (Mirai)", "value": "9b9b49cf71285c4b80eb715cbe571b895c952b7c490ef7d80b0043186387396b6fafde557d99f7afa2200884003e2305", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770817707, "uuid": "5b2cd1aa-25fd-4757-ac4f-e0968f712093", "value": "T172330845BC919A02C9C423B7F62E118D372663E8E2DF32079E226F1177CA92F0E67546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770817707, "uuid": "b16e6eea-9600-4676-936e-364b2221b68c", "value": "768:j0A6Husl3yKHwZHFu4oiTMkSMdJ3QoO//0uSTBNO6DS3f+mhy:16Hus9bHwZHFBQkSaJ3UcrSWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770817707, "uuid": "f81ea7d7-aeaf-4f3b-a6ee-0f750f3dfa63", "value": 54828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770817707, "uuid": "95a0f1d6-9123-4990-bc4f-d27bdfecc818", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770817707, "uuid": "e9aabf91-6730-4aee-9089-66263fc95437", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163cee83-077f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770837784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837784, "uuid": "627242fb-f062-40fc-ad14-8cdcebdea461", "comment": "Malware payload", "value": "8be360adff9b391c67c832208c6660f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reynolds", "colour": "#66C8C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837784, "uuid": "43c2ec53-afcc-4cfe-9221-11303465f7b0", "comment": "Malware payload", "value": "a0ce8bf57ecbcfe448f1b1baed5d29755fa4a5bb02b924a0242842d92176b841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reynolds", "colour": "#66C8C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837784, "uuid": "c964dedd-1d1a-4e0b-a70d-7721c9e0c34d", "comment": "Malware payload", "value": "3a9915495cc242b51f7b310a30fd072d9266a8a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reynolds", "colour": "#66C8C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837784, "uuid": "39b975f4-672f-4fd2-9624-7160abbfe06b", "comment": "Malware payload", "value": "68d5ea68e12b4393f2dd129a6667aebf34df06ea5ee96f46469ff7f158f346337198455608a8344f019f9879b89659af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reynolds", "colour": "#66C8C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837784, "uuid": "22bd8283-773d-4a06-a237-8b19df315ff8", "value": "T1A0449E55B7E500F9F5B3C1348AA55A06EA7278540760DBEF03A403F1AF236E09D7EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837784, "uuid": "935eef75-1acc-43b4-b4cf-d9d72ac05b6c", "value": "f1765cc4ffd1f7c7b391e7ff568a8533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837784, "uuid": "a92a0e2a-08aa-4c2b-bfc4-1a50cea6e87b", "value": "3072:wVwEjye5w9AiBj8VmwV754kwUB6Vuhcd6nWCX83QuVB+B2L8GlpEe:wVwE+e5wpuhVnjigcJ3HL/lpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770837784, "uuid": "51432738-70db-4227-8388-b84f7307645d", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770837784, "uuid": "3a7f1310-0cb7-442f-815e-c619ee2f2182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837784, "uuid": "222f9ff6-88a9-4867-89bf-1168edc87e98", "value": "a0ce8bf57ecbcfe448f1b1baed5d29755fa4a5bb02b924a0242842d92176b841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0f5a3c-0762-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770825447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825447, "uuid": "5d13453f-1ca2-41e2-898d-736e42f6798f", "comment": "Malware payload", "value": "48fd798b65f5fda79798b6c9ba71e3bf", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825447, "uuid": "32afd9f3-1370-4202-8c60-13e32a7ef351", "comment": "Malware payload", "value": "a0df7892bb76f0bf26c3e3d1be115e69d03510dfc6d92ebe874e2f3a1d7f6194", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825447, "uuid": "42a7867f-700d-4b98-a9f0-39d26f97716c", "comment": "Malware payload", "value": "a8464ee1ec150c4abcad1f8c0cb3ffd950b34354", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825447, "uuid": "203389b9-f27e-4198-b3f9-e1a0435099c6", "comment": "Malware payload", "value": "634e4e2fea145145a1cb791e26f792481885a052a1b67629c39184573cc6598f497c597ad46974d9cadba6b308932bfd", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825447, "uuid": "b7a37745-d624-4acd-9390-a555beb0108f", "value": "T174E4029E9A6A10D48080C3D944A77AE748E99FE12D585839BB6ED2D33D0C921F4335FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825447, "uuid": "078e7e16-9a1e-4030-86d3-f2a5fb7cfb21", "value": "12288:wTZ930XGu4KA/Oj9SrbSZYcoGRNrsn1pZjnuBZ9y8xjAS3jQfn3gh+DM:wzoA2j27k1YDqNzqgh+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770825447, "uuid": "7d1f2f69-fbbc-4c6c-b8b3-2627a2f809e0", "value": 716784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770825447, "uuid": "4432cdec-5032-4628-bf0c-9a5bc11d31e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825447, "uuid": "69ce471b-3924-4421-807a-d1153ed3f161", "value": "1bf78c3d9a887b46.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c447f349-0795-11f1-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1770847524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847524, "uuid": "0cd400c0-28d0-4e78-88c9-d79b66a20078", "comment": "Malware payload (AmosStealer)", "value": "d8ba368e60477651ffb04e8e4f93509b", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847524, "uuid": "412960c8-892b-4a60-b1bb-7b70b21483cd", "comment": "Malware payload (AmosStealer)", "value": "a0e66f3067e4aaf5b83e45b7845cc43b2fc96032a4398cab7cc9d11f4f962e91", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847524, "uuid": "d305c27a-2f84-4a34-b21b-794dba7037f8", "comment": "Malware payload (AmosStealer)", "value": "92a3d22717e6a7d25f74759dc9ec6f72e60c4f17", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847524, "uuid": "bf7e4dca-e674-4cd0-bfed-42b173fb2124", "comment": "Malware payload (AmosStealer)", "value": "0dcc6e1f36b395363372d346ba9e104637a4ae75e31f7bb9f92e9bde54e62e96344e84f30b500b10a8724c1c359ab21a", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847524, "uuid": "d98f3db6-950e-4c58-999f-bef8b4d2c98d", "value": "T17FB419E7623855F2D98EFB7CF44F2226F971BD4019B8B5D05D820E114ED9370AA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847524, "uuid": "3b688c0a-51ba-4326-a53e-4f7678306aed", "value": "12288:D0l+NcArlEE9ncvJJQqlsgcxv8pBprQMxJVXWlnnnHuuu21uKb+AfI0m:D0qEC8pBtkfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847524, "uuid": "2bbc7d36-e90f-4cff-9bb6-6bd447dbf991", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847524, "uuid": "00b7f602-3206-4bc3-83ad-7b022d7ec70f", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847524, "uuid": "bcff84a0-41b5-4c16-b97e-1dbd0f6e1601", "value": "a0e66f3067e4aaf5b83e45b7845cc43b2fc96032a4398cab7cc9d11f4f962e91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ff6993-06e4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770771538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770771538, "uuid": "962d4591-94d6-49e8-84b0-fefaad6982bf", "comment": "Malware payload", "value": "5b539c3bf7a25673d58495fcb25fec8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770771538, "uuid": "bda2b0f7-a406-4e0f-9515-dc3b7a1834a5", "comment": "Malware payload", "value": "a0f00524009eb2b3f958b7f55da66e8e04c04ed0518d15bc8d88173eab9c625c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770771538, "uuid": "fe24922f-9c83-4411-893b-3b87dbdda7c0", "comment": "Malware payload", "value": "f03049d5a92fda0d0edf26f3d2d2bf9248813dad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770771538, "uuid": "78454ec2-4b4f-4038-9345-c9085e38a67f", "comment": "Malware payload", "value": "219bf6053fe90c25543c3bc75db7e83886c539f3393cc5ceeb3b53add4d780866dc32f1bcb524600500f251702aa5cef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770771538, "uuid": "75bfe717-efb8-42f9-b3f0-f843534afa3d", "value": "T1063533E7ADD785CBC9B3FA79A0144A7C682624285B07030BA65CC7F37A19C785B4BD13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770771538, "uuid": "5acc371f-db8c-422d-9ba6-309ee81bba2c", "value": "24576:dO7EQb5XgACLCKdjpfYnWN+ZPhTUu5UPsDGK:dOZnWkZP1dUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770771538, "uuid": "b950d681-4853-4cd3-96be-3a5459b157eb", "value": 1078768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770771538, "uuid": "171c9fca-875d-496f-b537-c453fde61176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770771538, "uuid": "82938bf3-dc71-417b-9b6d-a009fc8d4aeb", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a91af61-0746-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770813336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813336, "uuid": "24b5a6ae-cb48-4ac7-834d-43d311a3d87f", "comment": "Malware payload (Mirai)", "value": "b5f581f1dd62e3f9cd7434672452979f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813336, "uuid": "ba5187ca-53c1-4270-9235-660546a55e56", "comment": "Malware payload (Mirai)", "value": "a55ffcbc8a7d52f9641b81cd27f11416b9c45797516717a88ec69e8cd0a94c10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813336, "uuid": "fb6d50eb-33d0-40e0-a31f-a5ea6ef10a33", "comment": "Malware payload (Mirai)", "value": "d24d2f9f9887b060f7ad37d171d4e0bfb344465c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813336, "uuid": "9ca01b6b-d83d-4b24-9868-9e02f6c6b587", "comment": "Malware payload (Mirai)", "value": "6e44de9ed12f179cf5a5246375b126d17272bdae75bd0bc293f57b1f315f877befa29b943743b0de4fdaa2c844b86376", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813336, "uuid": "0a0fb766-60b0-42b6-8b55-8309279a43fc", "value": "T121146C43EE890EDBC41BCEF086BF839B19E3569B89D1B1F5487C8C1C755D28A46D3688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813336, "uuid": "1ae290b5-3bad-44c5-87c7-04adb31eea34", "value": "3072:P0EQRlXaMET0942D506ddeeQeMu9TJG6UPOYIPhle5fWsSrNeq:SDWct/TJG6KTIPh+lSrNeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770813336, "uuid": "b2b62c7f-8ebc-43c2-b592-099bb5a2eaab", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770813336, "uuid": "a688163c-aa14-4e3c-9bac-59659cee955f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813336, "uuid": "faacfc29-d2f1-4649-b8b0-b8c5de0c0e46", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "effd70e5-0795-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770847598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847598, "uuid": "5e103ef4-8a61-449a-86e7-82a317d3d4c1", "comment": "Malware payload", "value": "30ca33a7b64f079ebf11e518d13988bd", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847598, "uuid": "4363e79e-6a0b-40f0-a8a3-695229747819", "comment": "Malware payload", "value": "a63f2109703a38963e9dcbabca1d25c730603b3d6b70e8a4d41bdf2c612f20d0", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847598, "uuid": "e391f89a-51dd-4206-a8bc-68b89d063e42", "comment": "Malware payload", "value": "f056b767cc9bbf58840296218ecb2d67f8ce5aca", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847598, "uuid": "1a6eab10-379b-4f3a-86d8-2a9b62915210", "comment": "Malware payload", "value": "fd9053f605f6e9937ef4bdcd54a8266a3c4b22d7413c8cf1fb3eb1d5e506894be9b9eaf204b21913fadbb3e3fea80ba7", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847598, "uuid": "ac340880-837e-49b0-adbf-1370f7e413bb", "value": "T152C0488A00286556EE818D3EF221C09102A8E061CD4F81485C288C3010423A83DA3DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847598, "uuid": "f1f80fc9-914c-44de-b5b4-b2c332355fce", "value": "3:ns3FV39C5eLbzXRjEF/QKQdVzXR4NIaFOdEzXR1KepVzX/:WFV39CeXzhjERfQbzhAIadzh1KepVzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847598, "uuid": "c2ec9b5c-b005-42b9-8280-f651ad0f6e69", "value": 138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847598, "uuid": "919c33d5-8f0e-49a5-9d05-1a9f4c4f2a70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847598, "uuid": "f80c7c29-80ed-4361-9b6e-61468deb211d", "value": "a63f2109703a38963e9dcbabca1d25c730603b3d6b70e8a4d41bdf2c612f20d0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe7c609-06f2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770777590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770777590, "uuid": "d64806b2-f9d6-4ea6-b9df-639126b330e2", "comment": "Malware payload", "value": "90c693498264b0b04293219dc3ed184e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770777590, "uuid": "cbd65a03-14d8-44c5-94b3-a476030b5e7d", "comment": "Malware payload", "value": "a6776b7e9090b7fcbeef505fddf70a798957e6431bd0c7c472b194cc831a03a1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770777590, "uuid": "2ffee083-4829-49cc-bf14-79d75c07b9c7", "comment": "Malware payload", "value": "78f550a7db0dce86e3e6f04b051d857b1ef030be", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770777590, "uuid": "fbab9a1d-b9b5-4430-8300-f97b4943e2ed", "comment": "Malware payload", "value": "c264d1a545f6bc9409e4f7663f5b7a5560cfa81f254c88610952a3d8174b0810071c15e404e55b64974762ff5af096ed", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770777590, "uuid": "95f5fdf4-d282-4c7e-b27b-f62f609999d4", "value": "T1BE354D13F6C57D3EE05E1A3A4973A29978BB6F63651A8C1687F44C4CCF294802D3B687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770777590, "uuid": "f6afadd4-c96a-4437-bfc6-e4218203829b", "value": "347f4b577ae680dae030c5195ca5f304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770777590, "uuid": "59b78737-7f6b-4e71-8a9e-8122249f8322", "value": "12288:uuNXNMhORJm4uiRx1iJyObr5mQleYbEIvbe0cmm9K4aag:fN2hOPm4uiRxQL5mQlrfvbJcmm9K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770777590, "uuid": "91059a79-fae5-4d13-b6d1-a64b2a238deb", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770777590, "uuid": "554ab88b-e0fe-4286-bea9-a4a1f7df546c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770777590, "uuid": "f5deee70-ffe7-468d-88f0-da5d6763adfe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeffbe4e-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816565, "uuid": "f0512688-daa1-4493-858e-963ef91a1a73", "comment": "Malware payload (Mirai)", "value": "9d9cd25a67158f996a99e5582071b6a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816565, "uuid": "51ddb549-12d3-4f5f-871a-9922cbf7b12a", "comment": "Malware payload (Mirai)", "value": "a71ba09616cf1fe45458bac0ba8d47344e3efb3b8da2f577d4a5ac11fb7ba60b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816565, "uuid": "b9c817ce-c792-4489-a89d-3be0cfbcd4b5", "comment": "Malware payload (Mirai)", "value": "e97272eadfcee7db6c89827185f60d73288e1ede", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816565, "uuid": "ef25ea8c-a04b-4d05-bafe-eeec057853ec", "comment": "Malware payload (Mirai)", "value": "4b0d91e83a3e1cbfd405bc3245ba2e46b45b3309056c5cebec803f7bafda2be662367c420cc9ac7d8b34f27bb30a1a7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816565, "uuid": "10851223-cbce-4694-8533-a33437ffa2e3", "value": "T1C5B3A2197F610FF7E8ABCC374AD92746248C651A21A87BB5BD34D828F64B64F14E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816565, "uuid": "637b8239-f750-49fb-9b41-2d19708777bd", "value": "1536:AsrYT15ZheExALpMPIb/DvuhRSGZJTNOolD3:A/TzZh5x0pMnMG/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816565, "uuid": "39586871-6b7b-4bc3-b9a4-96b9676784ce", "value": 108872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816565, "uuid": "d8ed81a0-fd52-4a60-b1ab-6856174485af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816565, "uuid": "2d91d4f7-a1a7-44b7-a4f7-c6406e723bd9", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e6d154-077f-11f1-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1770838026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838026, "uuid": "016b7f81-b368-482b-9118-3cc469581db6", "comment": "Malware payload (SimpleHelp)", "value": "93fc78684454e0c25fdc7c7274943201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838026, "uuid": "01709756-4785-4146-8e94-850843617e61", "comment": "Malware payload (SimpleHelp)", "value": "a75cbf9813693e052f7e23d2d90f9543a468d22eeb499d9776b6984c463f1db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838026, "uuid": "cb4c031e-8ae4-4429-a477-b331678a64de", "comment": "Malware payload (SimpleHelp)", "value": "3c73fef5934220b3709de7d1ac04482ce63d1ec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838026, "uuid": "c2515243-d05c-4c12-9587-8920c04a3f9a", "comment": "Malware payload (SimpleHelp)", "value": "c5e0feb005cdab3225c758bf5ae784409c57a91e5826db4bf6fbda4312629ff23036fa51163d6cb05b290ccadb8a9468", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838026, "uuid": "2d61fb74-bd82-4b6a-a3b8-a62f6dc9f162", "value": "T16C873329F39599FECE33D0FCC0854487EA96B9E54385412717F085EA4E206E58A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838026, "uuid": "aaaebf66-9d77-4dc5-969d-568820620ce1", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838026, "uuid": "7d01ad02-bbba-4bbb-916f-5863226e468b", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1bN:/uRf+nAu2FuQd73XyFeDMnKTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770838026, "uuid": "460d1755-d6df-4708-a40a-b98e4351ae6b", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770838026, "uuid": "496517c5-a9b9-4983-8930-f256ce6a53c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838026, "uuid": "a5fdc4dd-2c95-47cf-91fa-abdf28272e25", "value": "RSVP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982492b3-077f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770838001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838001, "uuid": "5a11264b-9f24-4f73-a77e-e8ac110dced0", "comment": "Malware payload", "value": "88da420dd5d82f1ca7c247f1305e37c4", "object_relation": "md5", "Tag": [ { "name": "BlackField", "colour": "#7EA85C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838001, "uuid": "f1662222-42e3-4763-894c-354da8ae8ac3", "comment": "Malware payload", "value": "a767f169ddce13a14649f7fa532bbf47476d533966c081a0f0a910c70e06014c", "object_relation": "sha256", "Tag": [ { "name": "BlackField", "colour": "#7EA85C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838001, "uuid": "42fe8f53-cb7b-4c9a-a1a3-8cc2a70f2e2e", "comment": "Malware payload", "value": "b3d4db902782c2921d6f437103ad1a38ac86c213", "object_relation": "sha1", "Tag": [ { "name": "BlackField", "colour": "#7EA85C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838001, "uuid": "7a4c9f95-9e9e-4bc8-93d5-d5ccaa1ffbb3", "comment": "Malware payload", "value": "e13852a974bcaa0ee8a81b0d83f2e2ff919cc7dd76af88a97330e3321b2f22e02f0b356ccd2de2e0d89250f2e9e0e656", "object_relation": "sha3-384", "Tag": [ { "name": "BlackField", "colour": "#7EA85C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838001, "uuid": "d50f3ff2-e6c0-41ed-8549-b2a4783c2d09", "value": "T173F37C5536D09031E5B719301AF096F14A2DFD302F21DEABAF90593E1EA1EC28935BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838001, "uuid": "d640dc55-df46-4cd5-b914-3546e20d4b32", "value": "f7bd48beb74744d647e8c7124806f062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838001, "uuid": "af445b68-c13f-4917-8778-e27463fd7b1f", "value": "3072:AvPRVRkm3fQuvg6k6+pqN3E+gLJ+EBoOZJLW/wR0LZu7N4eXH:AxVRr3YM+qNUnNzBtK/6JH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770838001, "uuid": "1f22ce35-9927-4716-94bd-e62840c0280b", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770838001, "uuid": "d03d2030-3d49-4e97-bd7c-18dbf09d5b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838001, "uuid": "ba49035a-0b02-457d-91c7-d9a1b539c7bf", "value": "a767f169ddce13a14649f7fa532bbf47476d533966c081a0f0a910c70e06014c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d814e0e-079b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770850036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770850036, "uuid": "c1afb6f2-ada1-4258-afb3-e6a8a1a2121a", "comment": "Malware payload", "value": "b409adb785f58f1de1cdf12e5c7c51a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770850036, "uuid": "10770ec5-a36c-4a27-8696-dd1013694e4b", "comment": "Malware payload", "value": "a7b351abcc254df7750d69e327aabcf15bd458b229b0a43347cc1e374870d1bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770850036, "uuid": "34430603-869f-444b-a29e-dbbade6c29e5", "comment": "Malware payload", "value": "4246d798bfffdc802da9847a074b4b3a3da9c710", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770850036, "uuid": "e12fcb6a-7621-453d-be39-744cf4e780e2", "comment": "Malware payload", "value": "041d58c69f2c6ff675208f96f37c870a08bd5f394ca7c333439334eebb40dc9faa92666f8b398dcd34473a414d13c67d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770850036, "uuid": "cd28123d-09f4-4004-8b56-956b5b305863", "value": "T185D528613B5989EDC55AC074C2468A722A7270CB0F34BAFF45849A783F6AEF51F3C254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770850036, "uuid": "4246c6ff-2778-46b6-98c2-197a90c80f87", "value": "314ce79d8e3b96c63beeed48ec10ef13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770850036, "uuid": "84e782fe-7a44-4325-aafd-b19329f1c4eb", "value": "49152:Mg5gn2mxKIQzDITfomx5+R//2akRn284+MqMbMhHd2OW5ln:L5qEnWB6u284+MqMbMhHd2Oo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770850036, "uuid": "6e6b2939-13e8-4942-be2d-5e69f737f63b", "value": 2850064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770850036, "uuid": "af707e99-4f3d-4cb7-bb9c-23afc6e3a36d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770850036, "uuid": "48508743-923a-4fa7-9a54-ebd98a44d012", "value": "DocSend.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f038af08-0758-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770821399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821399, "uuid": "d81ac3a3-71ef-4389-b71c-75c67edb78d3", "comment": "Malware payload (Formbook)", "value": "022629ebfa4fea55ba87db1f223b3283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821399, "uuid": "24394040-f17c-4444-b8d6-7b47cf571466", "comment": "Malware payload (Formbook)", "value": "a81497152c403cee17c51b92b6d337b080d19bb5b1105f563e42bbf7555c48cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821399, "uuid": "cece6fc6-cd2f-4b21-9a2d-763e0d3e93ab", "comment": "Malware payload (Formbook)", "value": "6e0e3e06600f97f519dd0fa747624681ec88a9e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770821399, "uuid": "764095f0-6d77-4cbf-95ee-042861b94456", "comment": "Malware payload (Formbook)", "value": "8b99cf6edf74a99b7395b2f9aa5b8b5f2dd2acda3bba7647c39fc0e0585a5c6d34cddcc34f2755bd26126d9416f573d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821399, "uuid": "d475f10e-f06b-40e7-ab85-86296f463f50", "value": "T1EB45BF0273D1D062FFAB91334F5AF6115ABC79260127A62F13981DBABD701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821399, "uuid": "ba542710-7737-4d97-a560-9e400320184f", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821399, "uuid": "31cc19ab-cac3-4cec-926f-6e94dd0762f1", "value": "24576:Q5EmXFtKaL4/oFe5T9yyXYfP1ijXdazV8vUOZaAeat:QPVt/LZeJbInQRazVR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770821399, "uuid": "d5184830-d68d-4872-9822-37f737b6c8b0", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770821399, "uuid": "68963552-3a26-40a2-9b1d-79172ef5d207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770821399, "uuid": "dd4830b3-ed3f-4395-9edd-b3368d238609", "value": "Payment Advice 3771092TT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ba9626-0721-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770797405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797405, "uuid": "dee369fd-436f-4a9c-9d3c-66b73f2ecdad", "comment": "Malware payload (GuLoader)", "value": "e33463f7aff87fae312fe9944babb4f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797405, "uuid": "434d97ce-0051-4764-9fff-4e4355080726", "comment": "Malware payload (GuLoader)", "value": "a854cca51b8f7256fb6ef5163a6e9a4a3d1340cb48273b0e3c974fbe17ce1c9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797405, "uuid": "a2e7890d-ade0-4f0d-9729-bcda3479b57c", "comment": "Malware payload (GuLoader)", "value": "6c8afd41d772827bc3baa61d4114c0869b95a16e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797405, "uuid": "88e4e969-3bfb-4ee2-b459-3c410d79e841", "comment": "Malware payload (GuLoader)", "value": "34db72f0e9ce5d037ab1cbad48fea1939be201422b72145f2d5a0a9c59c3dd6fe0cc5ebe66abc569f87ed5e6f613d671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797405, "uuid": "401029fc-efa5-4113-96dc-88586c2fc4f7", "value": "T1A8251202B354C92FC06707714A3AF6BA67719E106D82174B23C4BFAB3D773A2D90A359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797405, "uuid": "0a74ff3a-099b-47c2-bbc9-7515240d9e58", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797405, "uuid": "526f6f3a-74cc-47aa-9395-5465a84f3664", "value": "12288:DRpnprmnC+pdIwHOTz5VqlOkqN+CHSy7+8892YTQ/Ue1Txon6dB9mf0+5CtMv3lX:DzRmnC+pdhHQ52b2yQ89PMUmTz1+5VX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770797405, "uuid": "a1713c85-18f0-4b49-bf2c-eccc83528b3f", "value": 997912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770797405, "uuid": "39c22873-ca6f-414a-b7a1-1e9beb6f3bb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797405, "uuid": "24a0833b-d41e-483d-906c-c709f0586330", "value": "CB-861\u00a0VA861-2402193\u00a0\u00a0\u00a0CI\u00a0PL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a6a4ed-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816439, "uuid": "745cbff9-f964-4651-b41f-7156b36f9e4b", "comment": "Malware payload (Mirai)", "value": "b5b14bafa5aaa653edb64e7904f5e69d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816439, "uuid": "7044e851-90f2-441b-9968-7b3ec904d8c6", "comment": "Malware payload (Mirai)", "value": "a8bf18f7e7f552fe70a4825c618baabc27544854a11a40ec7bb0d4b97521c6f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816439, "uuid": "2e6a1527-25fa-4fc2-8cbc-7cb572cf6932", "comment": "Malware payload (Mirai)", "value": "185b069a85a86d5cce005ba1f020f4afdeb99969", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816439, "uuid": "e1ef8b93-d6b2-4f38-868c-f8c9b787629a", "comment": "Malware payload (Mirai)", "value": "a687cadf227c2baa3d2b398c3f78a4b967ab8ae1553667a34b72b9842c9480ff5fd6b0f6a3e000b1dc74871c729e562c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816439, "uuid": "1a4711fa-42b6-44f2-a23f-267c753707e8", "value": "T13773AEB2C0642DA0C2684138A5E6AD381B13F50196732EF14E568BE6640FEECF54E7F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816439, "uuid": "04ecf7a9-1381-40c5-8508-8412ea229eda", "value": "1536:E/jnwcbjq+ZwJaFwtO/WlP1Y1NO6XQWUJy5MFaHoG0NgxCS1SP:ErnwmqiwJCJu5i1I6R+FaHoGkgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816439, "uuid": "71c02977-a02e-41a5-8e74-5bca830a41f1", "value": 74804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816439, "uuid": "30181671-14d3-421b-aa80-85987eeba7c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816439, "uuid": "ba19be2f-d21e-4fdf-a34d-7ef83fd243b6", "value": "db0fa4b8db0333367e9bda3ab68b8042.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6805484f-0714-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770791965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791965, "uuid": "9cb1d6d1-f55f-437f-b413-301bef0bb528", "comment": "Malware payload (Mirai)", "value": "2498411b7a2a59f1d53af9b570d530be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791965, "uuid": "b11bfa80-e8f4-406d-9095-50442ebeb5ba", "comment": "Malware payload (Mirai)", "value": "a9ead032c8102378f157d84d07ec785d0eab90fddb0ac9ea560b4b0a9834cc0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791965, "uuid": "7372c85c-e085-43af-8675-1aea50d80f35", "comment": "Malware payload (Mirai)", "value": "730b5153a466b53fddae394a3a854de47db01264", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791965, "uuid": "af8d994b-6cc8-4abe-8315-613262a5af01", "comment": "Malware payload (Mirai)", "value": "dc9feab70ab50ad7150ac32ddd692b9b4d0f9a6d6f05c9a4be84f572d2138d09022dd0091fc9721ba38e951f54a512ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791965, "uuid": "10bc6b1d-525e-42ab-922c-beba7d49fd12", "value": "T1D6E2E028D4A475C9C9AC0D7A207AA3B1BFC1F25076362B8D63289C61F33F957F15299C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791965, "uuid": "59d820ed-e669-4694-ac25-8d87e08f5d9a", "value": "768:czujNv6iA7+5k0dZn88gZIXF8uJcTeEIYXWWBQv:3jDASk0ruKu6EIaQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770791965, "uuid": "9d8d07b5-61db-46ed-94c2-9e9ae1f27bdd", "value": 32036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770791965, "uuid": "40e214c8-73c0-4e72-b6da-8e3a85e4d93d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791965, "uuid": "bc8f527d-f4f8-49b3-bebb-5d7b88b4fd40", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2715909a-0746-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770813331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813331, "uuid": "033c46ac-2cff-4ad8-af64-cf64271e2c94", "comment": "Malware payload (Mirai)", "value": "5377d992da881289eebfcfe7766f3528", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813331, "uuid": "b45ff32e-8c20-4263-967e-7bcf96032c0c", "comment": "Malware payload (Mirai)", "value": "aa3f7d1ee48d4117ad58b5cb4a9763feca934c02393ea0e8b5160109ee460a32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813331, "uuid": "5cc1bd0d-1b7e-462a-a6c1-828b6fb65f9e", "comment": "Malware payload (Mirai)", "value": "1973cd5fd4b9178978163c36a699dec36e560653", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813331, "uuid": "7244e47c-170c-499c-bbdf-2e29657c8cb7", "comment": "Malware payload (Mirai)", "value": "f38bb5da84786767426aefa5c82bc6220fb98860a5b75c4418f69458b038343286f3f2986231085dd065d8a9f8c1ff63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813331, "uuid": "9736460b-fc35-4107-8181-62fc6e21b467", "value": "T12D831986B8819A20C6D5177BFA6F018E331257A8E2DEB3538D146F6477CAC1F0E37A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813331, "uuid": "c8350b92-c3ab-488c-a8d3-32e829ebc46a", "value": "1536:eRnn7svKPr6aldX6aeQTX3oLmpMguHcUKVUHalw7WRuH0HsfCXBmI2Kn2e2E/tUn:FvYrJsaD3oLmpMguHcUKVUHalw7WRuH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770813331, "uuid": "73000df6-05e5-4bed-8089-83fc5d92a320", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770813331, "uuid": "e72ca2a1-0c13-4ba8-bd3c-b56b30cbaf2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813331, "uuid": "d8efbf1d-b8c9-4c94-90d6-bc077f18ca29", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d192f4d-071c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770795490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795490, "uuid": "7b443eb9-5473-4d57-914b-ae0152f56fa4", "comment": "Malware payload (Mirai)", "value": "23f89d49d7e4b3bf999aa9a1a119c2e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795490, "uuid": "1212bb36-4a8c-4558-a8f1-4a2b5a1822e4", "comment": "Malware payload (Mirai)", "value": "aad571e5d813914d3d8c0a5440ab6be2b8ae528adc950d31c686c0d1c6881579", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795490, "uuid": "27644c59-36a4-4881-b2c7-168e23904294", "comment": "Malware payload (Mirai)", "value": "8798fd84ddb6f94660c2c15d831264f6f728834f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795490, "uuid": "731570c4-5566-4112-9d2b-35c932f828db", "comment": "Malware payload (Mirai)", "value": "522be29beb0f2a0de5d338fdf35ca906ff1a36ed6e535bcf6b44ef2e8be36f937fc5ff8b2f6de44dc4aee776ec01cfcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795490, "uuid": "525970eb-4e6d-4376-9117-39e90a9a5471", "value": "T1C66302E01BB1178C5676E8753ADE305F8128522B32DE29142DA791CEF81B2139973EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795490, "uuid": "e8e0316c-0851-4146-b6e7-07412a72390c", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZH:8D+CAXFYQChaAUk5ljnQs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770795490, "uuid": "4e321f61-f23b-4b8e-b204-1f3fc1646eed", "value": 67776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770795490, "uuid": "2dd9f645-0b9e-4689-b0ee-13de592d2f2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795490, "uuid": "bc2d5f44-3049-4eed-8c59-17603b24d556", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca43d12a-074e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770817040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770817040, "uuid": "32470011-a81c-44cc-8097-e0fd005d6c49", "comment": "Malware payload (Mirai)", "value": "4dd0e2abd1fba5482a575c3f33955718", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770817040, "uuid": "586036b4-e911-4dff-a499-8fba3fe7189b", "comment": "Malware payload (Mirai)", "value": "aaeea279278a3d74c057c3f09903444947649b83e52d4523d67995d38643ca52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770817040, "uuid": "8087a3e5-e837-4ba0-82bd-5f81a963075f", "comment": "Malware payload (Mirai)", "value": "d421dd025aff1d9e3cefa386c040159520973606", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770817040, "uuid": "74fca30a-9cb4-4485-a9ae-28c7f52e546a", "comment": "Malware payload (Mirai)", "value": "0d6737eda960ed939b5990ff0901ee0450b40b329b64447975a89db58d94720711af5c5fdc82806a3675665e11828940", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770817040, "uuid": "6d5a1b45-2530-4bc1-b1f3-eb4279c2ff56", "value": "T127C45D59F8409FA1CAD529BAF65D929C33130779C3EA720799245B343BC78AB0F3E641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770817040, "uuid": "0531f1e4-0db4-4faa-9264-c551a57f837a", "value": "12288:mNQhzUrVRH5NC0+Z5e9ydYSNgpEortl9e:mNQor5NfsdYSKhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770817040, "uuid": "9f10f896-1628-40f4-81db-b8b30a9d4f04", "value": 575316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770817040, "uuid": "e8d0e6be-44bc-4d52-8ea1-8b175202f169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770817040, "uuid": "70107dc5-475f-43b1-aa95-b1216c3474fd", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51658e2-0795-11f1-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1770847499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847499, "uuid": "a8713e71-325a-456d-af87-1387939b6dc9", "comment": "Malware payload (AmosStealer)", "value": "1e4ea02d65dc77565f684694400af6ee", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847499, "uuid": "b8e4fcf7-9a02-41cf-95f7-80dbe05324eb", "comment": "Malware payload (AmosStealer)", "value": "ab267488d2c0a6300b61b5c9046cb86fe4a9ac3fe9a615acd374465b3a4b26c2", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847499, "uuid": "bf149c14-6ed4-46fb-8a93-b6c6fef0ff25", "comment": "Malware payload (AmosStealer)", "value": "5bba9e26c896eb52857ab87c3b325453c1f73372", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847499, "uuid": "a5db4f2d-95a8-4b75-b1da-b9567151bfcc", "comment": "Malware payload (AmosStealer)", "value": "6ca14f433ca067c54bdaf16b2d9ad5daecf0205a549f0b0dbefad18a146fb66062320c223fc0e61ddbc3aeaf75c181dc", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847499, "uuid": "e84fa924-1e18-420e-8d42-2a195ccfe8c4", "value": "T116B419E7623855F2D98EFB7CF44F2226F971BD4019B8B5D05D820E114ED9370AA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847499, "uuid": "ff05667b-418e-4b81-898d-0775e55312ab", "value": "12288:D0l+NcArlEE9ncvJJQqlsgckv8pBprQMxJVXWlnnnHuuu21uKb+AfI0m:D0qE38pBtkfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847499, "uuid": "434fed7a-cfe7-45ac-b163-b7a61a3dff89", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847499, "uuid": "813ddb16-6347-493e-8f6b-08418665b77a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847499, "uuid": "344b844b-5676-4428-a44a-43a42d30db78", "value": "ab267488d2c0a6300b61b5c9046cb86fe4a9ac3fe9a615acd374465b3a4b26c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87c6054-071b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770795187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795187, "uuid": "3b564f68-4141-4817-9ae7-350175eb097c", "comment": "Malware payload (Mirai)", "value": "0960892adab63d88c4ff34d9b57acc3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795187, "uuid": "d10b628b-8bfe-4ef6-a060-1e080215c04a", "comment": "Malware payload (Mirai)", "value": "ab32a6b203f9354489ba70d32716757906f4c064d5a2ee3610b66d7b47f61a05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795187, "uuid": "eaf49a59-7e93-4227-99df-92b0789ae96d", "comment": "Malware payload (Mirai)", "value": "54e8963619897536e45d27d4765cd2ab133c6d49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795187, "uuid": "c731d298-0452-48b1-a147-9d794bfae15b", "comment": "Malware payload (Mirai)", "value": "58368d4554cd8bede475da7291a6b87951c635676090a6c5058194bdd181500653237983eef7bdb9b4ec8a599c4c194f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795187, "uuid": "637e7085-b972-40da-9553-e635de8623b9", "value": "T12CB36D06B7180A43E2636DB43A3F27D6D3DED9D011F0E649259ABB49C076E326187ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795187, "uuid": "e0ab69b1-0108-4227-a68b-ed85f47c14ae", "value": "1536:MW13bf05DrXLgjPl5DWKf2hAIL5udVMlK0daRo+kepOd+fTVUIeybs1QLvmaH92J:My3bf05/XLsSTOrL0qo0pFYyA1/cC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770795187, "uuid": "5b7aa283-7bdc-4a3d-a9f5-d41e056d13ec", "value": 111924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770795187, "uuid": "908fc211-61c6-4662-a017-e404bf5ca6f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795187, "uuid": "223c58df-a96a-4ef5-bd41-a4b21c34a20d", "value": "powerpc.nigge", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a644711-0776-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770834006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834006, "uuid": "ea9fd795-9ed4-4529-a8c9-b8844ffe2c4c", "comment": "Malware payload", "value": "a10baddf2ca6bc02bb21ea059877cdc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834006, "uuid": "e5b3add2-e0eb-4306-95de-0233750751d2", "comment": "Malware payload", "value": "abba329dcc106bac1850e6019b500c804c887bf13d41901633f6ac0f90c3b439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834006, "uuid": "d70a5195-a14b-47e7-9151-df8dc02055ce", "comment": "Malware payload", "value": "b8014a3b51e27c3c6e204d2b8d27e40c864aca6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834006, "uuid": "d22f7d20-eed3-45a1-9837-7d27543f6361", "comment": "Malware payload", "value": "8474e779e8cfabe0cb8638aac54fcda604de9dd97070db3cd346370377381abe10f2288af664cb61385096a8c8e5c9a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834006, "uuid": "79634a94-f8ee-4b0d-86fb-0b523d019aca", "value": "T1AF336D85B6EA4DDCC8A390B4E5268767F8B0FC109368599F0794C2368E5E331652DF8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834006, "uuid": "8bcf3fa2-958e-4cb1-98e3-ac35ee23c0b7", "value": "403a867978af50430f8233d4cbaffe9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834006, "uuid": "cb2ba90e-60b6-4fbd-a1dc-ac7129b4b431", "value": "768:T27vtoazVrYxUKai68X+7XS3BUsa9doTiLj/wmGaJ3rAGL3R4YQFtOZIG:STMaCUCEbAGL3Y6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770834006, "uuid": "b5dad723-8f43-402f-a83c-e3b34dd55d82", "value": 52864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770834006, "uuid": "153e6d0c-0c04-475d-ba3d-0c9855d2dd07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834006, "uuid": "b6289dea-cdf0-4a0a-a9fa-abb33ab9dc46", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44408.22031.21389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2c5227-0738-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770807546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807546, "uuid": "aa091673-3cff-4eab-b361-72aaa3fc3d0b", "comment": "Malware payload (Mirai)", "value": "dfcdf660e896cd3c7ec0e97cb7449736", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807546, "uuid": "46ff56d8-be19-43c6-8c95-1e1f47b7a67e", "comment": "Malware payload (Mirai)", "value": "ac3388d73c3c4cbf542aac3d4bb54d0ca67a992338dbbddf527ee573c819531d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807546, "uuid": "40baef03-c0d5-4958-a7f5-a0a272a7ab0a", "comment": "Malware payload (Mirai)", "value": "d755fdc4fee47edae496a7462ca29460f914a6e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807546, "uuid": "162729ff-dcc6-43c1-bdd5-35d5d638f843", "comment": "Malware payload (Mirai)", "value": "b120e47d369ede107bca16c7d17b9c6f34d7b69a7769623b6337327910f623068e68e7096163d236de9e9bdbb7a5b443", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770807546, "uuid": "4f3560f2-aeeb-400a-a7ce-9f8c1d37291b", "value": "T19DC32B56BD52CA12C1C725B7FBAE468837276BB8D3FA31028D256F6027875DB0E77102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770807546, "uuid": "dd4e6558-8290-4c79-9f78-474e1b6e7183", "value": "3072:6Ve+sMIg5cb/JfpKv+HyZvzlirKFxZN5SZBi3LAVj:Se+5Igmb/SvTvk8X5S/i3LAVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770807546, "uuid": "0642f40a-165d-41df-bc54-b0ac8b146c98", "value": 120208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770807546, "uuid": "6605ae7c-0838-4e80-ad15-6058c0aed905", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770807546, "uuid": "d3d2eff3-9721-4f28-9bea-f98823fc52e7", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e7b362-0751-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770818409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818409, "uuid": "940f05ce-7824-4115-bc76-d45a1542a164", "comment": "Malware payload (AgentTesla)", "value": "12c9e078918f9715e9fb4987200ae036", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818409, "uuid": "fc001030-6472-46e0-904b-e6f4cec49ba7", "comment": "Malware payload (AgentTesla)", "value": "ac96c8816c0028307876446c68f2d67e78cd743e870c9195fb38dbdf0a92cebe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818409, "uuid": "e0266147-be87-4b38-9a62-295784a66bd5", "comment": "Malware payload (AgentTesla)", "value": "86085898cda9dbcd945a28ceb003763cc73e7988", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818409, "uuid": "7054f227-66b0-4cd4-9d33-58a11b4f272f", "comment": "Malware payload (AgentTesla)", "value": "60614c606ab2a97d78c13a2ac32fc5cb31a90aaa817fe7145e6b08d770b3050c507afb27482bdebd267cbdbc6b0cdd38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818409, "uuid": "df794962-833b-4d07-8a16-738b2bee02a7", "value": "T1A535AE0273D1C062FFAB95334F5AF6115ABC79260123A62F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818409, "uuid": "f69a203a-055d-43b4-9b34-2f04d4eafae3", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818409, "uuid": "3d20bbab-3243-4305-9105-cb890fce1b3b", "value": "24576:K5EmXFtKaL4/oFe5T9yyXYfP1ijXda5XkzCO:KPVt/LZeJbInQRa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770818409, "uuid": "89d6a1d8-a18b-4354-b34c-994ec48649f7", "value": 1102848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770818409, "uuid": "f8a8402b-a333-44b2-86ec-65ab3adcd46d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818409, "uuid": "b0ffc6c0-24f7-4a21-8627-ffe82630b027", "value": "z1FACT9876545678900098765456789.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2befdeec-0771-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770831807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770831807, "uuid": "db9a7b39-b221-4cfd-bdc9-8dcc753e9b92", "comment": "Malware payload", "value": "d823d24ed35f7e13187872b389611c82", "object_relation": "md5", "Tag": [ { "name": "209-38-92-52", "colour": "#B32AD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770831807, "uuid": "f88e3bd1-47fa-4ad8-a11b-eb86a3287635", "comment": "Malware payload", "value": "acd7308c4c250b0740418a2175ca804ef8e26a7e5c96474a3f84320d31abe45c", "object_relation": "sha256", "Tag": [ { "name": "209-38-92-52", "colour": "#B32AD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770831807, "uuid": "760d5744-5211-45e8-8c33-fba7b9aa69b3", "comment": "Malware payload", "value": "2b57ee492c2beec8bd211ea47a7cfd241dab3582", "object_relation": "sha1", "Tag": [ { "name": "209-38-92-52", "colour": "#B32AD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770831807, "uuid": "7018f62b-16f5-4bc1-a133-4c856b50c7b2", "comment": "Malware payload", "value": "40217344152ef866ca8cadac65322ac630480ca70f2559d84a26f35ff67a86d64902b4c69e566417d98c47ba4c9b7e3c", "object_relation": "sha3-384", "Tag": [ { "name": "209-38-92-52", "colour": "#B32AD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770831807, "uuid": "48bd41bd-8812-40c3-81a6-a571b2f73f46", "value": "T159638D207BDA911CE1FBDEB8DAE27562827DE9531507B94A0CE275060E321C0EBD3D76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770831807, "uuid": "644fc6c0-719c-4572-8cc6-586e17760816", "value": "1536:JRXCjr8EHsL71ELMt/RYKiq4vo/LbREAFIHcYY0WcMX6K1:JRXC8EH+u4/OobRE5/Y0SXn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770831807, "uuid": "2cd90bcc-6686-4156-ad1d-976b3b34e297", "value": 71184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770831807, "uuid": "d3f78e40-c2b9-494b-bcae-98b5fcc1ea41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770831807, "uuid": "f77ebc34-759c-4a3a-8f00-80039badd8e4", "value": "chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b47678-075d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770823535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823535, "uuid": "04a988f9-1400-44b2-83c7-fec19336494d", "comment": "Malware payload (Mirai)", "value": "bde323b77c8ba80c15a5f650261d7f66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823535, "uuid": "4739410d-f54d-4410-b327-2928d5f81256", "comment": "Malware payload (Mirai)", "value": "aed7842fbdad1d381e5443d7e5f4cefaf3b33330e8e6ca2e2a6934310e0d3aba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823535, "uuid": "1b62af09-4d9a-4227-8218-f62caf3aaf24", "comment": "Malware payload (Mirai)", "value": "79b751e4bf1ad4843a3e66cc673fac3f92a0ed55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823535, "uuid": "10e10251-5a9e-4048-938f-d716bc43b089", "comment": "Malware payload (Mirai)", "value": "8558cf536d4187b821758b37e90a8dba78d46c808e31c28ed7d2d4121bfe2755ddc19b549ef9a4e4c6f55749b1a5ebe1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823535, "uuid": "81232fe8-68cd-4bee-a42f-53ba78010960", "value": "T1B913F584B8869E06C6C0537BFA0E82DD3B2973D8E2DD7303DD156F513BDBA2A096B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823535, "uuid": "0348a234-b6a7-4491-b85e-65a8a6ee3a43", "value": "768:boXgKS/E5do3soaHo8zwESkBxl33hdQhLljkbsZV0w1Wbg5:EXgB0tUg7dXQ0bu/oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770823535, "uuid": "4a300ce6-0e0f-4626-bf5d-2921f23b344a", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770823535, "uuid": "cad86eef-04bd-42fb-bb83-df2f83a852df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823535, "uuid": "54e70702-63e8-4a81-8769-fe396e6d3c3d", "value": "nexus.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691e07fc-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788101, "uuid": "0c813f25-2fb6-4cbe-bc0f-412beb6d42b8", "comment": "Malware payload (Mirai)", "value": "73c5a8b71fd064ac0906cbbfb313850a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788101, "uuid": "20c57d63-5d76-4ffb-81c7-934a83c23a77", "comment": "Malware payload (Mirai)", "value": "af5ea6d7cd56c0d8a6d51ee1815de1b5dc327c14b7a8871992f2ee020e8f5479", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788101, "uuid": "aa03ed49-a638-41b2-8e64-7f2608bebf7e", "comment": "Malware payload (Mirai)", "value": "32842a8fa1a97aa084e7325ea1ede8bb2d5381ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788101, "uuid": "8ec8d569-883f-49f3-ad29-15fe3d7d557c", "comment": "Malware payload (Mirai)", "value": "c95896fef9ce6c35075de2445847dad5abdc9aa7898fa29729a5bb9f34275af7aa6e88165c88491c410d00b07580c84c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788101, "uuid": "71b9a3e6-a459-4173-8331-df11328fbe54", "value": "T175241A90BA59EC32C05E1D3667FBDB593B0369D14EA2D100C460EBCCFB875C0AB9857A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788101, "uuid": "6f8dadc3-f50d-4c57-9d23-5d205763430c", "value": "3072:fwObuMhXw3VZRO1nPqaamynmetqu4R7vdkiVh43PwH/jd7nGGs2+:btOFZsdqa3y7quyPVh4ofjDs2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788101, "uuid": "413706fe-1fe8-4ace-8ddb-0992fbfffe7c", "value": 213080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788101, "uuid": "82f5c157-9820-4f60-945f-95bd29be0807", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788101, "uuid": "a8c444d0-c40b-4e58-961c-f5bb715c8247", "value": "bin.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94835019-077f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770837995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837995, "uuid": "5fe7c8a7-e22e-4227-b6ff-2a63b83f7a5b", "comment": "Malware payload", "value": "bba9738951d9a9e271ceccde8fbcba58", "object_relation": "md5", "Tag": [ { "name": "BlackField", "colour": "#7EA85C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837995, "uuid": "55960943-3db2-47fa-bb91-e5a06378505b", "comment": "Malware payload", "value": "af8ca0dc37128370685485b1e0ff9ac0df6f3ff7e91e06b8d728ecd10d9d0f16", "object_relation": "sha256", "Tag": [ { "name": "BlackField", "colour": "#7EA85C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837995, "uuid": "cd83a3dd-c9d5-4c4f-acbd-24369aec306e", "comment": "Malware payload", "value": "3d78eef817cb49c8d67c14bc640c50ffef2778b8", "object_relation": "sha1", "Tag": [ { "name": "BlackField", "colour": "#7EA85C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837995, "uuid": "edbaa438-ef93-4bad-9aaa-49f43e94046d", "comment": "Malware payload", "value": "dca1b3956d4c4f00257c3037a5e04585ee88d01d7b6db8cee71f62cd9cac5082574199c1a8f1d371de038d8d9c1b7cf4", "object_relation": "sha3-384", "Tag": [ { "name": "BlackField", "colour": "#7EA85C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837995, "uuid": "c95258ac-2d55-4d29-a077-ebc3ef6acf0d", "value": "T1D37302D164298E64C47E43BF4E4F215F235C739E47AEF22967CC202B5DC2B8E4A065B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837995, "uuid": "471ad8c8-5e77-40f5-a75f-a6cb98b70c5e", "value": "68129b2d485e4837261fea910ade592b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837995, "uuid": "5b6b7037-b866-4917-9582-8dca11515ab9", "value": "1536:HUc6tgpZPwDkDlq+P0J4NkVG92SGYVpUz9sCyhfuUnouy8V:HTCkpq+cJ4NJ9TXVpW9s3Gkout", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770837995, "uuid": "308e1eb1-858c-4220-a000-3df006932785", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770837995, "uuid": "1674d46b-7d63-4e8d-aeb0-24ed503b675c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837995, "uuid": "0420ec48-3b67-4736-a37a-2d902be60833", "value": "af8ca0dc37128370685485b1e0ff9ac0df6f3ff7e91e06b8d728ecd10d9d0f16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a9767a-074b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770815610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815610, "uuid": "f33d9fa8-87c6-4bc1-9cc6-8825615bb038", "comment": "Malware payload (Mirai)", "value": "b385ffa2dbe0fd08d8c1614eb13716c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815610, "uuid": "a8a2414a-ff59-4a3e-b2e0-15003d9f17c5", "comment": "Malware payload (Mirai)", "value": "afacc2307f89a55ff9ee80283758c818f0a6fbeb958348debae98fcec1ce07d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815610, "uuid": "ee5c9b66-fb51-4d84-97f1-95e90d6cc471", "comment": "Malware payload (Mirai)", "value": "c411f490128680d0330e4b6a5ff6603b4fd94769", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815610, "uuid": "43e77668-ff0f-4637-99e0-cdc37b20ee61", "comment": "Malware payload (Mirai)", "value": "c54800ab1c096fa52dd7bf74db27d3ed2c977159799defdecaa153d797b0daaf7977a0a6c8e03887efb857867ef26f3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815610, "uuid": "ad3e7488-7ad1-4c3b-a8c3-647a5f526f5a", "value": "T116F45B02EF991FDBC8AFCD30492E864716EC99D706D1973461BC8D8CBACD66A4AD344C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815610, "uuid": "bc8b36e9-7260-4144-904b-71ee033fac81", "value": "12288:CHVrCi3C9oh47aPfv/uqNVt0/6XlZIe7YdSkHwO95OObkxjJtgVkgPhrrXfMx8yd:+4lP5Zy/dSTD1vjhW4xn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770815610, "uuid": "f5adc417-2be0-4e7d-ad29-1d7754949542", "value": 731132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770815610, "uuid": "91ce5ddb-e09d-4300-b6a4-4d649f3bca6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815610, "uuid": "bf7aef65-bc0d-4e08-a2f2-77c484e03292", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdddac3-070c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770788408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788408, "uuid": "32baaca9-833e-47e8-9033-5daff720da4e", "comment": "Malware payload", "value": "e6b152ae09c4ef298e5ff1cc142a68f7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788408, "uuid": "0575e24c-5644-4ecf-b979-d6d26c1408f0", "comment": "Malware payload", "value": "afe0d86adb096af2d19db836ff56305cb62a33eed19528e1b39e3e1942fd4199", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788408, "uuid": "3fbc9984-0e26-4cc3-a720-38a9941d1709", "comment": "Malware payload", "value": "8775cc654bbd983f4aa05ade083bfe00e481c143", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788408, "uuid": "be4c64a2-a632-4063-b8df-e04382adc413", "comment": "Malware payload", "value": "f00102419e70672f1d66185cb05031e4eb363deb2cf1f637a9240cf07ea69c95e9e33f7b1304815f3a4571c4a8854586", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788408, "uuid": "012c0ec5-3e0a-4f5f-906c-054b02043339", "value": "T112D59D11B697C136C97E45711A79EB2E10BE7FA51F7448EB27E85A7F0AB14C20231F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788408, "uuid": "edc97042-0b3e-4389-9a96-aad8125560f6", "value": "49152:PooYS9MftgkfA7VqVZ9Rw4YP/BD/vTCPduTRUhfwE3B6zDojOwfFlApqLOSGRevR:fYIwABqNPdFBqwUpqLNmKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788408, "uuid": "38baf58d-d4bc-434b-b413-b8ce4923ef26", "value": 2885632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788408, "uuid": "0d7a61dc-9e4a-4787-b2f7-54421386d2af", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788408, "uuid": "9390892d-9f23-4fa8-9d50-513410f087cc", "value": "SecuriteInfo.com.Other.Malware-gen.82962437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5d4047-06e6-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770772301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770772301, "uuid": "68ccd94f-72e2-4405-b7e4-bd2ff4071da5", "comment": "Malware payload (Mirai)", "value": "c49bd96342b2a7ccca291b21ceaadc9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770772301, "uuid": "99b890e4-8804-4463-948d-2672a2bcd478", "comment": "Malware payload (Mirai)", "value": "b3925051b9734ef04c5d13ee3c08752694338f99cdcb1b3cd8821be66e903109", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770772301, "uuid": "d27adb30-f144-4809-a215-91d7aff6c3cb", "comment": "Malware payload (Mirai)", "value": "97aba318d2befcf6c4d285bd5f136d727237e859", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770772301, "uuid": "a472e299-d95e-4ee9-a6e9-775962461d70", "comment": "Malware payload (Mirai)", "value": "c36943de1b1e14e52322fc687e0827eaa0716a932cff8afa7953026dd349b49a1cba18cd8a80b4f08769110de0246675", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770772301, "uuid": "de59acc9-2646-44ea-8ce3-5f5076aa0aaf", "value": "T16C636CC5EA83E8F4EC1606712033EB338776F53E2025DA83C7A96932DD46A41E6563DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770772301, "uuid": "324b58ba-3660-4bd2-aae5-60ac389e64da", "value": "1536:Bf7rySwzxSXLHhAM/r/vkdA/Bctvp3jANSlTKdHxSjj:hrySwzxuLHqcr/vOA/BQvp30NoeVWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770772301, "uuid": "f1cb2ebb-188c-4e50-bde8-8463a88e3e79", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770772301, "uuid": "c6c8c5ca-2fa4-4b4c-b192-8be94f6c568c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770772301, "uuid": "952938c0-4005-45fb-beca-2476b67254ae", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d019a321-071a-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770794716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794716, "uuid": "930dbfb6-aace-449e-a7e3-638517ea88db", "comment": "Malware payload (Stealc)", "value": "e50eae63c7f97441772f8bffe1ca7112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794716, "uuid": "b99a9462-2089-4476-bce6-4f2b6299caa3", "comment": "Malware payload (Stealc)", "value": "b4e4178aea8498d952fec581ab3367c05a6272c444fac4854375bf712946b05f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794716, "uuid": "614c3d33-d6b8-4e72-ae10-cb9bfce2e674", "comment": "Malware payload (Stealc)", "value": "72214c2b44dcb92dcd429bedcfd743ffdab9edea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794716, "uuid": "7abed0c8-7052-45ef-bfe6-c939ca792d8a", "comment": "Malware payload (Stealc)", "value": "b30396ab67ac9c0318ddc6d659be4f91b8ec240ae7f709bac563c5d0806e59484a30d407ab64b0728115c6624c683b29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794716, "uuid": "7c634f29-1590-49f5-a0ad-9b6c841b2054", "value": "T1B5C52302B3D718B1E5A50B719ABAC500FE177CA519F0905A3CF5D80E0E7A7E5CD36BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794716, "uuid": "8376fba7-2b35-4b3e-bae4-227c2b3fc3c8", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794716, "uuid": "a589c1c3-4277-4a5e-b0ed-cb8b4f755d24", "value": "49152:Y+dHu6h24LoOoGhy/JQ5jG4QiqdnjEopvX9V9LW0e7BEyR6DDcsQ0rQoY4pviM:XO6UOo/RQ5yviqy8/rxW0WEyYDDcx74d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770794716, "uuid": "27fcb2b3-1655-4a78-a15c-f67dc7847f47", "value": 2655297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770794716, "uuid": "e0358456-c4ee-4c75-980b-960021b1f182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794716, "uuid": "5ef71fa4-983a-4bed-9488-873a0461de5b", "value": "b4e4178aea8498d952fec581ab3367c05a6272c444fac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2f5df7-0711-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770790653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790653, "uuid": "c7a013bf-4190-46aa-b8cb-783d158f4b8b", "comment": "Malware payload (Mirai)", "value": "a963f1360813eb78957eaa498b0b0487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790653, "uuid": "3f3a0ad1-3d4e-4d03-bb2e-15dd1f5aef6c", "comment": "Malware payload (Mirai)", "value": "b52badbb094059f4f47b771bfe696bbf4842ceaffa84cb776512e3f34d62b26f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790653, "uuid": "ba08be1d-830d-4232-88ec-2fee7254f4f6", "comment": "Malware payload (Mirai)", "value": "bbd0dfc807e40fbf181d1dfa25ca6824d41f3af7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790653, "uuid": "95cb081b-006d-4de2-825d-66467ee9530d", "comment": "Malware payload (Mirai)", "value": "cb75d741fb18b1927e252c53e246f00d8cc0bbd431fa869e5991cb75c85e94c326e144ebe228819999ff95b05cbc4cff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790653, "uuid": "26fb7e17-2870-45f3-9476-a56be52c2a4f", "value": "T17943013AC1818953CD566671F6150E02CAA21DBEE87E38373E78064315AD7E239FE6C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790653, "uuid": "b7c3a137-b2cf-4283-935c-2cb35ca8716f", "value": "1536:Z4in6U6mi69gpaIYpFIropo1XfLoixVkVDidyMDMj:Z6fVpaIY8rXXfLXxVk0fMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770790653, "uuid": "7c867061-cc47-4723-a658-3922b454bc37", "value": 55736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770790653, "uuid": "d93992a8-eabd-4d2e-914c-785a389b548e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790653, "uuid": "2a913fd8-181b-4668-9227-0d4b5f2ce5f3", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5b2e45-072c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770802122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802122, "uuid": "9a570193-3ed7-4fb9-860d-046388aaeb91", "comment": "Malware payload", "value": "f9ea0bb60077bddaa2d1e816a6a6b301", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802122, "uuid": "e8811614-5246-4625-b36b-8a604c288537", "comment": "Malware payload", "value": "b5e3ad616583063f776031205d751a5764c0ab015d5a4f7eb2577e9977a942c1", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802122, "uuid": "b7903ad0-6ab4-4ba6-be1b-f89d4f7bdb88", "comment": "Malware payload", "value": "fb2049650e465c4c5c3770e815d9f172e0f074c7", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802122, "uuid": "2e279a66-9a82-452e-9f3e-53e05d37eaa9", "comment": "Malware payload", "value": "2236498eabf3a99d9fc638030f14207eeb091a8a4f9bfb73c18996cbf509b732cdcf5971d9679c83cc1e8d9618d4eb9a", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802122, "uuid": "c1f69ade-f357-4986-9af7-83cfbebb7b51", "value": "T17C0633AD291B386DF71D43C9D464D16B51D072314A0EEFACF829AF72728892DFA0C712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802122, "uuid": "c29befc2-11f5-48fe-b6e0-bb3a193bc055", "value": "98304:ZEXLI1/03gRg0DaejXNboqD0P3AH8OpGaUkXy:ZEXP0+U9sw0PwH8Op8kC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770802122, "uuid": "b2a3e0b5-170f-4d7c-a55a-1b464d878567", "value": 3657542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770802122, "uuid": "63e48178-583b-4473-814f-740b2af93bcf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802122, "uuid": "c432e0d9-21b2-4f1f-b4db-9db904625a8c", "value": "7Zip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973b34fd-071e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770796339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796339, "uuid": "c979ffbf-1b6c-4d4e-a596-d4e5db4baf23", "comment": "Malware payload (Mirai)", "value": "4bdf93e1ee9923e9e28e844b33036fc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796339, "uuid": "e4afe248-39cf-48e1-87c0-da0d2731093c", "comment": "Malware payload (Mirai)", "value": "b727909f0545b8c1d9341b1427d5b0643377f8ce244293ff3cd89f06cd7416b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796339, "uuid": "ebd4f697-d126-4ee5-9ab6-520a3d23fd8e", "comment": "Malware payload (Mirai)", "value": "d893c790757f3b8d0dc5c75c1d5b7781b018e976", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796339, "uuid": "08acc13c-7c44-4317-af53-0112f23e375b", "comment": "Malware payload (Mirai)", "value": "be2defb6d1e8d40b2a2ce9e707ea4e5309d0a267274f63536a8380c90dafb359fc4f33757bf3fbb42c28f8f3e85e8028", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796339, "uuid": "2c26ea2b-3ad2-474c-94cd-a1f1938db113", "value": "T1DE534BC4E1D3E9FAED001978207ABF626D73E53FB135EA9BC3D95523A802702E50625D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796339, "uuid": "acaa5b35-efe8-4e93-aa60-00e001490c98", "value": "1536:zBBOY6hgd0tO2Kn+14Uvnno0Eq/5RA7mIq/Pu:V6hgd082KnCvnno09/jemIaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770796339, "uuid": "658f408a-fad1-4dfb-8065-82dc78ccfd8f", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770796339, "uuid": "89121ab4-36ae-4a05-82dc-79667aa02208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796339, "uuid": "714c5de7-8429-44f4-8011-3b8be3a440af", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea73f253-075d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770823537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823537, "uuid": "d8b84b4a-d62c-46b1-a419-878113703782", "comment": "Malware payload (Mirai)", "value": "39c4e32f04904570466d04470dae0344", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823537, "uuid": "4b0c20d9-c87a-41fa-9c33-ab9517c21439", "comment": "Malware payload (Mirai)", "value": "b73720da5385b103c75166a635047b445e49249bbd76ba2dd1d16958c798506a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823537, "uuid": "69f0023b-7939-42e0-a3df-57b9524f19a9", "comment": "Malware payload (Mirai)", "value": "1511985d28918b43844f490105b91d1be6a8a6ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823537, "uuid": "69a50339-7f02-4173-be96-7e8e20127390", "comment": "Malware payload (Mirai)", "value": "a69b2e33bf6eac57fa644254fdee8b7f424d4fe670818a7209ae6b9f4b73fa1dfcee5df7aa46eeead861a5114fbc0c9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823537, "uuid": "3d68aa59-80e7-40c4-bfd0-257c86f534d9", "value": "T1420329D6B400ED7CFC1EE77E81074A05B631B2985992073BA663FDA75C321A88967F43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823537, "uuid": "79f3e441-e0f3-4a9e-8a3f-c258d1ee03e0", "value": "768:O733+6PqC40oFD+0gjcuXVlAu7G8EYpjWTo0Xu8IW0WV6yiZex:ODuCPp05uFlJK8EYpUo0Xu8IW9V7Fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770823537, "uuid": "27a323e2-87a7-4da3-bb36-8b88ffb9f198", "value": 41184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770823537, "uuid": "78a924e0-d07e-4f84-9650-8a38146542fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823537, "uuid": "7a84db34-d18f-43aa-b195-354f738526ce", "value": "nexus.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e8ca0d-071b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770795184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795184, "uuid": "4da339ba-f76b-4a9f-8840-08399ecb7409", "comment": "Malware payload (Mirai)", "value": "5ae5de5b4b70ce565416d5f57c1f4111", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795184, "uuid": "ec2e1309-b9db-4213-aad5-342f4cb6aab0", "comment": "Malware payload (Mirai)", "value": "b73b9504e1e213938a673af6592df620e8af4a725ce98a58596472cd27d9dd98", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795184, "uuid": "c225b680-e28a-4aec-bd39-04251967aaed", "comment": "Malware payload (Mirai)", "value": "b710389d60d747a01b85a76b3657433e47f23a95", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795184, "uuid": "f917783a-8934-4cda-a31b-d5b9f7a765d4", "comment": "Malware payload (Mirai)", "value": "42e4fa6ff15e0132ae692aafdff6747e28d8d8a9fb7d423247e1bb52166298f4043a5dcfaff3e15985438ac250297ada", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795184, "uuid": "7a5fbc7e-a207-4cb8-8e0f-7d33587c3e73", "value": "T16B3121CF5142E24395EADA09B3B3D9A5D484859F20EA1E5DECDC2C3FC89E9687035F18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795184, "uuid": "071f3086-1afd-4c49-a521-d81450d7fdf8", "value": "48:cp/jgpcIgpocouV6Agpt9gpyWLgp3RgpI0gpucgpRCYgpt0tfqoroU:cW2guaoWa0/4fqa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770795184, "uuid": "ec850e0b-56d2-48ab-b0d5-fd93c800e075", "value": 1561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770795184, "uuid": "82545a8c-1be1-4181-9cac-b2da9b1631a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795184, "uuid": "d18b6d30-c169-4715-80bc-a2fd45a65c84", "value": "mass", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40d8a11-0738-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770807608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807608, "uuid": "2f242574-2c9e-4086-b6f1-8fa0b512d6f2", "comment": "Malware payload (GuLoader)", "value": "312ef13f1f4ee5f4d1ef856d94e91c3e", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807608, "uuid": "507efafd-b6ea-4203-96db-b1683d8fa715", "comment": "Malware payload (GuLoader)", "value": "b766e576f80bc67c45ded2a5bc6320e4b709081622a7f11dc6422fbafc2e04ed", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807608, "uuid": "151ec846-a632-4bb2-9524-50e356eb994a", "comment": "Malware payload (GuLoader)", "value": "99f76a61e157a9fabbd3a5b4c3b7694305fe9d54", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770807608, "uuid": "95991405-ccf7-427b-a619-299aa80523dc", "comment": "Malware payload (GuLoader)", "value": "559dd2015b316de2759b78594a0edf1d788161fa038e55508026bc620baa2e578f559923e9a122f4d70d0fa974f402f3", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770807608, "uuid": "dba3c3c2-aae5-4219-b72b-dfef96e98ce6", "value": "T145413DA83250727D2F43C363E25B1D89539CAC173107B2E14895979010F502CDD942B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770807608, "uuid": "da492331-5ed9-4942-8be9-4e738d6f62d8", "value": "48:ZSo+uoSYENLQbNi1fSAhrETdDEBg+XmSpUEj3EF:ZSo+usWfSAhrkErmw3EF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770807608, "uuid": "280d284d-9506-4775-bc8c-f4f638ecd07d", "value": 1914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770807608, "uuid": "2d11821e-0eb1-4cbb-8984-635a85110418", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770807608, "uuid": "07e9d195-2604-47d9-a43e-c3c199ff8159", "value": "nRichiestapreventivo_n__38878_202602111259_pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bada7e51-078f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770844932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844932, "uuid": "1d77cb22-bdd9-44f7-bff2-43ac81a076d6", "comment": "Malware payload", "value": "e2022cedcea9b5ea81764996732a9880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "hero-exe", "colour": "#77CE3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844932, "uuid": "4b2e248e-78fe-4a30-b88d-cdd3a047cc27", "comment": "Malware payload", "value": "b7a7013b951c3cea178ece3363e3dd06626b9b98ee27ebfd7c161d0bbcfbd894", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "hero-exe", "colour": "#77CE3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844932, "uuid": "33ee2bf7-bd3a-4a9c-88f7-68e9b868a7e7", "comment": "Malware payload", "value": "01ef636f9627a77ae11af9af88dd52106b163422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "hero-exe", "colour": "#77CE3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844932, "uuid": "0fd8f2a6-b97a-455f-ab66-9a53bab2a48a", "comment": "Malware payload", "value": "a9e096f956666215e9d092da67b559b9bfdc24b317bc7aa8e2d46c6e7262bd7ca1fc80fa410de155f7ed2e8576984138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "hero-exe", "colour": "#77CE3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844932, "uuid": "b9d1c016-9743-4ad9-b2f7-09d27adb2cc5", "value": "T15974AF127AC1E433D9B101705FA9DB25967EBC300F6159EBA3D46A2E9F346C19A30F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844932, "uuid": "7913eaf2-7150-4600-8d09-d7ce94acd851", "value": "eb896ed888a5d9e17921ad8ac5f846bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844932, "uuid": "4de9b032-5aef-4252-9f28-7f276479b204", "value": "6144:IY7vbivxGPWuhvk2/J95VmI5ToMHw3xkdgc4mTxCkJnQymmuFxb/cfRqAOcWGo2h:IY7OvxGPWQk2/frRHw3Ag6tFuFx4fRqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770844932, "uuid": "523c9204-3434-4990-b08d-49f94e33de44", "value": 350168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770844932, "uuid": "cac0afd7-edf6-44b9-87d4-59fdbfa056ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844932, "uuid": "d3871570-9c0c-46c4-a547-e88c56eaacf4", "value": "hero.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e22810-072d-11f1-a129-42010a9c0007", "comment": "Malware payload (Efimer)", "timestamp": 1770802759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802759, "uuid": "934ea672-1ddc-420f-9350-e37432347626", "comment": "Malware payload (Efimer)", "value": "2347dc4a34072740b5dcca13ec472a02", "object_relation": "md5", "Tag": [ { "name": "cieharryalbert-fr", "colour": "#D1D93E", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802759, "uuid": "5efc5b5c-e192-4e8c-93bc-fdaf3353851c", "comment": "Malware payload (Efimer)", "value": "b7f939bf0d133b7ee7cb151cdd109db5611c589b200eda633d7dce7848db4ae6", "object_relation": "sha256", "Tag": [ { "name": "cieharryalbert-fr", "colour": "#D1D93E", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802759, "uuid": "505bbc90-b16e-4f40-b4d4-2cde34ed0a4b", "comment": "Malware payload (Efimer)", "value": "bd25bbb046edc6fdba72f8462eaaa847d48acec3", "object_relation": "sha1", "Tag": [ { "name": "cieharryalbert-fr", "colour": "#D1D93E", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802759, "uuid": "7a2989c3-3b63-472d-a000-5ff4a3f8f034", "comment": "Malware payload (Efimer)", "value": "b49745ceef2d7a78a3490ef1c1ba20d383d6ca3509b22053f09dbcf9c6c97f4872ce3e29c9a7b6dc2b8fafd48fca73c7", "object_relation": "sha3-384", "Tag": [ { "name": "cieharryalbert-fr", "colour": "#D1D93E", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802759, "uuid": "52d2d35b-cfb4-4f8f-9a2d-5541c2782e19", "value": "T1F1C6339C0CFC901A4B7714867FD93778E49C356B66336E1BF9985EA888FB0690523933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802759, "uuid": "005f7f44-b5ff-43a4-bd1e-0f70428e6fa3", "value": "393216:VpGZoHhQ0cEH9wmeMEUfbPI+wt2vIuZ6ZcK48gTY:VpGZoBZwyDzPZwtr/KtbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770802759, "uuid": "dcd01198-7f0c-4b01-9442-07640894b6d5", "value": 12599735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770802759, "uuid": "ed002c46-3816-4be7-87d4-1b8b8f750d16", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802759, "uuid": "f6ddc05c-f54b-4077-a7ba-8e3cf718d023", "value": "\ud835\udc22\ud835\udc5b\ud835\udc61\ud835\udc1e\ud835\udc5fn\ud835\udc52t_\ud835\udc26an\ud835\udc1ag\ud835\udc1e\ud835\udc5f_\ud835\udc63\ud835\udfd2\ud835\udfe04\ud835\udfd8_su\ud835\udc32_x3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faba562c-0719-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770794358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794358, "uuid": "ce2450e8-2345-4a01-82a5-e341e03d984a", "comment": "Malware payload (Mirai)", "value": "b35105aa2e5d7802b23bf120279f1b15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794358, "uuid": "e6cdac97-3af9-4e98-a73a-273e4c1219c7", "comment": "Malware payload (Mirai)", "value": "b8b1d738e081b34b80821457cded32dedc7192da53c23a012b765bd231563602", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794358, "uuid": "543d1727-9fb0-49f7-a198-3fe92a1fc51d", "comment": "Malware payload (Mirai)", "value": "f1ccc86f719cbc3de87ac2ada7cf1b6dedf7766d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794358, "uuid": "fda014f6-be9e-49e4-8933-03bbe85dbbf1", "comment": "Malware payload (Mirai)", "value": "48ad5a976ff49a7200e41597df789986521fbe01c678b52dfec1453cdffef96782b5193494db85515ca13992713b9c41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794358, "uuid": "439edd82-41c6-48bc-b746-0e70d513b390", "value": "T1A353013E21087404E77028F26B8E9EDF175B9FE8407FB8AA5D10B34449932C6CC5EE69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794358, "uuid": "ec5e0b1d-f007-4363-bfd1-b7df42ad482d", "value": "1536:rAIbr7ympoMbP1LI/vP8oBI4D9myq11jbmQx9aLf:rAIGmOMNZomG9myIBb3x9aLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770794358, "uuid": "2cb146cf-64e7-4706-973f-7804bbdaa1ea", "value": 63752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770794358, "uuid": "e0584308-2602-434d-8398-05261d464f27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794358, "uuid": "8e4d5f17-330f-4405-a19a-b823ce67cf15", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295b57af-0783-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770839534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770839534, "uuid": "b4fbcea8-c350-4be1-8c19-483423c79e53", "comment": "Malware payload (Mirai)", "value": "e8c8d5b1b45359095c5002180ae7b763", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770839534, "uuid": "5284edca-ef81-4099-8970-4b2a82f87420", "comment": "Malware payload (Mirai)", "value": "b901f501febc9b6f9ab480842fb5109c19e99e06270ae12aaa9bae007e13f7cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770839534, "uuid": "d0a0eead-0b77-4543-9262-021e7241e655", "comment": "Malware payload (Mirai)", "value": "f6e02a35f448f53e53a73909484a418da1225692", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770839534, "uuid": "51b94bc6-8838-4e18-959d-f26e6c91b93c", "comment": "Malware payload (Mirai)", "value": "c438f8a23b130dd7a8af074a39dfe0c597d7071592a6635f54d8d1257c78eee81abca11141f2126169f1161fc9496e94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770839534, "uuid": "0a60310a-66a7-47f2-aa5b-fab2bfb008bb", "value": "T162837D01B7584D0BE6962DF4393F17E283AFE98021E5F149690FDA8A4271E33595EECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770839534, "uuid": "7b70fa2a-3711-4eba-8abe-4a2fbdd32ce2", "value": "768:OzZKcKv1JjX65AIA9gP3EtuMLouxbPn8c+B3fPofaG1vtQNViaEa9L+/u8GjpDIT:S0HI43bPn8h8J1yzLCNGtDIT4KdDyibt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770839534, "uuid": "caa12bdb-8fc7-464c-99bb-e08dba935df0", "value": 81132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770839534, "uuid": "84fea066-e8d3-4789-8d64-aad821f7ec0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770839534, "uuid": "2f351ae0-f9be-49cf-b7a4-0685f4503c83", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e31a80-0712-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770791047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791047, "uuid": "c131fc8b-49f1-4896-9944-0ddbf7e3b82f", "comment": "Malware payload (Mirai)", "value": "f7eb1806fa4b5f7fa354ac7f707d1607", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791047, "uuid": "12c9bc65-7f37-4050-8cfe-e5c3587026a1", "comment": "Malware payload (Mirai)", "value": "b976f4a47af44ff2181221fe15e3d50c9973bd01ca162dbf13a6946662420fbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791047, "uuid": "0c6dd23e-574d-416b-8ded-ca046f7286e5", "comment": "Malware payload (Mirai)", "value": "098989f0d4ff48359345d48932fa4dadc54b6c36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791047, "uuid": "394249ec-8c1c-4e4d-818b-e250d1a55bd8", "comment": "Malware payload (Mirai)", "value": "045ce68253a0194639b344c26bf938742110bf51b8e42efb02fcd3f729650e9eb7304f0dc6b32c2e0f6f91ce8db1c597", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791047, "uuid": "592f0acb-14ba-4453-aad4-74349ce00738", "value": "T11743F2C96610447DE20FC17B36F8C712EC614FF9AA1B688D6181ABC3AED20647D677D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791047, "uuid": "864453a3-5514-431e-b0fd-1791a19e53d8", "value": "1536:yWAFFaArRwW4l1OSLM5lREkHx2tn0sgZ3BvVJuPy:yWAZrRwW4KRd1Sg1BvVQPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770791047, "uuid": "02bc5655-896c-4bfe-8db8-529e50e55d47", "value": 58136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770791047, "uuid": "01bf3e78-80ba-47cc-8adb-2d82332e3a9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791047, "uuid": "c1f5b146-4137-47c0-b1bd-b34052d9d317", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666f4a5e-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788096, "uuid": "b1372e21-5fb7-4ded-9d3e-3ea13d21f961", "comment": "Malware payload (Mirai)", "value": "03027d1db6d08ff591ed41306e411ab9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788096, "uuid": "c5bbe6ae-7c09-4f58-9e46-4b6cdf6fa29d", "comment": "Malware payload (Mirai)", "value": "ba082cdbdaf772f6f3ba04fc5fc23a2f80e2a514555e5c536817fca223ea936c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788096, "uuid": "aa09b15a-e00d-4376-8386-30e0a5e0f389", "comment": "Malware payload (Mirai)", "value": "7a08a972b7d0bc5378921d5378d6aa4800c0c2e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788096, "uuid": "66257783-9cc1-450d-ab6e-f23570f39e63", "comment": "Malware payload (Mirai)", "value": "80772ee31e7091f33b9e326cb9e43fed1904b9a1c101762d7c81eca659015cc976a4a002fcc07e0789734830d6777516", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788096, "uuid": "f4da09c5-fdb1-4c1f-8558-b77395c8b81e", "value": "T1A9043802E603C9B2C01301B212B7CB761E31F9B7AE25D452D3FCFEA5AD656D165093AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788096, "uuid": "7f57b46a-23ef-4145-82c9-e744fa53512a", "value": "3072:6pvxSRDkg9jwwcV58ctaiJE7/CRDh7qU83Dlpm8X:yv+pf1ctaomi7V8rm8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788096, "uuid": "22d7a117-2870-4520-a860-aacda06fb234", "value": 184484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788096, "uuid": "a2da4b7a-f904-47b5-84a5-f3a586ca6ed4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788096, "uuid": "28bd7e60-d081-4bf8-b3bc-dd1da8cda571", "value": "bin.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67553d0-0778-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770835100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835100, "uuid": "4ec10573-92f9-4bf2-8d0c-1afa75346cfa", "comment": "Malware payload (Mirai)", "value": "209e745b6cfd7f0ce1181c8f4fcb82c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835100, "uuid": "5f6bc7bb-169e-475d-960a-5bf2da9eb18b", "comment": "Malware payload (Mirai)", "value": "bab93e868e99ae86c4366ee49646934b04f14c15d002cf342a3fd7106aacf294", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835100, "uuid": "00173a04-1e6b-47b5-a60d-c66d372f781c", "comment": "Malware payload (Mirai)", "value": "05d8449b578eb979e87430182e505f3bb1927e86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770835100, "uuid": "6f28242a-b34f-40fc-8b06-65d51cc49199", "comment": "Malware payload (Mirai)", "value": "74dc83dfd4d122eeb48f845a972c8b61d935ab95202e840de499595a953db8ce7679b75c7268a5793267a7eb9a14ea05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835100, "uuid": "ef8286a1-ac1b-4863-816f-fc2d3a88cd7d", "value": "T142632B17A54480FDC199E17407BF763AD823F47D423EB29627C8BF1B2919EA01F2E51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835100, "uuid": "a59bbf90-0b8f-493b-97fd-d61a518cf15b", "value": "1536:PFLm09BGMOAcE7/CzWt2zRKH+cRS2UOwNkU1jo1bwbo:PY094MOAcE7+WUbdOkN1jcwbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770835100, "uuid": "1c8b4d81-67ea-48a5-b757-04ab82dfeb5d", "value": 71392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770835100, "uuid": "af1600bc-80ef-45e9-895b-c27a878b16db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770835100, "uuid": "9124a653-9863-4107-ab0a-00a19044a6b7", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f554451-0777-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770834363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834363, "uuid": "e6bec103-a931-4c31-a05e-44db3f4ff7fd", "comment": "Malware payload", "value": "ccb27229f29410486e09b59c512d84e0", "object_relation": "md5", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834363, "uuid": "18e506be-fbd6-486f-ab4f-80805b18ef60", "comment": "Malware payload", "value": "bddf7052a6a77cb1e9c002f201d5b93b0aa8d3b11e962f2a6e10a7b25ff70e03", "object_relation": "sha256", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834363, "uuid": "ca12606a-f9ac-4ec8-a590-41ea9eef3929", "comment": "Malware payload", "value": "5c2546b01fd5dd1cdf9d095b2da3d518857727b2", "object_relation": "sha1", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834363, "uuid": "a126270b-9c4e-4494-a368-60290f84072b", "comment": "Malware payload", "value": "1f04a67854530d361f0c6b3b560f490d930268f03fe7f8f6b4f8401d65c7a7604aa0afc093fa31aaf95c8054433147eb", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834363, "uuid": "4cbe8a5a-7d30-4248-96d2-3e5ecdcb30da", "value": "T1344633DAAFEA25D7E98387FD4BF03F668C670B007389552418E80D88E1612A6F47F4D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834363, "uuid": "43114b8a-3032-489b-bc19-f4ae443bfe56", "value": "98304:fLYVphKwWpghaLIYY3r11T6YFY3gvCNEWaxGHsKYyLfoZsqDYeqa:81K1b0YCrvlFY3n2ZGsK7fubJqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770834363, "uuid": "f5444d60-695d-4c47-8efe-ab44294531f8", "value": 5380114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770834363, "uuid": "366fcb10-ba67-44d5-93e8-bd9a0fb69de0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834363, "uuid": "c3cb037a-d5f2-4d8a-8f0e-f525b7076eec", "value": "Velost\u0430\u0440\u0440\u0435\u0433 v1.0.1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26456b4a-075e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770823637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823637, "uuid": "ac36867b-0a89-41ed-9c07-720f680be86d", "comment": "Malware payload (Mirai)", "value": "766183f37ea9f7408b7fe71018a57c0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823637, "uuid": "1eb1744c-6332-4c7d-99de-570f693167ea", "comment": "Malware payload (Mirai)", "value": "be0554bbcdb568a6cc4843282c96642dc1ceac66470ac61d812cffedb8ff8e64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823637, "uuid": "f9be626c-2085-4688-a956-4ee9c42e5bf3", "comment": "Malware payload (Mirai)", "value": "8579673e8d753496dcbb63ccce3bb7e6a65c0c9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823637, "uuid": "cf5ff737-da95-49e1-9cc7-536587772e98", "comment": "Malware payload (Mirai)", "value": "324baf37d57e8c86bf91eb7e4bc6937977d9520fd0c2ef825348c57e1e3b610bd378fb66a4a74564352b561d2d4205ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823637, "uuid": "804e0f4b-c85d-4ef3-a8c3-4c4c5fac078c", "value": "T117032A8173280447C1B62EB0357F1BD0E7ABEB9222A4F389750FAB4AD072D379546D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823637, "uuid": "b13fb9e9-3d90-4f9d-9683-a7c4ee820f08", "value": "768:16KqIf9Yr9GyrlfnitOeH/dOsnKoRIOlb3B8/:167v6Qef0sn5RImDy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770823637, "uuid": "c1535c3c-a7bf-40d1-bfa6-f7d30c193236", "value": 38816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770823637, "uuid": "962a2d17-8f6d-4aff-9cee-bbb1a1504fb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823637, "uuid": "81ae08bf-ca64-432e-81da-e44dbaab99ce", "value": "nexus.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e19787-06fc-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770781807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770781807, "uuid": "e11f1a01-9010-47b7-91ea-eff2dea54c14", "comment": "Malware payload (PureLogsStealer)", "value": "87c3fd854df3caea05ed47574eef70d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770781807, "uuid": "8a8cba70-7445-4781-a3a3-ca8861b29863", "comment": "Malware payload (PureLogsStealer)", "value": "beb637ceb20275efa5ae8dc5b8be06287d7f45df6ab7454c378ff841a0f29f29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770781807, "uuid": "ded7be5e-5c8c-4f1d-97d5-62d3e10fa390", "comment": "Malware payload (PureLogsStealer)", "value": "cc89001e83f05593ad303bcfaccb8d048c8f8143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770781807, "uuid": "1216a302-385a-422b-b361-435ee0e7555f", "comment": "Malware payload (PureLogsStealer)", "value": "1be1bea37a48c14bf0287bacab7bd6738dccb5e4772010f478044f47aa2a7db2cdbdf71e7beec4426bcb95c45b1af464", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770781807, "uuid": "b13d0c70-6fe9-47b5-a08f-3fd5ac2e789d", "value": "T12055124DBB9AED11CA5C0E37D923600C41F3C2A7DD36F26A88D98CE51D5A394C95EE83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770781807, "uuid": "1a1cb141-79ab-4fc3-aa58-33f0e589ad26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770781807, "uuid": "16e13321-0b42-427c-971a-6402595792f6", "value": "24576:D12dcsbca6X3VtBhZXl7QcejvOrPfmYmW/VkcR/8D1PhjfRceFplQ6a:6csbYX3VtBhrMi3zV3t8DbjfRcuLQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770781807, "uuid": "135b6a92-65f8-4f35-91a3-9dfcb204c836", "value": 1406984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770781807, "uuid": "9e6fc15e-f3ff-44b0-a50d-aec4581698e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770781807, "uuid": "3750bbdd-08d8-41d1-b4c7-d8bfedb375e5", "value": "ArajanlatkeresPhotoEKR.2026K.EXE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91af8e28-0798-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770848728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848728, "uuid": "bc80f961-4b1a-4854-abc5-d2ef3a18dcf5", "comment": "Malware payload (MaskGramStealer)", "value": "ff9ed50ab84b4b50d343ae3eb9f716d9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848728, "uuid": "daf1cb18-3e4a-48f2-843b-3f2da63bf66b", "comment": "Malware payload (MaskGramStealer)", "value": "bf820bcfb66765cebc8af802b23675880be83586295bef0a1c825539f2530104", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848728, "uuid": "7e98f63c-997f-4673-87b0-85c71db29845", "comment": "Malware payload (MaskGramStealer)", "value": "33b06fa736d9d8d5258db8fbb0568ef5ed96d559", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848728, "uuid": "4d4b6a9d-5902-4656-97c1-e056cfc221f4", "comment": "Malware payload (MaskGramStealer)", "value": "d8799926d52617a980e3ffccba689fe96c537e068d1afd2f9a4f9adc0e9b38f0e7e8f8ec1928c1fe00cf0c6980da3af8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848728, "uuid": "7d40ef2a-35f5-4de8-be7a-5f0a8e6099da", "value": "T17ED31863A89184F8D82AC57489D7A23E69F7B8910579768E1DE09F021F73B70F31CB49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848728, "uuid": "baf802c5-773c-4a46-a2cf-a73226c1da2b", "value": "23a4af79dd7d05d0297656b7db50d6c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848728, "uuid": "e8056f0d-20ba-48c1-a3cc-87945501d3f6", "value": "3072:AvD2Ui/DY4O7CgiP9/REOcOwzu/vYtEpoRUnl/tPBGPE:AvD21s7CgiP9pEPJu/vLnl16E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770848728, "uuid": "34663c59-266f-48f3-aab6-f324ae546775", "value": 135680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770848728, "uuid": "0a3c5e1a-aef4-4ef6-8b3d-de065dee06e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848728, "uuid": "5c7c4b6d-cb28-4b07-beac-f3bedb8df21d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6ec009-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770816371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816371, "uuid": "4192199c-242e-49af-934c-6a20e5093c0f", "comment": "Malware payload (SalatStealer)", "value": "77c91b3eeff18e77302338f8a4f05342", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816371, "uuid": "0b871554-2378-4588-a32e-9f099ce8d0f5", "comment": "Malware payload (SalatStealer)", "value": "bfd98040f5c8e7553716131b9d091477107088522d48895d1aa87e77bdcc1fc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816371, "uuid": "56de8d25-8815-45ff-b0c2-c3a271abb7c6", "comment": "Malware payload (SalatStealer)", "value": "9de2d3ba40f659b6eeabd259bfd8536f7c4bf28b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816371, "uuid": "584d7baa-9453-4c53-9b80-9b536c0c0cd0", "comment": "Malware payload (SalatStealer)", "value": "e681cb2c2f05dc3e341147ac5976a1074d671e84906c83d8f24f69979a7c3bfeb4a541f0f73cecb0848ce876aaa9c04d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816371, "uuid": "3df3d222-f524-4831-9d2c-dc8b7719b11d", "value": "T107E5336DCE6F0845EC6649328DAC31AF80F7322EDC806076F9E0449749DA4FF87566E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816371, "uuid": "47386190-31ff-4a46-a3f5-7d21a0ff0ea0", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816371, "uuid": "36e3d94e-7c71-441b-8313-da1b9dc74703", "value": "98304:iy5RgREeBxUo0yJfWBn+u5hLILMpv3WY:t5O/Bxtbgn+Q8S3WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816371, "uuid": "616facd9-24b3-4af7-95e5-841ed2956bf2", "value": 3297280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816371, "uuid": "ed5acb8f-bf35-41e2-9b75-c58e4be9c92f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816371, "uuid": "7fac2223-f5c3-46d5-9eb6-d099bb20313d", "value": "OBXODeac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428ed013-06ec-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770774722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770774722, "uuid": "45a455b0-0b03-4741-a86a-a6f9ee74457e", "comment": "Malware payload (Mirai)", "value": "5ea9af2ef6479f8be13215fca623ab4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770774722, "uuid": "4999757a-8bc5-4b18-a146-bb65a75936ce", "comment": "Malware payload (Mirai)", "value": "c0cb40a066ef642104b340040f921147960ee6ccb73d507582cfa4d5908a76ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770774722, "uuid": "42940a88-27bd-4990-9513-8fb3a08ed5ed", "comment": "Malware payload (Mirai)", "value": "110b1e41b14ba78bb84738dcc86f815b4461f5bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770774722, "uuid": "d030580e-414b-4889-8bbf-926f018d7c15", "comment": "Malware payload (Mirai)", "value": "53f32a6e11a2b21a285d17e0434b512d905dff4538aa53d21df5165c7fd67b27a00057649572326caba1e6cc84c63cd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770774722, "uuid": "833450d2-36e3-41f9-80d7-96715e0e5a40", "value": "T12DF31B46F8814B12C5C512BAFE1E128E37131BBCE2DE72129D245F607BCA96F0E3B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770774722, "uuid": "526fae2e-aa80-4a37-b760-2bfcc4d4f17b", "value": "3072:9qhYiRcUYti+et5XpZDgUFRXEevTHazWubf5HfzFe7H:9sRcUYti+etxpZDgWXVvraqkJzFe7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770774722, "uuid": "9893d9bc-6e33-4337-b2cd-49ee0cff6475", "value": 166844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770774722, "uuid": "7e7c7fa1-986d-4bfe-a81d-8d1035f415b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770774722, "uuid": "35ba164e-7de5-4b54-a062-4c1f2c79c6d8", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f665c6-0743-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770812226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812226, "uuid": "644be6a0-7413-435d-a44a-41d7ab83f211", "comment": "Malware payload (CoinMiner)", "value": "690ab644317d2c7bb4605691846a6241", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812226, "uuid": "6659c84c-3fa7-4bcf-9804-6873ab8045b3", "comment": "Malware payload (CoinMiner)", "value": "c290ed8fbc2d5e378e4cf17edbf901898d35acc1c414ccfb49fe137e9d9532b9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812226, "uuid": "d6142700-895d-41d5-8a3a-c1f32383a848", "comment": "Malware payload (CoinMiner)", "value": "c0e48961a55357cbcf30dd6944fee300d68f06e4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812226, "uuid": "8d4e473f-9d88-43e3-861b-9dcc5eea7623", "comment": "Malware payload (CoinMiner)", "value": "3b17bd444f21d8257c2dcfdfc359e58df25019112fc664e38f820b21958453e08865848118b198baae0a403600755f91", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812226, "uuid": "6955960a-6a6d-484b-b84a-cce7cbc0f4d3", "value": "T1C6663319C3E804BCE1B3D4748D969D02E7377C8A47B1974F17ACAD9A4F276108A39B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812226, "uuid": "324f4a28-d608-4d68-9890-5c84c487eda3", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812226, "uuid": "df530f54-9b69-4e40-bd38-37e4d3642f6b", "value": "98304:gvOJpCFbZGcCXkhLF8S5H/0OnkdvnQln9qVtlzIEYQhgZdsh+Oq1+JpiJ+:HJxcBL+Sx8x/uObzP4914Ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812226, "uuid": "5122d7b7-c574-4d6a-b5a1-6853c608d135", "value": 7040541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812226, "uuid": "2a0ec130-fbff-40bd-a45e-ff4609b3a679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812226, "uuid": "4666876a-c115-4d83-b9ea-d9f7b9c794cf", "value": "hack_game.sfx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0495173d-0747-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770813702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813702, "uuid": "cf6d11c0-f7d7-4632-9e21-3c1d3076905c", "comment": "Malware payload (Mirai)", "value": "e4d74cad3ba6a0d0b7415e5b47126a6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813702, "uuid": "7a24760b-d151-4ffd-b397-3400c2fd9da9", "comment": "Malware payload (Mirai)", "value": "c304ae80699991bc775f51eb712a4bb92ba69690230e93e80076a863a71788ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813702, "uuid": "18a67deb-c6ab-4bbe-95d2-602908e05d88", "comment": "Malware payload (Mirai)", "value": "6e9152c021af2ab4c924436b4eb527f9494d178a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813702, "uuid": "d3099b4e-71fa-4f01-b9c3-5948c0d146c6", "comment": "Malware payload (Mirai)", "value": "b650a5473ff1f49042b09a11b9fa5bed21f51dea0fecf3e5787c39528f70fb5e3ff1f208daf3658901d93d805f289040", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813702, "uuid": "099bb066-35a0-4567-852b-9a332141f7cd", "value": "T17BC44A55F8809F61CAC52976F79D869C33134B79C3EB720699144B383BDB8AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813702, "uuid": "71c85a86-c797-4148-b1a9-b0941c701dea", "value": "12288:Sp71FGEu+/G0VS0XLUKzwIYFcGmynzgpEor26:oiwG0zUzNUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770813702, "uuid": "b4955a77-b78a-47d5-8dd7-9f50f6f5d7e6", "value": 587496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770813702, "uuid": "03fca662-f21e-4e8b-a5be-74d36ab69426", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813702, "uuid": "2891c330-cac1-441b-a4c0-5e19d6a3c1d0", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461280cc-0748-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770814241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814241, "uuid": "1ce0885b-78a9-4a3b-b965-68e9f7221301", "comment": "Malware payload (Mirai)", "value": "23e426828f582f15a0ca5e4eaaf392aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814241, "uuid": "2d37fe19-c7a6-420f-a427-d72a874b19c4", "comment": "Malware payload (Mirai)", "value": "c4b5ff59ba9ed973fbf38cf29bf2afc20851be4599adee7a395cbef331eb27f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814241, "uuid": "dd692c0f-cf22-45a4-a3e6-642badd22c26", "comment": "Malware payload (Mirai)", "value": "3aa433f3b6d79e4821b6c29b37db017ec9688e68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814241, "uuid": "da0dcdf5-76dc-4360-8927-f5c846eeed16", "comment": "Malware payload (Mirai)", "value": "36272a0473ef454a1a941bad099323da00efe0c3d37661f6d964729e44dbc5bce9410f96a6776e40a283491af0eaefd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814241, "uuid": "b6f9b470-9c42-4d9d-b945-8bcc49c05148", "value": "T119235CC4A583DEF9FC1506302176EF329BF6F53E2018DA47C799A9329D92603E54329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814241, "uuid": "b56780f3-64b9-43e9-8629-c12d07078cd0", "value": "768:NgbY+WYu7QasNUKF5J+gWHO0Le+re6cIo0SXjg2kS6u1X6Iagj:ObOQ9NUKF5J+gWHFxr6j0QE2F6uVJag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770814241, "uuid": "9d23281c-1f07-42f7-be77-1bc96384aeba", "value": 49968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770814241, "uuid": "ea27dbd9-f2c9-40cf-b9ec-cb99a3570779", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814241, "uuid": "a1d2a211-2c00-42ba-865c-080c92692274", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb113fe1-0744-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770812827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812827, "uuid": "86f31ccd-a4c4-4f62-8955-96c0d124ae17", "comment": "Malware payload (Mirai)", "value": "be1f58bb05deaea7edd7c029f479d3f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812827, "uuid": "ecfd3f4d-1d74-4be0-8897-e18c5f38d339", "comment": "Malware payload (Mirai)", "value": "c505d0edaeb59ee2b493ba23c71f01dbc3d7582dbfcab2c20bd84902aafe774f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812827, "uuid": "c5ba673c-4b02-447c-b50f-0bd1f99ac409", "comment": "Malware payload (Mirai)", "value": "2ea7a0c8d2e77819b434b2168999f6870d847e54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812827, "uuid": "2f00634d-ec6c-477c-92bb-429c73b005d5", "comment": "Malware payload (Mirai)", "value": "9a1c5a3f76767cc94f3d5c3d5081a28f72e38805b7c4da8524d7665328f1e5063d975f9f831123dde66af64811ab84ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812827, "uuid": "94889e05-a5d3-439c-8d1e-1b17e425ee9f", "value": "T1EB63734D7E618FBCFBAD863447B78B20924933A627E1C584E15DEA011E7034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812827, "uuid": "dcfe06c5-3fc7-47af-8cf4-8be236bd9335", "value": "1536:UMQ7gwld5+gZNoEXrlXruEXrtl9AN/nuif5lhirZdiHDIXTCJ:nggwz5xAocXPhirriHDIDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812827, "uuid": "c8a03714-f421-4888-be1c-b0134e9f8422", "value": 71668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812827, "uuid": "38291ce4-41d1-4687-9c84-d704fe241547", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812827, "uuid": "144bc90d-9d0f-47ba-a7f3-a961249ebe19", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39854787-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770816368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816368, "uuid": "d56811ca-7cdf-4093-950a-fa4c9354d9e0", "comment": "Malware payload (SalatStealer)", "value": "47e5f92dc35ed56c8875232ddc45770c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816368, "uuid": "de090af4-68c3-47d9-8323-632081761c1d", "comment": "Malware payload (SalatStealer)", "value": "c61e7b58ef69c07bb49ae499d35e093440aa9447863fbabbae1def16b2ce12d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816368, "uuid": "d78078b8-ba24-487b-92bf-89acc3e537e9", "comment": "Malware payload (SalatStealer)", "value": "de8ad3f85331c69f80172ae32503eacf7ce931d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816368, "uuid": "271a4f5a-2f53-4d48-a58d-5e275b1ee451", "comment": "Malware payload (SalatStealer)", "value": "d71a81d6e3d17f4755e4408bbf01b0ac390bb7ad64e09abd5e1e48021f69c60db6c41446ef88c6728cef66391b266c06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816368, "uuid": "4492910e-4509-4497-a4a7-99742657f367", "value": "T1DFE53376736AF0C9C259903728760386CFD58CF2EE3C26575BC937AC2478249DB63961", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816368, "uuid": "b5e8e65b-0a22-4777-93fd-92efc3f298cd", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816368, "uuid": "39dee7f2-9711-435b-b329-6143a576a1d4", "value": "49152:QX9FSPKgexAgT15kIgUSbloW0KhMKv/84ed359R2Q5DGHWbqoEVN2P9sp+XfyYyL:QS/mHkxpbloHKvp5QE2zCpmyYyfuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816368, "uuid": "9e965a73-fda7-40d2-abd7-c7ff499c6f11", "value": 3297792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816368, "uuid": "2f503978-349b-4102-bcde-09759fd7099d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816368, "uuid": "f1fed70e-4ab0-47ac-b985-2efd0403b379", "value": "AntiEac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88a970b-0746-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770813628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813628, "uuid": "140bde05-0111-444a-9dd1-879c6589a6f3", "comment": "Malware payload (Mirai)", "value": "0c8161214807f3080d3297c52e61ee94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813628, "uuid": "b50ad126-febe-4455-bcec-cc26919b617b", "comment": "Malware payload (Mirai)", "value": "c6781c1f228c4c4036712d98659bc4e2ac66e3c61709e749033c5d1f9abc1e7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813628, "uuid": "7d5d1bdc-7746-410f-b79f-86ca04d90077", "comment": "Malware payload (Mirai)", "value": "67459a4e569be6846dea812825440d90019fb2d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813628, "uuid": "af4fa61b-f0c2-43bb-85da-227cdc07f3f6", "comment": "Malware payload (Mirai)", "value": "a1375f40a55e494f9783219ccd15f0d80b5ca22feec03e0ff1af41b0ee2a11812bc02fc8035ca81c6e6984c77e85257d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813628, "uuid": "0c6e7f73-86ef-4b37-a1fa-7ac9a17c4d8d", "value": "T147236BB3C03EAEC8C25843786A254F3CA713E50597532DF6569AC665904BEECF60A3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813628, "uuid": "9807e20b-3e9a-4f98-a2ef-481f7bf25355", "value": "768:eap/fvXvD56gqt5m7Tpr7NNhHOPhztjqDmDS/UCS5doxBJ26Cejy:eap/X7mXqfNNhUriUT5Sxa6Cej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770813628, "uuid": "6fd9f50c-a4a3-4a5d-ba84-93bfa9ca5524", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770813628, "uuid": "4eb4d9c1-49f6-430f-8a66-794d26c01e2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813628, "uuid": "ff5ef97d-d093-4c21-9802-55eb00c03b35", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e376f16-0725-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770799169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799169, "uuid": "8e5332b4-e237-428a-abad-8728e0619537", "comment": "Malware payload (ConnectWise)", "value": "a3df647a5fea4a7749c3ac4ca46fddb4", "object_relation": "md5", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "adobeappsxpyrf-update-click", "colour": "#2F7543", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799169, "uuid": "c747ce71-12ad-4b7b-923d-93ec57b18bc5", "comment": "Malware payload (ConnectWise)", "value": "c6fa16127e3ed367122d1a708e7467da1bd0bcfcf52e9ba96db9f0003d8ca73d", "object_relation": "sha256", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "adobeappsxpyrf-update-click", "colour": "#2F7543", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799169, "uuid": "873cac23-f0d9-47a4-a947-0d9225ec7658", "comment": "Malware payload (ConnectWise)", "value": "ac90059b2da8638e7f0dbc4769f92abf7f37f3b8", "object_relation": "sha1", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "adobeappsxpyrf-update-click", "colour": "#2F7543", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799169, "uuid": "d7dfe941-bf00-438a-ab0f-5e7cda7a86a9", "comment": "Malware payload (ConnectWise)", "value": "20935facbab98bd096015db92de47debf4a6df80306c103103a3332c02a02a65046ae4af9b70ac27b20bcd1c013591e0", "object_relation": "sha3-384", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "adobeappsxpyrf-update-click", "colour": "#2F7543", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770799169, "uuid": "de6eb3f7-d321-4657-9dfd-150aa11dd16b", "value": "T11511C877C1912923FB4913F500AFB3EC9ECD4DD4085DA89421789B036C0F5402B7B9E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770799169, "uuid": "80d90b05-473f-4b9c-bbd5-59d6e6b8df50", "value": "24:9wDHC1Zfrc7I6MLXPWPoeKrZI9ece5cvE8tISOAmzx9DHt:90HCPrWsx4ecmccppBHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770799169, "uuid": "8ac16fc2-7073-4682-94d2-1b28e6a1bfc0", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770799169, "uuid": "06954ef8-b218-4f71-a642-44d291666dfc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770799169, "uuid": "609c6cb9-6246-4134-a507-dbb4cf8532f4", "value": "Adobe_Reader928097.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a05742-06e2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770770571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770571, "uuid": "065eefab-475c-4c10-92eb-997e209f90aa", "comment": "Malware payload", "value": "526586064c3a134b8bec5885717efd4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770571, "uuid": "9a5933a7-1ec7-4fe5-8c43-4fcb9d5cf508", "comment": "Malware payload", "value": "c8537f287a0edb42aa4b91ad1c5670f9c974aa3d1472ea277e187f81526961b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770571, "uuid": "28689f60-2247-48be-a171-61995053ecac", "comment": "Malware payload", "value": "16b7437b6191343c1291812d23113a8afcdbdbb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770770571, "uuid": "343b41b2-bc54-44ce-a17c-dfc3912426cf", "comment": "Malware payload", "value": "c459f2accf8a6db888bc081c7947e6482a81ef835f9426119bcb8e6f617954bc6bf65086074e14bb9e8d11b090fdf190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770571, "uuid": "ccadf91d-9218-4d59-97d6-4d9b26c4e144", "value": "T196F2E61BE541C470C2A4047A1D9D39F28ABD6FB8CA9D6FC79FD90C5107FC0A3B9246A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770571, "uuid": "376d8a01-5ca1-49e1-8ac8-ffcdcc8b3ff4", "value": "768:jDnRRHp2q0QLW64njWR1CsFjFxv5F6rkYJT6jX:jD7J2qlWBSRtXxv5Fr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770770571, "uuid": "1e9c1373-7fad-4e13-9c01-291d25039d84", "value": 35933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770770571, "uuid": "00052697-e2d6-4a51-871c-0162640411e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770770571, "uuid": "429f6873-bf16-4005-887b-6689988693b7", "value": "SecuriteInfo.com.Trojan.TinyNuke.61.30462.11450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b7ee26-0719-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770794058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794058, "uuid": "a3fc23ec-0c6f-4eec-8b8f-5ee6c8aff5d3", "comment": "Malware payload (Mirai)", "value": "a8a22ac365a6ff91654fc5e7f01c69a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794058, "uuid": "71e7f276-05d0-460a-9260-f5fec69732ae", "comment": "Malware payload (Mirai)", "value": "c8e928f2a6f1c4296473fd18f50d2724c2ae95708a00fda6e5145710849e3872", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794058, "uuid": "4a793ef1-e200-4935-baa0-cafe39cb8a48", "comment": "Malware payload (Mirai)", "value": "6e876a340b5176fbe3faba6ebb70b64437c71b20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794058, "uuid": "632460bd-2f9c-4e4b-8eaa-17479c24fdaa", "comment": "Malware payload (Mirai)", "value": "8f6b09df946ce8b56c59850feee1706076526875e1a16ab06a380d089538eea5f85beb270991847a4e32728f7b0c622b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794058, "uuid": "23dfa8af-c4c8-490b-9b55-7819dd1fc1ed", "value": "T1A7243C41A9808E63C1D5277BBA9F414A33329758E3EBB2078D1C5F7437CAA5E4E37606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794058, "uuid": "507bc0f2-610d-42fd-a4da-d35e53cead27", "value": "6144:kU4LFk3NiGCZ8oLmpMguHcUjVUHalw7WyuH0RsfC+TnydzvnxbEX3/H6TymM/9u5:kU4LFk3NiGQ8oLmpMguHcKVUHalw7WyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770794058, "uuid": "823f6533-c2ce-46c3-9b69-35b59bd7ef44", "value": 210897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770794058, "uuid": "6afd92e9-74b7-4af5-b4cd-d49ed4f8068d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794058, "uuid": "429956a0-12ce-4614-8270-71e816399700", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44015306-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770816386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816386, "uuid": "4b74a429-161d-4abc-ae5d-496d9d04eb24", "comment": "Malware payload (SalatStealer)", "value": "4039e984733c621968c7bc6afb6ea86f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816386, "uuid": "1083819e-d0e4-456f-b760-e166d543569b", "comment": "Malware payload (SalatStealer)", "value": "c9206b482b12deba9730a4980f8a72ced7dfaeacccd164b9104742ef196a1a1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816386, "uuid": "04e56a6c-6f95-4bcb-b6f5-c9220c7a76d2", "comment": "Malware payload (SalatStealer)", "value": "43df4a539d532ee5b9c05e5884781d75d7498f41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816386, "uuid": "192e9a3c-dd73-466b-a941-3aceed7a7842", "comment": "Malware payload (SalatStealer)", "value": "8f27972875369b1debb8bfcb84195d304043e777f61236d1481e2b362c46edbf28106ab14fd760f9756eabe57911a7b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816386, "uuid": "970a5e98-4c82-4a4d-a255-9dddb13936be", "value": "T143C65B41FA8B94F5E9031831416BB23F63355D048B28DBE7FB543F6AFC7B6921926209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816386, "uuid": "1d325f80-d222-447b-8d60-afac758db70b", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816386, "uuid": "cb582401-8bbd-4bbb-b227-5a37d0ad3f69", "value": "49152:3L1bs/bcpOtf8CG2LCE0N+dBAJZtNSepZinpp4qvN6aPql5x7h6i2OqRriSiFevA:7Fs/b98GqOp4jaPY0Ri5OfFKuqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816386, "uuid": "2b91bc71-1694-4fb9-a483-65ce092ccd1b", "value": 11671552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816386, "uuid": "83c5448f-c9df-410d-9cb5-48daf47c4465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816386, "uuid": "528ff792-9fad-4691-9e69-8b02e9317f20", "value": "AntiEac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9082c84d-0747-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770813937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813937, "uuid": "64c78d92-2da4-4fe7-a5a1-4887e8032fde", "comment": "Malware payload (Mirai)", "value": "4396be7f802d6a96a3b867d082538788", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813937, "uuid": "8c9dc295-70ec-41b6-8501-156d8edc5c9c", "comment": "Malware payload (Mirai)", "value": "c9de1825ae21b1e9e266e48a2637359aaf281ec58c7ad576397dafde1477f63e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813937, "uuid": "6e269af2-fa73-426a-9e88-3b97c798120a", "comment": "Malware payload (Mirai)", "value": "87e38b9e423b2db76e3cc73b83a5e4b9e2e3a815", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813937, "uuid": "4efeb081-c605-4e08-ba91-cf401732af42", "comment": "Malware payload (Mirai)", "value": "ecc4d3c79da7bef87d21f2955fffa487172720d18944ebc29e0be0a84cc014b6a462be22a1b0e75459eb1145a5743ca7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813937, "uuid": "640b7459-fa55-431f-872d-58bec1d2e7a3", "value": "T12AC34B46EB818E03C4D51776BA9F424A3323EB54E3DB330699185FB43F867AE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813937, "uuid": "6eff4bdd-5a21-4ab4-9242-4c50027cdf3e", "value": "3072:UPhT4KSEbL160KLc59J0X/AyWJk1M/9fV4j:UPhVSEbh60KLc5v04yWJOM/9fej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770813937, "uuid": "58a52b57-83ff-42e3-aa62-a904325298d2", "value": 128274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770813937, "uuid": "65477373-b310-4d8f-bb30-823a9ca04e35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813937, "uuid": "d15c7324-5e73-4c4e-9fe1-89807e9da085", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d83116-0744-11f1-a129-42010a9c0007", "comment": "Malware payload (UmbralStealer)", "timestamp": 1770812439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812439, "uuid": "b0a66017-06d3-478f-85a3-4c80bade9b3c", "comment": "Malware payload (UmbralStealer)", "value": "758cca2d1ae51c514d1e278c513e401a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812439, "uuid": "bd29c439-0bd4-4eb9-bfc9-ae1c911971bb", "comment": "Malware payload (UmbralStealer)", "value": "ca05f2ff001e06af0a29676556c0aac49dde7562d921e0f1b376b82c0198079d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812439, "uuid": "75808692-400a-4508-9ee6-12904943e976", "comment": "Malware payload (UmbralStealer)", "value": "05f9b9d7bc6acf26440381782cb7eaba00b63594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812439, "uuid": "3a6e5066-5c5b-4ea5-8037-e145ce91fc1c", "comment": "Malware payload (UmbralStealer)", "value": "5c882b40576ae6f2934cd3555c421cde7261faec6f03967aa5f70f0dadd775a432fbc5c9d7d852a090425cc8550e0d93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812439, "uuid": "9ab0a61a-f6af-4941-acbf-ecaeb6bb9eda", "value": "T19C347C5933B88F17E25F8BBDD5B1159F87B1F103E90AF38E0C8895E82811B42E949E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812439, "uuid": "a1f485a2-c4f1-4e21-960f-c5f6e56ebef3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812439, "uuid": "697b55b1-a041-4283-9d3e-5c07e6976b0e", "value": "6144:zloZM+rIkd8g+EtXHkv/iD4aNdQdLocDwabtIExUob8e1mdjih:xoZtL+EP8aNdQdLocDwabtIExZHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812439, "uuid": "3584f052-8186-4cd8-a9d5-72c9979026e2", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812439, "uuid": "624e7f5c-66bb-4e9b-b69f-8f5ae3cb1c5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812439, "uuid": "ea3a38bd-37c6-4eed-aaf7-d84f9f3b93d8", "value": "zensware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12115a6-0798-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770848888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848888, "uuid": "743007f9-a3f3-4c71-8303-fa4e92596481", "comment": "Malware payload", "value": "3b815a981bd1ff600b5f49d114266bc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848888, "uuid": "9125f2c8-67a2-47a8-8808-2d0410ef7c44", "comment": "Malware payload", "value": "cdd51b8c6557a7ff30517809dbe946df763f1542c7a376fd91359caf5649c421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848888, "uuid": "7c1f5e90-cef0-43e7-b4ed-70e99dc2e78d", "comment": "Malware payload", "value": "61dc1ba3d20bb00f04c58f915a185f0e2af49f48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770848888, "uuid": "ba719f20-862e-48cb-9326-c860f25f6b8d", "comment": "Malware payload", "value": "8addf26767ac2a20e3cd0fa8b6d2bdee1a1ad8622602c6a8888958435b936726ede3b75a447564560cfefef23f55ef4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--denboss99", "colour": "#6440E5", "exportable": true, "hide_tag": false }, { "name": "OpenClaw", "colour": "#41EAC6", "exportable": true, "hide_tag": false }, { "name": "openclawcore", "colour": "#DF6CE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848888, "uuid": "b4c52b2d-1d5c-4ef0-bc3c-0f02b645eeac", "value": "T151E623FE84D952E0D9D31B90734E57CE31C0A15A55BEAC2D3BCA1C429B32E9B414AE37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848888, "uuid": "ae6c1e1a-ab90-499b-8951-996ce6590856", "value": "8739de86cd836ae1476705562c069cc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848888, "uuid": "6dd5eba6-ee84-4741-9b2e-69ba99e66e85", "value": "196608:BHOr4G6EE2ENHa5rNVdJ+8XxwQ7Fq+//H4yV5AxmriFfLm4TSHfEal3voSz57fMh:VoJc2ERa5vX2Q7Fq2H4wXr0L4fE7mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770848888, "uuid": "125b3a47-aedc-4861-a9d6-a4261786c253", "value": 14533632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770848888, "uuid": "4ff18b0b-43ca-4af7-8780-d09ebd2624ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770848888, "uuid": "9dc3c312-91c5-4c96-9cac-521f04febd74", "value": "openclawcore-1.0.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a10eab-0712-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770790937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790937, "uuid": "831b7377-c2b0-47d4-bb5e-f256e690a62e", "comment": "Malware payload (Mirai)", "value": "429c40f153c511010ca865a2babaab44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790937, "uuid": "ca4becfb-8e6a-418f-8c6b-806656786f17", "comment": "Malware payload (Mirai)", "value": "cde6772d6fa77d7b71a40c5d18fecd47dff024088968f76aa86a685a2a141acb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790937, "uuid": "c849e8f2-72a0-4eae-b376-3c80aed9db26", "comment": "Malware payload (Mirai)", "value": "9d66e2874ec1f8d04821421c9b1125a914bd8c00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790937, "uuid": "5f2f347d-14fe-4147-be7f-8399b4378087", "comment": "Malware payload (Mirai)", "value": "55e089243d7df90334df82f0258609df9efb25ba77104aaa0ab9134e751d881291afd69cc8b74dcb277457f3c8085b41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790937, "uuid": "bcc1cdf1-0cdc-4940-bd6b-47357955bfa9", "value": "T1C9D32A05B30C0943D1A32EF4363F27E1D7EFEAC121E4EA41255E9A8A9172D335989EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790937, "uuid": "fb09ba6f-f499-47fd-a55c-542991410447", "value": "1536:idbi68FjAuk80dxFgPGiHHW7uvAvmf3fl1HGmcqBJv5qruj/YFbz:sW3jPF0dxFoWTvbk2QQbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770790937, "uuid": "97a061fd-9e80-4f12-b072-0121f046aa53", "value": 138004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770790937, "uuid": "05650b8d-e344-464c-8ca0-dc03711f29b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790937, "uuid": "9d8d81a7-3a2c-4ff2-9425-8d613368e4fd", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6f66ff-0716-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770792673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792673, "uuid": "ce689ed2-5359-4564-8a96-f0bc607a042f", "comment": "Malware payload (AsyncRAT)", "value": "bfe207530b307ba027afca802d77d1e0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792673, "uuid": "183fa965-48ae-4f4e-8a4d-807e99b24d01", "comment": "Malware payload (AsyncRAT)", "value": "cff4498cccb90693c91ffcce75145b5af8b0e017fa3b66b137b2d53587d8aad0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792673, "uuid": "a9232d54-5530-4fc8-b247-596457d0192a", "comment": "Malware payload (AsyncRAT)", "value": "7b489c9251d6c29a1df2425972c232903f7f068b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770792673, "uuid": "3120714e-e35e-480f-bbc4-357c05657b29", "comment": "Malware payload (AsyncRAT)", "value": "b0a617cb04e9863fc4de853dbd23246f25706a74526179d9c8714090240929e791a2afd5e5129550d3639e4a95ae5586", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770792673, "uuid": "e44568f4-cec8-4ab2-a72f-0d7a3b4d3cd1", "value": "T12DD24B08B3D48561E1FD57B94D7293048375EA5B9973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770792673, "uuid": "6d09794c-180d-411b-94c9-43d87ce10284", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770792673, "uuid": "e45fe2cf-726a-4437-aa43-0d0da2795350", "value": "768:fMARXV643iqBkgg/cIRGqom/Rb7fB/dTZ/+:EARXT3iqBk51i4RbN/f/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770792673, "uuid": "9e7a7df1-6abf-441d-9cea-d7a2181ed71e", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770792673, "uuid": "62cd07b8-476f-45e0-9c29-88ebf9280563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770792673, "uuid": "6cc218e1-916d-4a14-a750-9f5f26ac9994", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dda4cf-0773-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770832808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770832808, "uuid": "cc2d2726-d980-4cdf-a6f9-4a2e8ee0610b", "comment": "Malware payload", "value": "f376723a370d4083de1ebc60e21bd475", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770832808, "uuid": "df3bde2e-f561-48c6-8db4-8bf8a6a9cb5d", "comment": "Malware payload", "value": "d0317dccdd430ff23292fbe57e30fec13b247d6c43b693af20652629d2f60d81", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770832808, "uuid": "342f914a-5275-4135-b7ef-23a8aafbe0b5", "comment": "Malware payload", "value": "e4b292e0d086f3fa215a388886156a0f6e7cda9a", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770832808, "uuid": "06f0fe40-b6b9-47b2-89e9-7e0c26d120bc", "comment": "Malware payload", "value": "63cade76a6646f3c049cd5580dac552c3238b78191d1b8525b598d76200b2404373563285f7ff8fcee228212a2c4cf93", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770832808, "uuid": "e5458403-99b9-4111-9e0a-1738b6121cc0", "value": "T1688341C22A25D2B273554D0E82ED3038F9B9BE239AF5FC557063959085A7D23F24E63C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770832808, "uuid": "e2c3a8c5-b49d-48fb-a493-f19ad47f5370", "value": "1536:6wREyERwREyERwREyEHEHH+t9Qv7IVddFtYH:6wWyMwWyMwWyTHwysVddAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770832808, "uuid": "662f5e3a-bc09-448a-b9dc-44d72307ecce", "value": 81907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770832808, "uuid": "2d809389-633c-449e-856c-87f4d9e1ea87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770832808, "uuid": "6c1837dd-0f86-438b-be72-7184c16339af", "value": "z12ShipmentDocumentsonHoldFeb2026Updated.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6723d0c-071d-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770795989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795989, "uuid": "b303184a-fef5-4332-a41d-fa1011d81670", "comment": "Malware payload (NetSupport)", "value": "0eaf491679e38b977c351807a68a8dce", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-com", "colour": "#793A60", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-net", "colour": "#2B0ACD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795989, "uuid": "527d3a51-67af-4847-a34b-60b8d9421f68", "comment": "Malware payload (NetSupport)", "value": "d07db931fe592e2bdb4d77a8152e2156042b5e1b9f4321917ebfe177e815534b", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-com", "colour": "#793A60", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-net", "colour": "#2B0ACD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795989, "uuid": "9021f98f-413e-4841-adf8-b9341cdb0b9f", "comment": "Malware payload (NetSupport)", "value": "0a1a58041aca4a5eca37642556f53cc2d973d0d6", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-com", "colour": "#793A60", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-net", "colour": "#2B0ACD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795989, "uuid": "91712dcf-121c-41b9-8665-3381f7555654", "comment": "Malware payload (NetSupport)", "value": "8adef1ad442cd03ec678167bb8a780e7841c5f16a49159925569cb05180cfa162ef14e8de522ae37127f01f3e27ce63d", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-com", "colour": "#793A60", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqx-net", "colour": "#2B0ACD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795989, "uuid": "bd84ea31-a14f-4ca1-bbbe-87793f2147f8", "value": "T1121633A4CD80C40646F373EF5FB36A881C6710441DEA399A3DEE912449D63AF4B1DE9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795989, "uuid": "9630ae3f-a4b9-4d60-a609-5ed7c404e384", "value": "98304:wTUa229nHl2ufPbmvGymnRRJKnwVlkE/f8OEa328:fwF/mOymR2OlZ/f1p28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770795989, "uuid": "7e07ab6a-84a2-49fd-8c0d-265b23fc41a0", "value": 4021132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770795989, "uuid": "953fa2a9-1b9b-4885-849f-a28070f6e1a5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795989, "uuid": "9ff24ee6-e2f7-4a34-ada1-67b9343fe9f2", "value": "d07db931fe592e2bdb4d77a8152e2156042b5e1b9f4321917ebfe177e815534b.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5d9e62-0746-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770813633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813633, "uuid": "a5d32a0c-acf6-49ba-a184-9dfa293169bf", "comment": "Malware payload", "value": "3f8703f1ae9096a98056f34283b62d19", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813633, "uuid": "00c5c0c2-18e0-48f3-9082-89ec34c884ad", "comment": "Malware payload", "value": "d1051f25e7d6795e3000291ed2a3d91b5c7e0190951fc2ed9dd3d27f9595650e", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813633, "uuid": "7a4b8572-eee7-4528-ba07-0fde8bee15b5", "comment": "Malware payload", "value": "01f9393b48c91a51a13612d8c3596a22353b7d16", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813633, "uuid": "a0580a7a-4bff-43d3-b256-37fda86918c3", "comment": "Malware payload", "value": "8eb4ccbefed158a46a33304e8a4b9e1705ab833f264b68e88a080c8e2592670df04727966b9f152bd9d38cf4424ebd70", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813633, "uuid": "36439306-5817-414a-b819-601c1ab3e51a", "value": "T1A25733E9C5300BEE3C1F0466A9F1C1E1D0E970BFF64698D7E5A212164DA7FD033A94A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813633, "uuid": "7499e488-cfb0-49ee-9afb-d2a843da2f00", "value": "786432:MYe/Ij9WlmkZLzWn524iYNqTwSU9dueZK/HRfQ5uT:Re/IBWd5ytiYNB9dueO65uT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770813633, "uuid": "b1f3b57d-154c-448e-9afa-6ba957e1aa48", "value": 28444064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770813633, "uuid": "7056bd14-14ec-48e9-83e6-2eb37cf09c1e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813633, "uuid": "48018058-dcfe-4a16-8c81-e8389ff15c31", "value": "Loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593fc170-0713-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770791510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791510, "uuid": "5cebda39-d13b-41ab-8fbe-37f723e4d76f", "comment": "Malware payload (AsyncRAT)", "value": "df85526b9aa62029ac05f7b7161ad3cf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791510, "uuid": "e25ef8e9-f2c9-43f4-b01f-fb032e5bb8a0", "comment": "Malware payload (AsyncRAT)", "value": "d24065a85b224449b1f54f6a5102342c836ae2b0da13e2f3e3d48aab67d5662c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791510, "uuid": "216cf4fa-ba63-4dbb-a37c-48a5f8c9deb1", "comment": "Malware payload (AsyncRAT)", "value": "3795bbe735d88c6f7b51bc00baad9639ed793f9f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770791510, "uuid": "75ba9331-e2cd-4a8f-bf7c-d24d8a574c56", "comment": "Malware payload (AsyncRAT)", "value": "366da355af25287f9ca3e8233cb236cf0cfcf0802ea4410072f8e69414fad271f9fb9eec919ccdf0516f9aed42e92a4d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791510, "uuid": "8033f23c-d4a9-4def-8134-47afd31b8ed8", "value": "T1F7D23B08B3D48561E1FD57B94D7292048771EE4BA973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791510, "uuid": "721ad98f-00a4-4963-bca7-9a694b278402", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791510, "uuid": "a4774087-1072-42fe-9481-a61ae576694c", "value": "768:I0oRXxvJ/qymYg/cIRGqo+/Rb7fB/dTD/+:voRXD/qymB1iwRbN/F/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770791510, "uuid": "19918a66-4885-4e79-a178-88d1e4687cde", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770791510, "uuid": "b97cf91c-3355-40b9-9bd2-300fbbcd9af8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770791510, "uuid": "0032afcd-e3d9-4c15-9e8d-cd7f2dd62817", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7baf4a17-071e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770796293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796293, "uuid": "15c49912-a1d9-4d1f-9174-407f5a3151e5", "comment": "Malware payload (Mirai)", "value": "e4fb1549ef7ed1cff34fb7b76be47490", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796293, "uuid": "5c925772-8aa7-44a8-ae7f-85effc3a8665", "comment": "Malware payload (Mirai)", "value": "d2e1172f111465559e1974f54f8050409f47d70c4efb1bec334a2a664adade48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796293, "uuid": "89194e57-308c-4d43-8799-ff9612e2420d", "comment": "Malware payload (Mirai)", "value": "a38239c9673f5bbf4143aa7fa88da4d44328a7f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796293, "uuid": "691ed109-4210-47e2-9974-19350b05b563", "comment": "Malware payload (Mirai)", "value": "8f187b5fec228deb0e351796505900d96765fcb47f50d6f7cb4d7fcff094dc85787b228a578300c986ab060155e5bb32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796293, "uuid": "357820d7-3e1d-4c6d-93fe-a8e1a5bb9d20", "value": "T1C0D2E134E2EA8748C07F007714AFB8454C04C61CA8AD895CA964357EAF13F237A5E9D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796293, "uuid": "bcb82d08-c52e-4b6d-88c7-3eccbde6ecdc", "value": "768:86e1q3IUrfA8tfCURk94i3BWwYrGVnbcuyD7UM7g:86usIUrrRk94iU/GVnouy8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770796293, "uuid": "fac8cc45-dd3e-46f7-aa6c-95441dc37d87", "value": 29816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770796293, "uuid": "050b4b3b-a1ee-4eb2-8128-0265e8b55caf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796293, "uuid": "4c85c984-b1bf-4d29-84bc-b08ef08c5fa5", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd66ec4b-0720-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770797369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797369, "uuid": "c1cb6563-0ffc-4417-bc97-a01469414a92", "comment": "Malware payload (Formbook)", "value": "27afd8d4325533c9acd70fceb3a8c3be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797369, "uuid": "5f31355f-a1f6-4fd6-907e-9fa1a05a08fe", "comment": "Malware payload (Formbook)", "value": "d2e68ad5316a9cb37dcbc3a0fec4effe891ef43af8b3c19a1716ba21a3bd7e3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797369, "uuid": "fd73aa56-a837-4766-9a0c-a9da2305e68c", "comment": "Malware payload (Formbook)", "value": "eed6a93687d57def59fbc07e238469061b54c1cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797369, "uuid": "06792c89-e0c3-47b6-ac45-69a9880eb003", "comment": "Malware payload (Formbook)", "value": "3982c313de154409aa2be1023649708d8b9b3afdaa22b61230ccefcd712e4f5a255d789cf3ca8977a315913276172334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797369, "uuid": "eb755c11-ba74-47f8-8fdf-5ea14f4ee87e", "value": "T14305AF1DF5E260D1EC22D8B30E5E97E14E1B7313A7A6189723B806044F934FB1F6AB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797369, "uuid": "5211f030-4065-433d-9e12-edcd7f612bf7", "value": "244ab0ad2291503631a7b67d57f64503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797369, "uuid": "5d790b9d-1800-49e1-bc1c-5508ed806dbf", "value": "24576:mXr4nAKR2ul94XM0UK3gKT2CnXhtnV46:mXYR2ulChgYxnRv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770797369, "uuid": "7fbee22a-1050-4a94-be94-70e4a00957d3", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770797369, "uuid": "b9bc388a-8d21-43aa-9d8a-7e700332d749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797369, "uuid": "3fec173f-8d49-4392-a498-2e749cb5b74d", "value": "MV_ABB_MARINE_INQ-89230001628119191_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd773ae2-0761-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770825233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825233, "uuid": "624ec77c-9db1-4951-a474-0ddbe5ad5469", "comment": "Malware payload", "value": "3d1d14dd4431c978f49765e2a41ec7d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825233, "uuid": "28e26b32-0ac4-45e5-96de-dfd55b1cd9c9", "comment": "Malware payload", "value": "d39fb4775d128ffac734ee369eb2ea36b1aa9f5247a570cc6bf16bd74c7c6bc7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825233, "uuid": "6b551c86-272c-4d54-8db5-65a964974e67", "comment": "Malware payload", "value": "2a48829d75d410e50bfbc49bf8f9876ab16bafa0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825233, "uuid": "1b1869c0-a35d-4e80-b87c-1be0ec57eff8", "comment": "Malware payload", "value": "86991611d735dbeda8fbbe9e377af938d63fef8602c27026036570dbaf50e2f3b456e592d9e6ec093d1394f2a35c876f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825233, "uuid": "3dffd12f-3a19-4b2e-bc84-836745283320", "value": "T1F4B4FDD92EC2F16D0F81A933F21AF06EF4F599F0536A4C69A4DC2C08E8A16D5FD58235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825233, "uuid": "bcc6d826-5d8a-486b-90dd-5cf74fb94815", "value": "12288:1LgB3tpRSb1iM+DNk7PGUCxTif7AIG0rh3jseztpQJtxWzeRJqkuwYSxE6UkiwtV:1LgB3tpRSb1inDNk7P7oif7AwrhjsYtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770825233, "uuid": "d5242ed5-282e-4768-9fe3-cd851b439d61", "value": 541232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770825233, "uuid": "b38b001b-86dd-47d0-8bce-3ed82702ba2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825233, "uuid": "891bde0b-1574-4bbb-b852-0e5ce96f7967", "value": "PO8767.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad86bdee-0795-11f1-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1770847486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847486, "uuid": "e3991676-148f-4f66-a869-4625eb4826e5", "comment": "Malware payload (AmosStealer)", "value": "a43ce81e5fc36583ceeb8e363f2b5e09", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847486, "uuid": "8a6222b6-5b2d-456d-8270-21cec9f50603", "comment": "Malware payload (AmosStealer)", "value": "d3ad6c9325b71044134c77b1e0c97c392a1f8d27f0af041d48325815dc1516db", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847486, "uuid": "db89d7ea-42da-404c-acba-acb43a3e73a2", "comment": "Malware payload (AmosStealer)", "value": "836a3d0d3d90c8a87079c3e28d3a87ac91509ae6", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847486, "uuid": "d028fdc5-5cab-478e-a6d2-3fb9b8df7d42", "comment": "Malware payload (AmosStealer)", "value": "ab44d7d066d5aae0d50e90a059a40616b9280e449b55c46588682da7aedc58dc2a3518dc48f89a6b0b894d716c7394df", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847486, "uuid": "cefe930d-bc90-4f40-b751-33d658dbb4a2", "value": "T1A0B419E7623855F2D98EFB7CF44F2226F971BD4019B8A5D05D820E114ED9370AA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847486, "uuid": "c7148cf6-e6f0-4b06-a196-58cda8ad9b55", "value": "12288:D0l+NcArlEE9ncvJJQqlsgcQv8pBprQMxJVXWlnnnHuuu21uKb+AfI0m:D0qEL8pBtkfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847486, "uuid": "cb175874-d52b-43e2-b608-fcd7d415a4c1", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847486, "uuid": "3ae943f5-90ac-4b59-8adb-1df764316852", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847486, "uuid": "136fee08-49d9-4051-a255-8bc578aec346", "value": "d3ad6c9325b71044134c77b1e0c97c392a1f8d27f0af041d48325815dc1516db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cb15f2-077c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770836543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836543, "uuid": "7f023db8-3774-428a-a7ea-7d550965bd8b", "comment": "Malware payload", "value": "5e87b948711eeaa8804850bdbfe6e997", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836543, "uuid": "34612f7e-6a2d-4b8f-8188-bf23d58e997f", "comment": "Malware payload", "value": "d41ce666fb172891437932c603bb32a7189aebeb0951ded6380da17ce70e0c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836543, "uuid": "35200c53-07c7-4e5d-bf9a-72dd75ac3d50", "comment": "Malware payload", "value": "debab650f93c76c2e1835556f90b026c49ee41e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836543, "uuid": "02d0bfbe-07e1-4f37-9853-61780ef7ac8d", "comment": "Malware payload", "value": "91b39c50d9038aaa385f610ba0d3f5fc039f91fb5185bace6b55dbc6f5fa106d2ebac81b906d2a1271b1b695db0d27e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836543, "uuid": "ff87f477-3e81-4c4d-b959-f2b7ffff9fed", "value": "T1ECF7DF0773E502A5E1B7D139CAAB9107EBB2B8161730C7DB329C03652F676E05E7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836543, "uuid": "4e8ab043-bb70-4a21-978c-76340903298b", "value": "174435db180feb9caa3b336186ee6a8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836543, "uuid": "51d5eb86-84b9-40b5-a687-50c707ee2bd8", "value": "786432:AaW1JhQlR7TtKeagPV1tmrTQsZbU1og1/dNXnzJVltmo3O9vFpqLfnXeWhtQPW:AaywR7hKGiQ23gt3jJVnBYUfnOeK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770836543, "uuid": "7d7498c0-f926-4dcf-ab83-635ba7381c62", "value": 70367825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770836543, "uuid": "10adf1d4-d569-4f4e-bf13-3813b2e3f9ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836543, "uuid": "46021bec-df5e-4571-83a5-ec193f20d043", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aeea755-06df-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770769260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769260, "uuid": "63b10614-47a4-4577-b833-f06a5815b836", "comment": "Malware payload (Mirai)", "value": "89d713d3b79984f6fe4f578319ffe899", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769260, "uuid": "289390b5-aa02-4788-a55d-8720ba14ab03", "comment": "Malware payload (Mirai)", "value": "d41edefed34df54a32939cac00c03722fc1b1909fd547929ffd244626eafec38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769260, "uuid": "9e2b86e1-21e0-4359-b7ff-56eceb75182e", "comment": "Malware payload (Mirai)", "value": "ec77ebea70a81e5632bcc9f24dcacc35f2b05091", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769260, "uuid": "cf4d3361-6ec8-4ab7-b0e7-a250129797da", "comment": "Malware payload (Mirai)", "value": "5cefdbe97ede399bc7f7ffd845cf71338c7e12de7db5b38883827379be690c802530ab2744cf938ba9850b1f44ab1e60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769260, "uuid": "dc373672-db8e-4662-b431-ed87ed4ded34", "value": "T183A32996BCC5C202C6E061B6FB1F91CD371643B8E3E6B107CD19AB29674B8A70E37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769260, "uuid": "86a11b0d-a7cd-4c57-b25f-e9ec8993d456", "value": "3072:zW1jkGtWLRG16Lbw9OocIcIH5sVlYOogX:yVkGwLRxbw4PbY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770769260, "uuid": "b029272b-62ad-491a-afb5-696df43c376a", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770769260, "uuid": "4c84226c-4123-44d1-9670-b3f5c911d997", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769260, "uuid": "11d68d3b-f952-4b02-b436-d20d44e9ed24", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb47374-06f0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770776541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770776541, "uuid": "eec3c899-15f9-43c1-a21e-d46d68c11a22", "comment": "Malware payload", "value": "55f3f55420a2ac77b38da0507aea116b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770776541, "uuid": "186a9d15-91fe-455a-939f-44532c22d988", "comment": "Malware payload", "value": "d443f93731f57db11bc5df7a4dfcdcce185f65b22b917a0794e2369a20a8c72e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770776541, "uuid": "7df81cbc-4aa5-4c05-90bc-7e3f40b4f84d", "comment": "Malware payload", "value": "ffe99543bd00a40834d0706653e1eedc6d627fb2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770776541, "uuid": "711deeb1-cc73-4bdd-b8cf-5af87cd97fab", "comment": "Malware payload", "value": "89f3749b8a611b1f634dd4eee408880b1d69d148e95dcfe2fb9688ad1d0aa95fe34725cd6039eb6a3c3fa24de21ad523", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770776541, "uuid": "6caf386b-e184-4227-89b4-3cf993eed4a0", "value": "T192347DE6A348DC19EF72193C34DF9718322BEEA3FD52760713D47389A9723D9215281A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770776541, "uuid": "ec253cb8-a3de-43e9-a9d1-ae8d833f7171", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770776541, "uuid": "ee904b2e-aeba-410d-b95f-77e3f80f1c3d", "value": "3072:S1b8muKKZmrZj7Iq+gJTef4Vxv9EOYfcjQyGv/TCt1wEC6fFTB5:uba2nh+g1Z9Pj8/TCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770776541, "uuid": "6881e115-509d-4135-8eaf-a21fb7ed4d47", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770776541, "uuid": "40e0b7c4-f8be-4bb5-9b85-a159b31110f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770776541, "uuid": "8c33bba0-f7b1-4f48-9729-4435123df2ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e7266b-077d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770836976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836976, "uuid": "6ea4bffb-1bff-4047-995f-2db68284b260", "comment": "Malware payload", "value": "3c0c63853e47c828c7168aef4114941e", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836976, "uuid": "202c928b-30f8-40af-ad54-b9a960e24dae", "comment": "Malware payload", "value": "d46617ab7e3f8cb3402f6baff7e62f545587d2d192b8ca67c3d27b37ea186368", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836976, "uuid": "7cd321ff-ad5b-482b-9856-f104ef7d8df3", "comment": "Malware payload", "value": "017342053e7b1ad5efcb7d6fa05500e0e3e9429b", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836976, "uuid": "5e5f3a7e-dfce-471d-8365-cdd9735c6c99", "comment": "Malware payload", "value": "0b3c73f42f47e3bdc97039f34a92dbdde8779b6fba3c63acd47a5026aa0a576be4a3ee349437484ed6dead3f91481949", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836976, "uuid": "3961ee21-134b-4f11-b760-477bf04cbcfc", "value": "T1FBC2D1D4777081A5F56A87B05381FDD3BA226C991E74D6736C725B380529BCC06334D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836976, "uuid": "f974f136-320b-4094-b29e-1a46fec9bff2", "value": "384:uZJbjXP38o29UIW64CONHJh1msurb5PEqRciL5zjMXJIevmvZJR3p:uZpdSTWTCONHcs8bKq3zIFmvZDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770836976, "uuid": "d7b03d30-6ace-4c3c-9857-bdf9f6e881b8", "value": 26546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770836976, "uuid": "3ff0f569-ae63-4463-89c9-d05b066d069d", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836976, "uuid": "e3e4ebe7-9a2b-4814-9dd9-f0d638793adb", "value": "IPSInvoice.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e947e0-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816437, "uuid": "c4809416-e766-4d93-a10c-79b554186dc3", "comment": "Malware payload (Mirai)", "value": "bdb715ac12a7a8fd1d5fdddd3d3f5b1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816437, "uuid": "01651464-b2c4-42d7-84e6-977522b31e70", "comment": "Malware payload (Mirai)", "value": "d51af623c4da1b0c74b6017f76083dc5c39dad3995e56af8b156a50825d3c21f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816437, "uuid": "74f0b0ad-9118-4131-9110-ad3d6b6cec6a", "comment": "Malware payload (Mirai)", "value": "a4d40f9473ad05b8d2c1e2265048a641b230d38f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816437, "uuid": "fe5e18bd-21bc-442d-8b29-877337d0ede7", "comment": "Malware payload (Mirai)", "value": "373c87b40a60edfe26c5d976ad20ada79e0b26d2aceefcc9dd1cbf147e5a4e20ae97ef64bb34d0e3e10d5ef983ff2c33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816437, "uuid": "dd7def4e-ca16-4a36-84b8-ef2b6e58ddab", "value": "T186E2E050F6554FE2D5FF24711A5BA764B3E40A9ABAB1828487C18F04D690A39FB1CEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816437, "uuid": "388d0b87-213f-4dd2-b0ef-147841e34010", "value": "768:uC4d9cEIEM72bmUOyslk4d7h5Ys4uVcqgw0RTWXr:Hojni2bK642s4u+qgw01WXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816437, "uuid": "5eab9e38-d4d5-410c-8251-a6107078e8bd", "value": 32200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816437, "uuid": "3a29bd2b-35d1-4077-ba45-66fff90f8d79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816437, "uuid": "9a185095-7648-4802-a696-7fa0ab3bbb21", "value": "db0fa4b8db0333367e9bda3ab68b8042.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9453775-0761-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770825172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825172, "uuid": "076fb145-1524-47ab-8877-2d06108950a5", "comment": "Malware payload", "value": "a15da9de1f57c28f6aed70dc457780ad", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825172, "uuid": "cc168be8-68a4-44fd-9fcb-d761d4b23bef", "comment": "Malware payload", "value": "d62dbcdcf1cc56e79a7326baadb6124b7ca6d505cd76cc85b53c66aa5f3cf6af", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825172, "uuid": "2323d5dd-3eb5-43cf-8380-34ae6289e828", "comment": "Malware payload", "value": "324b9c67fa7f8758a3bca89aec3dc0ad67d228ee", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825172, "uuid": "de6e0927-3cb7-4df1-a6a0-be161e30264f", "comment": "Malware payload", "value": "1aca08492f8f0975ed369f76c823fbcf9e27f0131fb55be2067af74422163f8d83a44f209bb86fc74133a5f16ff06acf", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825172, "uuid": "c48e3068-7454-4227-acdc-6df530d463e8", "value": "T1C5E502BB58B2A9535B904663E70F2C1A339F29D13B58D346EA51905C2F3B1D38E91B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825172, "uuid": "8e365e82-f704-47b0-9d43-98c6300276b5", "value": "49152:lOc2yD4lTP8t/xBm2FRbvZu/L2ewx6tGjbHucD2iECaiv0zavlvZ0Td8f60drBJC:loyEFPA/xB5F5ZuDndGjbHucbECaiUyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770825172, "uuid": "044b233e-e708-4020-8c05-aeee1e72dae8", "value": 3054383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770825172, "uuid": "da84a7d1-1110-46f2-b63f-73bd1659f0ca", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825172, "uuid": "892a1b38-c802-4ad6-9272-1ba05ae94533", "value": "JEWILXCV.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36759ed-076c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770829887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829887, "uuid": "702dac67-8eae-4775-8b0a-009ebee50f55", "comment": "Malware payload", "value": "c012563cf64a20acdd8318dbb27c185c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829887, "uuid": "fb9c9343-1796-4bb3-96c0-c96ec8df3c25", "comment": "Malware payload", "value": "d769eb7336e1f9d250023354aabc22d5243584e501b6bf865793f5f011ae2dbd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829887, "uuid": "c1652a07-61ef-47e1-9c42-139775b0b6fa", "comment": "Malware payload", "value": "f48f39983017174b9b11470ce114a03024dec89d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829887, "uuid": "879724ad-8c6c-4a3a-8c48-a3b8aacf5bb1", "comment": "Malware payload", "value": "c28ea8f7b8f7d09d2d2db0994cf055f554dd5571c8f71306d578c8b638ec532e906dbbcd640f9b666ef853461da7d0c0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829887, "uuid": "bd41f780-13bb-4db8-a94c-47030ba2538b", "value": "T121152983F6B68CA3C7C90435DC7AD2B67B24761CE3F786327280E9D7B5B6251781421A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829887, "uuid": "c8149570-c162-449c-b479-5bcf3952429b", "value": "ae118f3d7fe149b456ac30484c6830f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829887, "uuid": "52b0343c-bbb1-44d9-ae22-cff45b98375a", "value": "24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXl:7wqd87Vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770829887, "uuid": "c8254488-3f4d-4e30-a2ee-8989e8267847", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770829887, "uuid": "9f9d85ca-bc36-467e-97c4-ab69e3afd6c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829887, "uuid": "2cc718aa-28b3-438d-99b2-bfaa0a5c5838", "value": "d769eb7336e1f9d250023354aabc22d5243584e501b6bf865793f5f011ae2dbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e452e7-0791-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770845693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845693, "uuid": "5cb774d8-966b-4413-896c-4ca07216806b", "comment": "Malware payload", "value": "94faf3659f42465fb29f262468ced522", "object_relation": "md5", "Tag": [ { "name": "7z-dll", "colour": "#02BB8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845693, "uuid": "cb161520-ec3a-4082-8072-b2f5ac57d6a8", "comment": "Malware payload", "value": "d8115cd606a9733ec467cb5168328711fb5c78e8a81e64c3cf01a80532396ee9", "object_relation": "sha256", "Tag": [ { "name": "7z-dll", "colour": "#02BB8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845693, "uuid": "50413b4f-4d22-4d1a-bcec-836afe6a1496", "comment": "Malware payload", "value": "cd10eedf25e80e5005a5ba91b7f6ba384da8fa34", "object_relation": "sha1", "Tag": [ { "name": "7z-dll", "colour": "#02BB8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845693, "uuid": "a7c77625-0fe9-4266-8b16-279f8d0bc2d6", "comment": "Malware payload", "value": "0fa5b0a3f58987621f21bc0d03ef562be101d73739efbe77f463d75c9257a19d36e1ca714805660258c37be6e224abcf", "object_relation": "sha3-384", "Tag": [ { "name": "7z-dll", "colour": "#02BB8D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845693, "uuid": "93fddcd1-55a6-45a6-b7d1-5e4282ed94b1", "value": "T1DA458D16F7F5C074D58A4630871DABF640FCE71ACA1068C76BC0BE6E6F319D6C229989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845693, "uuid": "925ef205-0d19-4fd6-aefd-c3734d13fd27", "value": "f3dc956f72b38463817f1a764bf2b5a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845693, "uuid": "c849dbbe-7bcf-4410-a3b5-8baf1e0499fe", "value": "24576:EgiLEtP9FaybY4B7S0APFkWPHMd6axRnt3usIPK59x:EgiYXbY4B7EWrTwsIPK59x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770845693, "uuid": "a5a88058-c1bc-453e-a302-2004c55f9adf", "value": 1249752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770845693, "uuid": "9becf6af-d8a0-4070-8719-4819cdf5c659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845693, "uuid": "faa3ffc4-0d59-4428-90cb-fe07640e97cc", "value": "d8115cd606a9733ec467cb5168328711fb5c78e8a81e64c3cf01a80532396ee9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1328911c-077f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770837778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837778, "uuid": "35ebc070-dcb5-4ea4-a35a-533c05cb7dc4", "comment": "Malware payload", "value": "637d7b92325a8894dd96f94fc063fe17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reynolds", "colour": "#66C8C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837778, "uuid": "2f6e6a25-85c4-45ee-b4ab-11227bfe9b19", "comment": "Malware payload", "value": "d8c9744f57d1258571e38ea05531cc581be7dac51c74cb98f06df829c4f8f6d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reynolds", "colour": "#66C8C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837778, "uuid": "7c4e78fd-3ef2-49e8-84cb-04df90c39f3c", "comment": "Malware payload", "value": "4d6949d1fa5e2fb325cba8b6a4ecb3d884332ea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reynolds", "colour": "#66C8C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770837778, "uuid": "e628050e-6136-49ce-a65a-61c2e8537d28", "comment": "Malware payload", "value": "955f8c244c63df3e2b3eaf64d928793fd2b55ce1f4963515aacf0bc69f9934014132c2e6e96ba545eadc57ce0288bff8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Reynolds", "colour": "#66C8C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837778, "uuid": "72afeaca-2887-4d4f-bb18-93a15cedf964", "value": "T118448D7C7BE530B5E5B3823489655E06E7B278557760DBEF036403E12F23AE0953AB22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837778, "uuid": "df3fa766-0f51-4fb1-8010-74817588162f", "value": "3072:vVwEjye5w9AiBj8VmwV754kwUB6VuhcWInEo0IKXg3QuVB+B2N8Glp:vVwE+e5wpuhVnjigcWgt0I53HN/lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770837778, "uuid": "f532c4c0-ca68-42ca-a901-abcc4089d8ba", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770837778, "uuid": "ccf630e6-d6d0-4862-b717-56ff1d6518c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770837778, "uuid": "2b3c21b9-7cc5-497e-b6ed-9daee5065788", "value": "d8c9744f57d1258571e38ea05531cc581be7dac51c74cb98f06df829c4f8f6d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc54b6d-074a-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770815221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815221, "uuid": "2d557235-c461-4b5c-8950-eddda86ea553", "comment": "Malware payload (MaskGramStealer)", "value": "0d430f3d6fcff40659c6c7677acdf703", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815221, "uuid": "b345d923-be65-41ca-81b3-aacb6acd473f", "comment": "Malware payload (MaskGramStealer)", "value": "d8f65be6074b05a842ff6bea7e0d5bf341d0b81bb19752fd93fdba0eb196fce4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815221, "uuid": "f85c9bca-067a-477b-9654-e07820d34c22", "comment": "Malware payload (MaskGramStealer)", "value": "99483c887aa0ca5d65422e8b41627e06d96198fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770815221, "uuid": "7304db6b-9580-449f-9c28-b10afc716ea0", "comment": "Malware payload (MaskGramStealer)", "value": "caf237958a931f0497b156de9c262b67266cdfc7a03a62947a088f3067a87188cb5aafa21bb991a372a161d40d93ac80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815221, "uuid": "83d362c1-8efc-47a1-824c-bacf4b13c5f0", "value": "T1E0064B136CA08D69D46FE238E9E2028673B07C080B3236D76A507BBA1E777C4557B76D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815221, "uuid": "dab22186-a5a0-4ce6-882e-8e9480b4bc78", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815221, "uuid": "cf3b685c-ea36-4050-a3ff-0364ec4843b1", "value": "24576:V1Z67AFBdT5zMG6RaM0Fy2OOYiYcONN9OTdiOBnLGKDodEe6oBUlvKn:V1I7sBJeGyaM0Fy2OOYiuOBzuOeXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770815221, "uuid": "7abebc7a-dda4-44ed-b149-5b89102229cd", "value": 3665624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770815221, "uuid": "e6bce46d-1c22-49d7-ab99-7ea55c118ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770815221, "uuid": "d8692edc-4877-4792-8a27-4ef8bec922a1", "value": "52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251456a6-0719-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770794000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794000, "uuid": "5cf686a7-dce8-4f6f-be00-9a6d76fc71b7", "comment": "Malware payload (Mirai)", "value": "9313db6e1f4baf7476116dbd59622a98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794000, "uuid": "ee66a3fd-e69c-4793-b76b-8386a080b1fc", "comment": "Malware payload (Mirai)", "value": "d9677cf94ba0870fd28835d102702326cfa53f30653c99425c026bdc5e729f4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794000, "uuid": "48463ba2-3565-4f21-947e-bb77d8485dee", "comment": "Malware payload (Mirai)", "value": "5b9b0715484bd7eb3db62a4852507944bca39fda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794000, "uuid": "8143e659-c212-4d38-8a16-84c48c096920", "comment": "Malware payload (Mirai)", "value": "c8208f1a0864476575d91ede9225f8550e21d2d08ff8a5c5e3d67892d9113b354b50b59e1cf5e47b628542d0f7a892e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794000, "uuid": "3df18e62-fb57-4819-ba5f-4fbb48121086", "value": "T1D06301FBC245E12FEE252F329E2C45D26D6C1570F35B3AA89171868DEFD12A48322B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794000, "uuid": "18f2dcc1-7f73-4bb3-b317-3f009f87a56e", "value": "1536:mwwOnLZu42YfknYlILgUkCyVhHJ3TzxORxfccyoqQ+/FE8XL98:mCVuicn3MC+ToRxk5/GGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770794000, "uuid": "aed93550-f654-411a-912f-955c0f6746be", "value": 66780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770794000, "uuid": "30bb4c90-1eea-47cd-972a-65e717102a33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794000, "uuid": "3e264be9-abf2-4ff3-a619-2312c9495329", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb5722e-0796-11f1-a129-42010a9c0007", "comment": "Malware payload (UmbralStealer)", "timestamp": 1770847941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847941, "uuid": "9b4e05a9-0a03-4cc1-ad73-de4bff55c295", "comment": "Malware payload (UmbralStealer)", "value": "10ad1d8eb91385635066a7e50cb866c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847941, "uuid": "f2508585-465c-4a6f-b9de-1b6c15d3ae9f", "comment": "Malware payload (UmbralStealer)", "value": "d987393f7fa473c3702445a6644552a66f18e7fd0caeed04e8105028af4537a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847941, "uuid": "f1118c64-88af-468d-94d1-4ef87e105c4a", "comment": "Malware payload (UmbralStealer)", "value": "1ccedfdbf5d8ac99519c515c7621013644b71d01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847941, "uuid": "ce61715f-2732-4da2-8ca3-b118609b6a3b", "comment": "Malware payload (UmbralStealer)", "value": "ca62499ed1a0338bb48e793e0d2ce917097f41d4828da993835bc17a53df5b67367e85d1c2190e462514327860855411", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847941, "uuid": "f297c20b-317c-4046-98ad-167082408e83", "value": "T118346C5933B8CB17E25F8BBDD5B1548F87B1F103E90AF78E0C8895E82811B42E949E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847941, "uuid": "1d379c58-751e-4468-b6b3-d443839e3ad7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847941, "uuid": "56fa4ad3-2174-42a2-957f-7c04030c7aeb", "value": "6144:UloZM+rIkd8g+EtXHkv/iD4TVsqGELnshd42X3WhFb8e1m0Ci:SoZtL+EP8TVsqGELnshd42X3WPZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847941, "uuid": "49836386-dc76-451e-a453-b89f4f39f664", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847941, "uuid": "1beab31c-3b42-4a78-b2e2-50d34ece2f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847941, "uuid": "c6807aae-6563-4f98-b26c-ec3f79d44537", "value": "zensware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25808e79-0777-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770834373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834373, "uuid": "913191aa-1fcf-43ee-a4a2-776172a3defa", "comment": "Malware payload", "value": "f519c8792c0a64b86325354b78bd46b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834373, "uuid": "296bc1bf-f3bb-486d-911d-fbdeffc3c23f", "comment": "Malware payload", "value": "dce353226dff793072ad5e1f2bf30fa2402d5ad45d4a433d2e819668930d0c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834373, "uuid": "3eac660a-6ed3-4f67-beb9-3114329805c2", "comment": "Malware payload", "value": "625660f1560dbb99413362d07aee1367757ad56f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770834373, "uuid": "28a2455c-7ed3-42d3-b903-3d2b9b259eb0", "comment": "Malware payload", "value": "f5fc47ef00dfc9da621b60ef93821b419b3663b9916d4784d437d68c2f857222cc6b68b47a8d3bfe56e8bcc96d172d22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834373, "uuid": "01932a4a-837b-41cf-9ced-c137b683e6ba", "value": "T108064C11E8A24AAAD179E1345CF55321B67134A483323BD31A9BA1793CF7BD81B3E71C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834373, "uuid": "50cd8881-1efd-46e2-b776-36fb8e93a997", "value": "2d2db1983f16ee73d4e0b0e79a1481b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834373, "uuid": "e9533577-91d2-4d24-8ddb-1d7a0c3b03a5", "value": "49152:c6Kl1t3bkE2Cx3Hz2MF/j4U6Q4k7bhBcJF133jidwpFzaZC+VsgEUONDK30ekl4o:Q33gh+e08eWDzJkap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770834373, "uuid": "8d637b6e-b4b8-46c2-9770-aa24def64886", "value": 4015101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770834373, "uuid": "355f9b86-7dcb-4feb-8d7d-465964840e6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770834373, "uuid": "e78a9896-d06d-4fac-a73d-bbbf4d79becb", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65574253-076c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770829756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829756, "uuid": "31a0ee3b-e95c-431e-a602-944a101e960d", "comment": "Malware payload", "value": "c94fe911ae30f58836423d98e1db5613", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829756, "uuid": "e6654991-93cb-4d09-bb2a-b848351b6dbf", "comment": "Malware payload", "value": "dd1a0a347e17c36f966c5d32a7b589e76541a7dfaae618b384c5da9f577e8b5a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829756, "uuid": "d8f1d2bf-100b-44ad-ae9c-f69e7995e34f", "comment": "Malware payload", "value": "934f3714cc4049218d1eaeee670d83859919d4d1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829756, "uuid": "5603a5b2-d2ed-4ea3-9a33-c56ee66051eb", "comment": "Malware payload", "value": "92bf7aba0cfe4e65f9026f4a8343a481e37e9b92a2f94f0b767eb80a36853a0fd928ff45dc018ef458f06244537e8bee", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829756, "uuid": "5b67c8de-a9a6-453c-8e27-8fc8a3602cfd", "value": "T136A5332683B911ACE828EE787F5014BD60272735C36E3A6FD23636CE4B54658EE411F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829756, "uuid": "c21882ce-4ba0-4516-9cab-0784ddbc81f0", "value": "3a8632a6ba7f7c06aaa289e4406ae495", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829756, "uuid": "c7f71707-8c6f-4ad4-8e40-516c8e2bb067", "value": "49152:Jx5DOyptulPOjpk9hS735+Do3goGAWe6S:JnDRgPIpKhSb5+Do3go/WN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770829756, "uuid": "b6b2aca3-6f7b-496f-ada4-5cecf8016673", "value": 2064384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770829756, "uuid": "8bcfea70-43d2-4cf0-bbf9-3ee767b7f3b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829756, "uuid": "8fa3fc12-4465-4bf3-9d81-4565ac6449c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0072bd7-0768-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770828163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770828163, "uuid": "4cde851a-b676-4adb-9e6b-d8a4f57ab556", "comment": "Malware payload (ConnectWise)", "value": "de7f22b1cfde5f744cc7761337b1fb45", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770828163, "uuid": "8598476b-3bd7-46bf-be47-47db40ad8e20", "comment": "Malware payload (ConnectWise)", "value": "df7ae2cf23e74912a367b0d9c4d9ee0857666a2ed02a4a073a99604659e7c1cc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770828163, "uuid": "b6979828-65e7-4013-a061-31371afa94cb", "comment": "Malware payload (ConnectWise)", "value": "d3814480ab70b30e2ef01c4020da25cd92b3471f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770828163, "uuid": "f3a49ee9-4eef-4fc3-b340-4f088f00ab51", "comment": "Malware payload (ConnectWise)", "value": "8b41c41f6f3f09792aea6e35a522ab75428a4b0a451aaea3929febec54deb68cee968d3c1923c90bb9ceaced9078bf48", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770828163, "uuid": "597e2292-6696-4766-aaab-f183f532b284", "value": "T129A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770828163, "uuid": "29dc49ee-4b55-43dd-9366-0e22ddefed99", "value": "196608:GKaLNkbgii4Q1KaLNkbgRKaLNkbgdKaLNkbg:oWgiiHpWg1WgxWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770828163, "uuid": "9fb3f418-0fbf-418f-9636-10517f2fa36f", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770828163, "uuid": "984cc82d-ccfb-46f9-a81d-47eda91df5b3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770828163, "uuid": "bcf165cf-b151-44b3-a3ce-08b4bd964492", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08cf3199-071f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770796529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796529, "uuid": "51fc4311-afd0-46ec-bbad-455ce566e1fe", "comment": "Malware payload (Mirai)", "value": "0aa26e0a16c92e01535ae88408bd2e30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796529, "uuid": "524b3ee8-8cba-4195-b083-45ffc5e1d05c", "comment": "Malware payload (Mirai)", "value": "e02236b41b8a552f44861ed7a56022d384c0b39eb22acefad4b78626955d2f67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796529, "uuid": "9159e20b-7439-4fed-ba4e-33c66b4a7862", "comment": "Malware payload (Mirai)", "value": "bdb159322cd3fbf185f972c176ec6b288d1d91ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796529, "uuid": "4d2118ee-b6c4-452a-a115-54cade680b9a", "comment": "Malware payload (Mirai)", "value": "fdac7fd082d7308450c0f1e232a8fb0a36b9ec2fd60e719dc73c8f0c43774575df6e2e2fb09530b4ee77df4febff668b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796529, "uuid": "8d8a7e2e-d2d7-4637-ab87-1a13f302c351", "value": "T1FD937CC4BB43E0F9E82709752172B7328B77F129602ADF57C3789931AD21901E92E76D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796529, "uuid": "19c44b91-c888-461f-b5d6-5652cebddcd5", "value": "1536:dAnIhuK007/WM2YWPRiR7Wwn2aRmbhuR16CvSOtB/XSC:dIvMD2YwRi5WTaAufJKOtRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770796529, "uuid": "b9c536a8-568f-4fa4-87b6-5728a8b2b181", "value": 95208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770796529, "uuid": "d9f83e9a-7758-4559-a485-482119e4bb1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796529, "uuid": "ab90e0dd-9b5c-4c14-8060-888b927e0aa6", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32783934-0740-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770810773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810773, "uuid": "2e183f3b-9dfb-489f-b30b-cad514ab205b", "comment": "Malware payload", "value": "705f570e89ccbbcb32b8bb304537a2e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810773, "uuid": "224e42a2-2626-4319-9b4e-946989c2570b", "comment": "Malware payload", "value": "e20f3a7806418c2739ad3d47959857eb0dd2e4960e966f413c6e047d11d003f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810773, "uuid": "c676d7ba-4931-41c3-90de-c7b24054706b", "comment": "Malware payload", "value": "4c9e05b90802987242a919295a6190b851f35436", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770810773, "uuid": "a8ff9342-a37a-4e97-94ef-4affdd8024ea", "comment": "Malware payload", "value": "ca5aaa395a18f475b1f6531dc039dd2df06bc6d4fac0ee3279aff9c53d5c72bf7bbd543d217031cc3abdf07249135bfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770810773, "uuid": "53c6d572-9b48-484e-8706-bb97c10222af", "value": "T150053A01BE4D15FFD5C6C734526349A29B35748B3B60A9DF0289562AEF6ABF60E3D300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770810773, "uuid": "be101e4e-5109-453a-ab88-6ebd7b439658", "value": "d6ff2d8d10a4945b5a263e9b05c0c186", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770810773, "uuid": "872b7e99-0083-4bff-a5b6-4ca3191e39f1", "value": "12288:doRaVm04otPqI50LO2XlIrh/bW6SoUfcXe/3:do4ZvOO24qCu/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770810773, "uuid": "f3058df4-47c3-4ff7-9e2f-654f1e711cbf", "value": 867056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770810773, "uuid": "f217859b-6056-41cb-86f9-8ce019b1e4eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770810773, "uuid": "f2dfc9e1-96d8-4c7b-8ebf-bddd25a30df5", "value": "0yxsgr56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8b13c9-071a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770794605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794605, "uuid": "47cc4e89-3826-45d3-a826-9df8a2502d60", "comment": "Malware payload (Mirai)", "value": "af49db03ccbb6c1acdc8e8d7fa07821d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794605, "uuid": "c743d7de-26dd-4558-add3-f55c054b6c50", "comment": "Malware payload (Mirai)", "value": "e345a4cd23ac33d878b9dba438c2d12f623456548ecde9c7a5d7b0cc3337d44d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794605, "uuid": "7357535b-2f6f-484d-ad47-ea65a73a50ed", "comment": "Malware payload (Mirai)", "value": "fd688aeafd3bf343b86728688ce0e5684fd9e892", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794605, "uuid": "d3516c5f-2edc-4be7-b1b1-613b0882c4d5", "comment": "Malware payload (Mirai)", "value": "65cb6a9f6c3f7b8ec19779d7b17d374e295963afa4d9e79b1c63bf735a2475e3f4621f51dee68d57e8fbe1990ed04523", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794605, "uuid": "66002f7e-ceed-4271-9b80-bad70a2980f2", "value": "T1CCC2E1753562E0A2C6744E36AD388A4261C71B7E9570712B3A38D4FD52E9A0D07F9B07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794605, "uuid": "603f8c9c-ea97-44b9-9b5e-5cc6d153af1b", "value": "768:vHbAmS0hAAzix+3HdSmtfFZFTc4R1s3UozMBl3:v7AmS0hjHdH9/Tc4qzYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770794605, "uuid": "71362bf9-c7a0-45f7-9ae9-f93f40c251cc", "value": 27456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770794605, "uuid": "e90d8b21-2765-44e2-bda4-dc188814e0f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794605, "uuid": "7c1d7f4b-cb26-4fdc-b3da-f6cc17981c43", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f2b9c4-0795-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770847557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847557, "uuid": "518b6fb1-8467-4c6d-86a0-89fc73406452", "comment": "Malware payload", "value": "d92be1b82e3ed7be464f4f500d2986e2", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847557, "uuid": "cb08e036-66b5-4c42-b151-f35d2148aa7c", "comment": "Malware payload", "value": "e3b5a5dbbccab4cf36c7abf5cb5ae83062dd1b5dee7db04bddbf53fc9ebdb233", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847557, "uuid": "c2f36727-9e17-4368-9659-8ff24abb91a3", "comment": "Malware payload", "value": "8473b9190a748c77a3f306d946a787c3092d9a83", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847557, "uuid": "50d41411-d408-4199-8082-81b75812967e", "comment": "Malware payload", "value": "d6957039cb8e36a9e5f5cb90eea3770721bcd9420201cec3c6eac67ea882fc7821e70fd29b38298350a265a14956ae43", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847557, "uuid": "e8d1e2db-0135-4e1f-87df-c65b0a389ee2", "value": "T103C04C49002541578EA14D393671C39E2DC0A9A145F162705027262012CA2BAF79F53C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847557, "uuid": "c822e2f7-2298-4cc6-94ad-5fa97061ac90", "value": "3:ns3FV39C5rDSHTmF3dDSHT6IaFOd8aSHTerDSHTn:WFV39CHkSZdDkmIaZak6HkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847557, "uuid": "a41e86ff-a123-4587-9798-9a8693e39798", "value": 138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847557, "uuid": "e5005718-188f-44c3-a1f4-4338d36b88a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847557, "uuid": "fe45bd1c-a732-4adc-8409-03c4b61b476a", "value": "e3b5a5dbbccab4cf36c7abf5cb5ae83062dd1b5dee7db04bddbf53fc9ebdb233.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad1a92f-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788104, "uuid": "498304f4-8ec3-4305-9218-151a0911a0e8", "comment": "Malware payload (Mirai)", "value": "604219560e211233d37868b968d6c3e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788104, "uuid": "b64d44eb-0759-43a5-9ad1-b08ccd09b8df", "comment": "Malware payload (Mirai)", "value": "e45a52959c4b82db82af83ea793eef41221055241c46ce7acecb83fb17a36077", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788104, "uuid": "c3232998-04ee-4842-9bc3-64358dbecb7f", "comment": "Malware payload (Mirai)", "value": "3b4ff73f4e3d4f921d481dc62c81c16b3f4fec58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788104, "uuid": "e2a5d215-8d3c-4014-a999-081108a0ab3d", "comment": "Malware payload (Mirai)", "value": "137a672cc18dceef5d7928e5b61ff7f0fea08653acb26f17ce470c0e584d6334dcf8b9ab55d5da3ff087d230baf9fa24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788104, "uuid": "fcce9eec-6c58-4f12-9c4d-382629868ca6", "value": "T11314F946BD518F23C6C311FBFB9E429C372667A8D2EB3102DD257FA437864DA093A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788104, "uuid": "8e8ae3c4-ce3c-45c3-869e-fa7eaaff0f58", "value": "3072:Y3TlJxGMSsd8EsAiEmjRqTiJKzTp6c4JVQZsIhatd9j47nGbWL:GDxwZETLmjkOJ8Toc4JVisNX9jvWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788104, "uuid": "6bf0a6ed-cb85-4d41-befa-80a67df60872", "value": 206172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788104, "uuid": "068d5a05-c090-4ee3-8fbb-d8a1c9a9cc7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788104, "uuid": "00cf82e5-a18e-4c7d-b1e7-e35786ff7fc0", "value": "bin.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775e640e-0752-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770818619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818619, "uuid": "889d7907-d28e-4c85-a65b-8d3e8942e3e6", "comment": "Malware payload", "value": "1bff33de5ad6773fd97f8ff164e3d7aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818619, "uuid": "da9d3dfa-7c42-4161-a655-da3289e8ea92", "comment": "Malware payload", "value": "e46ba570e9e4b5305bce9e9b82e113c9465525a5290319d47737dcf6277c256f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818619, "uuid": "6d4a9955-3ac9-452f-b618-b37734da855a", "comment": "Malware payload", "value": "c16a35ca8a8e5a973cf8c155b8bed885d9261174", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818619, "uuid": "6d079152-2b40-4d2c-8d09-44f66966da5c", "comment": "Malware payload", "value": "370bfac17b6778dbc9df4480c8683204f8d49a0a9e0d2d759f3743bddada42770efd01410d6ca4390b24e0696e6170f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818619, "uuid": "3ec6bd46-c183-4cc0-83b4-dcb54e62e6ac", "value": "T148D533D3C95E5AF04B8552C5B70F26AB462019296D43F03AB0EA667853F88787ED730F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818619, "uuid": "5da66b56-e77e-43df-8722-25f08c312e2d", "value": "49152:26oqXzZ5RtjH/ZYIEHahhVVuUBjSBAcjQzB8exj+4y1kX8j8zH1qSPhgVO4FV2KL:26oqLbHxY/ahfA8jSe+Qqes4yeXo8zH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770818619, "uuid": "9c6b0991-57e3-4377-8c30-13b7d7b6b8f9", "value": 2970725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770818619, "uuid": "c6708847-6db3-4758-81bf-14ba15676578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818619, "uuid": "1729bdc4-d651-471e-a772-cb2935b3964e", "value": "avx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d07c54-0730-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770804007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770804007, "uuid": "ab43ad23-92c1-409c-9fd9-7f312b348c70", "comment": "Malware payload (GuLoader)", "value": "0bbf3db03e5fa3958cde36eb86de62e7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770804007, "uuid": "42ce14ae-55f5-457f-931c-35cc42fd7169", "comment": "Malware payload (GuLoader)", "value": "e4824713433a3fc0db0d80b5a0be004909fa02b7927e020e97e03feb0402c12f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770804007, "uuid": "1b8e7aa1-4ef6-4079-b7a5-b700b31bf98c", "comment": "Malware payload (GuLoader)", "value": "bd8ff2eebecdd1f5d47e54dfa4c28a46007d062a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770804007, "uuid": "a871a52d-30c7-44f3-9d28-e814018f5817", "comment": "Malware payload (GuLoader)", "value": "c0d8b87a446d1305dd40a459207510ad7639b27c0fe1a6a5d29ecfa0d508cb08dbd332a67b46202b473115630a2bfb03", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770804007, "uuid": "f652153f-a197-48ca-ae57-c0b9cf3b57d5", "value": "T1E751D8FE3771C1B7D92B6CD596AC5109443F5C3B3432262C028AF648E43914A85DCBBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770804007, "uuid": "0039cb10-dc83-46dd-994a-c8375382b9ef", "value": "48:bnCR8hSzMNKFVTJQEb0OmGCDg2gMD/2nwy/K2FH0JmIn+fqbtpr/jWrAOGqlv7uh:bnV01FVTaEb0LtgS+n/K2FHIJprrWrA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770804007, "uuid": "9efb910b-f50c-43fa-8f7e-58bbe1198efa", "value": 2863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770804007, "uuid": "aaea353e-816f-47c5-9197-532ddf55b678", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770804007, "uuid": "d502eeb0-7a9a-4c6f-8243-4ee7b7d330f3", "value": "rRichiestapreventivo_n__38878_202602111259_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab55095c-077f-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770838034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838034, "uuid": "baa356a9-7aac-4cc2-b90c-5e8736e80db8", "comment": "Malware payload (ConnectWise)", "value": "510dcaf4911d15cbc4e6a62d0428ed50", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838034, "uuid": "cd50f291-e25d-4b9e-86e9-8d4bd095dfa3", "comment": "Malware payload (ConnectWise)", "value": "e4bd5b924e089b75d92fcb9f6e71c52958b79c4b3fe76476ac9b2750a5c7d9f5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838034, "uuid": "09d7cc9f-1c37-4ab1-9eac-5fd9a62d9a4d", "comment": "Malware payload (ConnectWise)", "value": "71e7da342ffdb814725b6bb36fb63437dddd8066", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838034, "uuid": "3520b821-16c4-4582-a9ff-09b52d308e05", "comment": "Malware payload (ConnectWise)", "value": "d2f71bcf8c08683d3d44c9759ebdf7998211ad12b8ca73a9e38dadc6a2ff684d89037e5722c2069b6bf45a910d3d92bc", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838034, "uuid": "8e2574fc-e298-4840-8423-024c3d2e35ef", "value": "T131A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838034, "uuid": "c9d1361f-936c-42dc-ba56-7bcc8ebb06ac", "value": "196608:JKaLNkbg1i4QiKaLNkbgRKaLNkbgXKaLNkbg:tWg1iH0Wg1WgvWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770838034, "uuid": "e28b3f75-ec88-4ff7-a7cd-4b1ad6148d10", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770838034, "uuid": "f852806f-fb30-4a1c-b47e-9c17390d1c67", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838034, "uuid": "3b971451-f700-4333-8438-a1dfbf522574", "value": "JODY_NEW_PROJECT_PROPOSAL2026.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2e9bef-0744-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770812592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812592, "uuid": "89ddab85-f7dd-4c79-b443-a27c8a130ae2", "comment": "Malware payload (Mirai)", "value": "72dc77014c57617c77dd90e939e95a98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812592, "uuid": "832e5ab9-f319-4a27-a753-d280dda778d6", "comment": "Malware payload (Mirai)", "value": "e691cafe1b33058a8125dcfc047ba420cf221f6bd92f27d51a2b8fbbdac5df58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812592, "uuid": "c1eb2735-e50c-4972-bd46-a5fb780a8887", "comment": "Malware payload (Mirai)", "value": "4343a8e1f9a7119b84a09e7e661764e9fa083b07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812592, "uuid": "745f414b-7417-4ddf-bd40-4b2dcd731fbc", "comment": "Malware payload (Mirai)", "value": "cb8f285eae5980f533f15d6ca12dba723fbd22d03efd595952b24cd61327f5cb10fa9610becf99330d7affcc92251be0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812592, "uuid": "ddde0467-19ff-4d22-9019-d6c5534a80f1", "value": "T148E2F19CC970B1C9E35C4D7C21D61A15A915F1C06127CBC2C7218BDAEBFE94A78E2898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812592, "uuid": "7a18cc29-1f9e-4b1d-b5f4-9619c26792c6", "value": "768:RS2g/r+0dsRZv6fOOEbIiug5L7q4jnJ+Di7WWBQr:g2g/cZv6fmbIium/FjnJ+OBQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812592, "uuid": "9c0bb93b-d5c5-4148-9b72-b35ba2458816", "value": 32140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812592, "uuid": "0c1bf712-11ef-4135-83b7-28f6b1b8fa73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812592, "uuid": "dc2b67e8-0f7a-4659-9ef6-d580116b1abb", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fc852c-078f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770844982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844982, "uuid": "fd8b88d0-5580-4532-94d3-5870190160e6", "comment": "Malware payload", "value": "c4edf28177e72d1bfc482cf4d05a156b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uphero-exe", "colour": "#D760FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844982, "uuid": "cc2b5f36-67b3-41f9-b78f-c71798d860f4", "comment": "Malware payload", "value": "e7291095de78484039fdc82106d191bf41b7469811c4e31b4228227911d25027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uphero-exe", "colour": "#D760FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844982, "uuid": "5b828295-ac29-4517-806d-bd30f895baea", "comment": "Malware payload", "value": "aeda326c3653f17120bb0d75738c0bd82e7f7f31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uphero-exe", "colour": "#D760FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844982, "uuid": "c693891b-b2a1-4e4d-9972-af344772099d", "comment": "Malware payload", "value": "fecc47af63577e8aa48891ad4f6867a6987d3ac409d96fa4fb5af2e55b74d8659dcfabaca72cf6cae864a99df6df45d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uphero-exe", "colour": "#D760FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844982, "uuid": "ef4d4bab-35de-476a-8f69-5eaeab2779df", "value": "T1DEB5BE12BB42C172F592027452FA6B7F883E9934673485C397D01E7989312E36B3E79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844982, "uuid": "8f6abf5e-2c87-4351-8bb0-ad100cc55e28", "value": "3c9f80f2e71286e71d7f91cdd26c6049", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844982, "uuid": "46147d58-7d3a-406a-ae56-8b7cebbf62ed", "value": "49152:hCV3m+X04yQjatPNBlG1coHqi47Nr9TPcPQJ1ErF/Yys:y3m14yNtPNBlG1coHq77NrN13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770844982, "uuid": "420e0b48-b3da-4097-a7db-a8c019a46c97", "value": 2382808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770844982, "uuid": "04e17500-fe88-40dd-9beb-9a207bba3fa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844982, "uuid": "37534b36-e0a1-483c-9dd8-a9eac354ffc9", "value": "Uphero.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b3f815-075e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770823639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823639, "uuid": "b6dfcceb-4c64-4314-a32b-1aa03b9918c7", "comment": "Malware payload (Mirai)", "value": "1d1b07065613cc12b70a8e11817e0aa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823639, "uuid": "49876ab3-f1d2-4e4f-9ace-3383e46467bd", "comment": "Malware payload (Mirai)", "value": "e763c55eb9187d7a521b66f8a939eb116288ebbba656e8cf4284e9d42520d742", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823639, "uuid": "b4f78646-06ea-4c69-be76-cb1ae3ad65a5", "comment": "Malware payload (Mirai)", "value": "b15cc17e0d1b12d8b310f199c9c438cb973be790", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770823639, "uuid": "c5b7929e-4abb-415d-9400-346d6507b9d6", "comment": "Malware payload (Mirai)", "value": "1021200fb310a829fb3da8f012891fe467c24b5312b7aa15b636cd5efa0c77fac57a330e5c96e95a00d1a3c0a5f8036f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823639, "uuid": "65fc158c-a796-46d7-ae1d-cc475bfb72f9", "value": "T1561329131451C1FCC968C2308B7FAA2BD533F07D6631FB9A33983E266D5AE201E5B095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823639, "uuid": "598481cd-8eba-46e3-bede-dc8467b58d03", "value": "768:l67Kp31eLpTeVFQzf9YitD8ht7NS3v7R0WQ611gsp:0K/YTfJmv743v7R0e1gsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770823639, "uuid": "76a5bc1e-e44a-4e4e-89d2-6224575554c4", "value": 42240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770823639, "uuid": "347c206c-7a64-45fd-8696-42ef4ff9dbca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770823639, "uuid": "5c5969f3-8eb0-4024-b465-8958c64d8155", "value": "nexus.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54028895-0720-11f1-a129-42010a9c0007", "comment": "Malware payload (StrelaStealer)", "timestamp": 1770797085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797085, "uuid": "5ff86485-8ad6-4a28-a2ef-882d480d6ef8", "comment": "Malware payload (StrelaStealer)", "value": "904607822cea6a0379291192d0e9de7a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797085, "uuid": "5a2117b5-3f8a-48c4-8bdb-692eb871250f", "comment": "Malware payload (StrelaStealer)", "value": "e81b162c2a88c51fac92ea7050449276128cf48523d92cff2dfe928ff902d904", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797085, "uuid": "cfe4e24c-ae0c-4d63-950a-ca5e9820dce2", "comment": "Malware payload (StrelaStealer)", "value": "368ed6346e24a23b4fd15b4560364560c853ab49", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770797085, "uuid": "f69a986a-37fc-453c-b505-a23c1d9a902f", "comment": "Malware payload (StrelaStealer)", "value": "af1e434b9eb73bcacd8dcd4d5f8e5da1ed4b9a50c258ab292fb11273375830549f188f677727a8ac683da07f615438dc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797085, "uuid": "4642201e-6e40-4685-9b8e-d22cfb361334", "value": "T1D135E414DAAC68B8563B116D351EED2A8D320427B2439D4B7E87BEDFC24E944C1B237D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797085, "uuid": "559b2744-02c3-48b8-8fc0-fa1efd619603", "value": "192:5hI3B7scER3B7sc2KlIEK3B7sc60EZ/Fcz4GD3BEQ5qNM3wvgnVvrVhXE6UPq+IL:TZp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770797085, "uuid": "0c5ff6ac-38c9-4b7c-9cf4-34e06de5aa42", "value": 1163392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770797085, "uuid": "e3fe8991-de01-4f1f-8edd-755d01ca260b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770797085, "uuid": "ba3df872-2c18-4fbd-ac8f-f967d7f3bae0", "value": "SIP_202527017689.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed708f94-0751-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770818388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818388, "uuid": "73013688-ceca-47ec-add2-7e13559cfb09", "comment": "Malware payload (Mirai)", "value": "1908473d32774e3cd3b143545069e92f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818388, "uuid": "d96a7dac-1d3e-4eca-804e-3562294cd798", "comment": "Malware payload (Mirai)", "value": "e962d5049c05db32c5761916545028aad69b3c87cc0e6d5c6a5b0791274d98f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818388, "uuid": "77bc2d26-e066-4b94-b8dc-ab11b95167eb", "comment": "Malware payload (Mirai)", "value": "4ffe3a11458e0faf634da195b8ba0ad37b92bfd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770818388, "uuid": "08810306-1db9-4270-bf17-4878480b7afc", "comment": "Malware payload (Mirai)", "value": "66a8dba81b07922e609d00dacbc24062cf114015e91a64236fbdb8ea6bde147b142c910875d4267f773394c2f00f7798", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818388, "uuid": "77e65be2-7884-4869-9caf-479f8002d74f", "value": "T193158D99EBC6E4E1F26300F1025EDBF21674A1265013FAF6FF85266770327616F1A21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818388, "uuid": "911c2d3f-950d-4979-beda-16c4bbbeaa70", "value": "12288:dBFSWMt9OZYNhgWhEIQHITQONLzsoM82CnHu+rds5PyI/vCybQtLu:deWMtMZGhgWhwIsO9Jv1nHJsVKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770818388, "uuid": "389b6101-7cc4-4d3f-a861-e0317fe58645", "value": 899096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770818388, "uuid": "8a813e45-474a-4bc1-9dda-6694596c2ebb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770818388, "uuid": "4be96c55-f6cd-4baa-a502-b44989d0edad", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b58330-0745-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770813134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813134, "uuid": "31a683ff-94bc-458d-9d7d-8ac971bc1e3f", "comment": "Malware payload", "value": "2a85d541e2db6bad6905c64291083274", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813134, "uuid": "27c9c691-d0f2-4cbe-a337-a51f7c82582f", "comment": "Malware payload", "value": "e9fc8710b7ebeb4ccfadeba523152d63dcbc2d70707d8d70e8471feeb9ac47c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813134, "uuid": "8f7652f4-452e-400c-8edc-d95ba9ee49fb", "comment": "Malware payload", "value": "b9c5cf8d8e19c013461122ce4f225cdc99a4da87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770813134, "uuid": "e01a9ff0-32b4-4b0f-8f1d-dd6a784f4777", "comment": "Malware payload", "value": "051c29667406e447b407bb6dc947712a428b82f292f439848d28176cc5c65e9b13e06269227dfe82b7e95012d6f7a2db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813134, "uuid": "0e221e34-219a-4e4e-b0bb-96cc31098b59", "value": "T1322584A27F99AE0FD2A8313956A6C13473C67A45C0E07036CA93D7091FAE274DC5BDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813134, "uuid": "a2b093ff-8a61-47dd-b663-294f2a034206", "value": "12288:8NzT1gkjE8cOPth0n3H4gd2f2HCela5U/vjRYm4y+2Kld:sq3HUJec5wjRcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770813134, "uuid": "9dc2dddc-ad56-43de-bf57-3587a0041007", "value": 994939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770813134, "uuid": "0ce6a484-6d35-460e-95a6-3f9dee21ca4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770813134, "uuid": "b5136979-be93-45d8-9f5a-753b375aa5d1", "value": "bizy.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cd9c72-0771-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770832090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770832090, "uuid": "68dcec34-c9c6-4380-afe9-f2342f471e8b", "comment": "Malware payload", "value": "64b99a0767a7e3b6024ce505389510aa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Tedy", "colour": "#6E9002", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770832090, "uuid": "34d0bb67-c9c3-4d33-a4a1-c4e646218ebc", "comment": "Malware payload", "value": "eb28fc1bbe23ae47f2b66cee1e4f907034e68e26f81bd8fc645859ab386cff77", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Tedy", "colour": "#6E9002", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770832090, "uuid": "61629d3a-a959-412d-8166-60fe6b792f78", "comment": "Malware payload", "value": "248452fd56ef42c7c549ee63763ad071049291b5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Tedy", "colour": "#6E9002", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770832090, "uuid": "a6204d34-ce61-4090-8ccb-4849cadce91f", "comment": "Malware payload", "value": "61b7981db0199c08c83c2b4e53f80e9bdaa3698364d0e2f5dfc9733c704e9263c7557e40e3a46a1d9f18a8a2559064ff", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Tedy", "colour": "#6E9002", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770832090, "uuid": "f4be25fb-d257-4a06-a9d8-622bf58cac3a", "value": "T10B97E01016B925E2D06346348AFECD71DA767C9A752CC09F0086FE5F7D32A429E3973A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770832090, "uuid": "64dd851e-0660-4249-b71f-2845c4b55e55", "value": "2cbfc7b418c97f51792b8de381e641a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770832090, "uuid": "327ef882-081a-40d2-b4da-866984627bac", "value": "786432:mFeXahsoGXSRHmXwZ1hQ11wzEGVFnjEIV0gL9808Sk9GhgVA:CoahLRGXcvO1wzHxjPV0gL980Vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770832090, "uuid": "5592ee0a-d610-4469-90a5-76d848ffd8be", "value": 40582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770832090, "uuid": "7398b4d8-76d7-4905-87f7-a3810b102cb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770832090, "uuid": "e90b292a-3923-4e33-b046-63ebb14d13c2", "value": "winaijservice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8731159f-076c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770829813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829813, "uuid": "d683f5b0-7a1e-4829-b96f-45332c2b5922", "comment": "Malware payload", "value": "d3525abfe38ba8a216b36a333da40ec6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829813, "uuid": "9b732587-a627-4dbc-888d-7d9490aa2d54", "comment": "Malware payload", "value": "eb8c335f72521e6f96b409a7558274c8dcdbe74f0878ff99a58501b67515e506", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829813, "uuid": "67171ac8-94eb-433e-bff8-d9e7119aebfe", "comment": "Malware payload", "value": "4a9e9f82e54bd853c861b16742feb83be7a88553", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770829813, "uuid": "100b22a5-fb60-4f5b-830a-be61b448cfe1", "comment": "Malware payload", "value": "e5245a4fda757916840c7febf838c2e532f0bd912a3ddd35622126d3a29c93b651711fa96336e52860bd0d787353e1b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829813, "uuid": "d230dafa-85a0-4d22-9ff1-37832aff3886", "value": "T1DBD73388EEB08CDDF53F52795765CE09DC31696D9F348A9327B009790D4B3EA8E99B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829813, "uuid": "40ce6647-0ddc-41c2-81aa-4cd140cb05a5", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829813, "uuid": "988372a9-1fbd-40cd-8b23-85a87d70869a", "value": "1572864:+tyq3zKCamxTztdQ17nD0C+yVQSghbWRel2jF:TqkmZ5dgDUbWReYjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770829813, "uuid": "c7178663-3a9b-49f0-95dc-633a822e9901", "value": 59989541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770829813, "uuid": "48990650-08a7-49b6-a639-75602f04f4f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770829813, "uuid": "37bcf3f8-8820-47ff-b943-48711e0be76b", "value": "eb8c335f72521e6f96b409a7558274c8dcdbe74f0878ff99a58501b67515e506", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a0df21-0743-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770812326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812326, "uuid": "085ab1a7-9fbf-468e-bedb-cacb31ec661d", "comment": "Malware payload", "value": "c05530b024ef205d3561df22eab79d58", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812326, "uuid": "0934ad37-1b57-47ad-aa64-4eeb78c5261e", "comment": "Malware payload", "value": "ec9c55b1bcf9cad762455619278cf7aaadd996de9d5c1a6178190b16373f472b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812326, "uuid": "820b6ade-a8a5-4a97-8ef4-016fc3399c21", "comment": "Malware payload", "value": "fa1c394e79a66ef590179f78d4c6abaea85a4123", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770812326, "uuid": "9493e2e2-0c08-40a6-80d7-54515882f9df", "comment": "Malware payload", "value": "e1476ffcebb5be50f135fefd65ff8413fc19f800d03473de8efd36b77c66be2799950fce78f7b72026c9f449336f4b1a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812326, "uuid": "a8594234-8e62-4fc5-9f47-1620cc297075", "value": "T1E7E4B787F1208AC7F44FDA7F14504210AEF0E4704607F2572B6E895A6FEB9C89E653E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812326, "uuid": "c7325a06-1bce-4de0-b4e4-c03306749d81", "value": "6144:S1eMX5Uh/W94gpr2TQPjhMocK3/9xw5heKYCW5iHBuZ46U7oMOh/1zp3x1Zfly:SJDbBCba9N/1JHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770812326, "uuid": "8af06c2b-d19d-4af7-a863-90a8a82b6dc1", "value": 702365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770812326, "uuid": "08eff042-41e4-4665-83bd-2b254a77fbf6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770812326, "uuid": "cc1901b2-7502-456b-aba3-9d40872af73c", "value": "Donut mod v2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb85627a-0711-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770790897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790897, "uuid": "a25b1b7b-0ef4-46e8-8e37-ded55755964f", "comment": "Malware payload", "value": "b57587fbabddb2f6d25784c7cfdc7c1e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "santepluspharma-com", "colour": "#792218", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790897, "uuid": "1cadec67-fa5d-4f0c-89ec-58712674e1c7", "comment": "Malware payload", "value": "ecbdf260cb95c25db672ff0e802bf2d38ce707313396cd83e912da4c5c9a94b0", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "santepluspharma-com", "colour": "#792218", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790897, "uuid": "711a3689-0471-44c1-9aa1-79db5ac5ae19", "comment": "Malware payload", "value": "63201deda1dbd5bce55d497d2132dbfaa0bddc9e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "santepluspharma-com", "colour": "#792218", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770790897, "uuid": "7467fe39-c30d-40b9-abb3-0ce3eec5827b", "comment": "Malware payload", "value": "73a13268c063becca0651c4c5e567cfe1a46176307210727a85c2710e37eba707b7e7b96ac8acb79df82944f4f5cc926", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "santepluspharma-com", "colour": "#792218", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790897, "uuid": "fb72a6e3-b08c-48e2-bdac-eaee51c661d1", "value": "T149A5FB51FED8060F34DE484670EDCA82FAF66F17D5E2B4822B8B6365240FF6E652D085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790897, "uuid": "2c91b2a8-717d-4308-b953-b102844e1abb", "value": "24576:4GEYwf14CirMCv9L1tU5qEBBg6pX8m5jDsgzvYcfFLjpVOxdYJnNoYe:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770790897, "uuid": "3e9c3447-80b1-4b6d-b13b-0f72dc8c570b", "value": 2180928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770790897, "uuid": "ab3542dd-4348-47ec-b593-b985bde756b1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770790897, "uuid": "1cd3bdfe-9189-4de4-a87f-a67216341e56", "value": "sal.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce2074e-071e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770796456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796456, "uuid": "0df7d2a2-3cb7-4968-b2e0-7aa3b9c157e1", "comment": "Malware payload (Mirai)", "value": "7c0b81b4c59037b3c9a62f9720015a37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796456, "uuid": "6531ecdf-aec6-4ff0-aa47-89388270eefe", "comment": "Malware payload (Mirai)", "value": "ece6292801cc532fdd8e55c9e9684e654e98a0676180ca5f0132fea6d24f4a49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796456, "uuid": "399ffcee-4e5b-4b4c-987c-5f062676aaf8", "comment": "Malware payload (Mirai)", "value": "d16947a1e526f3e6dcbe60bcfa6b4e27956dd03f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770796456, "uuid": "ed924cfe-c5e8-4299-a45f-758db1e5aa0d", "comment": "Malware payload (Mirai)", "value": "4bed2d92d54296baebe6b9e29da3bae56f083ac4f7444edcd981453da6c44cc86b3a8b89121f39831f25acd43cb24845", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796456, "uuid": "4a7f8a6b-eb70-4a2e-ad7c-542736976b7e", "value": "T1F503F1F142E39AA2D4E9E17D904B6E1F009151087AE89EF2DDC422E36873F201E46BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796456, "uuid": "6f3cf90b-13e0-40c6-b593-8e0614e86afb", "value": "768:7qlR59BXgKUa3TPriT19HSo/hiB89ZBtJtoP05LxnbcuyD7UjQRjW:7mf9l5dSJ9yS15NoAFnouy8jyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770796456, "uuid": "4f189cb6-15c6-45c9-95f3-49d8e7c957ae", "value": 40892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770796456, "uuid": "e03ea5af-6840-408a-95d4-df0efd2940be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770796456, "uuid": "67f22573-e769-4d6a-b3da-db6aa2d1392d", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78523de-0766-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770827424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770827424, "uuid": "6c1638d5-b1e6-4f63-b321-22619a0e9443", "comment": "Malware payload", "value": "09b78f9f0492362639c715619eae0b7d", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770827424, "uuid": "4c4680ec-7816-4714-9b36-85ab31b8b8a4", "comment": "Malware payload", "value": "ed469c2b4f210a87e14305a9f88d459202cb19731a11728f26449a55e40a53e2", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770827424, "uuid": "a1e41943-9bbe-4a46-8d88-3ba09151931c", "comment": "Malware payload", "value": "5349b40518c5623e2438100b3fc726bb6e00eafa", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770827424, "uuid": "130ec6e2-2afd-4cdc-84e3-36e75cbe56f6", "comment": "Malware payload", "value": "3e4cc1ec4f14b456e65062f88fb8b1e2c4f13999560b0277e3bf6a9fb1e88512c82af040abad6c943b90fa821227ddc0", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770827424, "uuid": "d7c1afc5-4a88-49f7-b675-53204af26a66", "value": "T183A44B4AE76844F5E077D0388A639607FAB238494B74D7DB0790C76B1F237A0A93E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770827424, "uuid": "5fc902ce-9372-4319-84f0-c68cc282365e", "value": "c46e637bb0d1eceeaf0d96d8f1a84258", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770827424, "uuid": "6dabbff3-f923-487f-b01f-1b691445b5e0", "value": "6144:hXJT+3P2/fuZ1niuc/eHn8xzr8PMFUlQ31lh7PgjY3iG5Z9xzw:pWE/rU231geLj9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770827424, "uuid": "37382185-ba76-49f4-a7c5-92cfa0f0afac", "value": 465304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770827424, "uuid": "e94a9269-e07e-4e86-a584-10f72151a021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770827424, "uuid": "bb2af8b6-89b8-472c-bfb0-a177bd9f9bea", "value": "wmprph.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7174ee0-06e0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770769737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769737, "uuid": "65da9c19-9ce3-4cb2-97b1-4ef08a71b623", "comment": "Malware payload (Mirai)", "value": "3486fa7cb2260f44f033e62fdcae5051", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769737, "uuid": "2c04f5a2-0443-44fe-93bc-788ed65e741b", "comment": "Malware payload (Mirai)", "value": "eddfa98a7e7ba32c6ba651de1cc37a9f77d5864fdc1971e84ea2a088e2c13d61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769737, "uuid": "0a8015d5-bb6b-4281-9807-856d8129ec66", "comment": "Malware payload (Mirai)", "value": "80b9f4e391d09cf03527d17567806bcfbf0b78a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770769737, "uuid": "c74bb3bd-df37-4041-a6d3-3b26451fbf22", "comment": "Malware payload (Mirai)", "value": "b7de08328dce8a39ddff58597944d52d32a9e9e84f49b6da166417c7538d6f044854f77722ca005533ca1c164cf2f8b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769737, "uuid": "fe121493-fe03-495c-9099-4d49fb09a81a", "value": "T157F33B47EB814B03C4D62775BA9F42453323A764D3EB33069918AFB43F867AE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769737, "uuid": "b7bc5ede-0c2b-4f1b-bd20-cd3eea0fdd5a", "value": "3072:3n83zHAN81pfpF0alBki1GfF/s66Xs9QlprrHFwM/9zM2xKK9W:3n8Amffj0a3ki1GfZs6xKdrHKM/9zKKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770769737, "uuid": "ca0f37ab-1b37-433c-b0ac-b1a5745f1e3d", "value": 163325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770769737, "uuid": "3f0b02f8-60a8-4285-9e04-fd6e4966a216", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770769737, "uuid": "0b01b8cc-b9c0-4e46-b2b8-a9e23462a7e6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da37b7a-070c-11f1-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1770788404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788404, "uuid": "c6144722-59a8-462c-ad30-d1a24138d5c8", "comment": "Malware payload (GoProxy)", "value": "2ee2eff62d0d3631dd27a3dc45ed3809", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788404, "uuid": "52c1efbf-6485-4bd6-bf97-44772eb682f9", "comment": "Malware payload (GoProxy)", "value": "ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788404, "uuid": "d0582edb-1173-4edf-9016-1a6bf162c362", "comment": "Malware payload (GoProxy)", "value": "96f9dad1077eb27e362677359c8a75043dd62222", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788404, "uuid": "3cb5db11-fa28-4ee6-9444-97aac3c5dbf0", "comment": "Malware payload (GoProxy)", "value": "e221b9fdb9408494c0125a253bf31a67ecb503db15766e5aa32e95c447af5e939df41bb4c9125f07dbb53134a04166bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788404, "uuid": "7244c788-9aa3-4e1a-83f7-1c76971806a0", "value": "T1EB664A03ECA155E9C0BAE2318A639252BB717C895F3123D32B90F7292F76BD06E75750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788404, "uuid": "c202ce36-baa8-48c1-a073-c19089950d48", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788404, "uuid": "96f7ff68-2be5-4ab6-9c86-b932b372c779", "value": "49152:CIld0fxaVaGMtmqmj+bN3rwKltXvmRUtaHcTIRkAm4pQR5QW4gM3zJj3cj0BrCUG:CAwt9LscukAPMrkZukbcEn5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788404, "uuid": "5b698ccc-20b3-475e-b507-96527fd6eabf", "value": 6677272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788404, "uuid": "5bb07087-40e5-46ed-be37-961cb4192f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788404, "uuid": "1f9f941c-4438-478f-8acc-f38cabed58cc", "value": "SecuriteInfo.com.Win64.Malware-gen.63477928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46ff0f3-0725-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770799394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799394, "uuid": "7560b7f2-7cde-42dc-92d9-638aec51a73d", "comment": "Malware payload (ConnectWise)", "value": "5671affd380212d963ac1eed0ec73375", "object_relation": "md5", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799394, "uuid": "f3992f34-fae6-4b24-9845-2735a426c1a5", "comment": "Malware payload (ConnectWise)", "value": "eec055cd2c0283367e4e536838022313df2694d6b4a3ddebb0ba416ab993845d", "object_relation": "sha256", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799394, "uuid": "db4751d7-a062-4a63-9a89-04204b0fde4e", "comment": "Malware payload (ConnectWise)", "value": "e04cc6deac471558d5a96c909eaa81aa98aa9d90", "object_relation": "sha1", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770799394, "uuid": "ed39e198-0b89-4094-9db8-7589df6ec9d4", "comment": "Malware payload (ConnectWise)", "value": "c3ca150fc09a33139e80d0ee26e57455851464c2eb65ef96d358a3cbfaaddb4365f81b1facad33aaaaf9e76fd2d1ba87", "object_relation": "sha3-384", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770799394, "uuid": "59f4ef9f-ee7c-4fa7-98a0-f1d157695c20", "value": "T166D6232523FD441AF8F74B79FD3682A45D72BE68CF21C11E9228B90D2A74D4096727B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770799394, "uuid": "0e8b3068-91fd-4b03-b673-28d0884f97c9", "value": "196608:KWh0cGw1Wh0cGZWh0cGeWh0cG7Wh0cGmWh0cGiWh0cGS:KWacTWacoWacZWacEWaczWac1Wacv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770799394, "uuid": "d354581f-1e53-45c5-a34c-7a1b72c30e0f", "value": 13357056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770799394, "uuid": "0232a762-ee89-4942-a882-9fee9ff704f6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770799394, "uuid": "7e475592-1030-43fb-941a-431c9695afbb", "value": "eec055cd2c0283367e4e536838022313df2694d6b4a3ddebb0ba416ab993845d.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db7eb73-0724-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770798792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798792, "uuid": "daf77007-5452-4f61-89d0-ecf99dd7f7c8", "comment": "Malware payload (ConnectWise)", "value": "e5c42eacff2f96c34abfb36a8dacddc5", "object_relation": "md5", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "adobeappsxpyrf-update-click", "colour": "#2F7543", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798792, "uuid": "33ba96bc-ec85-41e9-bd02-042e286db22a", "comment": "Malware payload (ConnectWise)", "value": "ef5853338daf570b6f627c41f8f80e07c083e0a44c1d93ab5006102538ff4773", "object_relation": "sha256", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "adobeappsxpyrf-update-click", "colour": "#2F7543", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798792, "uuid": "e62b3c19-e670-4257-9b6d-2beeb5d6f069", "comment": "Malware payload (ConnectWise)", "value": "1258bce9fb2755d38f7c2c310f08b74f06e88f5c", "object_relation": "sha1", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "adobeappsxpyrf-update-click", "colour": "#2F7543", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770798792, "uuid": "04fdf3d8-b7eb-492b-9260-53b6b694aceb", "comment": "Malware payload (ConnectWise)", "value": "f890224f65a394a04c60b4c8a33bee2e000abc8ce39abc43f81761e561b4212622ded70eaac35541e15583eb51a0e595", "object_relation": "sha3-384", "Tag": [ { "name": "admin-diversifiedfireprotection-top", "colour": "#AC5C1B", "exportable": true, "hide_tag": false }, { "name": "adobeappsxpyrf-update-click", "colour": "#2F7543", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798792, "uuid": "f608f970-f071-483f-aac4-48bdba5ddf55", "value": "T1BF71CF063D3AF925C44F4F1441714362FDF2665FBA00ECAAF0A6C3A63A10BD197EE44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798792, "uuid": "61432aee-366a-4cf2-89ca-d20a685d34a0", "value": "48:02LldhzyH6Xi2LldhzyH6LYBCF7f+boIhspKlFlrLIhJpOc4leahBCF7f+boIhsg:zDhW6hDhWo+bxP6AL6+bxP6ALB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770798792, "uuid": "a8b32f1a-1bc5-4b3d-81f0-848ee0230410", "value": 3614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770798792, "uuid": "766b66f5-7bc8-450d-b7e8-0fa3eaf63f0c", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770798792, "uuid": "3ddc6ca6-2625-4807-85e3-5971fd5090dc", "value": "Adobe_Reader928097.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6ea06b-0795-11f1-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1770847565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847565, "uuid": "e730b2cc-e386-4e2b-9806-69e9fee6db14", "comment": "Malware payload (AmosStealer)", "value": "a37f6403fbf28fa0b48863287f4c5a5d", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847565, "uuid": "fb94a5cc-0401-44f0-969f-325f0429288b", "comment": "Malware payload (AmosStealer)", "value": "f0a54f2b44e557854b0a5001c4e10185884af945814786f78b86539014f78a16", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847565, "uuid": "ca0c4963-1149-41e4-a90f-06a97145260c", "comment": "Malware payload (AmosStealer)", "value": "a396ec79d8e33ca984c7ffc7ee4d7d2caa8412ee", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847565, "uuid": "821b9ae6-f30b-4816-9fc7-3dfaac3e2a83", "comment": "Malware payload (AmosStealer)", "value": "f0763a45836fbd5ecb5b534229515766c5710fcb0ba9d013a38beae5490ddc068cf7ed4c61deb14f9248a2c5d63c693a", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847565, "uuid": "60ad82cd-cb01-4d72-bbbb-aa5ed4d2232d", "value": "T163B419E3623C55F2EA8EFB7CF40F2267F936BD4155B8B5D05D410A110ED9360AA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847565, "uuid": "54e80a4b-bca0-4a46-9abe-a9fa97ddd7e7", "value": "12288:HaOLNaXUoyWecdCiLkZVFRmocmXQtWdmHJxXOTT////wpy8PBS/iSxgNSG:HaOLUESdWdmHlNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847565, "uuid": "3424796a-0710-4773-a7a6-793eb16ecb6a", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847565, "uuid": "ece2fe05-8edd-479b-9f9e-cf5e6b3318af", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847565, "uuid": "0f7623ae-aa60-4e13-86cd-b1f46a06225d", "value": "f0a54f2b44e557854b0a5001c4e10185884af945814786f78b86539014f78a16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f16c05c-0791-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770845664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845664, "uuid": "0f07680f-3a9d-4b8e-807c-a60476d06e47", "comment": "Malware payload", "value": "a419671fccc5f004ec1cf363537ac0b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Uphero", "colour": "#BEA625", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845664, "uuid": "496f0fbc-4e36-4a80-9226-77b0d1394946", "comment": "Malware payload", "value": "f0fbe946b604429f2b32150e224b7c97cce3e03a455ab27c009705c2ae71f574", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Uphero", "colour": "#BEA625", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845664, "uuid": "13f75bf2-5457-462f-a2eb-7a1b2d2cd7a2", "comment": "Malware payload", "value": "2e6527b79a6db2c1224b798ff3c2c749bae1a661", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Uphero", "colour": "#BEA625", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770845664, "uuid": "dd9c4de7-9aa4-4efb-9e3c-0449ec9ffdda", "comment": "Malware payload", "value": "51060d5c0b9a4cb9b5baebf41b418e6b8579ca6501286f25136e7096456d9fda499405c080a9b5e04b495b8e80886c01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Uphero", "colour": "#BEA625", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845664, "uuid": "018c78f7-a13b-4d22-a747-9cd7928e0e43", "value": "T1E4B5AE12BB42C172F592027452FA6B7F8839A9346734C5C397D01E7989312E36B3E79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845664, "uuid": "69da5ba2-09b3-465a-aaea-32ae6e0976f0", "value": "3c9f80f2e71286e71d7f91cdd26c6049", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845664, "uuid": "9591b3b5-5529-4d62-a8a0-629c4480dcae", "value": "49152:cSwsPCYeq2KgKPi6dpRQsHyhsZKf7Nr0T9cPNKHuqQF/Yye:qsqYeHKPndpRQsHyhIE7NrSFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770845664, "uuid": "8dab9923-a7cd-4244-b3de-88e3f5567b27", "value": 2381272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770845664, "uuid": "63a7f524-7ec0-415a-baeb-f80d3899947e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770845664, "uuid": "bf9eb449-49ea-40b1-ab3d-745056289405", "value": "f0fbe946b604429f2b32150e224b7c97cce3e03a455ab27c009705c2ae71f574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3fc366-0762-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770825524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825524, "uuid": "d069364c-74de-4018-9366-c0391bafce10", "comment": "Malware payload (SnakeKeylogger)", "value": "99080db964d0f69c19b7d6257c97b582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825524, "uuid": "8c264260-f8a0-4594-98f1-a7192d3376da", "comment": "Malware payload (SnakeKeylogger)", "value": "f3110b41a4006ad3afc849b446e32470b1acafbd46e7a54cfa2a53ca8b581af7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825524, "uuid": "7384b9ec-cd29-408d-9382-0582790466d0", "comment": "Malware payload (SnakeKeylogger)", "value": "15a2c775c25befb5b7d57fb947ad505dc3fc89fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770825524, "uuid": "b7ce57d9-cf11-44df-bf25-99c1a65bd8d4", "comment": "Malware payload (SnakeKeylogger)", "value": "f1784843b54b2afe7fcd93263e289f323d2773820ef94aad1486bd6f016f9ce99e698f4157a6d11f45811dacc4da3260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825524, "uuid": "94b5c67a-2b27-4af7-bf4f-b94967e98d11", "value": "T158B5BE65F3D81199E47BCA78CB41A323D5B278220772A4CF0695170A1FB7ED29BBB311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825524, "uuid": "c500d92a-c6c4-4a70-8d6e-c0c7f355124b", "value": "919cc231eb5ff2389c4ee51ddd70b90a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825524, "uuid": "e84bcc67-c4f8-4856-bdc5-e4f0451b1a4e", "value": "49152:C4L5olLCMDvB++qNmp/U4PifZpYCLuRtR:AlFuW6fZpYCLuRtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770825524, "uuid": "c9e1a23d-279d-4c5d-b582-8e5613b6ecfe", "value": 2302464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770825524, "uuid": "37f4a69b-a0f9-42d8-aa8a-c7788cb4f019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770825524, "uuid": "4edafc2b-e1b4-4933-aa87-8642f4cd81bd", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8983416-077a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770836016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836016, "uuid": "5d4e0e66-2457-4476-a231-664e8950ed57", "comment": "Malware payload", "value": "1c1a391e19e6a01e32c529b0bfbcffe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836016, "uuid": "2a9009e4-7396-4da1-b938-4ed3bbf0a9af", "comment": "Malware payload", "value": "f3ce4cc31a498d67a0d8225189e591c6b5cb4121fef0cfe6d1ffe3b7cf104ea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836016, "uuid": "391caee8-9108-466a-8d6f-977b561d118b", "comment": "Malware payload", "value": "3de4709c4cff2f6078017d5e5a10b402bf69d2cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836016, "uuid": "e47138d9-7123-4143-a5b1-dfdad7a41a13", "comment": "Malware payload", "value": "3f6f0fcd41197f8dd89d43e80cf0a9a8800607b7dff8f84f7d5beb37077c23798693c88950c829edb43ad7ac3b9a49b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836016, "uuid": "81fa9246-da5b-4534-8342-7fcce5fb42da", "value": "T19A563377F31B76E6C4AC49B758A516B612043C7B454106BBB2B2B72A0FE6316F72043B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836016, "uuid": "17cb7734-6043-4039-a85b-eaa179d670d4", "value": "f30c837ea10ececf19f729ac926277eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836016, "uuid": "c3a72cec-8d8a-4b66-9406-8d07a8c33b93", "value": "98304:a8xwc16o3/1MI+exo2Qf9HA0Lk8DEWLvG5lhx95dwrtQDihb6ukqTC1w80qU:a5dkJFxo2Q+EoQSjL3wr2e96gu1w80qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770836016, "uuid": "a0c90c39-0128-42bb-835c-4d45c6a85600", "value": 5912158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770836016, "uuid": "1d274ad1-a1f9-4933-851e-28951cbbd0fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836016, "uuid": "ffbca3fa-c919-4cd6-b5c6-589e48cc2a18", "value": "Executor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c83451-077f-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770838029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838029, "uuid": "9c82fd4f-b937-4e9f-808d-2ad3cc7cdd62", "comment": "Malware payload (ConnectWise)", "value": "424c7f4b2a10b7b49d17c05c22f34eaf", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838029, "uuid": "51f0a515-eeaa-4c54-ae95-03abc9443ce2", "comment": "Malware payload (ConnectWise)", "value": "f64cb128dbe9aa095f657e4b677184aef1702614ea02e0e4317f87f4f686745f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838029, "uuid": "622d3bb9-345b-4eba-b2ba-39d9c57016c7", "comment": "Malware payload (ConnectWise)", "value": "ee45b48a138f7d588bfd095aef00a0bc171dfbbb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770838029, "uuid": "85e5b043-6f22-4bbe-aa5b-f7cb6aa4f382", "comment": "Malware payload (ConnectWise)", "value": "725e7894d0c3dbe0196105425a917b1e62c8cb4de7a8246e220245bab9d3934b254c165f61902f4724dddeb1c5633d6c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838029, "uuid": "4ed2b323-7fe4-4dc9-8378-efd7306adb14", "value": "T197A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838029, "uuid": "d8dc3c18-2e4e-4503-896a-bd085f22c2fe", "value": "196608:OKaLNkbgci4QRKaLNkbgRKaLNkbg7KaLNkbg:wWgciH1Wg1WgzWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770838029, "uuid": "ada2fc53-3d34-450f-8457-8f4baaee6748", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770838029, "uuid": "5858aa1e-851c-4424-a725-be36e4be553c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770838029, "uuid": "5be99fb4-7521-40d7-878b-e3942cacc62a", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff5bc6c-075c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770822982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822982, "uuid": "c776c7bb-26c6-4d7f-be8c-95e1d3d495f7", "comment": "Malware payload", "value": "7f768931edacd229a0b95aca8efa7141", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822982, "uuid": "e8cdf890-1b7a-4320-ae57-ce4fe1cd5534", "comment": "Malware payload", "value": "f69703ff107de63b152f0e1bb227b1a27e0123e053c236771f2cbf2aa115e1c9", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822982, "uuid": "8f196773-7b6f-488c-8c7b-a58c21ff2efd", "comment": "Malware payload", "value": "38dc96c7e6683719d51eaebacdffe15627aa4ce8", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770822982, "uuid": "f21be608-64b5-4034-aec6-d6b41efc0756", "comment": "Malware payload", "value": "018ddf06614395da8b5e888aa0ca41a6433e3c3915408a47e1c15bc3a6ac2698765c0d718a555f914b7240bacf0667b9", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770822982, "uuid": "a3e50326-1bcd-44f4-a361-6a97a7c36b57", "value": "T1E5F40240A75505E511A487FD3E9309AECDF247E2F8800FDF2F90FAE244A54477A4BAE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770822982, "uuid": "514c5a45-ffb3-4c8d-9695-c96352f1a1ce", "value": "12288:udk9TnDcAYxzUTZ2n6SCZF/DzShchct0hGuz5Cwd2xewhTkaL/TK16Kz:tTnoAYZUF2nQrsNY5CwaBpSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770822982, "uuid": "d80f90b5-c9dd-4b6d-80fd-800646052483", "value": 761825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770822982, "uuid": "b44b0f40-d874-44a6-9ef0-d7e7a6dd23bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770822982, "uuid": "f4af6374-77fb-4d29-894a-828d099d5191", "value": "e40a6fdc92a20245.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5b51a3-072d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770802953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802953, "uuid": "b9899598-6bd7-445b-b470-888f44fdd7ef", "comment": "Malware payload", "value": "0def0130026666d078d9ce5fdabcbc9c", "object_relation": "md5", "Tag": [ { "name": "reparertelephone-fr", "colour": "#CC610E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802953, "uuid": "23e76fc9-8e75-4ddc-9e46-e6a442b280cf", "comment": "Malware payload", "value": "f82bf011b377fb506c2d540f1bccb1cdfc66013cea57c8586b4efd6b901f3e68", "object_relation": "sha256", "Tag": [ { "name": "reparertelephone-fr", "colour": "#CC610E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802953, "uuid": "9195c01b-64dd-4b86-b72d-7aeb4a3bc0b3", "comment": "Malware payload", "value": "9d5897b00ebfc71010343436979a7c067f69f869", "object_relation": "sha1", "Tag": [ { "name": "reparertelephone-fr", "colour": "#CC610E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770802953, "uuid": "2b962ac4-461d-44fe-a788-9d0a6f002b65", "comment": "Malware payload", "value": "d701d24886ad5238a88996af78ac5c5f98471744b842e03ebf67af3120e777aed258e854e57a17eaf7f919dc0b6c70a1", "object_relation": "sha3-384", "Tag": [ { "name": "reparertelephone-fr", "colour": "#CC610E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802953, "uuid": "95b9e86a-2876-4006-8320-caa9bb0b643d", "value": "T166C6332228CAE3DA8F75B7DDCA6E222D7CE11F806F90B035E754136A64152F3D9C45B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802953, "uuid": "0a38238d-082b-4fb9-9757-7eef36296410", "value": "196608:Xh9PropYlncKq7taRejay4bDyTR5Hg77ptX6/+7VMPgf1KUrOZwgv1UoSHw/SBYt:x9DopfmdHOTRinPNVfCZwEMNYaOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770802953, "uuid": "359b1b0a-a271-4986-807c-7ebdefef7877", "value": 12600453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770802953, "uuid": "e6c0918c-0259-4d69-8e9e-913ef5fa3c23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770802953, "uuid": "0b010fb6-3b82-4f68-a7f8-3f4e25b76f9e", "value": "\ud835\udc26\ud835\udc22\ud835\udc1cr\ud835\udc28s\ud835\udc28\ud835\udc53t_\ud835\udc1ex\ud835\udc50e\ud835\udc25_\ud835\udc2f\ud835\udfdc6\ud835\udfd9\ud835\udfce_c\ud835\udc62\ud835\udc55_x3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c27062-0718-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770793513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770793513, "uuid": "6643abd1-d6fc-4846-9ed6-a5a872ac43e2", "comment": "Malware payload (PureLogsStealer)", "value": "09d7b1584ffef9f398c3c7acaaf299b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770793513, "uuid": "7d1df11f-0850-4f3c-b09a-05c590522ac7", "comment": "Malware payload (PureLogsStealer)", "value": "f85f97defd5f754e3a6186e945cea34c9b54c94a0ce409cc76df181c725f652f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770793513, "uuid": "7d9ea795-9a37-452f-83c6-45abaef5e76a", "comment": "Malware payload (PureLogsStealer)", "value": "028f56af3f5bb7fb7393fb7cb54cb6e185112f1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770793513, "uuid": "f72efe45-2a7c-411c-a945-455d7a57d7cf", "comment": "Malware payload (PureLogsStealer)", "value": "e33cbc3d3832a7e8e2552e2b5d16db22ad9b309ccacd44429fac24c3a1244fda2dd60a5658a7dcd2b7b800f3d89cce33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770793513, "uuid": "884c0d5c-f8ea-4d28-b883-32108cd688d8", "value": "T1CDD4AE1B7305CE21C148663BD0C7850097F5A5D2B677E31EB9C9239A5A073BEEE0A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770793513, "uuid": "a71a9b6a-54c7-4653-92c6-4045711bd55f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770793513, "uuid": "3d92cd5e-7320-4c37-84b1-c16ee25281bb", "value": "12288:bK4ERiBympzPOmXaDm70HW2GePSE50Il0DL7Hv8mC7sgJMIdHDB:bnzpzTAK0HW2Lh50IS7HUmCAOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770793513, "uuid": "038f05ad-b7ce-4cfd-8dc3-1d9ee484cc40", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770793513, "uuid": "cba09e83-290d-4cb7-b605-36729c07c8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770793513, "uuid": "02d11217-79d1-44f2-a33c-732972bc1cb6", "value": "09d7b1584ffef9f398c3c7acaaf299b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c54fbc9-071c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770795488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795488, "uuid": "fc6889f2-12e0-41ee-af6a-108d751a1386", "comment": "Malware payload (Mirai)", "value": "6e5034ebe73579f0c8c5847766a49edd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795488, "uuid": "c4fd98c7-f1bf-46dc-8252-602daa85951c", "comment": "Malware payload (Mirai)", "value": "f908e53503421a884e965983ab056ea40557ad21039d0f8a3c64a73db19cd2d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795488, "uuid": "cb703ff0-fc42-4b7b-969e-56ae51371169", "comment": "Malware payload (Mirai)", "value": "6ad72d28d40915bc2e3746c81430321af1bb41ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770795488, "uuid": "032f4d55-1f03-4ba5-b8ac-2b556a8cccae", "comment": "Malware payload (Mirai)", "value": "5cd7567fa1c5c68ae68bbc2f7ff21e7176932b8e9fdc4ecb3e9c4ea8299dbac6e7d6edcd2d4dd05f98df8a25b3af6d89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795488, "uuid": "99101fcc-05cd-40f0-b4b5-372992a051ee", "value": "T10E430292037EEA33CF60147FD0345D45F6A7297E94E8301967ACA27AA2E0D0EE5F8153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795488, "uuid": "28101c39-28b9-4cb4-84fa-d0bc7a49d08f", "value": "1536:UGFIsJ7YupPGH2t1mYm1jpE2iEMRSIuz57GzFUTPiviNddhGCzH:U4J7/pPhylpE2iExoqivKhGCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770795488, "uuid": "012e4e40-4392-4749-9b08-617ead10c4cd", "value": 59212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770795488, "uuid": "a4d26d50-c24d-499a-8cb0-79519dc1a50e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770795488, "uuid": "b226183e-6978-4430-bd77-0c97be7af676", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d706fadb-071a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770794728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794728, "uuid": "74120963-e31c-4698-a315-e8d37c41464e", "comment": "Malware payload (Mirai)", "value": "544c20354a99268446eb826dd22ec8b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794728, "uuid": "00b9bd12-55bd-4401-87ee-95c3914ec1ae", "comment": "Malware payload (Mirai)", "value": "f9eb3eccc44a8f2b1e57d93478efe11b947646cace71bc11aae6e220589a66a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794728, "uuid": "168fbc9c-34d0-4432-b6eb-293d2e9857ab", "comment": "Malware payload (Mirai)", "value": "f13a8bbd010ca5dabfe0e3fd3190c4dfbac0445f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770794728, "uuid": "148e6f24-b301-4a98-b6df-78ad5b26040c", "comment": "Malware payload (Mirai)", "value": "3f647955fe24bbe8a1df017043453ed357bdd9249ec6de31892533e4ae949b93a9fd6f72fc4c665899507020f479b1e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794728, "uuid": "dd4d1c42-d48e-4b09-a1f3-7e7bad56c3a9", "value": "T1BC832A86B8819A20C6D5177BFA2F018E331257A8E2DEB353DD185F6477CA81B0E37A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794728, "uuid": "5bcd48da-a307-437c-aea7-19e1184f934a", "value": "1536:GRnk4dpKdKl6/+BCJaetMXUoLmpMguHcULVUHalw7WouH0EsfCKrL9nGQ2E/tUge:epblB6a5UoLmpMguHcULVUHalw7WouH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770794728, "uuid": "f2e57421-abb1-4365-9255-1f61c152376e", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770794728, "uuid": "794ec457-5d4b-49ff-90b4-5cefd17aad3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770794728, "uuid": "d8d25348-c7ca-4bbe-9fe9-66f3f30384f8", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa4592b-077a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770836001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836001, "uuid": "08307f04-7a51-4ffc-a979-b2a32d462a75", "comment": "Malware payload (Mirai)", "value": "259ec431c7acca2ed61670b6e2fa13aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836001, "uuid": "46f8f0a8-b842-47b2-b3b2-7cd7b15c5d67", "comment": "Malware payload (Mirai)", "value": "fa0684a65f8adc8c2c012615aeb27e7bad038dd61d1ee2efea1f40cdf1dc2411", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836001, "uuid": "42ec66a9-3b1d-4181-9f1e-b1c3a54fba65", "comment": "Malware payload (Mirai)", "value": "595123104c922980ccdc89d4b129642152a222ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770836001, "uuid": "c69a2e62-ef11-421d-820f-dce294096f12", "comment": "Malware payload (Mirai)", "value": "165758bf6546b3c914bcba10fdcdcde7d6296dead2cbf7e49d25dcf94ab7f9c624e6fa8365b9b79512679cc71bb3ae1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836001, "uuid": "1c41466b-e14b-47d5-9f2b-31f83b039956", "value": "T1F7345D45A9809E13C1D1277BEA9F414A33329758E3DBB2068D1CAFB437C7A5E4E77205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836001, "uuid": "e7f0c36e-cb49-4b3e-b8a2-94441acdd151", "value": "6144:4exCDeqNUJoeoLmpMguHcUwVUHalw7W3uH0YsfCWOzJ3jYyraQYMm8y7MXWqgExs:4exCDeqCJdoLmpMguHcpVUHalw7W3uHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770836001, "uuid": "0b89df49-1230-43a5-81de-281832980112", "value": 242086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770836001, "uuid": "135bae47-f815-427f-9e78-fabee15cfe28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770836001, "uuid": "651e5a47-278a-4f2a-97b2-da14db37d793", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c7c05b-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816568, "uuid": "8bc124c8-bf2e-4632-bf43-34ebd170a07d", "comment": "Malware payload (Mirai)", "value": "b20057aff57611f3a6021de18d72cd55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816568, "uuid": "0592d5cc-62ab-4548-9f17-189ec64fe09b", "comment": "Malware payload (Mirai)", "value": "fa200b1da7110bc2318a2395d558c924cb9ec71a6139c2e13a6912e6a234ed8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816568, "uuid": "7305151d-ecd8-4f32-bbaa-b16e434ed772", "comment": "Malware payload (Mirai)", "value": "dd5c01e6bc506d191d03194a19e0b193be0c1468", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816568, "uuid": "9f9ac231-18ab-4128-9626-e1effe932ac9", "comment": "Malware payload (Mirai)", "value": "b6ea8ce25ab9527383a7076cf8062f5e1930fdfc6878d95d428f7e60480cef51a209913f3e1bda3f1a554280e8170769", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816568, "uuid": "62375be7-c43a-4e5c-bd0c-7e58526a85b7", "value": "T137831881F98B84F1C50B4C3461A7F63FCA31E57A1075A7ADEF899F35DB27A01920724A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816568, "uuid": "6243012e-db6a-4f8a-8a79-89c7075ab377", "value": "1536:CguEb8iCrDaVol4JI3Fmbs6x6Qh7tkfj6e/J5UY3yTeB3/ySkjgoShn:CgR8iAaWlF3Fmbs6EEtS/J5zdp/ySo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816568, "uuid": "138a3785-f8b6-4283-9eea-3a28263d6735", "value": 82800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816568, "uuid": "6a9de870-61a0-4014-9344-37fa38131f40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816568, "uuid": "73f6054c-7f92-4ef6-9bf0-daf85a7a5d23", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947a10a3-074d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770816521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816521, "uuid": "3438d7c4-3105-463d-b05d-6b812817ad33", "comment": "Malware payload (Mirai)", "value": "2293ecd1b19af09037c87a90b8df87db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816521, "uuid": "2ff0c113-f4c6-4370-8467-f148c7e921de", "comment": "Malware payload (Mirai)", "value": "fae77252b4538193c771c4e69af0614a513b7b4f9d93b21aaa322d1ff7a01d7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816521, "uuid": "6ac74df6-c5c4-4b8a-a7e0-201158e31e14", "comment": "Malware payload (Mirai)", "value": "253bd9fca609b30ab3e3c9cecd775892fe64107b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770816521, "uuid": "7add4b3b-8879-46b4-a40d-0b1909f380db", "comment": "Malware payload (Mirai)", "value": "7d034d8b7470d25132262514f51458518146865a74c57a009313f5ede2f43ac655b9560b12e7be496ad7a49ae07b3499", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816521, "uuid": "aa95563a-97d2-47b3-8114-b1134b5342fa", "value": "T1F9F2E09550DD82E4CA9D90F319FEF9098D70E506A3562CF6B6ED203E9153F9807328B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816521, "uuid": "70b0438c-2586-44b6-b3d7-c38b5d78ebb8", "value": "768:a4mdAgfBvZAVKkKahYfaYoLL8r3IlFx4nJPg+nbcuyD7Ufyqg:jTgftWtzhAa0rGDMJP7nouy8qqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770816521, "uuid": "95098a8e-50ad-4cf3-939c-dac4cdbe7d97", "value": 34848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770816521, "uuid": "f0dc47c0-00ec-4bbc-80f7-3ca13941160b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770816521, "uuid": "8b932e5e-09cc-4308-910b-689641f0387c", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a0f611-078f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770844834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844834, "uuid": "4ce09c6f-0595-4966-bbd0-d3e85c710a7a", "comment": "Malware payload", "value": "2009b69852a9b20bbbe85061e1ef9186", "object_relation": "md5", "Tag": [ { "name": "7zFM", "colour": "#41BEB8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844834, "uuid": "3361727f-cd13-449f-82be-566ba4f15b5f", "comment": "Malware payload", "value": "fc10ff87b6fe2dcbeffe636c7a3ca85ce3da944c38c7ea08cd7e784c11fa0302", "object_relation": "sha256", "Tag": [ { "name": "7zFM", "colour": "#41BEB8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844834, "uuid": "c565183f-1a79-4ac4-8ebc-eee5044eb3a3", "comment": "Malware payload", "value": "8e82366a9e726a8a8ac84058a0fbbd9aa701bd9f", "object_relation": "sha1", "Tag": [ { "name": "7zFM", "colour": "#41BEB8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770844834, "uuid": "6a76323c-7e96-456b-b5e3-9b98753e78f9", "comment": "Malware payload", "value": "d23883aa70b9dc4922e8dba4e62940c228737026ed7d14d1fbeddf4e44631f2cfbe9a9bb3b891f29fb2deb7a178e1426", "object_relation": "sha3-384", "Tag": [ { "name": "7zFM", "colour": "#41BEB8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-7-Zip", "colour": "#C8102C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844834, "uuid": "70bc9c4e-a5c4-4f23-8df4-f5f4bc185e5e", "value": "T18BA68C11FAC780B3EA03123044AAA3BF67346D144B25CAC7E7547F3AEC766D15A36B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844834, "uuid": "5815f1c8-99e2-46f3-8ea5-fe209c9210d9", "value": "60d0e41a806fa097a0c30e93e6bfdce7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844834, "uuid": "7113cf57-a2f3-42ed-8a8a-bf1d29d994c7", "value": "98304:YMJ+Jjrnk9rfFO3Ol48Vbwac3m14yNtPNBlG1coHq77NrN12XWzne9GfzQDckzsS:wJnkWAhVPxtn9T1yWbnWKs2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770844834, "uuid": "6eedca04-5413-4532-8af8-b68e86d5f402", "value": 9816536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770844834, "uuid": "803d7d4a-4b9d-421d-9f99-e221088ca0f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770844834, "uuid": "9b4dea6b-b2f1-4c32-920e-4945e3a5c575", "value": "7zFM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ca543a-0767-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770827716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770827716, "uuid": "d95c3092-f5f5-4e56-ac8b-b5ac00c00565", "comment": "Malware payload (AsyncRAT)", "value": "c50b6b9a390b628d86709e94bad57d14", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770827716, "uuid": "01945a56-1d3d-4af1-a53a-7c3c029e612d", "comment": "Malware payload (AsyncRAT)", "value": "fc1eebb23aea55d37668aced346cdb2438f0ca0e68d5ee24881f755602946427", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770827716, "uuid": "1944438f-a5c2-480d-8548-b1dfa1b345c5", "comment": "Malware payload (AsyncRAT)", "value": "7b3a00a35c08946e6a807cc9f3ca8b024024b446", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770827716, "uuid": "96f52025-b7eb-41b3-8b45-c9b1df1e3a4a", "comment": "Malware payload (AsyncRAT)", "value": "1059b5f799b2af71cd2eeba22fe66c9d913f2706a688d2a4ff5976acc64d00cc67bc5bb6fdfd4de0d9d538f02afa8b53", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770827716, "uuid": "70167ad1-da68-47ba-99c3-78b81ffd2032", "value": "T1A5737D002798C966E2AD4AF8ACF2990046B5D5772106DA5E7CC404DB6BAFFC649133FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770827716, "uuid": "1aae8541-196b-40f4-b517-ae93921022ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770827716, "uuid": "799eba43-8336-478e-945c-07268d45aeff", "value": "1536:hDtA2wfLFzBSwdDYTGbb3wZxecG37r8Gvtoq9VclN:hi2wfLFz8wDuGbb3kezJt/PY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770827716, "uuid": "5eef2fc3-f2ac-4ab9-938f-4c76f0e1c5b3", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770827716, "uuid": "ee8d52df-8952-4a49-acb4-19b689797695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770827716, "uuid": "9a560d18-771c-4ca1-a9eb-ec687a35961c", "value": "Void Echo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94e941e-0774-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770833306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770833306, "uuid": "0c0e3fab-32f6-411d-90cf-7e4d127521a7", "comment": "Malware payload (Formbook)", "value": "1098d6abb431f74da8805d97831e4f8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770833306, "uuid": "60c4ee14-acea-4eda-a469-bcf006477e48", "comment": "Malware payload (Formbook)", "value": "fe0139a29474086a8352e614196fe8bb19f719678b61bbf99211e3d5a3894453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770833306, "uuid": "404fe96d-e4f5-4a59-9bc0-e4ff6a205d08", "comment": "Malware payload (Formbook)", "value": "937bab987ddb89cd0de86b937ff9e4e7a08e241a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770833306, "uuid": "fef4e483-f002-4268-9839-edfd1df9677e", "comment": "Malware payload (Formbook)", "value": "bbd9b30341338d6926e5a09f8a56c153617e37bd5c9637c0789f3bd0e19366a8cfce4e40f9eece0ea4fb97bbbcabad86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770833306, "uuid": "390a69d1-4f9e-4237-9c48-35ab23a250fd", "value": "T1B7552374220ADE46D4E917F60A22D33A53F9AC9D5021E322DEDE3EF7389A7518D14723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770833306, "uuid": "775f103a-7bdd-4d7d-ae9f-ed0f7527c5f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770833306, "uuid": "d1c99638-60c8-4f93-85c4-0e58042f49f8", "value": "24576:GguQao528odC0GVIQmT4wJhNu00hJpiM6EIn2+XfJvjTnIg6vIw2Victa:/uKVITcwTkngMo2+PVjTItIvQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770833306, "uuid": "b9095529-bc36-419b-b1be-f507b4a19416", "value": 1318400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770833306, "uuid": "87166d0f-389b-4741-a1e6-ded17e5a4169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770833306, "uuid": "1837f91a-ae49-46e1-ab86-3245ac4b7f0f", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5226485-0795-11f1-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1770847606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847606, "uuid": "3b1f5f8e-2d6e-4ae9-9621-575ae98bd601", "comment": "Malware payload (AmosStealer)", "value": "e76c0a4af307a846b81ca298682a7184", "object_relation": "md5", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847606, "uuid": "94ff0248-e600-465d-9593-fc34f4395089", "comment": "Malware payload (AmosStealer)", "value": "fe3859f076f3b34efc4155b7d724b024d193dd20ad2e4638985ffbe15992f27d", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847606, "uuid": "8ea864e8-2727-4b2c-b85e-0c292c53a8a5", "comment": "Malware payload (AmosStealer)", "value": "d121d3e55f550c0c4e1aba88ce16359d6cf4d1f7", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770847606, "uuid": "6d49556a-deed-4fe7-81a7-2cf1616a4c5d", "comment": "Malware payload (AmosStealer)", "value": "fcd8572fbe07138516d8fbc780863a8c1b51abf53742ef592ec85574fd9f2fda04ceb5ba5a181d01e21f43a0bd1ea9ca", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-30", "colour": "#8CBA95", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847606, "uuid": "a0f9d413-91fc-4759-88c7-0db2df24b4fc", "value": "T147B419E7623855F2D98EFB7CF44F2227F971BD4019B8A5D05D820E114ED9370AA2D38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847606, "uuid": "0f98d9bb-a86d-4e77-bf0d-986b414273ff", "value": "12288:D0l+NcArlEE9ncvJJQqlsgc9v8pBprQMxJVXWlnnnHuuu21uKb+AfI0m:D0qEi8pBtkfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770847606, "uuid": "94341041-9837-4147-9a0a-cfa8ce1cd019", "value": 521440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770847606, "uuid": "0ddb0cd6-0f43-41eb-a145-db1cffb7af08", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770847606, "uuid": "e1dafd8c-a1ca-488a-9afc-8ebe7098aa17", "value": "fe3859f076f3b34efc4155b7d724b024d193dd20ad2e4638985ffbe15992f27d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f006ea0a-075f-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770824405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824405, "uuid": "880b89f9-511c-4882-99ef-0ae63044764d", "comment": "Malware payload (ConnectWise)", "value": "6ea7e33fe2f32a5d165794b4fd2fe0e1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824405, "uuid": "b1e20dbf-589d-4d70-9cb3-f59fd4008357", "comment": "Malware payload (ConnectWise)", "value": "ff58d51b60c8ffcf22efa05ecb995dc5763b062cfd5f34b8dba5f44228abdf9c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824405, "uuid": "8fc3928d-2e34-4974-b481-278ff415e7b9", "comment": "Malware payload (ConnectWise)", "value": "1edcd96587e7d4c3166c67b9ff522ab060987e87", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770824405, "uuid": "15adac3d-3d08-45e0-81d9-04bbba9a7a23", "comment": "Malware payload (ConnectWise)", "value": "a8474e3262125f05bc7f2ea943f5c2e1c49f6dc53055b3a84e24779d5c519f0166bbefb6430121a7db761636ff09b8e9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824405, "uuid": "7df4152c-8ee3-4ce7-be73-bd154cb66735", "value": "T1DEA6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824405, "uuid": "426c44b4-01df-48e5-94a7-f3ee56aa3bc8", "value": "196608:vKaLNkbgfi4QDKaLNkbgRKaLNkbg1KaLNkbg:HWgfiHbWg1WgpWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770824405, "uuid": "e2598739-d9b5-4a00-a7d8-6b78ca8f7890", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770824405, "uuid": "0bdba3a8-a782-4874-8221-759d0cd5ac76", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770824405, "uuid": "12ae8b84-f760-49e2-8ac9-51740b0c0610", "value": "Internal.IRS9.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555a7dcd-0749-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770814697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814697, "uuid": "6085a48e-ca18-4454-8a03-7a16213f7d65", "comment": "Malware payload (Mirai)", "value": "1c004503b903da2d5dbe396b7493da85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814697, "uuid": "0c890105-5abb-4aa4-950c-7c96555293bd", "comment": "Malware payload (Mirai)", "value": "ff80274d8832049c0e89290148450bdb38f40cf1a9c65c85685bf197c49656f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814697, "uuid": "7da73989-12df-4a24-9006-f915c1b68fe1", "comment": "Malware payload (Mirai)", "value": "1ad0cbb94cb0db07625eb6517ceb91ece4920336", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770814697, "uuid": "99a6f355-eee9-44f3-bec0-6226651b5062", "comment": "Malware payload (Mirai)", "value": "456dd683a4e0b5c5c95f33e58a84b8a38606b57f68ac0fbf92e2ee0ed12707fa48570fbb000d191719898cb2a35e73b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814697, "uuid": "886db578-9468-40f9-bc86-897a42aadea9", "value": "T159C34B46EB418B03C4D52776BAAF42493323EB54E3DB330699185FB43F867AE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814697, "uuid": "c0d3c0bc-51a6-4cec-b6e1-8bee711d1660", "value": "3072:UPhT4KSEbL160KLc59J0X/AyWhIaxVfV4j:UPhVSEbh60KLc5v04yWhIaxVfej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770814697, "uuid": "909cde8c-5a2d-4536-8c97-4bf9a9945ae1", "value": 128274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770814697, "uuid": "02ad9856-c90c-4232-9277-ba07df9c6b38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770814697, "uuid": "19a5ca56-6890-4e6b-8e35-97a06057e3ce", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9fe23a-070b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770788107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788107, "uuid": "68bc2ec4-d1c6-49e9-8cbf-2251e0b88d3e", "comment": "Malware payload (Mirai)", "value": "05b6dff3e54a2f161a9562a8eeca800e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788107, "uuid": "ac954a27-c889-4372-99f6-e878785f2c8a", "comment": "Malware payload (Mirai)", "value": "ffc10217f903e2b3c90e43c9297ce4829e15506a0d213a1f090afd190fdd7ee5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788107, "uuid": "5836a6a2-efc8-4075-a014-ee2a2b18677c", "comment": "Malware payload (Mirai)", "value": "aee800561d88cb0c5a3ba88f19190c197a5a2f28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770788107, "uuid": "c6418faa-b86a-4efb-a83b-41b54040bd3a", "comment": "Malware payload (Mirai)", "value": "e48a8036ef9851bb6de1da1b733c748bb69c8756392563b3bbbcea2a6eab755bab657a7ef9706adb6eeb6d58b9bdd4dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788107, "uuid": "e41252f7-66df-4552-8f6d-86ccd4627283", "value": "T10D343B87F900DF7EFC07A2B244674915B130BF6A18620677F122BCE6EE390D5196BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788107, "uuid": "75fbd2b3-d801-4694-b097-49bdbc3b1741", "value": "3072:jokxoodmgTijXVVxRTL7JL4y5aRnQgP6CTzrOifgWAzqVdjbidL/uWZlpAtSe:jok2WqLrqy5CnQgRTHfJAz1LWwAtSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770788107, "uuid": "ba4bb01e-6253-48c8-8a61-608f090107c9", "value": 232184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770788107, "uuid": "8088bec8-4efb-452a-9f10-256b28bd1b89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770788107, "uuid": "0422675a-ac10-45c0-baf1-4f71cef8cc92", "value": "bin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }