{ "Event": { "published": true, "date": "2023-02-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-26", "timestamp": 1677456181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8fb04d76-332e-4d45-a5fb-e47b20e25bd7", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47126393-b57c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677378089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378089, "uuid": "83b137f5-493d-4df2-b971-136f44bc36be", "comment": "Malware payload (RedLineStealer)", "value": "19f42cffc9da376352c723559c7e93d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378089, "uuid": "5d4b82c8-76b9-45c7-9bbe-da9ad3461075", "comment": "Malware payload (RedLineStealer)", "value": "00c7453735b92b52a229aa1b4b5d7c2f61ca5aeb44ac7e9f7a93476cb3f7b064", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378089, "uuid": "b42af2db-29f3-41c4-9df1-e1d0c2443689", "comment": "Malware payload (RedLineStealer)", "value": "b6130e6ffad9de16fe6d789a039e6046bf1a944f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378089, "uuid": "5690279e-c9a4-40d5-930c-2d60c0e3e17c", "comment": "Malware payload (RedLineStealer)", "value": "419bbc56fb92ecafcd571b3862ed066c7cd10d6c8190d37d06d513d8769a3229ca0e336e0c746cd5f33fc47cae65073b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378089, "uuid": "e1bd09fa-80c2-4057-b7f0-b33461c97d06", "value": "T15464F2D1F5C0C475D85A8C309421D9E8297ABCA2939499433338FBAF6D303E167EA367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378089, "uuid": "bf03a643-12cf-4ec0-82ac-a2b776f90eb7", "value": "4453019f24fbdf41dd3a4f06fe73134e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378089, "uuid": "66223bc1-e157-4267-adbc-50f93ac82e4b", "value": "6144:tNLsN1obA/gwx1JfR6YXQbOI9OKkvVwTyhN7HFZlCbKmQ9kHwbb:tN4NCbA/FJ7gKIk980pZWS6wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677378089, "uuid": "ec66d615-4296-4412-8908-f4bf2c55f749", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677378089, "uuid": "90b75aac-a98a-4e84-afa6-554897b43cd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378089, "uuid": "0d7521b0-f15e-4806-9bda-84bb318fb9b1", "value": "19f42cffc9da376352c723559c7e93d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227bf549-b60e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677440734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677440734, "uuid": "93d6fc80-d34b-423f-bf5b-a126a1f9b6c1", "comment": "Malware payload (RedLineStealer)", "value": "20a49d69ea32eb30121d9a908a8e6191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677440734, "uuid": "547b15ac-0128-499e-90b7-b020bb01ae3c", "comment": "Malware payload (RedLineStealer)", "value": "017832c5ae6bcd2621e422275e1af6c1ada2cf0412212a028167e4700f37f693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677440734, "uuid": "b1336ad7-a6d7-4046-8cc2-fdddb9767357", "comment": "Malware payload (RedLineStealer)", "value": "f320a019463a282509cfac7fa570656410b16035", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677440734, "uuid": "febba491-337d-400d-ad20-086d60524b1c", "comment": "Malware payload (RedLineStealer)", "value": "ae8a34b8a8f02bebcb4d8d0c6fe91eaa0c23f1e2a6a39fa4acd9634fc78765dbe0145cbfd68adeb0f39c4e1cc8958906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677440734, "uuid": "bef87bed-ba9e-422f-8ec4-857cd9bef545", "value": "T177452217E6DC42A1E9F47B706DF142C31A367CB16E34836B238D9D894832695A370B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677440734, "uuid": "108d53d7-57cb-455f-8ca0-95339fb869a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677440734, "uuid": "658edb9c-3ddc-4647-9679-895b78cae51d", "value": "24576:qy4QLME9udmSlJ67me2LMqe1Inmpvlihj7Dk2Tl:xFLME9LN7oMqe13vlihDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677440734, "uuid": "3562306e-f74c-48b7-87aa-687f5bd0275a", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677440734, "uuid": "e27f3c34-1823-451c-aa22-0143d8a29eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677440734, "uuid": "81af0fa6-3f7b-4799-84c0-4198cad4180a", "value": "20a49d69ea32eb30121d9a908a8e6191.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61bd09db-b5f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677430532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430532, "uuid": "178c7d15-8fd6-4415-9640-5701570cff05", "comment": "Malware payload (RedLineStealer)", "value": "302a5431723fc9c01dad1061ee23563f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430532, "uuid": "f90ed904-5f86-4c5b-b83a-9c08b520d064", "comment": "Malware payload (RedLineStealer)", "value": "058ab741c326fe5d70bfedb6f4105a75a56a212aeab329f4462ad0224eb5d4ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430532, "uuid": "343460bb-7499-4988-94b3-e3d6d5acc640", "comment": "Malware payload (RedLineStealer)", "value": "c65e007c377d65f668ce93993b05ae7f41c47e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430532, "uuid": "6854cbc0-123f-48b9-bb6e-f0663c81843a", "comment": "Malware payload (RedLineStealer)", "value": "5ebe7ef4dd484e2e01869586c20d68f2a02941f0759a6a008a5bf2eda5bfa3d84fee7666bbe9799ae05bb2ed36d674a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430532, "uuid": "ac3af1e3-95a5-4f90-9009-5943b3786da3", "value": "T1F445230FBAEC4822E4B257B019FB03D32BB17D615A7843A71387D95D14B32BCA53536A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430532, "uuid": "4dcfae37-2ef4-46d5-bccd-6bbbcc6bd07d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430532, "uuid": "67c662ea-8673-4366-b011-25f620c8798c", "value": "24576:1yILfV158JSZoq2s1OqXEC31Q9FTbv1m2hqEjNQgNjGdU:QILXK6bn0D9ppzFGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677430532, "uuid": "a0b69075-9c8d-4403-bbde-c494de4111a2", "value": 1166848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677430532, "uuid": "096c66e6-bc5f-4f60-a31a-39fc4a51b706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430532, "uuid": "56e3bd25-e8f7-4e0e-b109-549711918de6", "value": "302a5431723fc9c01dad1061ee23563f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8340b9-b5bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1677407037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677407037, "uuid": "2480a2b4-6e82-4c46-97ee-0434f1e65b1e", "comment": "Malware payload (AsyncRAT)", "value": "726b5edc5de5729ee83e916239643f8b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677407037, "uuid": "14075d6b-3053-4a27-a500-2bec19dc6549", "comment": "Malware payload (AsyncRAT)", "value": "07442f6c22ad2b6a0d4f4c342c3e2a9095941147462b2722e2cb95c3ad77221f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677407037, "uuid": "d30a3410-b2da-4176-8e6c-0fde747b3b95", "comment": "Malware payload (AsyncRAT)", "value": "cef6bd4aec26e6d01e7a727aebb67d699eac7196", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677407037, "uuid": "7ff755cf-b4c8-46d1-9561-1adc46415609", "comment": "Malware payload (AsyncRAT)", "value": "a663b022736e330f240306fe45d30aaa47be9c8d2676cb58887b2d57466b90e5a77a757c3f0e9bd1d2ff9253e5e8f618", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677407037, "uuid": "a13f4a93-a342-413a-bf09-a5911d4aaaba", "value": "T1FCB3807EF0FA87501716D4A44F78B76D92A24061C36E08E2E4C4AA217919E3E735EDCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677407037, "uuid": "3adbdca3-7972-4129-9c43-8b5e80f636bf", "value": "3072:uLj7PFLj7PFLj7PFLj7PFLj7PFLj7PFLj7PFLj7PFLj7PFLj7PFLj7PFLj7Pg553:uX7PFX7PFX7PFX7PFX7PFX7PFX7PFX7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677407037, "uuid": "defbfe22-f653-4402-bf54-35661586cf4c", "value": 113943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677407037, "uuid": "24a53474-4f1a-4e0e-8ce7-2c460ec7ac3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677407037, "uuid": "d20d7075-4f37-43d2-bc47-6c1f7fb3bff2", "value": "BillID-95205S5FR9.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56875c0-b59f-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1677393414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393414, "uuid": "32b42375-d79a-4a5f-baf7-8babd45c0bc4", "comment": "Malware payload (CoinMiner)", "value": "21cbb96d0d2504c2339b985c6580ec3a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393414, "uuid": "a5aee07d-5e71-4167-89ad-e1c9ff778a7b", "comment": "Malware payload (CoinMiner)", "value": "080dda7b4647a6a26928b828d4c04bd001cac784b150deca81a731e144d7bcf1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393414, "uuid": "24481784-0f45-42a6-bb84-3fdc5d3cddf2", "comment": "Malware payload (CoinMiner)", "value": "fb3bd7c10aee4160e9d12e9b96cdcca327065350", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393414, "uuid": "416cec69-96ea-4434-b0a1-0f1cf34f883a", "comment": "Malware payload (CoinMiner)", "value": "8cd48687e4784c4e67d32b242ee84948a4d9e9c524ece0f95b14cf9822e82399cc83d8d00d0b4828cfed8780d301c8d9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393414, "uuid": "b672fe19-ad5a-4767-8f62-a43ea82d8dc7", "value": "T19C052314F74928E7E749FE75DAA03E13489604CE302D83B743D1D85BAD0A7528B2F66B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393414, "uuid": "9f015b14-195a-4ad3-9b81-ec1fb7eff8c1", "value": "4ddfbce6ea238a577891a46e80aa2c8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393414, "uuid": "c04b5e0e-8cf3-4d90-9583-2d274fa7c3d1", "value": "24576:ExrsKbkAZgZXget0LzbcAQg81USyYmhLbnyNUFKv:srsKbhUXqPf81USyYQbyaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677393414, "uuid": "2e6ed911-b33c-4848-96b5-382e5398c9f4", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677393414, "uuid": "af044e89-eb2c-4d29-bba9-c2c24ec8ca7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393414, "uuid": "babdec60-28bd-4d85-bb0f-fe9c34fc6b20", "value": "SecuriteInfo.com.Win64.Trojan-gen.23581.31557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035161c8-b5be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677406322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406322, "uuid": "db61ed32-cd7a-444e-9ea4-12c2b4df8f9b", "comment": "Malware payload (Mirai)", "value": "dea0a87a0c93b6d8c00a43886df54e5a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406322, "uuid": "dfb1823d-7a0d-48a6-9f9a-33ece70b5e64", "comment": "Malware payload (Mirai)", "value": "09d6b348bedf9611cd939d9755c5b2bec156fee440589165d245d33d71f82b99", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406322, "uuid": "b55e3762-485c-4d12-a12d-ed66e6ce6d08", "comment": "Malware payload (Mirai)", "value": "244d681794c8f7018be36408f4a5c342535bc937", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406322, "uuid": "ebcfa78d-f3ee-4a2e-95b5-b011880c82e5", "comment": "Malware payload (Mirai)", "value": "f80d1675ad455b8ec903b18d18c1345c1ab77a9092196f6ba33d03b9258e47d21ca9e5caca49e491dd14b9a6e9b836ff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406322, "uuid": "d95e6d28-8a32-4c0a-80df-d99b4f2c6096", "value": "T1A733E789B8918F05C5D412BAFE1E118D331717B8D3DFB2129E206F247B8B96B0E77916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406322, "uuid": "900522ee-07f4-42e5-a772-bd3e784a7893", "value": "1536:wRn94JSVfwJk5jUfYfATC0x09gP4IpinGwEvN:J8Vb56YYeggGwEvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677406322, "uuid": "2b64a228-fa3f-4855-a9ee-16fbb5fc2560", "value": 54476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677406322, "uuid": "4b70e02f-fe7c-4146-8b9c-bee36f20f2bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406322, "uuid": "4ab0c91a-9e71-405f-913f-f9b961244a89", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913f0163-b62f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677455093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677455093, "uuid": "7c130c17-6512-484b-b22d-7079bc9dd7a0", "comment": "Malware payload", "value": "1dd458dfd2a43fae421a45156299ef6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677455093, "uuid": "d16cad3f-eed5-4707-baaa-0da683db6bbb", "comment": "Malware payload", "value": "09ee52edd929dcef2d1acd570e4fbd0eb50402f861882f6f0a1df961ade058b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677455093, "uuid": "5dc5b6c5-f48f-4524-adfd-b348f7015b01", "comment": "Malware payload", "value": "5d6247336fbd227553e1dc3cb28a9ca59cadc15e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677455093, "uuid": "07105a06-744e-494e-b48d-17ef34356157", "comment": "Malware payload", "value": "6e7bf83b4a46a9f7e0b650f98dc201b390a0791ec0345c9f0594c81aa2fb3266f427c4da864d2baa463255fd2dc3ab28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677455093, "uuid": "7afb2a5b-0950-4fb5-ba60-d2f5a03c10ce", "value": "T163452307FBDC9179E57957F058F203930636BD9056A4839A510FEC3F1CA22B4AA3276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677455093, "uuid": "cc982eaf-8c74-4b07-a711-4d6ebf8f0d0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677455093, "uuid": "39dd1a72-b771-4408-846d-2add37df90a7", "value": "24576:LyoV/ZclrqtCiomR8pkAw0NMHgpqnOsdAoGRdumna:+o0lrziPR89jGTnPdAHRDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677455093, "uuid": "0c9afc62-8190-4e2c-8095-01c42ae920e6", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677455093, "uuid": "f7740360-3a1f-4579-a4ee-c08d9a9b819c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677455093, "uuid": "16d79f41-c351-4eaf-820e-c3e4d35dfded", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d6b429-b59f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677393335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393335, "uuid": "e3ac3794-fffa-4024-b0f2-3131fb1424c4", "comment": "Malware payload (RecordBreaker)", "value": "79ffb1c5df972dfadfdbed09e415f623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393335, "uuid": "b87fd3f4-61ae-45d7-8078-6142e6158e14", "comment": "Malware payload (RecordBreaker)", "value": "0aaaeeb2a4317258353d646cadba368cef0d2e477b3e559f656aff75a3a40946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393335, "uuid": "341de44e-b30f-42fd-ba68-9c43540b38b1", "comment": "Malware payload (RecordBreaker)", "value": "14a93f10708e193a32d79b8366343ab94d5a50fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393335, "uuid": "f1cc1cc9-f439-4a90-9e03-7b273dce44b8", "comment": "Malware payload (RecordBreaker)", "value": "9b06d50aebdc33e45f1f1fad3cb21a6c04ee8995e16c368858bfcbea6266db692281fe43e0b829b9d87ac44223c2f4ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393335, "uuid": "b793f8f0-4963-4069-90ab-c57d00221b63", "value": "T109D633E322654189F0C5CE327727BCD5B1F16F7A0641AD3C30DA7AF91236996B202E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393335, "uuid": "181ae3ff-521a-4c6d-9ed1-852a1b45a7aa", "value": "ba71c93bfaf8a292238017b3a884ad39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393335, "uuid": "5529bc6b-23a9-4461-ade7-ca02961b1dd7", "value": "393216:AjNH3AoQ2YeZtvoI18SxZJNTecv2IUEv9rYh9uoRPjSHoPolr:cOer18SrJNTecvpHlshcIPjqogl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677393335, "uuid": "c9351494-726c-4217-b74f-1c834f24bf89", "value": 12861440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677393335, "uuid": "fadfb6f6-537e-4ca9-8a85-4fee9f3ff758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393335, "uuid": "1700b9fb-10e1-4f67-be61-c7c44f454a7e", "value": "79ffb1c5df972dfadfdbed09e415f623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb0fdb6-b598-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677390127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390127, "uuid": "bdccecbd-aca5-4c0e-98cd-8a5af54673b3", "comment": "Malware payload (Mirai)", "value": "fafd5fe38d48640d8ca1159df795d54a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390127, "uuid": "636d3dcd-0bf4-400c-90a0-67a1a3c008e3", "comment": "Malware payload (Mirai)", "value": "0b251edde589351386fd0673be83f120598b15c49aea5e88aec81ad8e0deb671", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390127, "uuid": "045af4f6-4ee8-416e-b7aa-10eace157888", "comment": "Malware payload (Mirai)", "value": "ef8de1e2c343cb1ebb1b87ec46d2ef7129826ade", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390127, "uuid": "1af6c187-74df-4f60-8e57-6056376b5099", "comment": "Malware payload (Mirai)", "value": "3a280db2de27f720a3bf82ce58b2f9233d55f64144b2a3bdee705dc083fd1b0801c925a96c75e98e31bd5f78ab2a7bba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390127, "uuid": "1c5b04ef-477d-42ac-afd2-360c251091b9", "value": "T109539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390127, "uuid": "fef358e2-c024-4d49-8525-87240017efe0", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677390127, "uuid": "32aed71f-58e7-40a2-88d3-56e78d476a4f", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677390127, "uuid": "bceef151-f982-4c08-bb2d-03a89ffc8d54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390127, "uuid": "cbfe8f6f-c228-40f3-859a-702861bb426b", "value": "fafd5fe38d48640d8ca1159df795d54a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b18291-b5c3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677408869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408869, "uuid": "132a00f6-088d-4d21-8289-e7553675d4db", "comment": "Malware payload", "value": "87739d4a43453b46f6af39fbc3decec3", "object_relation": "md5", "Tag": [ { "name": "87739d4a43453b46f6af39fbc3decec3", "colour": "#C73158", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408869, "uuid": "065a079a-a430-4cfe-9788-6e404c2e7497", "comment": "Malware payload", "value": "0c36d38bb757f7ce0ee31bcc47227035a3f6ae37a371258b5ca6d9b92a4bc55a", "object_relation": "sha256", "Tag": [ { "name": "87739d4a43453b46f6af39fbc3decec3", "colour": "#C73158", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408869, "uuid": "22d9d3e9-fbd4-4e32-8cc4-20ffc4cfe740", "comment": "Malware payload", "value": "f4297ca428a7c3af99715363236922b2241abd55", "object_relation": "sha1", "Tag": [ { "name": "87739d4a43453b46f6af39fbc3decec3", "colour": "#C73158", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408869, "uuid": "cb57b22b-7bd2-4d44-a1ca-c46042d0ca2d", "comment": "Malware payload", "value": "5ee7ea0d52f482a0a24504b4a25989684ed7683cac7c2f0b6166aa68242a6a17b7c5604fd5bd0d52e562440ac9d1e006", "object_relation": "sha3-384", "Tag": [ { "name": "87739d4a43453b46f6af39fbc3decec3", "colour": "#C73158", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408869, "uuid": "fceaeb01-220e-4d70-b47d-4c0ad3b96f06", "value": "T1621559D7219904DCF8EA83356BC78E029973BC2DC3B1A67A0553397FCA3219C292765C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408869, "uuid": "e75a9626-a1bc-4ddf-bb99-c8913860d2b7", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408869, "uuid": "2e726409-1a0c-41e3-abeb-f3cfadc00cb1", "value": "24576:ofXq5aG/o+RTJSn6+Ev5MkZguccx2X3f4zyoUdoO:ofGbTJe6+Ev5MkZguctX3QgaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677408869, "uuid": "78060644-016d-42c5-92f2-ad12ae718cb4", "value": 911744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677408869, "uuid": "ba613674-6ec7-4aeb-bc0e-7dab01591023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408869, "uuid": "c6f85cbe-b6af-4dc9-ba56-264d10c2c0e3", "value": "87739d4a43453b46f6af39fbc3decec3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d014dd1-b5ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677398392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398392, "uuid": "26762067-dc51-40bd-bfb4-ea8a5a8d91a5", "comment": "Malware payload (Mirai)", "value": "54e785586f5d064a6815e0e8639c8967", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398392, "uuid": "225f5563-6170-4b9d-86d5-221ad463af1f", "comment": "Malware payload (Mirai)", "value": "0cfa47a4be38d804e3dfa8b193d8aa17eefe4ccf0b73c98f84a83be780806046", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398392, "uuid": "20ee051f-1278-46c7-84a2-2899451867f5", "comment": "Malware payload (Mirai)", "value": "49e9e7b7fdf4339daaebc3c7ee2fc29449fbc11a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398392, "uuid": "ab010d09-a94c-477d-960e-8beaddd5ca72", "comment": "Malware payload (Mirai)", "value": "f167144de3851bbbdffc56dce157aed714134ea06ef8a910210fcc8555066467f40da79856b13b85cc1d00cdda6e1fba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398392, "uuid": "95aa5e99-9fd7-4dc6-bf1b-5a9faeab5ca8", "value": "T164431795B8818A16C5D023BBFB6E018D332263F8D2EF7207DD212F14768A81F0EA7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398392, "uuid": "af9b07c5-eb94-448b-a544-13fb71a21de0", "value": "1536:fENgweZG6OtlHQ6DcM0Dxnd/ut5+usKcFIL7hldHh:sNgwU36DVwTGbvcF4zdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677398392, "uuid": "d36e4a31-2f05-4d89-9761-652b7766708f", "value": 60056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677398392, "uuid": "fe47618e-e739-4c64-8b60-269ca75b6018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398392, "uuid": "4040e5e7-0b59-4119-8a47-9a04b1752716", "value": "54e785586f5d064a6815e0e8639c8967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75523f0d-b5a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677395346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395346, "uuid": "e12f4a5e-1a3d-497e-ac7d-82406ce5b5bb", "comment": "Malware payload (RedLineStealer)", "value": "6f591f39f08403f8173db80fc031b41c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395346, "uuid": "2569a730-865a-4be0-80fc-009badec322b", "comment": "Malware payload (RedLineStealer)", "value": "0ea3ea642d9046323c3b355c2b6c1e0ba6b8ee3850899a56d0bf3ba34312adbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395346, "uuid": "a8a7d4e2-e802-4ab6-8a35-de3c1e83a09a", "comment": "Malware payload (RedLineStealer)", "value": "60071d1b1ffe9c3c3182fde5562bbb10ece646c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395346, "uuid": "c654ebf9-2ee0-4aa7-bcd5-f1a630445300", "comment": "Malware payload (RedLineStealer)", "value": "8c6c152d13a62c4bcf153dcabd6315f29a2cff0168fa564975cbda60d8f702577ef6c4f006d0947f82283b50cdce388f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395346, "uuid": "75f0edea-7c56-4746-bed4-8f88a7de6344", "value": "T1D094F10BA7E88172E8B59B7049F706C30735BD905738836A374F6D9A18B25A0A73177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395346, "uuid": "dda36713-64cc-4826-9799-bdcbb2620903", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395346, "uuid": "117aa94f-8bcb-45c0-b34b-11a4255c3784", "value": "6144:KFy+bnr+Ep0yN90QE1OLizUC8SC8qPEbnrYdPirz/hYrTVjfS4lMP9c5GoHrFz8T:nMrky90KSy8BYdPirzZiIiFFML9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677395346, "uuid": "9fe0d2e3-805a-46e0-91a6-da617b8c8867", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677395346, "uuid": "e9804f90-4d0c-406f-a7ec-a243e7a75041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395346, "uuid": "1021328c-7753-46fb-9c71-a1e024a1a577", "value": "6f591f39f08403f8173db80fc031b41c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21854d64-b5a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677394347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394347, "uuid": "b476ddcc-7f69-47e8-9671-b92b9c9ee495", "comment": "Malware payload (Rhadamanthys)", "value": "e41bd341e4ff458d7def6651c9d22aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394347, "uuid": "c2a31223-f64d-4a9f-9faa-285ccc18f416", "comment": "Malware payload (Rhadamanthys)", "value": "115b0ce460a286cc2cbe886befaf3a588421ffff276194a35a94a102b43e2943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394347, "uuid": "7c7a52dc-8559-4f31-84fc-b016e04275fc", "comment": "Malware payload (Rhadamanthys)", "value": "37bc3f44eaf472922f2838f0ec7b6422d14434e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394347, "uuid": "74c31a69-f992-48a9-8920-d9cedb4cb087", "comment": "Malware payload (Rhadamanthys)", "value": "2fb6a1add3283a6e94a7baf5c423df8c19ab7d32580aad5036968ce24af8cbf9815c04d9b9c07d7a006c9cbeda7d5bb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394347, "uuid": "8945a559-2987-4f42-97d8-b5063b3a19c8", "value": "T16A85F06277D88468F6804E784C6FF78125CA7D792FF9653F3CD291DC7890AAA8C19D02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394347, "uuid": "a1309485-137b-4c5b-bea4-e5587fef308d", "value": "57597d29f93a39fa7a25b9585ea93e6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394347, "uuid": "7e4d93b9-08c4-42e3-aa85-3aba697d76c6", "value": "49152:rpIgvQd8PRUMpDtCPnElazMhXAS8S4HFuu5oelw3nDeVlL0:rpI6nRR2fNzSwrSRu5CElY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677394347, "uuid": "18282e46-ef0b-4fe9-ae2c-b2a17b03bec8", "value": 1836032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677394347, "uuid": "de079228-a7da-41b7-9ef6-3a6cd91b1bcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394347, "uuid": "18675f4c-948d-438a-b478-ed2e7cbb127b", "value": "e41bd341e4ff458d7def6651c9d22aec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8e2235-b5e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677421210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421210, "uuid": "2cd2c213-0d1c-4965-b406-c38d44560df6", "comment": "Malware payload (Mirai)", "value": "0cd7ea01e135a5e2a4d6392d9f388a8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421210, "uuid": "dddc5c38-99dc-480e-816e-6a0b5e8f8443", "comment": "Malware payload (Mirai)", "value": "117b94f8425c6b954d217fa7b4b43b7f66b267d1fd28715824962f0013e1de2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421210, "uuid": "dab24e01-b6d9-45f2-8ba1-97d5c8e63f7b", "comment": "Malware payload (Mirai)", "value": "7f05a0e3f1f9d64138bef9b4f0b9f22380625a4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421210, "uuid": "38481c5a-01d5-47b3-9b33-8712bdcf59a5", "comment": "Malware payload (Mirai)", "value": "7324f2788982f74c3561d8c13851d842a5951663647773889c3579243b962fd78b0a5ce6aee8a2c9f0e0e82ba7932404", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421210, "uuid": "9b9bd8e7-fc27-4d2d-b294-a16770c22d6d", "value": "T141C32A377B270A23C0C9047112E31332BAB5D79A38FE5397BAD06DAC6F169843556BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421210, "uuid": "d7c53cdc-209a-4614-8819-777352916fb7", "value": "1536:JaTFMiGcuGKNM5A9Etxd5MtCxljoQVpsmagEP/Ps8cfKi/5:0M45KN8colhpsmagEP/PhcfH/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677421210, "uuid": "262a194a-3aba-4ad3-a25b-f4537406c657", "value": 125428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677421210, "uuid": "98d14931-f4db-4e79-86d0-8e10044c954f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421210, "uuid": "9370a6d1-7360-4ad6-b3f0-8c2e79f3fe02", "value": "0cd7ea01e135a5e2a4d6392d9f388a8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8f5392-b582-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677380916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380916, "uuid": "c3cd9b3f-50ca-4087-8a51-25b79167a7a4", "comment": "Malware payload (Mirai)", "value": "675501b83ffaf1548c06c3663c6029e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380916, "uuid": "6e3e0392-03f1-48d2-8cab-5d2a44582794", "comment": "Malware payload (Mirai)", "value": "13b32afdb420406bbb6324475e762dfa58245fa41c1b1852f85f7ce291de0f43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380916, "uuid": "551294f1-d080-461e-87cd-e37820d17781", "comment": "Malware payload (Mirai)", "value": "2471f2130517cdeeeaf34bcbee9c1ba418241a26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380916, "uuid": "3588dd66-6b96-4f97-9cf3-3cc68bd8df5f", "comment": "Malware payload (Mirai)", "value": "c7967c07eee6a2108813ba72bfd0f37991fa45096d736f739d4b5e545109a8d7a20c1fb4e3122623db599af61b9cd2c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380916, "uuid": "d3ea8af0-358d-4825-a319-ad56e26d83be", "value": "T1A893AD23C9202D24C1054AB171F5EA369363951691CB3EFAE585CB6DB843DDEF226BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380916, "uuid": "c018d76a-87c8-4837-84a2-eee4bbf8262c", "value": "1536:4PF+gLbgXwFCcKaSgedRyTd4+2XC6Oi3DPYyCfIZJKAsagZYJYay5hrb:KfbSlcd/syTd4S6nDPYy6AsuYj5h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677380916, "uuid": "c4bba45e-7785-4167-a000-8fab93eda4d5", "value": 91508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677380916, "uuid": "473a5a6a-0ad6-4fd1-bd01-ba51326ef28a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380916, "uuid": "bc68be7f-0e8c-426c-8ee4-e38a3a34000f", "value": "675501b83ffaf1548c06c3663c6029e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d44497-b569-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677370094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370094, "uuid": "ff604c8a-dc33-42eb-9662-123390d5650d", "comment": "Malware payload (Mirai)", "value": "ecff8b3a7931d4cf826a01aabc4ac60f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370094, "uuid": "2a79b84e-733f-4761-9d71-e6e15bc45aaa", "comment": "Malware payload (Mirai)", "value": "142191abaafbed3ac27206fb6d0f0d823b0a364eea2d586980ef4f7a381d1454", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370094, "uuid": "ef35a06a-38ce-454d-bd48-9f8bc63f940b", "comment": "Malware payload (Mirai)", "value": "22674e8e458d12edaee289488d1ddef59e790ac2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370094, "uuid": "64a7adb9-2cd7-4a17-aad3-cbea32854456", "comment": "Malware payload (Mirai)", "value": "86c2bae3f39df0eb4d339f58a195566662ce82c35372dd6c339a01bca4c439bef6d161bb308a033dd8e9d4a56ba899bb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370094, "uuid": "65a1347d-12e5-41c5-8021-b746e0016707", "value": "T1C703E651BC829A77C2E1137ABAAE4A8D333163D8D2CF72179D214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370094, "uuid": "6d11bdd7-c22f-4f43-bfa1-9775bce20806", "value": "768:wgJMCbqsG5f0OtnlUlYOJFFARwAtb9LnWwaCv+bv1C6ibXoTU/NZwW:wub1G5fPlUlDf43aw9v+sbfMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677370094, "uuid": "c5c35d01-80f7-4971-8e39-c6062970d2bd", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677370094, "uuid": "d271d2e4-a9db-42c3-a04b-7cb628a06a0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370094, "uuid": "428e8e0c-d4bc-418b-aa0d-059f5e4140ae", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d805a01b-b582-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677380909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380909, "uuid": "7293c618-1a16-4fa5-a587-2a86d45e2af8", "comment": "Malware payload (Mirai)", "value": "b88409d7ce24c05b6cd1be95deb3de33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380909, "uuid": "cd0d5e92-a97b-4b09-b6c1-0c3d1989d6e7", "comment": "Malware payload (Mirai)", "value": "1447fbd86d84ebb98a3e6dad7f30af118538b1e3736881320f44bbae7944f5ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380909, "uuid": "517cfa92-4d01-41ed-a106-638c17005016", "comment": "Malware payload (Mirai)", "value": "186762571070f6c2cfd8213b1d8554fe9a4cacbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380909, "uuid": "ce943df3-5a3c-4747-8c99-c3199fa2b8b7", "comment": "Malware payload (Mirai)", "value": "a4b47b3bea0b608c1054f8fe5ba173d2f45854129795fd7ad417c9c3c71bf8972c476ab8526a013e6b306561dfb12eed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380909, "uuid": "1877a86f-a61a-4e97-868c-68f9cc0d191f", "value": "T179A36CD7FC00DDBDF809DA3A41670A0AB131A3A10E921B37B2536C67FD751D45A2BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380909, "uuid": "a73e01d1-7b6e-47d7-a403-5ee4e1ec70f1", "value": "3072:cCMLL8316iIBnqybZspGWN6AAerSyoSeIrhHVLJ33b:cR+1UqyEGWNXUyoirdtJ33b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677380909, "uuid": "6e035858-5452-4542-b4c9-c1fcd99f9085", "value": 106636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677380909, "uuid": "c4504b2a-dcea-474d-815c-47a4123d6afc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380909, "uuid": "ba1ee1ae-8464-48a2-bd70-5d0c40bd7bf3", "value": "b88409d7ce24c05b6cd1be95deb3de33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f8ed13-b5ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677398322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398322, "uuid": "cf565cb7-d3c7-4d1e-856f-35c7ed512bc9", "comment": "Malware payload (Mirai)", "value": "82cb35d258cd18a0709a65f6123e9548", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398322, "uuid": "905f881d-1e60-431f-b89e-b4fefde34dd4", "comment": "Malware payload (Mirai)", "value": "145a359a3a6f4916dac8d5cd9b97e92d172267198f1806f09e57cdad80cf97fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398322, "uuid": "db5d48f4-ad25-404b-ac93-75a20edbf6fa", "comment": "Malware payload (Mirai)", "value": "e4ec6c6b8c4e9f677e187fd30ecc8e2d31003857", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398322, "uuid": "173b8160-f90a-4c7e-9270-f67144bd09be", "comment": "Malware payload (Mirai)", "value": "de6b54744c0ecd2c672b7ff4353f6ca94b1053d6c1e1cdc4940eb0feb43a0fce4a1854acb0109773e6c6a25dec95023a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398322, "uuid": "addf8588-be0d-40c0-a6ae-2a0040e82ead", "value": "T17FD33A46FB808E03C4D517BABAAF41453323E764D3DB730699286FB43F8669E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398322, "uuid": "34fce9df-de45-4543-8e15-cc7a7594d126", "value": "3072:KQFTqO/gkXycZkMH+cfYZcEYoEXe1fqToHcFvtZhM/9X2neJ:5FTqyym/+QYZcEYoee1EXvtzM/9mneJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677398322, "uuid": "4bccf0cd-5fe9-44f3-8ba2-0b1493f034cc", "value": 133941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677398322, "uuid": "2b748d8c-a1a0-4079-8cbc-1d3ca1267a3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398322, "uuid": "e04a6515-e461-43a2-847c-ee6f79862bd1", "value": "82cb35d258cd18a0709a65f6123e9548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ad9afa-b5f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677430530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430530, "uuid": "65a78427-0c60-4b7c-b286-008e7b5c30f8", "comment": "Malware payload (RedLineStealer)", "value": "9bd91b8e725cb8e248287b30ea59ec4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430530, "uuid": "53c58297-5ed4-4693-85c2-70bf19412faa", "comment": "Malware payload (RedLineStealer)", "value": "14900bafd95d53f43c44453772490ee3559179d7f49e2f8873e6b11376062c09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430530, "uuid": "8eb239be-961a-4d86-8f8c-fdb4ed4bd584", "comment": "Malware payload (RedLineStealer)", "value": "4037ecee290a0e5306a2309045a71fb926b444d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430530, "uuid": "4c24b317-d1de-454a-8505-c879064e4ca5", "comment": "Malware payload (RedLineStealer)", "value": "472a8d83a5eaf690f3e09fdd21e2e988692bbf7104d41560b4b6045c628d0f573ccfcd758b44cc367cb1a58aad78a946", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430530, "uuid": "7003209c-db89-464f-b4af-daee66e7633a", "value": "T144A4F25BBBE88072E87557700DF603C30A35BE506B78829B134F6C5A58B26B4F63476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430530, "uuid": "50af01d9-e57a-4eb2-b699-2f170eb1dad0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430530, "uuid": "5ca1309e-a023-4c22-9137-51bcac565ba7", "value": "6144:Kny+bnr+Lp0yN90QENSQiX1gw6SXi3Nh2cKMWBSJwl/7MF6bgIGn10aqJ6F3zFd9:pMrfy90G/B6qi31j4ew1A8S+w9L9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677430530, "uuid": "ec1e69d7-679c-47a7-a88e-d2d6c4f89cd3", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677430530, "uuid": "bde75f62-e085-46a9-8114-26cc051eec04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430530, "uuid": "9494c590-abaa-4005-914e-3a8fd2d9aded", "value": "9bd91b8e725cb8e248287b30ea59ec4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baec953c-b5f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677429823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429823, "uuid": "0671ca5b-417a-4056-9c36-28dc00f8d91a", "comment": "Malware payload (Mirai)", "value": "f1f8562c3b6d7be9eb5dd549d865c63f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429823, "uuid": "796c6d7e-7c7e-4fb0-8228-a398ce270fc2", "comment": "Malware payload (Mirai)", "value": "14b3834f37ea2a03a4beecc71001ea304615e5c97fa17f99c6f7d2ccb076c0bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429823, "uuid": "6f8ff9f1-88ec-4459-bca7-811512a9cceb", "comment": "Malware payload (Mirai)", "value": "82b86a5e5c4b6fdd27b6bc0a8e89cb0f2afd82d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429823, "uuid": "b13eda41-8c70-4c45-b3b9-b670943220a2", "comment": "Malware payload (Mirai)", "value": "b6f0aa135e7aacba2cd0b8986d913c6f041c5f75c42e6d8c3b6cb9e5dd32e13d4baaad511e8c1cd2e1cbb7da3da61d5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429823, "uuid": "5458e174-fe60-442d-ad79-4c72293662e0", "value": "T1EDC2D1E0B726FE31C420AC3EE53B4D893A510A7C81FF353654259C398ED165B66F88B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429823, "uuid": "927782ba-ddb3-4560-9fb6-f886ca51ec32", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrx9q3UELu+:PKy4qfqoeJdXWgkLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677429823, "uuid": "cc623839-1283-4906-bf6a-ddec20902a03", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677429823, "uuid": "f9e41264-e6a7-4eb8-b2b9-2379de550e07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429823, "uuid": "5c38d49f-7534-41ba-82e8-c411c37d7056", "value": "f1f8562c3b6d7be9eb5dd549d865c63f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24484d12-b576-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677375453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677375453, "uuid": "cced7ffe-398d-471a-b20d-43db48dc9cbb", "comment": "Malware payload (RedLineStealer)", "value": "e25607129665f296c34dfbb8c4c91bbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677375453, "uuid": "243f94f0-f821-4873-9bf8-128217dcf8a1", "comment": "Malware payload (RedLineStealer)", "value": "14e2872ba87811b677432d96bdd0ec42ca09d014275b6b4db3c2b6ba6e58bfce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677375453, "uuid": "205567e0-0f88-4c3a-921d-62936e81b71f", "comment": "Malware payload (RedLineStealer)", "value": "99581e33c985a42f2c657b1e82257bdadb30cd78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677375453, "uuid": "58c27bcc-d627-48d2-9da3-3b73b8e9a8f6", "comment": "Malware payload (RedLineStealer)", "value": "6f0f1b66ec76485c5a4499b36c59da6e9ab239718e2367db95c296535dd1418f69c1f0a7c7ab8e772ee0ab102de8c543", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677375453, "uuid": "84b6cebe-3932-49ee-be09-83e1d97baff0", "value": "T1FD64F111B540D032D84A4470C821D6F93A7EBCE15B59899B73A87BFF7DF02E166AB312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677375453, "uuid": "726d0ccd-3184-4720-9c37-14dee5db460b", "value": "4453019f24fbdf41dd3a4f06fe73134e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677375453, "uuid": "9752da2a-fed6-4c25-978c-367cabb3da81", "value": "6144:falLyM1RCsdkRdFpeDWLwsq4FPGK2QPKQqcJVA8dg8cB2b:falGMesdQFp2xscKLB9u8S2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677375453, "uuid": "36b42cfa-b0f7-4105-8a67-6e0db12cc647", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677375453, "uuid": "a50ddc92-d843-477f-9700-e150f4660755", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677375453, "uuid": "3ec52a2c-dfec-4d17-9c90-76de4701e1e8", "value": "e25607129665f296c34dfbb8c4c91bbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fbe7432-b5d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677414745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677414745, "uuid": "3067e992-7936-41a9-a7c9-fb3b35402b4f", "comment": "Malware payload (Rhadamanthys)", "value": "b610ed46b9f31391f16d354cc06613f0", "object_relation": "md5", "Tag": [ { "name": "b610ed46b9f31391f16d354cc06613f0", "colour": "#D9A4F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677414745, "uuid": "b6144f8e-e7dc-4210-9439-40a6d175318d", "comment": "Malware payload (Rhadamanthys)", "value": "159bf58e8eed53f17667251ff65c1666d405e9bdaba233b74c697155f5b0fada", "object_relation": "sha256", "Tag": [ { "name": "b610ed46b9f31391f16d354cc06613f0", "colour": "#D9A4F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677414745, "uuid": "1a639b8b-513d-4019-a501-8c4c1beb7c48", "comment": "Malware payload (Rhadamanthys)", "value": "51a42af9d2ff8676d529168ae5f11ca2d49792ef", "object_relation": "sha1", "Tag": [ { "name": "b610ed46b9f31391f16d354cc06613f0", "colour": "#D9A4F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677414745, "uuid": "d18ec8e9-33f0-45ce-8946-4d546e93b36a", "comment": "Malware payload (Rhadamanthys)", "value": "be1ab0458dfb120b44eea7e49068ff697453ed49394e2e9de83666fbb55fecd20c126af1138ddf9cf79b3c5730220a2a", "object_relation": "sha3-384", "Tag": [ { "name": "b610ed46b9f31391f16d354cc06613f0", "colour": "#D9A4F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677414745, "uuid": "ad628915-ccb9-4c62-8649-7daf69c890cc", "value": "T15054CF17BF5C80B8E826DDB454B01B626BECD636239F131B976C0066DEE07E05DE42DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677414745, "uuid": "41adafee-2867-4768-bdd5-b1b282c7b81e", "value": "34c076e543b95918c5f8b18c85e7fcd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677414745, "uuid": "795ce9fc-9d9c-4e6e-9d64-b0ba547162e1", "value": "6144:7at6iUcrOMQGRovA3JcH8P1mEu0WO01qD9plEXRbzNblVmTI3To:mt6ifPRRN3JcmffFDqXNNZpTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677414745, "uuid": "94f5709d-4338-4224-a829-83b2233636f8", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677414745, "uuid": "2ec60bc0-fef7-415c-8b1a-9de1541f57bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677414745, "uuid": "f765f75d-d8ae-4f04-a4a4-fba304a60e78", "value": "b610ed46b9f31391f16d354cc06613f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2b49f9-b5da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677418364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418364, "uuid": "e7c246af-96c7-4afc-b243-fcde59a971dc", "comment": "Malware payload (Mirai)", "value": "5d63282f81c92427b9257afa08c0fb1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418364, "uuid": "d3eb4239-364b-4177-8831-0fd40af0b9a0", "comment": "Malware payload (Mirai)", "value": "15c1c60e0b5d6ac7751d6ac145a0b732779696b12b233f48a0fee4b847535ae1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418364, "uuid": "b0318be7-ba21-4f45-815e-4eeeacee318f", "comment": "Malware payload (Mirai)", "value": "643d31e7a1170deedbbc219253cde158d0be297b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418364, "uuid": "28163b4b-d4b7-4d3a-b22d-55e51cd87475", "comment": "Malware payload (Mirai)", "value": "405ac2b9c8d274aff1e09be015cf564630202b4bc5ae0326aa65b0613decfa8fb4291e3b1cbbd2b6c3106d47cb61d6ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418364, "uuid": "4dec9253-28aa-4670-bd7b-e993eedc6009", "value": "T12563D759BF610FB7E8ABCC3705A91B41288C955B22A53F35B970D418B64B24F19E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418364, "uuid": "5ef94e3c-637c-4a3c-8cd0-82746e47ab1c", "value": "1536:FDTxZkvEYxEosp3eHTX7/07HkZm0Fmaxb+10Wwm:FHxZkvGpt7ktxeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677418364, "uuid": "2371f284-5332-4d6f-bdac-be00c3fda94a", "value": 73304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677418364, "uuid": "89992b2b-a828-430e-bb3a-b13a0bf0b28c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418364, "uuid": "fbfa73ed-c8f5-4f94-a286-1508ef49d596", "value": "5d63282f81c92427b9257afa08c0fb1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07ef895-b610-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1677441938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441938, "uuid": "7d237925-c569-45a5-a3d8-190b69cfdff5", "comment": "Malware payload (AsyncRAT)", "value": "281768a86aea4bf6f786eee1a12dbbf8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441938, "uuid": "f98eaa44-a4d7-4725-a1d5-23c082697aa7", "comment": "Malware payload (AsyncRAT)", "value": "167bbd9058620cf4884372e3f322eeb0783c644ece600f0eee356b29a1d0925c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441938, "uuid": "4df6a9ee-30be-494a-8d9f-69b1257b0f5c", "comment": "Malware payload (AsyncRAT)", "value": "152c1a5c097177f984e28360486c160b3c967f86", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441938, "uuid": "12250e5e-052c-4cec-b1fa-3dcf84cf41c1", "comment": "Malware payload (AsyncRAT)", "value": "51cdcecc236e25eac1ee24d411cd02a5ebbaefcf46db0929442132df33b49dba24e8c4d96999bb9728247bf92963adc3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441938, "uuid": "9ebb23f3-2c52-4d5f-aea5-6270c4221b18", "value": "T19EF44A9DB714476AC25C36B6C8E99604D3F2E596DB33C3064EF5736CA973393AC0A428", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441938, "uuid": "8dfe92a0-5cde-4fc8-9a35-8ab6d9da8e17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441938, "uuid": "fc1b8840-b044-4b02-9d0a-d0e2b013d0fe", "value": "12288:erRsLGfhQYrgAupanwh7V3CmzlmYZ0FW0mEtJ:ICLGfhQIgAugnw9VBlmBpmEtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677441938, "uuid": "0e676a7a-8beb-437d-b5e3-4887aeaf7486", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677441938, "uuid": "69adf179-705e-4ec4-b16c-897afc4ec0e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441938, "uuid": "37514a6a-ed02-4de3-9c27-a4f39554d747", "value": "167BBD9058620CF4884372E3F322EEB0783C644ECE600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a14362-b582-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1677380735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380735, "uuid": "7d90dd18-3cd0-44a8-a5d1-9586acb890d7", "comment": "Malware payload (AsyncRAT)", "value": "67bafee7976200182941c19b8cbd9dc3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380735, "uuid": "1c0027f2-2338-490f-9cab-02335a1f8ae6", "comment": "Malware payload (AsyncRAT)", "value": "1695cc89d3c2f7f0682631b79b6289787719d625e13da6cd981a83b2d1e29380", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380735, "uuid": "d65323ac-5810-4b0d-96cb-7cc3a9022448", "comment": "Malware payload (AsyncRAT)", "value": "ea73d99634f4ffe2bf4d40beb3600355f4705453", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380735, "uuid": "4644f05c-1124-4a1d-84d1-40df7885f2cb", "comment": "Malware payload (AsyncRAT)", "value": "75d2b3a85e725cafb54b45d60fac9ec910f8e42a73e1f988e6d4ec347d836b3db6356eca760dcb5e5d3be223de728b80", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380735, "uuid": "9d0ef422-32cb-49cc-a2df-c5a6e5b9481b", "value": "T162B49E528B595B13F5EE0E346C16B62DCFFCAE46A7A0C1867CE430D93AB3B505B20E54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380735, "uuid": "0fb974d8-c263-479f-91c9-f6e3e1198f62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380735, "uuid": "ef34502b-533a-493e-ba7a-3c852335fea3", "value": "6144:y1bymMdyHOGHiDeDG+thbATFysit2lniPZEhknzwW2HKOt:yUdyHOYiDik0siqnQSSELd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677380735, "uuid": "3d70771a-2ef1-490a-9080-5c3e8a48221a", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677380735, "uuid": "ec1bc9c0-3ad0-4910-960e-38762d65f7f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380735, "uuid": "8968d231-578b-4993-841b-a6503a14d8a0", "value": "67bafee7976200182941c19b8cbd9dc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7112251c-b5ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677398345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398345, "uuid": "5bd81e3d-a0ec-4eb0-9b44-9baa53708f92", "comment": "Malware payload (Mirai)", "value": "0a60c19e16ed935e98365a0f986ec006", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398345, "uuid": "d84a2182-0883-4c11-9abb-00bd11b29f48", "comment": "Malware payload (Mirai)", "value": "16a863ac6732b8a4b1a9ce5aa09b79fece2969e75ce21d5421e2b9e7531c3c7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398345, "uuid": "e40783d5-6f50-43e7-beea-52d6f5258b7c", "comment": "Malware payload (Mirai)", "value": "b065653cc6e37c9c77088060d72593f37daa9d25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398345, "uuid": "eb0cb313-7ff5-406b-9806-c29a676509de", "comment": "Malware payload (Mirai)", "value": "b7864714ec2923bd2afeb8db231c93baa183f6817dda11abcb3faa0c3e095d6cba39318408f3d68bbf95acfccc0cdad2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398345, "uuid": "a5acff0c-6f31-49e9-ad17-8304b41d3b1f", "value": "T153630996BC818E16C5D412BAFA2E118D331727B8E3DF7213DD105F24778A82B0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398345, "uuid": "2dbacd36-862c-4d3c-85e4-d20a5c8258b5", "value": "1536:p5ngHXjmR/yD3f7Uq2ffeuP/XkZdoOHYDykl33MkiwiY5sDkqhpxHc:ij+/I7UTRsZdoO4tiY5sDkeHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677398345, "uuid": "61c336ad-dcef-4775-b2e0-2103f18e038d", "value": 70992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677398345, "uuid": "d59e4f63-c710-4439-b72a-4fb50e9b6325", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398345, "uuid": "c8853041-cab0-4111-b85e-00143b8d943c", "value": "0a60c19e16ed935e98365a0f986ec006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb18c9b3-b5c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1677408455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408455, "uuid": "a5a3a979-3451-4530-9359-912c11680aff", "comment": "Malware payload (AsyncRAT)", "value": "1549756b6d89ddd9009765236f058d91", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408455, "uuid": "54262c51-9fe4-4434-b1f2-baea2c03c9e0", "comment": "Malware payload (AsyncRAT)", "value": "177d453cc267a310d7dc8bbf4128c558feec25095690a31ccb6c388866666bd0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408455, "uuid": "ee5d1d4d-6d2f-4290-93fe-30d0e6189453", "comment": "Malware payload (AsyncRAT)", "value": "cdd3fc4772841b56cea35499972ae9f08219f90d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408455, "uuid": "9b9f59cc-b974-457b-b3ce-14c487f7c698", "comment": "Malware payload (AsyncRAT)", "value": "0f4b0851dde5a466cac967b1b281a2cdb6599bcc599f2843d91b451b99c1aeaf41d6131185e912eca2f54d6cf33d510c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408455, "uuid": "e2af3972-001a-454b-ba11-a9d08bebcb0d", "value": "T126538D7A56638F51ED2926420973407EDD14385F18F1A4BBDCA162F19E9CA8F3CDC8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408455, "uuid": "dba61880-2ea7-45b8-9043-5ac7cda939ac", "value": "1536:3zzzzzzzzzzznzzzzzzzzzzzJzzzzzzzzzzzPzzzzzzzzzzz+zzzzzzzzzzzyzzp:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677408455, "uuid": "5126da6b-23d3-4e9a-bff5-341750a387be", "value": 62710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677408455, "uuid": "1bc45cc0-875b-4c65-8be5-808e3d7302f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408455, "uuid": "3a6fd7f1-cff5-4a47-9f06-f2e0b1c0d637", "value": "UnJXSGaaEh.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d530a0b4-b60e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677441034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441034, "uuid": "5fab5c82-d679-4e02-8a66-ed86fec7295b", "comment": "Malware payload (Amadey)", "value": "21fd14cd052cc3acec609fef9e8204c5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441034, "uuid": "06cf1a5d-f1d0-4283-b6e1-0dc5934bfa95", "comment": "Malware payload (Amadey)", "value": "17b0a19fded194190e606b3d5be82d7d2d9c6fec134708ba1ce6c6a7c1e84ae5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441034, "uuid": "1077d5f2-32a4-441a-b67d-cb63e0231f7d", "comment": "Malware payload (Amadey)", "value": "07949d48a7b1eaea7d2ffc7843dab2ffc163b6b8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441034, "uuid": "32ae6fe3-13d9-4854-9391-4d031cbf9d99", "comment": "Malware payload (Amadey)", "value": "92e78686a3839ddc6f4319432aae253f643909f03e2e5b5c3d6f816d34a442f1a63d11e7139b12e5856cca932ceec05b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441034, "uuid": "7b80bd86-be00-41c0-9c1f-f187ef12acf6", "value": "T16C45230BFFE85552EC305B701CF222C709377EA156F4939A538EAEAD1872298513636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441034, "uuid": "756ff951-d05b-43b5-a8d4-00c3a7d6f6c4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441034, "uuid": "1c547b60-1777-425f-99de-ed9db6f42a76", "value": "24576:HyC+cHSz9Y3Hl36+kGokRrB/BnDjwra+mFKiiB4IIWCkd48A:SCgxYF6K/BnDjIiFKfBfIWNd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677441034, "uuid": "4ffb1f0e-e670-4b51-9e05-666f1eda735c", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677441034, "uuid": "7a22aa1e-73c9-4ee1-9efe-449b28bd6087", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441034, "uuid": "4e7d097e-282a-4838-b24c-155d70ee9b01", "value": "17b0a19fded194190e606b3d5be82d7d2d9c6fec13470.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca4ee79-b592-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1677387440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387440, "uuid": "fd437e80-ea05-47e6-a1b2-24fbb51f6fe5", "comment": "Malware payload (Chaos)", "value": "aeb08e18c57936e33a56cad7aba7d16e", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387440, "uuid": "cf3a9ec3-2a82-45a1-a4f5-3dfc26ab3015", "comment": "Malware payload (Chaos)", "value": "17df7c94d998ce0de5fec6586b9281ab87bc2ba445e3bdd35993e9d56457653a", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387440, "uuid": "d0cfd050-b5d6-4804-bd47-8c2abe1428b3", "comment": "Malware payload (Chaos)", "value": "ce7dc6ce99d6a4e3c52e0fb0ac7b167455e5215a", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387440, "uuid": "834f3e7b-7025-4d3f-814d-3c337d808192", "comment": "Malware payload (Chaos)", "value": "b545c5d761901ee61be8fc681a59ef33b6bd34f1808bf54e9e5a44537e37c7fbf52677353f7f96b80025330380be74ff", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387440, "uuid": "e19a0186-e042-479b-b793-8df9a49822d8", "value": "T11EA3512439FB502DF273EEB55FE4B5AB9E6FF6333A0A646D104103460B22E81DD91639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387440, "uuid": "c2ba4c17-6a58-48b2-8d8d-5b03347ce7f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387440, "uuid": "77f5d653-a0c1-4936-b90d-b67f30d4b400", "value": "3072:koQyxu2r9FNHLPYBtBsGLUS3FTotB5CHcv+q1l3sBbU:5r9F1LPOB1L330U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677387440, "uuid": "a4131500-f685-402e-87cb-d4a4f43c532f", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677387440, "uuid": "3f798171-a8ac-4fe1-bab7-3e081e5b26b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387440, "uuid": "a6e649ad-0fbb-4423-90b0-c3267dcf9018", "value": "2023-02-25_aeb08e18c57936e33a56cad7aba7d16e_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f63c2b-b57c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677378082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378082, "uuid": "3fc3e033-bac3-405d-b09d-70143b318067", "comment": "Malware payload (Mirai)", "value": "f71afa725744a60ffb173ca06236d09e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378082, "uuid": "4d141b8e-b647-429f-b6c5-32065d94f254", "comment": "Malware payload (Mirai)", "value": "180f8f9d2625f902d6afb43de72840eaff20d763c14085bcbaef39dcb172a6ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378082, "uuid": "bb3f9e95-e145-41da-87f6-58ac84fe46de", "comment": "Malware payload (Mirai)", "value": "389b7d7673cdfa71bd315caceba2b9d5dae54b65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378082, "uuid": "1fa496b6-af69-4548-a34b-8b7c0e27cfa2", "comment": "Malware payload (Mirai)", "value": "d103a48bae6873d44f50a630759c2301bec1a4260947d1377dff6475ba4f5bfa6c1ba80488210af23614d55f7b6ee42a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378082, "uuid": "bb0c2326-485b-42c3-8787-adb00e6cd410", "value": "T192235BC49A43EAF9ED110A7420B7FB335B37F07A1169F987D3659532AC42B11A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378082, "uuid": "b4d01eba-3f78-49bf-9a3c-44ac888da3d4", "value": "768:c8/MjSNW4GBs82WELXtRsqzqNQvh3vNFEwaK3g+ZdG:c8/MjSNW4GBz3ELd+NQvVNRaK3hZdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677378082, "uuid": "e2287af4-5520-4f9d-8af2-b52a714e56b6", "value": 46640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677378082, "uuid": "0698e9a3-4e9f-4e3c-8758-6103be0b2790", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378082, "uuid": "73bab1a9-cb65-4dc0-b196-bd6f95fddc77", "value": "f71afa725744a60ffb173ca06236d09e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab6bab5-b569-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677370095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370095, "uuid": "abb41371-7da3-4f33-8bbf-c852a0b51198", "comment": "Malware payload (Mirai)", "value": "3516e4a702161fa410f4772063454cc0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370095, "uuid": "450cb21a-98ea-406c-9c18-32f5f2cf3919", "comment": "Malware payload (Mirai)", "value": "18fdb087c4a218931c105c9081116d21854509a4e9b31ce936b9534dc9453a3a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370095, "uuid": "c332a1ae-e7f4-4bc9-b305-1d8a7912c4ab", "comment": "Malware payload (Mirai)", "value": "dc5d38440aa0c5e6f5a51a8b9cfdd444f4098e0f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370095, "uuid": "f692ce8a-b00b-464b-a518-c03135ea185a", "comment": "Malware payload (Mirai)", "value": "cef24d1d57f145213962cde82c796bc9979951ffb0492d09bb5dc2cd55b03f09386b2ae2eb3827546e836d035d312f37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370095, "uuid": "697223f1-a6e5-44a6-ac54-44488b4181b3", "value": "T1E4631851BC819A13C6D1127BFA6E02CD3B2613E8E3DF72179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370095, "uuid": "e1692f62-fe93-4f83-9f93-5a5b74bfac4b", "value": "1536:rNHlxvmiiBmLv/RN/596ya4BxF+2YWfwz2vvWM:rNprxI14BxF+5sbv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677370095, "uuid": "cb6e914e-ed18-4935-aca8-aac393417e2c", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677370095, "uuid": "4aff9cb9-57b8-45e7-8d20-7dd323af9a70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370095, "uuid": "847bd605-9535-40dd-894c-961a09d91b33", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e706b2b-b5d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677415548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415548, "uuid": "7c33d595-f921-4887-ab62-1627dfc3338a", "comment": "Malware payload (RedLineStealer)", "value": "ae191a7a247ae89606777fb0ebb11473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415548, "uuid": "4968389e-02ca-40e5-aa9c-67134dd882b0", "comment": "Malware payload (RedLineStealer)", "value": "19e4962bf1ee48574684734bd893c15e4b4ed96b1d7b1ecaa77d795e0e4f1d23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415548, "uuid": "76fdabb6-af4c-4c1d-bc15-37fd5b805a53", "comment": "Malware payload (RedLineStealer)", "value": "5b7b1aa4b516d19bef0c7f70d7ddc8b25e83c8d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415548, "uuid": "1967eda2-2d7c-4b1f-b92d-5df6f98fcffa", "comment": "Malware payload (RedLineStealer)", "value": "af6b125d1218fceb377b2a8bebcfb3a4ccbcd7c8b17e1ad0e3345d7476e3f518a4f76c89cf6dba2dd95538e051bcb087", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415548, "uuid": "80048234-40dd-4f25-bae2-c359160434be", "value": "T1F764F11AB881D431C85E44718911E7F47EBABCB18699C98B77347F6F2D302E16AB6343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415548, "uuid": "45b9eb4b-74e8-4cae-ae31-5a13cd14bcdb", "value": "8119127351e3b87a6bff2fbdc0425751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415548, "uuid": "ae98c74b-6f9d-4f7f-b2b4-a00e8ed14d45", "value": "6144:m2L9qHCmcAg7Uc6Kz7VwBhDXAxmbk/0XlDM:m2RqHZcAg7UQzpwBh7AIw4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677415548, "uuid": "de3292f3-963e-44e6-b6fd-b33152fcfbce", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677415548, "uuid": "76a1ce06-61c0-4bf6-8205-cfa403d3f349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415548, "uuid": "5961bce0-2a21-400b-968e-2e7230eaf28e", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf2307e-b5cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677412807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412807, "uuid": "d08e71a7-98eb-4b55-8191-28ba2c98edc4", "comment": "Malware payload (Mirai)", "value": "483bc6401d4bd25f9e1b9018d1b1820a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412807, "uuid": "bd8a6bed-6d2d-494d-8ad5-af607a044a44", "comment": "Malware payload (Mirai)", "value": "1a1ac50d52ba02d1c9faa10f722c03e8d176edd3ba132c49f98abc2c94b3128b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412807, "uuid": "f89ce14b-2300-4ac6-b7fb-d0cb46a63921", "comment": "Malware payload (Mirai)", "value": "b8d1f536bd7e16b6f8d11b05e6232a8da63cc694", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412807, "uuid": "f363d390-fbb1-4961-802f-2228f1aaaf54", "comment": "Malware payload (Mirai)", "value": "1754e4801e82c3c88107014394dcc290e96942a0da8a4a19532eda18fc4f7a34580c78ea43a31c10112edde258fc1c04", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412807, "uuid": "cff3229c-e143-4342-96b3-24ccd506293e", "value": "T124633A92BC819A02CAD412B6FE5F518E331623D9D2EA7207AD15AF2037CBD1F0E77251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412807, "uuid": "cff01dbe-c96f-4e7d-824b-834f7e472959", "value": "1536:/WloK05nJ7xkC0ztNrB28k0EWwq04QVW84lx1RVvH:/WNY7635qEEfXzVWp3dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677412807, "uuid": "ae2d483f-50a3-4380-acc5-730783ca4b7f", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677412807, "uuid": "5fe84677-080d-43bf-8c86-744aa7b49ad8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412807, "uuid": "a3357b36-32ef-4574-b632-a8398c83b88d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58dd894-b5d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1677414325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677414325, "uuid": "cfdeacb4-fc11-4794-b183-8caa8b076e7a", "comment": "Malware payload (CryptBot)", "value": "daffebe85db2f9cceafc999e3df6726e", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677414325, "uuid": "de347ed9-e344-4bb2-989b-d687da8a9899", "comment": "Malware payload (CryptBot)", "value": "1aecc833c303e9ed4757c4cb94a2a9e2957ba57a385e55b1ef23a8bc3d52fbfa", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677414325, "uuid": "c6248770-8c58-413d-9bad-5dfb18e2616c", "comment": "Malware payload (CryptBot)", "value": "b83c835c51a8f354c7570aedec7c2940f68b65e4", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677414325, "uuid": "11a3669e-b013-4060-9bab-1b26145ab115", "comment": "Malware payload (CryptBot)", "value": "7211319f12c781f6fa3f8de8c8b103d76a772dfc0f079bd7fe235901cbdd8865510d68aae6e930fafff1433b84ab37b9", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677414325, "uuid": "e7c39006-379f-461f-a08d-e01ed6ea27b1", "value": "T181050153B99084B9C06112B6E61EF52052313E311CA46C6BF3DF7D6EBA2CDB18367B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677414325, "uuid": "6a5a8515-87d5-482a-b13e-8a8b6eea4121", "value": "24576:Rnv5sT44xohgYBjcThG9Oa4myjpkX9hzInH4pFvvFqvsHH:Rv5raUuThGN4mspkX9ZInsdvFqvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677414325, "uuid": "93a169e7-732d-4133-b787-87e48d022b2e", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677414325, "uuid": "b6b79566-ac48-4946-9228-720c2c9910f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677414325, "uuid": "d601370b-eac6-4a1c-b567-7be021fb59ee", "value": "daffebe85db2f9cceafc999e3df6726e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5efed8a-b5f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677429814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429814, "uuid": "f0e00178-9bf2-464c-b2ba-765713123452", "comment": "Malware payload (Mirai)", "value": "9466dc28c943b24d70ebe0d0de78eac4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429814, "uuid": "fbb033df-20f8-4f88-b230-b8847e8f6806", "comment": "Malware payload (Mirai)", "value": "1baca2f39f58b9f1786cebe2616b4c7f4575d744766b762c73a8d06c740928f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429814, "uuid": "5a916bd5-560f-4a70-aa2e-6a8087581ebc", "comment": "Malware payload (Mirai)", "value": "969721077d5acb971989ab2dc81269426f1a0605", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429814, "uuid": "7a226a8b-f6d4-455f-b301-2f1e00f5a349", "comment": "Malware payload (Mirai)", "value": "a6b3e31ce30d3ec29ecc95b859f40feb5b08bbbfd6172deeabab4fb520d25a076a50f8dc1c637b70d79928d3a15af64a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429814, "uuid": "65089c3a-4c6b-47f6-b0ec-5fb4bdf7328f", "value": "T15CA2D12172632D65F3DD1C3DC96A835BF9A71BFCD0F6327629412621C90D20B3E39A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429814, "uuid": "78227db0-6827-4961-b3a9-81bdc1ea656d", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjZhymdGUop5hP:vvQn4j+ZO5fKAlxds3Uoz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677429814, "uuid": "2e47947d-3dd1-42b7-b906-62b201204e5a", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677429814, "uuid": "bd29a094-9570-4fe1-bcf0-047a5fd5ec7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429814, "uuid": "6edd2fae-caa4-496b-8104-547e4bef05d8", "value": "9466dc28c943b24d70ebe0d0de78eac4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c2847f-b5a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1677397226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677397226, "uuid": "a49f7dd8-06d0-41df-afea-b4e6fcf38562", "comment": "Malware payload (njrat)", "value": "7fc6ad338950135c2a686374226c5a05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677397226, "uuid": "4a791705-ea4c-46d2-9137-9359c27334af", "comment": "Malware payload (njrat)", "value": "1ce3569751cdb290358824f5e2c341bdd73de729c9c995ca901417684bb1a0c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677397226, "uuid": "5da2f53c-eb0f-47de-aa86-3fbd190cffaf", "comment": "Malware payload (njrat)", "value": "e1dd04402e1cabd6e2d4e51944506dbb690c0c59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677397226, "uuid": "d94d3c44-1152-4f1d-86e6-4c5c854ffeb1", "comment": "Malware payload (njrat)", "value": "cf794b91a7710459499881594fd69804ed5d7e002b684aec8ad955141e07267b6e5258ec1f7a6ce38780a8c50f277eea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677397226, "uuid": "d5d4be08-d241-4b28-97e1-3f9b5614e679", "value": "T140A4F142FAD1C4B2D53209324A19AB51757CBD302F25CE6FB3D86E2DDA341D0A325BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677397226, "uuid": "a1095538-f9c4-4987-b771-43d3d00085f3", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677397226, "uuid": "a46501b1-b705-4144-90bc-2a3ca8b5de23", "value": "12288:T2ghLvPhXpe3PliT+tcun48M1YlsCcpnN:1XhZgPlou4P1YWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677397226, "uuid": "3f8105ad-a8d7-4a54-9ea4-7a52dbe28add", "value": 482812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677397226, "uuid": "dbc583f7-2a40-4813-ae72-4c91426643ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677397226, "uuid": "43d374c5-6ecd-4a5e-9558-62571c9ebc7f", "value": "7fc6ad338950135c2a686374226c5a05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11b774e-b5f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677429806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429806, "uuid": "4bdff863-1c0f-4a6e-bc67-b40a3cda114a", "comment": "Malware payload (Mirai)", "value": "0a586a3f8fa2f29ee6dee912be81f4f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429806, "uuid": "8769a387-3b1b-4339-8166-ef13b4990022", "comment": "Malware payload (Mirai)", "value": "1d3674e1fd30c03fe508054df66426b5f1c43f207b363270797e96d91e313393", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429806, "uuid": "a0b8f586-4da7-455c-8508-64b8a5c9c4da", "comment": "Malware payload (Mirai)", "value": "c5c27757665b5c428b02533c90fe7219ed893292", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429806, "uuid": "a911a943-0ed6-4151-bb0f-596267879d75", "comment": "Malware payload (Mirai)", "value": "ce34c0ddafcc42a7f3c0d3cea8000bb29d4dbfbd70b8ecf8fb7ceac92f6c0f3d948e81cdc5064688990450026572e6cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429806, "uuid": "2575213f-f5f9-47b7-ad88-284b1e809421", "value": "T194430795BC918A17C6E022B7FB2E019D332223ECD1EF7207DD216F15778A91B0EA7654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429806, "uuid": "bbb32e45-5e3f-4e97-9dcf-123bccf553b2", "value": "1536:7WFqkuaRuWJGrmZDvOmRdPgt5T6YcMFSFlhFdH0:CFqkUre244bKMF8RdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677429806, "uuid": "38b85c55-a011-41b4-8e5a-399ba682699d", "value": 60088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677429806, "uuid": "a85364d7-04c4-43ef-9861-fb87a2fcddb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429806, "uuid": "932ee39a-b53c-4310-a288-208ec5bfa93d", "value": "0a586a3f8fa2f29ee6dee912be81f4f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7479db98-b607-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677437865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437865, "uuid": "1b6a8bf5-5a25-47a9-8adc-822cbc7a680a", "comment": "Malware payload", "value": "d5a3aaa28767c4fcf4ba7398fd841cb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437865, "uuid": "a5dee0c6-9721-4f2e-a230-fe905c3cc69a", "comment": "Malware payload", "value": "1e98e21c51a0bb6151673aa5af5f0ca66fd4789a72f92386ac5f21d402243ddb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437865, "uuid": "e35c2738-30b8-4f2e-920a-087504bd5f2b", "comment": "Malware payload", "value": "4d76d75bb5c3d42db788e8472fe75bc902843016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437865, "uuid": "5f4100f8-6221-4307-b71f-8f765bf370cf", "comment": "Malware payload", "value": "a412457194da3f66db2e64a33890b13d5eafade1cb4806560400d55544fd7d3d7363e0e277cba3761eef92c44bb30b0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437865, "uuid": "cd036840-332e-47ba-8dbf-3a556ce0d27a", "value": "T13AA523671113A1DDE52E993C49F362B1B47CFD8092227ADB57B4C6E00DB08249EBCB9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437865, "uuid": "fc79402d-1ded-4675-8fd9-12f5e3459358", "value": "c24ea937b2b0d62e829e8a8faeff5a8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437865, "uuid": "e1f400a2-fad8-4210-b1ed-f3aa3f5d0cdd", "value": "49152:v5/wKrshZS34rtb3YBQONC0Rwe7rWOTA6L9wR3+I+rosoMId5zUz:BBAgqJQQzSA6L9wR3+joj/d5gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677437865, "uuid": "29864c01-dd74-4090-b029-bea69b7ceed0", "value": 2165248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677437865, "uuid": "a7debfbe-d2c5-4deb-b690-809cd79b0293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437865, "uuid": "e864a1cf-8395-4323-beb8-40ef64d8b5cc", "value": "d5a3aaa28767c4fcf4ba7398fd841cb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acd5db5-b5a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677394335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394335, "uuid": "aaabb4b2-0345-4b8f-a141-2c108789fead", "comment": "Malware payload (Rhadamanthys)", "value": "fb1525f378a50746d56bc13e794efaa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394335, "uuid": "b35098cd-9fb9-4c3c-b929-0aa046061100", "comment": "Malware payload (Rhadamanthys)", "value": "1fa174b49910b32c4315465a64def27970f3dc1907c133e1d5d06db8672cba7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394335, "uuid": "a59102d6-5913-405c-ab7a-2905404314d0", "comment": "Malware payload (Rhadamanthys)", "value": "b61dcfa185935ba2877a41671ecc7d556f66dc99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394335, "uuid": "2140846d-0898-4bd4-8b9f-7a5bc1fa5fd1", "comment": "Malware payload (Rhadamanthys)", "value": "2aa6c6b02afa7081413d4f3f135de1143fb5752fcc6885507092776a13264db4ba44a982962612539a7ae80a531e6804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394335, "uuid": "a71b5268-a65e-434f-9c77-35755a88e471", "value": "T16D54E021B5E0D471E9AB85345834DAF82A7BBC724E65C58F33573B6F2B302D246A6312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394335, "uuid": "f1a909c1-da21-41ef-83b1-92adfb09f166", "value": "8c965d062b338134cc0af1a9d38bf4da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394335, "uuid": "808417b9-a340-48d0-9acb-969e79492967", "value": "6144:2bseTLngv1Gr99Wh0NzPBOwzNA/f3lkYobQXXOUBm:24uLw1q9979p3i+gX+um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677394335, "uuid": "5b864026-f2e1-4b80-b66b-408a484f5932", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677394335, "uuid": "c5ec2ec8-2674-4f6d-919c-67f09456fab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394335, "uuid": "a5ee14d1-f3fd-4d4a-aa41-7787cbcd1dd3", "value": "fb1525f378a50746d56bc13e794efaa0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b33c0a7-b598-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677390148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390148, "uuid": "3db515c2-c227-4340-a142-ac18c3a52403", "comment": "Malware payload (Mirai)", "value": "bd316b07ff0263027979d217126d6073", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390148, "uuid": "55986148-a044-4acb-9d2f-6525429098cf", "comment": "Malware payload (Mirai)", "value": "1fdb68ae34bb84bc2c684ff3b992422a21e6e533a23fae383982a00d35dd6a43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390148, "uuid": "2cbd9e59-a6af-4c28-8c25-46dbcd8fc495", "comment": "Malware payload (Mirai)", "value": "b2fa158f88d5379df49e3ada3d2a7c9624a15839", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390148, "uuid": "ad6bd61e-bc69-491b-8c57-a53f493a5dae", "comment": "Malware payload (Mirai)", "value": "63a1e163815ae3a37a801a6a609c33552b3dea2f2bdf6381cba8c255d865ee7f402eee74d5bd8fa1ebe12a7c7ec48412", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390148, "uuid": "1a97f424-dd70-4ab0-808e-ed93af5b1b97", "value": "T170C2D044F0019A42DFEA29F53E44CAD7FBE46F1F6A628E8027A053D15B6C2A79305DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390148, "uuid": "5b173a09-3390-4b08-a96c-e39671db2f53", "value": "768:CVdafO76jpmNJJKehmA7trpfIX9KeA7P/4uVcqgw09d:mam+AnKehPRa9aH4u+qgw09d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677390148, "uuid": "d545af0a-0c3a-43c1-b789-bc6e7cda261c", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677390148, "uuid": "f9bf7d01-c205-4e23-8368-8d453d1c8a45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390148, "uuid": "9f309e11-1b49-4175-9cf0-c8bb599264d1", "value": "bd316b07ff0263027979d217126d6073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57462973-b61d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677447265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677447265, "uuid": "da7c79de-51ac-49bf-a718-1466a55f6302", "comment": "Malware payload", "value": "5bf5131183f7022290d04ed0b1d2bf73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677447265, "uuid": "d5bb59b0-b0b4-4dd9-b058-e6cdfd4ae289", "comment": "Malware payload", "value": "200419d41b64b61e89e22a6ada3f6a8e291e7de711181e5c6cbd6e3fddf19222", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677447265, "uuid": "f9306e89-c241-4810-8bcf-3d90d5fbf70d", "comment": "Malware payload", "value": "fd23150cf8bbe51c1fe281c7c4109034c7dc4b52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677447265, "uuid": "65e0e4e9-5ad2-4b03-aa77-1ef2bfead218", "comment": "Malware payload", "value": "fb27914b817530e43c3325aeb3d6cbf4aec7b3104f6dcefad6e398e6c1a4ea02a9509a360833bdf493bc2670a2d673ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677447265, "uuid": "390bd2ca-6921-440c-8c1b-a9dca677ee21", "value": "T1810523E0D619A81DF3574D32E2D26537D2FB85C6DF9AA92E3CA860F7CD01662E9F0011", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677447265, "uuid": "4dd31249-b22d-43ca-96a9-7a9be96582b1", "value": "0b67e3f83cb8ebdabb97d1a6b59c83b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677447265, "uuid": "5ad30423-8492-4992-8cfd-15b71ac5708c", "value": "24576:rEBMqpq+4ltlKuundlHZO4xjJy4SFTrXiEsijdzW:rEBvpq+4ltzundlqZtTsijRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677447265, "uuid": "e0724e26-1edb-4699-a347-656d7c0e4934", "value": 805032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677447265, "uuid": "4d6e8229-55e1-40dd-85bc-7a0fa2ce483b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677447265, "uuid": "94e8caf2-af55-40ec-8c83-9c4ccd6625b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e90fed-b5c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677408606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "4ceb1994-e001-4ea0-879e-a05897e5b771", "comment": "Malware payload (Mirai)", "value": "e12bb8af15cf5642f9ecb5e4e25204bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "d0c50411-7633-4351-bb2f-f363385ccdad", "comment": "Malware payload (Mirai)", "value": "21b9f74b07606c1601363cfc9fe83a881adc81c899ce2d26f9333316044a4fdf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "a3de99b9-402a-4426-a4c2-c8f10888fa83", "comment": "Malware payload (Mirai)", "value": "33ae731fe9f2545d4ad7fa3bb76e8ad576511a68", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "3de9b5e2-b5c6-4f19-937d-870569f3fcbc", "comment": "Malware payload (Mirai)", "value": "44080b734eed3a408615afa49f84708cf38e6021d45a932c5944bb113182b6e9f9ec1039ef5fbc2e864c30277cea9a59", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "976c9a34-3e55-49bd-a479-2b524b22dea8", "value": "T17CF34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "b9ba7536-6d06-4276-9017-ab2a3d36829d", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBNYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/XYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677408606, "uuid": "30a5ad20-9811-486e-a8e0-4a9a511444b3", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677408606, "uuid": "76f5b9c8-1561-44ec-bc8b-dee5c982c680", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "401aabf0-5d8f-4795-ab26-95731d91cfb4", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced2bea3-b5be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1677406663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406663, "uuid": "3d33f97f-3d9e-48b4-8d62-ceac499e200e", "comment": "Malware payload (Gafgyt)", "value": "0b564a2053988dbd3c1aaffa20083989", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406663, "uuid": "526fb1ff-46fc-4d1f-9aef-f0018de736e8", "comment": "Malware payload (Gafgyt)", "value": "229ac9cb37d0ec6bf658c847218984be2393e8bde9746a8baea4eee805fa9bdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406663, "uuid": "9deed309-b0dd-4c50-8131-11cf45b9885c", "comment": "Malware payload (Gafgyt)", "value": "f1ac655a9a1eec8985cb29982d8990f5a71b795e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406663, "uuid": "91267d54-ccd6-498b-8286-fa6b2e638cf5", "comment": "Malware payload (Gafgyt)", "value": "aa1b922d44169e5f426959187a24c30798e6ed34a321929a80d540125f1b25fcc2acb9d05f37faf72d18f304a4c27962", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406663, "uuid": "f14df5c8-4f2f-4833-97b8-73001376ad16", "value": "T1D0F3756E3E21ABBEE26887310BF76F70C39529D366A19342E16CF6185EB124C1C5F750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406663, "uuid": "d1d78b8b-16b6-459b-9aac-4a4aef1614d0", "value": "3072:DnUEs3UNwBLGqqKh5DaFnrPjDi+tsM9qSX9bNi:DDsTBCT0enrPjDi+tsM9qSX9bNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677406663, "uuid": "afdc9249-a038-4a40-ba8f-4802aa79621b", "value": 160503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677406663, "uuid": "e0dd82a2-b1a9-4c80-8842-0f02e707e32f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406663, "uuid": "7621f278-6353-4d3a-a2f0-055f448d5c4a", "value": "0b564a2053988dbd3c1aaffa20083989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20af7fc6-b576-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1677375447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677375447, "uuid": "f647c577-3549-471c-85b8-5054f5c5cb77", "comment": "Malware payload (Gafgyt)", "value": "a9b8933ccf1f6ca55398fa8616d7d108", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677375447, "uuid": "a2dd4364-a58a-4f7e-96c7-ce95e7fccfc3", "comment": "Malware payload (Gafgyt)", "value": "22b6c4b906fde1df6282fd308502b8746d5f7b13088282f7f1855fadd6076eec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677375447, "uuid": "73dcad8e-d1e8-4c93-819c-869f1fe92e73", "comment": "Malware payload (Gafgyt)", "value": "9099afe3730e07704516deb8c91f0793db113c9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677375447, "uuid": "1ff78aba-1149-4f5e-912f-df647c00b7be", "comment": "Malware payload (Gafgyt)", "value": "d23be345a3843ba6b3688c66f2b7100f0c18ceebf2fb0a31203bdc4e3c7ef743046d5bacb09d6d8f337c8baaa72f9e4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677375447, "uuid": "6126774f-ecf0-4d25-b087-edaa8c50a99c", "value": "T1EE93F892B900EFB6F40ED77A44D34724B670FBA24E531672731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677375447, "uuid": "d3d71a92-4771-4a68-9084-892cd60f3f88", "value": "1536:4mZMaXpB8F9OEG6ktQm3r/FS3n9RIB6Yy36gr62f7vTmQ9VqXjewf2Le:v7p09W6KTG/IB6Yy366NfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677375447, "uuid": "ec00ba30-f591-41a2-8917-f3a706d24cac", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677375447, "uuid": "c80d1156-faaf-4942-bccc-1d71fd8e32d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677375447, "uuid": "a4d5b89e-cd85-4a90-aaab-5522506b1013", "value": "a9b8933ccf1f6ca55398fa8616d7d108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82240b7-b5cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677413175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677413175, "uuid": "99c09de8-cda8-4302-9224-0469e789c73b", "comment": "Malware payload (RecordBreaker)", "value": "c1178098b7c78516e24da5eaf1f78754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677413175, "uuid": "4ed5faec-ee92-4fa9-a5ac-2f82c0fc0937", "comment": "Malware payload (RecordBreaker)", "value": "241d509937b8e33c0db3e41580fe1514291588c7cc4035e0bbd80741b23ce55d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677413175, "uuid": "6e272a66-0352-442b-9a63-f6c093b437ce", "comment": "Malware payload (RecordBreaker)", "value": "2a5027cc24a7136c66e56c05032845e649dec3d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677413175, "uuid": "127f8423-1c4f-4391-bdc9-06f58a6b2c2d", "comment": "Malware payload (RecordBreaker)", "value": "1afb6dfcfb769545b33cae09f84f20aa0fd95703e420bb154ace76f1bfbc441210f4396436dd0cc2c85ae0a5f3f7ead5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677413175, "uuid": "f9e011bb-44cc-4682-ad7c-ead7bb05aef2", "value": "T1C844CF32F5D0C030D5AA857059F4DBA86E3FBC725625858B33583BAF2E302D556E632E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677413175, "uuid": "9a5ace6d-cd2f-45a3-87cb-a3d6ad394c92", "value": "7678d4c3c7ae7af0fe9e5b0456987a57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677413175, "uuid": "5fb30787-ac35-4651-8737-9d4940021e1b", "value": "3072:a4B6W+LEtT5n4dAMlCGgQL+Kbtx/eQmY2QibUp7NKyOJrBzllhS1:ZWLU4dZKW+Stxm0uQIyOJ1zlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677413175, "uuid": "d4790617-0ed7-4f99-be04-72ebccbb940b", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677413175, "uuid": "a0f1cec9-9af4-43e9-b263-18a58f9b4888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677413175, "uuid": "668ddc80-0b58-48b6-8854-088bc91ad02d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344e42d5-b615-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677443770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443770, "uuid": "d3db8d5f-c80b-451a-86c4-b1cbed2bafc2", "comment": "Malware payload (Mirai)", "value": "a6f1492f0d38a8928093f7992987f7f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443770, "uuid": "9d9ceb76-4fe6-41ca-ba15-8123089f894e", "comment": "Malware payload (Mirai)", "value": "24dd8bd29b7233af1afab655f3633285247b5ae967423dca3cc3d508e3c86a14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443770, "uuid": "afd8fc79-3c22-4bcc-8bba-cd18dcb316ce", "comment": "Malware payload (Mirai)", "value": "77acfe01447fb552f85ee266dcd27125cd3048a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443770, "uuid": "d2d4df6e-7c90-42cc-b907-516091cb9e56", "comment": "Malware payload (Mirai)", "value": "102b7b71deb0366bdf37dc357eae50e0a693e983db1f1c7c09accc0dec9a0a3091d62e5357864a13c30edf3dffce4b20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443770, "uuid": "14629512-c689-4291-a5f1-e44acfa3dec9", "value": "T1DD431925AD792E26C0D8B57E11F78724F2F2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443770, "uuid": "82841682-a8ee-4cb2-bdf7-ecd5e1f5bafc", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCD3:eL0AxvSHfymp0xgunvCkV6vTMDaus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677443770, "uuid": "4c74593c-9a8c-48b4-8437-90737071c93b", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677443770, "uuid": "7af24c0f-6378-4acb-904a-a2c0e767b724", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443770, "uuid": "2dc1dbe9-b42f-414d-a578-5f9f3dbe3549", "value": "a6f1492f0d38a8928093f7992987f7f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51724ff7-b5eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677425780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425780, "uuid": "d3e0f5e0-9373-4826-b8ee-de106c81510f", "comment": "Malware payload (Mirai)", "value": "1fad3f44acaf94764d3c5242b731e83d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425780, "uuid": "1f8bbcf6-7437-46ad-abd9-1ff2ec5e5ed5", "comment": "Malware payload (Mirai)", "value": "262de16e747879180549957bc86d24b6b802e84906dfa3d31b39c4f9df80e877", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425780, "uuid": "e9ecd030-8460-46bb-80f6-359153c0cdc5", "comment": "Malware payload (Mirai)", "value": "7b8d028c88885a1c104cb8b04a7faa59e8d2aee6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425780, "uuid": "0d20c3e4-9d36-4370-a517-f48755f9b839", "comment": "Malware payload (Mirai)", "value": "36b18cd9a3c1cdb4b975315805cf5f311be97d4ba661ae48f0a47307e3073f1912e9d724567d6b759bf50a67dc8d8c2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425780, "uuid": "260c4e41-395a-4dd1-995b-b020f33683c1", "value": "T190436BC4F643D8F5EC8715702077FB379B72E1E622A8D643D3B4D932AC52652E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425780, "uuid": "a7b55d81-a9e9-4de5-b6f3-aa873fa57a39", "value": "1536:JeESt/basV2rcZhG6ySN7naYtad1zWOIaEjrqMDs:JeESt/basVTgS7naYQdttXESw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677425780, "uuid": "d609d3da-237b-44cf-bed3-0cca44f50f2a", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677425780, "uuid": "7057883a-dce6-424b-9d91-b190ec792226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425780, "uuid": "e2ad51d8-914f-4b9c-8e7d-17807d3db3e1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5136a15-b607-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677438000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438000, "uuid": "f8fa3299-2582-4666-aa2f-9c3b17e02fea", "comment": "Malware payload", "value": "e543854d7afea3fc92b9d1d108b5831e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438000, "uuid": "6937631c-c416-478d-aaa3-66946d0e9435", "comment": "Malware payload", "value": "26531748250efc27ba79e9be6d071d3e535e8d46f61773f747aee254080503f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438000, "uuid": "190db361-7c30-4d20-93ef-163d06b4f726", "comment": "Malware payload", "value": "3e4818ff2fbe7c06497d44c7048cf7ab99d03d58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438000, "uuid": "ac5c5b79-cf19-4f56-a330-162ac469f0b9", "comment": "Malware payload", "value": "44e67dcb2a774b13520841a4df6673f8069c6671cb0b7a491b84495d31038211f1883c372f567a2232a126dd7852cb24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438000, "uuid": "121bfb8e-b985-4a62-a721-5f576766184f", "value": "T140844BA4F681FEF5F8499B7914E1331D439EB291EB9CD7337850FE29001AA5881B364E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438000, "uuid": "51bed4f7-84d7-4544-b52f-7089765f30b6", "value": "3696fc8d77a3b4132542c238e59dd362", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438000, "uuid": "17f4fe6e-6680-47c7-916b-d6902b35a774", "value": "6144:3LrkR10efU9AKKoOlOvSd0lW1+laP2nRykBCuTS2mx41ZTD3iif6D:bQztfo3EaSaQMUenAt3NqTriQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677438000, "uuid": "b1d748d7-e4de-4640-a428-659a528a8302", "value": 392175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677438000, "uuid": "1c831b9d-811c-4767-b2ae-81e6124e7ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438000, "uuid": "3f9453ed-4f2b-4f69-94b9-a5d4ea921963", "value": "e543854d7afea3fc92b9d1d108b5831e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a787aad1-b569-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677370090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370090, "uuid": "4150f5d7-3092-456b-a465-e88d9588e214", "comment": "Malware payload (Mirai)", "value": "38d9f2c2ef8cee5d93c33354e9ca2174", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370090, "uuid": "80be4ccc-89b6-4ce3-883a-01caaf8c906a", "comment": "Malware payload (Mirai)", "value": "2713931c8a275c5d56e399dfdfec75fd6630cf7346367af48e7c9848909601d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370090, "uuid": "9437b4d7-6333-4547-a1d3-0379a83e3182", "comment": "Malware payload (Mirai)", "value": "156b9e0d5968182c3d7c0cb2070e044af9118502", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370090, "uuid": "9361f1ea-185e-4acd-9b29-daa0bc6467ea", "comment": "Malware payload (Mirai)", "value": "a6fced47365a61513b30d76bbce280eb47ba188b2479b539bd99b3358f7f709e96c7b99581fcc82eff64b131d073b2ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370090, "uuid": "3a5be2ca-5c83-405b-8646-27c4e47a5c05", "value": "T12DE32B56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370090, "uuid": "f82965d6-f9a6-4a68-85c4-b544a60058c9", "value": "3072:eJLce5p0pHdFSEaaHbz4NrA/Jt5IQ1F7UXMk/M/983kY:eJLcH2EaaHbz4NU/JrH7UXMcM/9IkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677370090, "uuid": "ca2d9e8b-85d2-4e2c-b4cc-aa58029df1a9", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677370090, "uuid": "87442cb7-0cd5-4fe3-b8ce-f49f2f2f052e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370090, "uuid": "9165e2c2-97ba-4047-b845-0fd5d4688642", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f674a5-b5c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677409755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677409755, "uuid": "0f6622d6-0441-4297-bfe0-47c8d8db1da9", "comment": "Malware payload", "value": "34129a520171eb9b5b197c6d69e85b47", "object_relation": "md5", "Tag": [ { "name": "34129a520171eb9b5b197c6d69e85b47", "colour": "#B3FFC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677409755, "uuid": "53af591e-9f15-4ede-81f1-4da4e708bd31", "comment": "Malware payload", "value": "27a3a9e19eb51cfbe93d336ed81c3993797d0f66e97f80347d8777658b95cd74", "object_relation": "sha256", "Tag": [ { "name": "34129a520171eb9b5b197c6d69e85b47", "colour": "#B3FFC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677409755, "uuid": "c860acba-e4e6-462d-a3ec-e410e1e9f2d3", "comment": "Malware payload", "value": "b551870a2a595cf95d9dbc6edeb8e8588a93cef9", "object_relation": "sha1", "Tag": [ { "name": "34129a520171eb9b5b197c6d69e85b47", "colour": "#B3FFC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677409755, "uuid": "dce432e6-9943-4c35-80b4-0590ea424329", "comment": "Malware payload", "value": "9f1643e4ed0ed8ba67bd49ada28839eecb29ac409a982bb09f25bd2ba5da85b2ffc2bb7d346e5a7e2ea335d58f3ea537", "object_relation": "sha3-384", "Tag": [ { "name": "34129a520171eb9b5b197c6d69e85b47", "colour": "#B3FFC6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677409755, "uuid": "f15ee13a-09a8-4126-97e7-82b7401605b9", "value": "T1FB5612C7219900DCF4EA8335BBC34E129933BC6DC7B2727A0653797F8A225AC656365C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677409755, "uuid": "62a0a8c7-f61a-4bcf-adc3-3c291529b539", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677409755, "uuid": "e78e5c42-a02e-4860-b508-f2d5664dbaf3", "value": "98304:79+0h/zRB2uW5MI0md9g+DltLGMY8DI65KiaYGgQ30LJd2UqLjkLqp9GNcVKq8Xm:7NRkL2Vmd6+DXLZy7YM30Lzajzpuba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677409755, "uuid": "f8efa0e4-d4e9-4935-83b2-3b8b6ef694a6", "value": 6383163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677409755, "uuid": "67237bbe-bffa-445b-a453-fd7b799f5f27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677409755, "uuid": "a196a1e5-7c56-4ec0-9e0f-0916204dfc8a", "value": "34129a520171eb9b5b197c6d69e85b47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b6fb7f-b5d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1677415828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415828, "uuid": "f271e07f-012e-4852-8e68-27c2b6d60a83", "comment": "Malware payload (NanoCore)", "value": "9e2b04c9a83212110c713f10355a8333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415828, "uuid": "f6fe0e56-cdb2-4aa4-ad42-43f207f1172c", "comment": "Malware payload (NanoCore)", "value": "28267e1721965329056339c6c4b948e7cbe0ec19ae48299b7b6ea5b0202fd3f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415828, "uuid": "ce73eaf4-8f09-45a9-b109-0a4eca414475", "comment": "Malware payload (NanoCore)", "value": "e17c607131dff57e4dd835b9add8484715e4fd6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415828, "uuid": "db03a72e-ca9b-46d4-90fa-e9d6be87ce69", "comment": "Malware payload (NanoCore)", "value": "de79569773cbd0d53de31f86160b436b313491b9f78278e5c6eaee32bb72594c75bff9fe081ee966ab857afce2d5ae51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415828, "uuid": "5feefeb1-84ad-4b70-aadd-c414a082910f", "value": "T1AC14BF5677E94A2FE2DE86B9602251128379C2E3E8C3F7DE28D454F78B267E406071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415828, "uuid": "033eb1ab-e16f-46de-a1dc-3fe0fe1c1ce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415828, "uuid": "8aad1a42-5bdb-44bb-9f9c-fc389ce6af6a", "value": "6144:gLV6Bta6dtJmakIM5YlWUu5LYkO0TrWSD:gLV6BtpmkflM5LYkO0TKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677415828, "uuid": "75dee84f-9e5d-4ffd-9bf0-dfda9824ed8f", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677415828, "uuid": "f04b2735-583b-4b66-ad99-0f3e5a0d03b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415828, "uuid": "c958cd09-8ee8-40c6-8e07-fee2f01ae8c2", "value": "9e2b04c9a83212110c713f10355a8333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2967c4b-b5be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1677406669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406669, "uuid": "15074dad-a672-4cdf-af5c-fc6d97d94b22", "comment": "Malware payload (Gafgyt)", "value": "85d247b7ed2d29f0fb37202a73c6d065", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406669, "uuid": "093828ff-f09f-449b-b508-87d3811a2281", "comment": "Malware payload (Gafgyt)", "value": "28dcb9ebad9d049da236d38a9846ea998810c1ba1bfc45453506f54cf504f8d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406669, "uuid": "6d9f3778-c160-4ec8-a5c3-6b600ee5b1b9", "comment": "Malware payload (Gafgyt)", "value": "0257daa4bde855778d548552952c1c4ad124e023", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406669, "uuid": "2e252618-680d-4ebe-a6d5-d7c49f339bc1", "comment": "Malware payload (Gafgyt)", "value": "3e40a4978d5cfa4524a06d650c728264d6f9df31deb45e431c5795d1b3ccda00195401c5ba0eef4a7eb7ea8f6d811227", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406669, "uuid": "ac0c10b0-4cb9-4ca9-a0df-9c3279c56207", "value": "T1DCD30A45F944475BC3D327BAFB4A038C37365E6857DB3311AA397DB42BE1B982D2A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406669, "uuid": "1512f57c-dd28-4798-bdd9-107973a10539", "value": "3072:CLbn7lQiQQnDb7a22Xkzcb2J8n44uDDMQS0+QD52mNi:CvLfb78XkzcbSt4uDDMQS0+QD52mNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677406669, "uuid": "702e2629-5256-47b2-ad2a-8d3ed869a19b", "value": 133209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677406669, "uuid": "ffec6889-ec74-4bd9-a900-8ca228d20d32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406669, "uuid": "436d095c-8b5b-4e3f-aa36-018993e6f721", "value": "85d247b7ed2d29f0fb37202a73c6d065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16dd3fd1-b5da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677418380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418380, "uuid": "5033677b-8677-43fc-8c21-a78f008e8062", "comment": "Malware payload (Mirai)", "value": "dc7294b172d56badd9ce77568be8951a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418380, "uuid": "7cf8b6d1-ebb2-471a-a9ec-3512ac498787", "comment": "Malware payload (Mirai)", "value": "298a21965b308d2d738cec4d1e9d769a63d075203a4b490dd5dbc4b8be9190d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418380, "uuid": "d5c1b2d6-d692-4627-b748-06999b9726ca", "comment": "Malware payload (Mirai)", "value": "88c5a6eb3c182aa3c4cbe3df884d3595869d0193", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418380, "uuid": "4431038f-0289-46d6-81dd-e86a5c1571e5", "comment": "Malware payload (Mirai)", "value": "75c1d8e8ca5b3135f27b6a46e8d32fa49d33618dc0bffb794ddef612ce046a6008dae96d2272362c3a0248d36342a688", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418380, "uuid": "151602c3-07c3-473c-be35-7782bf9651c1", "value": "T1EF132B96F8C18B6AC5D0127AF66FA95C3320A3E8C2CF7303DD641B61769741B1EA7E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418380, "uuid": "48937b51-f910-4d24-8360-12238ab7adb9", "value": "768:qOTla24bBJ99FJhPurTDyQaCchpwgLHwzo51H5dPQt5RJjysFLUaQNOwbZ010U5N:qf2U3FJhPuHch3LHw6H51Qt5Ro4ub+17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677418380, "uuid": "cd5a32a3-e065-4abd-8049-d5448ddf9821", "value": 44576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677418380, "uuid": "0cf5e0a2-394c-4cb2-afda-7be873599e2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418380, "uuid": "1d4fb887-9821-4433-8d94-0f5abaae383a", "value": "dc7294b172d56badd9ce77568be8951a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a1a76b-b569-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1677369917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677369917, "uuid": "1da79979-dc22-468e-8147-e6b2172bf46d", "comment": "Malware payload (Stop)", "value": "4852acad8ef53a1e2af4b6a0e8cab49b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677369917, "uuid": "430d2f3e-8df2-4547-9304-ed4e68274844", "comment": "Malware payload (Stop)", "value": "29ad3aa5ff2506f62cb097d8d5dc0e70e53c7d2d60f408e3dc1cc784746bcf58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677369917, "uuid": "ba5bfe29-4243-45a5-bccd-0169c1e21fa5", "comment": "Malware payload (Stop)", "value": "378450bb16452528c1ec73e2535cab22c9b9f2c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677369917, "uuid": "8669f4c7-4b85-4b9c-ba8b-c8f68cf0a86a", "comment": "Malware payload (Stop)", "value": "9ac591fb498721b042d57151628b1d23c63140ea842b50afc85c46ef09ae5cecd05d8d9e6b65e0891a3ddaad2e9f1813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677369917, "uuid": "975b9d43-2e84-4116-92d0-7ac0f011c300", "value": "T199F42213F0C0C435E45F05728825D1AD75BDBDA1D2A54A8B37693BAF7E303E2AA7620D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677369917, "uuid": "d6a17b95-6f9e-4f60-9c1e-f71b33ccc992", "value": "4453019f24fbdf41dd3a4f06fe73134e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677369917, "uuid": "f51a4b88-a676-4b7c-9e21-8d4beff12a8c", "value": "12288:4QK8KEIGde34K9B1+BYR0yWFeh6YK12bb+jr596ZhSQh:4IKbqeoKwyWFKK1Gbg998J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677369917, "uuid": "3aa6fa38-e885-4984-8abf-bdfb6bcc986a", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677369917, "uuid": "9c836ae1-5820-4001-86f4-07ae07156e31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677369917, "uuid": "457e0571-255b-42b0-9e37-d58c002d5fd8", "value": "29ad3aa5ff2506f62cb097d8d5dc0e70e53c7d2d60f40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b598ca-b590-11ed-88f6-42010a9c006e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1677386868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677386868, "uuid": "a7d4d370-075d-4431-bf7e-3fd7a41ad16d", "comment": "Malware payload (OrcusRAT)", "value": "203d479f9429a21e92b94181db34c427", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677386868, "uuid": "3e310c3b-d537-40b8-8ecb-2f85b0f051a9", "comment": "Malware payload (OrcusRAT)", "value": "29c34406bc0b9ae5c44474529917fd6e2177f66381131aa2ede5bfb6da334d96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677386868, "uuid": "20bb6e40-5bc7-413e-899e-8b3a7b98ce6e", "comment": "Malware payload (OrcusRAT)", "value": "884ed48a71c71dad1601253e95c9ff2f6251a26c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677386868, "uuid": "69c3f89d-5b2f-44b3-b548-af80f74b5be2", "comment": "Malware payload (OrcusRAT)", "value": "f9186ffda59858dce72b99c05789f87ec8c5922d3b109b01475cb265f4077800d625da88d11624e14f3999b2579712d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677386868, "uuid": "ab45b9c5-7502-4f85-83a7-be0b4d929baf", "value": "T142E512417BECAE03C2BE2778B6731EC807B9EA069546FB0E0860526D1D9F305BD65367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677386868, "uuid": "d7d5809f-0627-412d-aa5e-d9cd3440a65d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677386868, "uuid": "bf88d81b-6507-4849-87c1-73b9fa19249b", "value": "49152:BOJ3PHJZKMvup/RGA1Ub/6U3bFaAypQxbzkso9JnCmaJ/nkrrzI0AilFCvxHI:BaGUu1D1Uj6UnypSbzPo9JCme/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677386868, "uuid": "7d673816-2c70-43dc-9b54-a00ac5c2b3e4", "value": 3112960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677386868, "uuid": "8b9361f7-cbd6-4750-a9a9-54915e5f592c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677386868, "uuid": "f1caac9a-cfe5-41bf-9911-ef1af0ca918d", "value": "203d479f9429a21e92b94181db34c427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113b7e4b-b5cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677411929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677411929, "uuid": "b12c39eb-a1d9-4b66-8221-cb02a0be2dbb", "comment": "Malware payload (Loki)", "value": "97ab75b5e547268129079e3de0a11e62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677411929, "uuid": "cf8e2892-e50b-46b4-8c22-c64804bdfeaa", "comment": "Malware payload (Loki)", "value": "2a61986750ebf1d6ebef20af349be5dfe157936cbfe83778af1531aaa9b8db0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677411929, "uuid": "c93133bb-c346-48a8-b467-e597240e7518", "comment": "Malware payload (Loki)", "value": "da531b397f005ee944db5f79c227bc459984f7dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677411929, "uuid": "420d7854-bc1c-487c-8863-6359fd77839f", "comment": "Malware payload (Loki)", "value": "5f4cd88358aa3ed3139528e946e8e924704335d164c53312fcbe8c99b3d2b65cc1026be0a5a47d93cda5b5fabc79c006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677411929, "uuid": "a7488f66-241b-40bf-8bf0-a5c5b1516054", "value": "T155159D9977B46073F48B01FE6838278D2D2075437609E22FA777BB91A2759FB72C9201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677411929, "uuid": "19fb9234-9387-414f-9186-9274ebe961c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677411929, "uuid": "cc3495c2-a854-4702-ae74-5c532988d11f", "value": "12288:iLfU6mgJXrKOMGdByquHYQ753g7RbAhpQWCkJTrKAASNlt1gWybr2ay4eaIXSPJ+:iLM6/1uGdByj4Q72RbGuWft5mWy7IL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677411929, "uuid": "56a5446c-ef9d-4452-b508-400e3318307a", "value": 921600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677411929, "uuid": "2e7e5d45-6837-4dbc-9d15-f84d20bc2929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677411929, "uuid": "491b925b-08d6-410b-bb34-cb264eee2c61", "value": "97ab75b5e547268129079e3de0a11e62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c15dfc0-b5ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677426603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426603, "uuid": "d279bb8d-9bd6-4ecf-b15c-87535b8b75a7", "comment": "Malware payload (Mirai)", "value": "f108ac4cfd3c0dc75a1cb57fe00c2097", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426603, "uuid": "ccadd2f4-a2fd-4a08-b0cd-7ea961ae5d49", "comment": "Malware payload (Mirai)", "value": "2b86d442cb2113dc2fbaeb713b3dbca2180e2a5ea761a67a8ad6338d64756675", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426603, "uuid": "dd55a931-6f8a-4719-bb75-db6b43f22ff3", "comment": "Malware payload (Mirai)", "value": "718edb6fabb241eebe9d05a57f3ccc0631a52d9a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426603, "uuid": "0f8d51e6-ee8a-4eb2-985a-6548a5662855", "comment": "Malware payload (Mirai)", "value": "bf67c27aa8dc23e9beaf30a9d7d2eeb53f032d5fee55ee4ff9c9883cbaf38632ece54d1b21aa3049a394df08e3fd85bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677426603, "uuid": "117c8038-6b2e-4cc4-bac7-8e2395a3ee60", "value": "T1B723F1E131F5F4676A76E8302E628B416E17CBECD1E5A0B2037485257A36E0107F996F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677426603, "uuid": "debb2e9e-e0fc-45f5-be23-38592cb1497a", "value": "1536:UIGW+AhDnn0y76UoTgQy+RReanLKbrh3C6Bzi5HG0lgx:UBAhDnnEj8QyjcLurVC4W5HPSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677426603, "uuid": "a7e55eb7-465c-41f0-aca0-7164f5c164c5", "value": 49528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677426603, "uuid": "382281f9-1a8d-4b97-bec5-189d3e9ceb1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677426603, "uuid": "a24858c7-4aa6-4e69-be58-98e121caeddd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58726f3a-b5f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677429228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429228, "uuid": "44aca51b-3785-47fc-956c-e42b5a00591f", "comment": "Malware payload (Mirai)", "value": "d7940c9cfd9f10209dd9b5044162f44b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429228, "uuid": "e70d8119-49eb-429c-8357-dd6552b7dbee", "comment": "Malware payload (Mirai)", "value": "2b87af0ccf617a49a951147ffe78bbac8f9af1c18a1e44227abcfed1819c24a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429228, "uuid": "2cad2b0b-bc4e-4081-87a5-6dbcbf8ff09c", "comment": "Malware payload (Mirai)", "value": "69cc63e487901b55baab41eed7ea733becf0de6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429228, "uuid": "82e03647-9552-4dd0-8264-7b34558c3105", "comment": "Malware payload (Mirai)", "value": "fbb63ca35ed352b75bd6b1ebd9a124c55811f803dedde1396e0401aab59453ba5b8be6217327ddca88794efc1bf6b579", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429228, "uuid": "850abc55-f55d-4f9c-8e14-36ccceadfeb7", "value": "T10F633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429228, "uuid": "b5d41853-9de6-4d5e-aeed-7adcc40f513a", "value": "1536:lGRaTYmol/hGIAs4PNvAYQJGm75123tStdl:lya7hJWGmVDbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677429228, "uuid": "74b0f00b-16f8-489b-8152-2dbfb57c82f0", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677429228, "uuid": "7c39b54e-e213-4356-9154-67d998cc6b07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429228, "uuid": "a47333c5-4498-4589-8a93-584b1ad140fa", "value": "d7940c9cfd9f10209dd9b5044162f44b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6671b652-b607-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677437841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437841, "uuid": "2ff0fb16-b959-423a-a24d-e990d0ef1557", "comment": "Malware payload", "value": "6e0b218317b69c736d9633145dbffdf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437841, "uuid": "0a56c006-fd8d-4d66-bdee-757cec0aa094", "comment": "Malware payload", "value": "2c51a80f6454f051c81a927885897b3790101766615581b3dbd4b82fdc70ed0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437841, "uuid": "607f0a0a-355e-48bf-a9b1-643f58c1a394", "comment": "Malware payload", "value": "277b1a07c393f3d6633eed61a9a43a294983dba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437841, "uuid": "3fcd1500-6ef5-4693-abc2-a6cc38b15234", "comment": "Malware payload", "value": "e162a5ee7dbc4e5cb7762f50eceb1358c052667492bfbc292c49dc93721bb97a124059005c077dc19ef7342109835549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437841, "uuid": "56f2a6c0-68e5-4bbf-bcb6-5ad779c8cec0", "value": "T183E3DF21B890D431D446267108B4D7D57FBEA4320BB4988B3BA943BE5F743E2537A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437841, "uuid": "a07e1703-c71a-4da0-b449-4171f46e5e3f", "value": "bec0a8a77ea6e846112173ee928054ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437841, "uuid": "a2b534b4-2901-482f-9463-b2d09dc51ffc", "value": "3072:s3Xa3LxhPNcYgL8hQEiiKY3KPn1g8KGdzv:AuLLPqjEbKiCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677437841, "uuid": "111b096a-c1a1-4767-b77f-3b8e10450455", "value": 154229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677437841, "uuid": "a0fdc34f-0e58-4edc-89ac-27c1a78b550a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437841, "uuid": "ed99a0e3-35b8-4537-b20b-268a67ab2eb5", "value": "6e0b218317b69c736d9633145dbffdf0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa47ad19-b5b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677402012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402012, "uuid": "520aeebf-f763-4f3d-bd42-5aa8e81c2269", "comment": "Malware payload (Mirai)", "value": "d1c40928c6600a13dc1a592c548adcb8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402012, "uuid": "4e05120f-e8cf-4671-b1e1-298cfc7fbd29", "comment": "Malware payload (Mirai)", "value": "2cc812a033e00fbbdda963f413950419e99083c80caf84f64a11ee1be7180f3a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402012, "uuid": "8fcd3b8f-68eb-4e10-b6f2-1d344ccf6f16", "comment": "Malware payload (Mirai)", "value": "47647837f384afe26da398a927fddb72ce6d2b60", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402012, "uuid": "5ee2c696-2b18-4d92-a723-09d4df9319f2", "comment": "Malware payload (Mirai)", "value": "5a2e60948acce213386a8145b1d363ca1d97a47197f8376287c8f027622c75a53e5c57b05b24acace2f40d462b5fe222", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402012, "uuid": "65487970-a7b3-4e5d-bd7f-a7cca082f12b", "value": "T137231841B8818613C6E4137AB66E46CE3B2563E8E2DFB2079D321F503B9682F0D67F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402012, "uuid": "7605985c-fa31-4393-995c-9bfb8714e17b", "value": "768:plT3kFv9sOvAZo3tmvqKZhn9Om/8a9E/PoV0P/N+WfDZb7LYw:D3kFvCOvco8VAZ/dPrFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677402012, "uuid": "f9f81033-5794-41c8-ad76-2f7aba7ebddf", "value": 46872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677402012, "uuid": "7fe37292-f82c-4870-8079-21b6a26df6c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402012, "uuid": "2b6a1153-de2c-4fe7-a6d5-bc0a07a8a986", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6689a218-b5b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1677403482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677403482, "uuid": "515a6ae2-a86e-4a0e-98d8-7ec6e2d43df1", "comment": "Malware payload (GCleaner)", "value": "89646da3eb29f4ff171352944a911272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677403482, "uuid": "7e660267-e33f-46d0-9b62-4b81404bdfc6", "comment": "Malware payload (GCleaner)", "value": "2d4b618389ee094a91a5b1a32baa770c7a54afa96c71d0d153b69a3a5d51e0a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677403482, "uuid": "fc010cbc-c611-4491-8ca9-b05ffba303aa", "comment": "Malware payload (GCleaner)", "value": "dfda50e5d7b068aec4f5bf3223118df49b890cb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677403482, "uuid": "d0e53f30-e332-45d2-974a-81ea6d804294", "comment": "Malware payload (GCleaner)", "value": "8290e5aec16ba2b50d87bf79677b71866b6e6e3e7a5e5340a2723f270e6650dee653a236c7da426acbc6073f2ebc1d72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677403482, "uuid": "c270001b-eef3-4873-9357-cf201ef44976", "value": "T1DBA523B9AEAD8839E0D578F89D21C8735A361F417A3C971270C93D1B3BBD1A26D5D203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677403482, "uuid": "5d61bd1d-17e8-4471-9569-19d4679792d0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677403482, "uuid": "baf2ea6d-932d-4659-9495-0a8dcd9f4ddb", "value": "49152:icPLnQWFE+TbziAPuKCpvtpleUdHgGf1HGZAvKlFCnTALjSLCgv2MR:XPLnQeziAPur9eoH9fxvKLDLuv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677403482, "uuid": "4d16930c-12fc-4237-b103-a51d3e67b94a", "value": 2256094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677403482, "uuid": "6fcd46e2-aa22-452a-942b-d3d2ede87147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677403482, "uuid": "a06b943c-d319-4064-988f-b3be12ceda61", "value": "89646da3eb29f4ff171352944a911272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8221fb42-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "55a5e67f-1301-460c-9285-690a54dd4702", "comment": "Malware payload (Mirai)", "value": "3ba80bd893c5a6c77d39286c0bd86f0a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "4c347656-d18c-43fc-a928-12360f23a9a6", "comment": "Malware payload (Mirai)", "value": "2df2881a5fbde78e3cda6dc49591c5ac3fc77dea9462ee73c61fdcd1b94f3aeb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "e84be0e6-1dc5-4c9e-b24d-af1486029f63", "comment": "Malware payload (Mirai)", "value": "770f81d332b1e6a16eb10c338bc571896a47b6f5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "76595c26-2a6c-4740-a1de-ced57d9b7a8a", "comment": "Malware payload (Mirai)", "value": "9421b729aabab02fc1c45876c1118253ab07dcf74e6a2dc8cce02d124a7d38d9becaff31d7bf293a2409fdc68072cc42", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "fbe71ec0-83d9-456b-b623-cd26468e8c61", "value": "T1A173121562B30F8BFB2AF13D1EE309AD63554D5225250967036CAC1B24FF5CEAF1D80A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "e88ec185-8714-47b1-8d1f-8748df6dd295", "value": "1536:qM5jgE6f0BwetWTbriB9MdYpyOydvPDxVoE92HhPsNK4YwOBFRn7:b1If0Bw5f2B9AYsOcvrxeEg5sYbR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372604, "uuid": "2f0684f6-0af3-4998-aed2-c50744744b9f", "value": 74840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372604, "uuid": "f6b28f91-8b42-478c-9363-72efb56bd0b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "42cd8708-0b89-4be8-8182-a3a578150b5b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6daab8dc-b5a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677395333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395333, "uuid": "4ed81b06-1400-42aa-9320-b0f443ae2ee9", "comment": "Malware payload (RedLineStealer)", "value": "e8b435509b39d10eaa7e6b1b6a03ab1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395333, "uuid": "e13ab721-2d28-4580-ac37-adb67057d436", "comment": "Malware payload (RedLineStealer)", "value": "2e2488dbef57884e3c4d273beedc8ea18fec76f036c9b5915936cdf2a19b3bdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395333, "uuid": "ab85953e-a40c-44eb-95c7-0b227b18dc3d", "comment": "Malware payload (RedLineStealer)", "value": "e7af6e974ddf8f042aec718cfa0dc7bcf4eff92a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395333, "uuid": "87f126d4-ab58-4ec3-86a7-28711812ff62", "comment": "Malware payload (RedLineStealer)", "value": "e234fe0a9c86d86745b0c1472465474636bfb0849398ef6c2cf55d36e53dc1152accbf6c88ae1db6c15bf952502aa01a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395333, "uuid": "84cec4fc-e4b2-4469-8a46-5e38a8ac3bcc", "value": "T15D94F147A7E88172E8B5977059F70AC30B39BDA15734829A334F6C9918B2570B73137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395333, "uuid": "a801315c-d6cb-4504-89e2-2e8b61804b59", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395333, "uuid": "a49e39ce-ea9f-4190-a9d7-90eced83fd39", "value": "6144:Kmy+bnr+qp0yN90QE0OLizUC8SC8qPEbnrYdPirz/hYrTVjfS4lMP9c5Gokl12px:OMrey901Sy8BYdPirzZiIiFOyq7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677395333, "uuid": "35a4d32f-5527-46e0-8564-7eeed383b8ae", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677395333, "uuid": "6896fb21-1e9b-42c5-8937-ac48aed2affa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395333, "uuid": "c208f963-96ed-41a8-a174-67526000963b", "value": "e8b435509b39d10eaa7e6b1b6a03ab1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2d680d-b591-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677387008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387008, "uuid": "14948140-0732-40c0-937e-402eebc2f5e1", "comment": "Malware payload (Mirai)", "value": "6b4948fe4551f134b638099946419b4a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387008, "uuid": "2ade82ca-30c0-4257-b5c0-28ad7463b56f", "comment": "Malware payload (Mirai)", "value": "2ecf5009e501e710dc5ffbe9b7afc972639b0694632b15c1a16b904e117f7ad6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387008, "uuid": "43441d15-736d-45f2-9caf-5f06f37b0445", "comment": "Malware payload (Mirai)", "value": "b8803a2f8ba61a906c6fbfe9fefdc428521fed3b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387008, "uuid": "822f8ee0-d922-4e4c-b1b7-b73d4aa23b68", "comment": "Malware payload (Mirai)", "value": "e5e37fb074584daffa9683db18cd84bc6f4278d17165e5379b9cc0e98bb09b6135d96b4704348ca7f1da6de1616f4c15", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387008, "uuid": "2d15bd22-4c84-4ba7-a60e-84ac4e160ab4", "value": "T1C833027267AE35D251B05373FC33AC5962DC17F95C6730DA2CF0991577C58024AF2686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387008, "uuid": "09c3d332-771e-4e0e-81b0-a43c268073d0", "value": "1536:j9O/ZMAXIxNUk0gLcPqF1aBexo4opKZbg:j9O/ZNKysLGqFUFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677387008, "uuid": "1dcc4a17-e9a2-437f-af36-1ec08d8795a5", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677387008, "uuid": "2bb5a5f7-addc-484e-ae44-e0222fab3baf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387008, "uuid": "b203d78b-e590-4036-9518-59ea530a86c1", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b799d5a0-b5e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677421227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421227, "uuid": "e4f6dd7b-648c-479d-a5e8-1a60d8249276", "comment": "Malware payload (Mirai)", "value": "e6aca2d07def4a1441fe6e20961b1102", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421227, "uuid": "eabce176-a86f-4271-bee0-9f68e55c2a62", "comment": "Malware payload (Mirai)", "value": "2ed7ea014bba45ff7c78d17e361153907109d7a7105c0987737dadd07c9c9ed1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421227, "uuid": "6b349222-ac5b-4c08-80f3-485428495a78", "comment": "Malware payload (Mirai)", "value": "04c433efe4ca3c56d626bdf4af5316300d338009", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421227, "uuid": "53498a68-222c-4b64-be5f-36988ae38e71", "comment": "Malware payload (Mirai)", "value": "34178f91909a268719e89ff980e9913cfd78fa2456c4e1c46404c1e0c8b902eb47cafdde7be861cfa2c2a8de9f40a204", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421227, "uuid": "ce3022f8-68cb-4afa-bfe3-2a6264653c3a", "value": "T1CFE39466AB618EB7D80FCE33069A4501118DE59642E93FABB3B4C51CE74BD4F08E3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421227, "uuid": "c6ddfacd-19b3-44c4-97aa-42ff8046ccd5", "value": "1536:diWneTrUT5jZd2MyZBeh/9ukUEAI0gJXDmPsw+hmvj3q+13fJotx5:pIQ2xD1ER3yPsHhmvj3q+13Botx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677421227, "uuid": "d5f07e0b-1c2b-4131-b75f-225eebdb211f", "value": 148038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677421227, "uuid": "36429a46-5842-4d32-bfeb-0cf0ca8623bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421227, "uuid": "0ff58578-6f67-4238-ba98-ff5cf395f251", "value": "e6aca2d07def4a1441fe6e20961b1102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851dbfb6-b5e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677424578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424578, "uuid": "e1fc43e9-e18f-4fb9-a1e4-f4ff436981ba", "comment": "Malware payload (Mirai)", "value": "cdae6f025eaf55d1db57575a02346bf6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424578, "uuid": "1db13269-347e-49e3-9756-d84e4917b79c", "comment": "Malware payload (Mirai)", "value": "2f131d4b8cdfdfe1391d84cf0b895c15d1c2c9d4225d78e58fe05a6b3c764007", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424578, "uuid": "a97a37c2-3e36-415d-90ba-66c8258255a6", "comment": "Malware payload (Mirai)", "value": "91e4877d6a2082fea16302483dd0ec673402e090", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424578, "uuid": "c11bdb7e-a092-4075-84ea-76f0e92eff16", "comment": "Malware payload (Mirai)", "value": "5aa9388f1c286769c8487c560cd4f5524d529097be42bf2f61c7fecf96251caa217a03243d308ff0fa2081737b72e215", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424578, "uuid": "626d69b0-535e-4fc9-b179-6bd8f35c6f72", "value": "T1A0A2D015D345AEF4DFAF5D9093C2D2C2B6E547C6278AC8E340FEAF016A06042F789D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424578, "uuid": "e545a68b-193f-4b4b-8b57-82ecf146275d", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5+M4uVcqgw05VxJ5:mRxsSVsMD6xiJJE5zRWNv4uVcqgw09r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677424578, "uuid": "ed7a21b3-0e88-4939-9b98-82db72be3775", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677424578, "uuid": "5a4bbad4-f469-478a-8252-d1ad190a6813", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424578, "uuid": "b7cf80af-a011-4b18-91a3-47f74afc9c0d", "value": "cdae6f025eaf55d1db57575a02346bf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e76954f-b5b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677400918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400918, "uuid": "eef46b1c-1c95-454c-9c80-707034d45e46", "comment": "Malware payload (SnakeKeylogger)", "value": "8325e47cc77db9e223393da8089bcea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400918, "uuid": "97d68fda-fcd0-486e-a643-11b246ec0682", "comment": "Malware payload (SnakeKeylogger)", "value": "2f79f91c728540c598fe963a01bd581f9c5309cca2255aa7af6339af2b80475f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400918, "uuid": "b17d5b71-e7d3-4eab-946f-dbffd4eabdba", "comment": "Malware payload (SnakeKeylogger)", "value": "6e3ddf5f67027fe836fbde2f22702dd013483656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400918, "uuid": "cb2b8ecd-d74b-4f46-b1b4-9dd97486d852", "comment": "Malware payload (SnakeKeylogger)", "value": "0a7cc212d9fbf02bdd30c1f3daaf3ee259f2da6a068deb640e2e42e55c7951e34ec860b01f9659253d63e33efcb198f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400918, "uuid": "5d37a9ad-9669-476f-8167-d7944dc286d4", "value": "T15E159D5977B46073F4CB01EE58382BCD2D3066477618E22FA777BB91A2719FB7288211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400918, "uuid": "db85c475-dfdd-4464-a05d-698344149817", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400918, "uuid": "db257dbc-f90f-4e77-ba8d-ca828857be64", "value": "24576:e/M4opn+xSStIkk35JH+/axa6YMUWmWy7IL:eopn+Jk3+36HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677400918, "uuid": "1fdbb1ad-e257-4138-8ee6-af011d7f807f", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677400918, "uuid": "c752d761-61cc-4326-bb13-145bc0da44d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400918, "uuid": "905b2d3d-844f-4b09-8aa9-9c483f90ff6c", "value": "8325e47cc77db9e223393da8089bcea1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83af46df-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "96e070d2-6e12-4370-8140-f5ea4f8ed686", "comment": "Malware payload (Mirai)", "value": "d72b38e5f20124c173ad5a459a01814a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "b1f3ac7a-9645-44f2-96d9-11589a2f4bda", "comment": "Malware payload (Mirai)", "value": "2f963ccfff3b1defde83381449d20117277c01b7581c1242b4fd374882c2d156", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "400776e6-5c79-4485-aace-6e79b7fafecc", "comment": "Malware payload (Mirai)", "value": "6a13d7ebfc25fc1f75ba57c0e9119b2c0fb357a8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "41a31172-afe8-43a6-8b5f-a203f5b4285e", "comment": "Malware payload (Mirai)", "value": "96b18a9ba7579fad720ca59727f0283907076162b4f24643d532a4ff15027d40e29dc4160e6835708722a2c0ec110878", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "b2b2fdd3-c473-46a4-83db-910e533de0e8", "value": "T158633AC9A5D3F8F5EC040A393077ABB299B7F13B6138EE9FD3982563A941642D10166C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "70ad1ad0-215c-48bc-aa68-88441afa4915", "value": "1536:m4/aT1T71yYlupXqMmJmBr4vMFnKi/IFO2418H4QjWkHvm759Qpb4Rj:b/aJT7MxNpmJm94vMFnKHF/4CH4ePY2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372607, "uuid": "0cfe2d2a-281b-4929-a263-ae6d3fba0195", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372607, "uuid": "1c84be29-35fb-4dd6-8c8f-7b4b602c3e8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "fcdc7b35-5c66-41c5-9426-983fe8473a50", "value": "KKveTTgaAAsecNNaaaa.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bda7a66-b5eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677425771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425771, "uuid": "e7d29ceb-63dc-4f4b-90ee-7676ff09c71a", "comment": "Malware payload (Mirai)", "value": "8a97f1992e9b8091bc17eb46ab763178", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425771, "uuid": "0f6eefb2-8aa8-4115-a9b5-c4ffc2ac4bec", "comment": "Malware payload (Mirai)", "value": "30962a586da4f7737ededf17f47715647e53d3a8287c04ec07b2d66a66e9c093", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425771, "uuid": "7488d14b-863f-4e17-b52d-2ac2f683f3e0", "comment": "Malware payload (Mirai)", "value": "b1fb9e900e80b59b76bc6624c9787b224bf3fd2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425771, "uuid": "93f3a0f6-5cd6-4f69-b672-7195ccafe2b6", "comment": "Malware payload (Mirai)", "value": "ff649eac9731fc14a8d1460779bd3b97c2d3f3f5d2c29ce488cb9a2421b4100c56ddb2dd57389f13b51e8b3d468166c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425771, "uuid": "095c3ff7-97c7-4ab1-bf65-63aa1f31af74", "value": "T1FF03F751BC829A77C2E1137AB6AE4A8D332163E8D2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425771, "uuid": "6e5a939a-2a70-4707-898b-94f5b5b3a7fe", "value": "768:sga4CbfsG5f0OtnlUlYOJFFARwAsb9LHWhCv+b0G7rDUXoTu/NYwWS:svbUG5fPlUlDf4Sycv+PURjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677425771, "uuid": "44aeb914-c41b-4532-8430-8bc32d84c67d", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677425771, "uuid": "ba1259f7-c546-4c5e-b823-331918574235", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425771, "uuid": "4a5b964c-d047-40fa-ba82-06c6d15c84c7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79c94bb-b59f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677393283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393283, "uuid": "82e039f9-463c-4428-ae98-34b478b96ccc", "comment": "Malware payload (RedLineStealer)", "value": "2d046356adc419adef4049f5ec0529fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393283, "uuid": "082c5966-657c-45f8-9b4c-db57c3456d42", "comment": "Malware payload (RedLineStealer)", "value": "31e477a3732cf4d377bbb89c5a5a3763dadd3581ce07534bb4fc54efb951823b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393283, "uuid": "ff6c1cc0-7083-4850-b249-bd62bb80e180", "comment": "Malware payload (RedLineStealer)", "value": "59b79b81155927260c7e5c73c1505b7ff820fcd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393283, "uuid": "5192fb4c-c991-4ab8-9b88-c79d1b7e69f1", "comment": "Malware payload (RedLineStealer)", "value": "09e71a678933beb9ee71f44fa9542ec6ec94f7c9d6d5b2d94fe57f8a381aafe4efa3e1908b26729d713826304e8aaee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393283, "uuid": "18f6358e-2568-4b6b-b064-71bf92b5c8a1", "value": "T18B55339606B468FBCBDA13B19D6ED26DF132BDF9C4DBC209458759C5A2D024033363EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393283, "uuid": "cd26af54-1bbd-4031-94d7-1f5668d4580c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393283, "uuid": "3648cf1b-cfa7-43e5-8f0b-eccf6c8a6c13", "value": "24576:FfEZRk+1BmMN+wkQZVhtMOb7UlyPeNks08yfcadLetM7ckAx:Ff3IcMNHRLF4yP8k+y5UYnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677393283, "uuid": "ab829782-d464-498a-ac3a-1d93e480f485", "value": 1334272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677393283, "uuid": "ef8b5c3a-2da9-4b2b-8195-185ff8e0570c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393283, "uuid": "07e7530e-603d-4dc7-a5fb-48018029bfcc", "value": "2d046356adc419adef4049f5ec0529fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc87a0c-b5a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1677395359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395359, "uuid": "0c5335c2-6551-4fe9-ab58-88f373d06924", "comment": "Malware payload (PureCrypter)", "value": "597b373d9774804b932f3470f6206429", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395359, "uuid": "9248f824-a8d0-40e5-ae35-ade73ad328c8", "comment": "Malware payload (PureCrypter)", "value": "320c842b7668314d60fe11232d050805503a1df1c8c40005efa1759aeecdadab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395359, "uuid": "898d7b4d-d170-48ff-a168-f7ee7ab9a601", "comment": "Malware payload (PureCrypter)", "value": "4f34594c5afa51faba82c9c0615ae776914bb217", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395359, "uuid": "0bb78189-651e-44e9-a490-fa7da79e67d9", "comment": "Malware payload (PureCrypter)", "value": "72f8a8ea85236754aabd2418f7ee9b111746e3d4dc87a31b97be55a8ed0807d1830cc0fe0dbbf05fccb52bc04c3e72f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395359, "uuid": "4622f21d-b8f9-4fff-aff1-ddf51c287404", "value": "T120C2292177C14E63CE4B4F3A98E3A3513338DA908B93C74F2498A26BBE277D50F12194", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395359, "uuid": "0ae1d8f7-2c75-4908-86ce-ba0d81b6b3bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395359, "uuid": "7e323008-002c-421d-9d61-0c5319363608", "value": "384:OMtXm0ZQVvS8QyRB7HPGscO92xkBE0kb7s4/LGf8JN77hhtS:OMt6VzB7HCPkB+6k3hXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677395359, "uuid": "4bd22489-563f-4295-a659-47bf42c5577a", "value": 28072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677395359, "uuid": "d6c79907-da62-46fa-85d8-38cf600028b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395359, "uuid": "bc7c9a62-9741-481f-9c07-140c458981d0", "value": "597b373d9774804b932f3470f6206429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761d51f4-b5e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677424553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424553, "uuid": "59dc9e05-1fe0-4321-93a5-f86a37044c1d", "comment": "Malware payload (Mirai)", "value": "8772d72a6dc400c24780933c3360ee16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424553, "uuid": "3c60e88a-6f08-4cb2-b33a-c91b4f205991", "comment": "Malware payload (Mirai)", "value": "32c1ebf24b859f782570424fd82b59b786999294db72da41aff3b3a93e068211", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424553, "uuid": "7a7533fa-a7c7-40fa-b0cc-33d99c8c069d", "comment": "Malware payload (Mirai)", "value": "cba3580dbfa1b5b063c227fb8021566ab4848be4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424553, "uuid": "5a2a168a-62be-41d6-b776-b7d8da43f84a", "comment": "Malware payload (Mirai)", "value": "ab70706ce33becbdd8044fe2c14302668d31dd6b76118927954357625a8208b086739dbdc8639d385b34c010968d7147", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424553, "uuid": "bd4c5fa3-53c3-4410-b96f-56f26cdfa394", "value": "T19782CF3061AB75F8CBF14431EEADCEC6A7160BF8D1FC369316586B78894610661F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424553, "uuid": "81d3873a-4fa1-4205-9d5a-e2438793edac", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaChymdGUop5h5lu:2dV0P6+kom0tVAoNvm+to1Cs3Uoznlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677424553, "uuid": "d5fbe35c-d4d7-4ea2-b2df-8c27e6cec39f", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677424553, "uuid": "4b3ff0ae-1502-4f1b-863d-c94a05d221af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424553, "uuid": "6efb0fbb-4bb9-40dd-b568-fe945de7d0e5", "value": "8772d72a6dc400c24780933c3360ee16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce0e4df-b5dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677419867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677419867, "uuid": "ed63d1b5-0c5e-4a80-b736-7d45e9b60ced", "comment": "Malware payload (RedLineStealer)", "value": "14676a41e04426dc8b8fb52780184ba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677419867, "uuid": "20fac5c5-10e8-41ec-929a-de9da01b72c2", "comment": "Malware payload (RedLineStealer)", "value": "332da5f65cf75fa0ede2e97ada465f82bac1c90fe2e12336dbd7ecc4b2a5784f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677419867, "uuid": "187e4e03-aa93-453f-9fe6-97176eec9c38", "comment": "Malware payload (RedLineStealer)", "value": "ce9f997adbf63b5c7ff2ee52eeb11a96ca3a8b72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677419867, "uuid": "77568187-4d37-434f-ac21-449570825f18", "comment": "Malware payload (RedLineStealer)", "value": "2fd60665b94ac9c56fd433ffeec36f2d1053d09f7acc43cf28a2308ed34b48bbe8a3faad1b09f136fb9e402c1c5fefa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677419867, "uuid": "b8e62205-e586-4cc7-8935-4d3c1a7f384d", "value": "T15C755A283DFA5029F273EF755AE879E6E95FB3733A06546D1051038A0723981EED183E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677419867, "uuid": "e24bed4a-0c61-4e90-a900-dd6b92565277", "value": "24576:hwedxB4D3cK4CGN4EW6rLULs+pXD2Yurpwr64W0y:Geb6+7NLU2Npwr64Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677419867, "uuid": "e8c218bd-bb52-481d-8666-ffe6c256cf25", "value": 1563808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677419867, "uuid": "fed6e4f4-b78a-4a29-96eb-c3aed6b96259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677419867, "uuid": "7c15dd25-012f-4b3c-98ec-25835a15a078", "value": "14676a41e04426dc8b8fb52780184ba0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f94cd3c-b5ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677434367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434367, "uuid": "6e0a168d-857d-49de-9f10-e6f26e9fdaae", "comment": "Malware payload (Mirai)", "value": "65c9b6b82582e6fcd34109db6cfd4139", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434367, "uuid": "6c7ce341-1bf7-4500-a1a7-0265c175f5d9", "comment": "Malware payload (Mirai)", "value": "348da5da295a832211ec2de0e08603f47e8dca6f05376252d8fdbf345e9c005f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434367, "uuid": "25086403-ae20-4737-bbc9-8fe70a028141", "comment": "Malware payload (Mirai)", "value": "9c3b48b637cd0ce891b7d6bc4e0ca5a7bc93972f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434367, "uuid": "f4b79c4c-642d-4a3a-b4c7-bb1e9feb52cb", "comment": "Malware payload (Mirai)", "value": "3eff3f279fe84c5638bfac9563aefc2096b5b117be6fdb5d9b9a4c907cc2f4073fe6624e48b3947b033b7b6b5ef7cfe2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434367, "uuid": "702e9523-5d95-4894-981e-5ca4b92ae0f7", "value": "T1D243F855F8818B22C5D4027AF92D118E332367E8E3DFB2139E116F247B8696B0D37E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434367, "uuid": "14358663-0572-4631-bcb1-cd47984747c4", "value": "1536:5Jng2Ke3tTQZoSgLyUN/aKD3ezzIci13FihNJ:A1edT+dC133FihNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677434367, "uuid": "b112306a-b47a-46e5-ad10-deaf501703ef", "value": 58676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677434367, "uuid": "7ceff83e-6d2c-4c93-a608-a1a93f590321", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434367, "uuid": "22f2a325-ce78-44a9-8056-0e85ac75fb36", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50edd275-b5ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677434369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434369, "uuid": "403cc8b5-6059-49b7-a459-d1ae8d8abf29", "comment": "Malware payload (Mirai)", "value": "b575192571b220c6698a76222baa362f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434369, "uuid": "f2f54caa-d853-4429-a327-b3b1b9114ba9", "comment": "Malware payload (Mirai)", "value": "34be37c9fd807463a8b12aaddd5f05545195d49d2452c4a6471d888f60d12bdf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434369, "uuid": "6da38022-739d-456c-8418-27b4bcd4fad5", "comment": "Malware payload (Mirai)", "value": "e0c3b53ddb2f5aeaad902cdf8d229a9573a4858e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434369, "uuid": "b30bbb7d-bc37-4b3d-9bb8-dab4aac5e281", "comment": "Malware payload (Mirai)", "value": "5a9883a001b4c9161b537389af61f746b52c8511f217319ddeed752ddfb4ed038e111bceaecbd2d3fa1efe997515d874", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434369, "uuid": "0cc383d7-af41-423c-8e4c-1fe77254ff89", "value": "T175C33B46E6818B13C4D61775B6EF42453323A79593DB73069928AFF43F827AF0E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434369, "uuid": "464c3bca-50bc-411f-9757-f37ec2f121e4", "value": "3072:AQO3WqApOKMoMuPGYlqqiao0+EuNM/9cE:AQO3SXMoMuPzQqY0+E4M/9cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677434369, "uuid": "d8e83ddb-7193-49f7-a2ec-dd473fca9484", "value": 120446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677434369, "uuid": "e4a55ec9-740e-4927-b3ba-48a43104f12c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434369, "uuid": "79de233f-87c5-47fe-b391-0f71aa0cb425", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e0188b-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "5ffa1a0b-f88a-49a1-a7ee-1ad8398305f8", "comment": "Malware payload (Mirai)", "value": "da2c017ca5c715d2c457e475fcba36d3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "ef08f8d2-3523-4db1-b48f-e5e33eb89d4b", "comment": "Malware payload (Mirai)", "value": "34c00b651b858d88685577a55cf631069374f12b0088c00b6d682bcfa0c56c60", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "72e6f077-530f-4860-b134-bd9d0c62bf6f", "comment": "Malware payload (Mirai)", "value": "0db03d10f9853cf005a60c5f7bdda1af53433775", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "9cab3e58-4783-4d5a-805e-b18706b508b9", "comment": "Malware payload (Mirai)", "value": "e433c154c4a4da13ed565163dcb139c8e9d10a5129224edc7a7eabe7f14dfb529150a3595253dd75928aa794cff7f8e3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "38abec0d-3c5d-43f7-a550-1dc2bb9023bd", "value": "T1263339C8ED97D9F8DC5125712027EB328672F13B1019EA8BE7DDAA23BC52B41D40729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "738877a2-3a1e-468d-a910-8d033f6a8a12", "value": "1536:BAmkKnnAvjccy7ZeDm4EJd+67ZdC2BjWxr2dJKQDfw:ORKnAvjcV7ZIEJdxZdC2tirS3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372607, "uuid": "c104d862-4919-4dd1-a352-c3917226628b", "value": 54800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372607, "uuid": "4cac862f-9796-4b1c-932d-e55406e57e00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "b2fbfd3a-9431-4bc5-9118-969a61128276", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fb360e-b60a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677439236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677439236, "uuid": "baed2a4f-bcef-496e-9cfd-8edd8e9cc064", "comment": "Malware payload (RedLineStealer)", "value": "f3d9c28606805201721aabe46dfb46de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677439236, "uuid": "c173db80-5282-4c5f-a816-cd4bd4e3f1ef", "comment": "Malware payload (RedLineStealer)", "value": "34cfddae6527c3c05618478497f9a2a9460c8e0a275c0816be6a27affba74f76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677439236, "uuid": "102dec09-73e8-40f6-a8f8-7192aa0652b8", "comment": "Malware payload (RedLineStealer)", "value": "5e2e7e6cd14ae0fa8352241929b17dde5e8137c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677439236, "uuid": "2800e0dd-ca8f-4c49-ad55-4a3496b73241", "comment": "Malware payload (RedLineStealer)", "value": "b1a09cc663f7ae57d46cca517ddb866f58d6c21f0938220773021728f3ccb194433bcf2253b13f8ef35f74c2eb8943bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677439236, "uuid": "ef431c6b-8e62-46bc-ac27-4b0fb321f676", "value": "T13E452347E7EC8172E9796B7105F602C316377DD02EBC439B339AAD4E04A22A4B53572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677439236, "uuid": "4ed94cfa-d722-42c3-a039-b67630d7897d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677439236, "uuid": "f3556c42-9b73-4c18-ac44-f1d3b38e7a94", "value": "24576:fyznVgRhUYQWp1M/HCI9dwqNgQo5bDTosfFR8BM+2RNExHhp:qzVgdsHCkdwqNgQebDlr8BMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677439236, "uuid": "64a102d3-8195-499d-b23c-73b7a8d8edc1", "value": 1176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677439236, "uuid": "4d6ee9e4-085c-4bb7-95e1-c1a8bc0b98d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677439236, "uuid": "e90c5063-e14b-44f7-a2a4-6daa10b9aa91", "value": "f3d9c28606805201721aabe46dfb46de.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d9a9f4-b60e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677441092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441092, "uuid": "293248ac-8ce7-4dc8-ae10-d46d933449cd", "comment": "Malware payload (Mirai)", "value": "605757d0293e7d57d117080bf0ab8e5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441092, "uuid": "6bebdac4-a6ca-4cad-b834-b21438a9f689", "comment": "Malware payload (Mirai)", "value": "357c896091cb5fc01b158ae1deb2e7fd5a6e2a7f025cbb66970ffe4818fead89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441092, "uuid": "8f0abd46-3ffe-4413-a399-14e47092a898", "comment": "Malware payload (Mirai)", "value": "11d83f819e03b4330707caac372d2a55d39ff18a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441092, "uuid": "698d6020-de24-41b4-b9a3-51ef309c80cd", "comment": "Malware payload (Mirai)", "value": "ae92742586a6b5d3b1d41283887e664c568fd6cf1e3ef26f39c5c2d3e4ad378001f44a00351d057e8526fc4910ba3084", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441092, "uuid": "2266e632-82b9-4372-8833-36c749ebe506", "value": "T1A7B2E195D6FB27C3C2A2C336E0BC560DE6731BC10746450A120A728E979764E8BFB3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441092, "uuid": "da1e4d36-02f7-440d-ba89-f53256134878", "value": "384:MVDKKQOcRpmYLdn6RBOFRFt5rUFW10iSelCo3AnupPFNqnrrd1NEZgO8UXWozPLr:w/QOC0Yhn6ROHWFGrcwNVFCnNBxcCcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677441092, "uuid": "9c68060c-cab5-49d2-b44e-ad66605ab3c4", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677441092, "uuid": "af32183a-5717-43b9-9ec1-e551f84a7dec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441092, "uuid": "9732763a-4b02-4def-a44b-f6f182bcb8fa", "value": "605757d0293e7d57d117080bf0ab8e5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48577bcf-b5b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677400425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400425, "uuid": "e13044a7-a539-44fb-90e5-d6be732986e8", "comment": "Malware payload", "value": "be62961ba92c99f388fc2862b54f48c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400425, "uuid": "ecff15c7-928b-4b9d-8b8f-ff94f3e3d7e0", "comment": "Malware payload", "value": "35e022e4141e2ea92879f00a4f634b81e28639e2a28ef450e220fdddd6f2587a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400425, "uuid": "bf679b7f-0d21-4186-b526-71a7962435db", "comment": "Malware payload", "value": "c39836cf47f575031a5a8c6f811ae23cae75c6d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400425, "uuid": "11bce0c7-1e28-48ea-9159-748b2d703b66", "comment": "Malware payload", "value": "4051ccc3a1c5ac271ff42c0fffa788c0edb75eca92f728284d33a8cc9ff9a87b3c2198fa585950e38e0667ede662876f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400425, "uuid": "78825665-31d3-4017-98a6-d0de019daaba", "value": "T155258C23F5D340E6DB61017229E7373D9E659A018F29EFCF5126EA2D5A33081DE37226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400425, "uuid": "38f190d6-2af8-466e-973d-39fe41a5ff83", "value": "12288:2FtAZYYN0UCP17i3uWIZuHxh0kuib+jp6WM7PJb5G30u:2FtAvs1W3uWlHx+jp6t/G3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677400425, "uuid": "d399fe69-227e-4cb0-a112-bcb17df4973e", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677400425, "uuid": "7c01db47-0b24-475b-800a-27d4ead2c32b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400425, "uuid": "d649a582-70f5-429a-a2e5-da1a6bb6d1f7", "value": "SecuriteInfo.com.Win32.Trojan.PSE.16DVGAX.31482.19316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7723bb-b5fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677432481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677432481, "uuid": "3476aed6-420f-4cbd-9569-0edd829e23ad", "comment": "Malware payload (Mirai)", "value": "492651c852c518aa31f97c312628a494", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677432481, "uuid": "679a8fbf-1376-4c25-97b3-5414a9fc5ff4", "comment": "Malware payload (Mirai)", "value": "35e876ab617e1bfcbbffc1cd67c04ba30f3be8eaaf6da1087421152dfbddc4c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677432481, "uuid": "222a002e-0ffa-49ea-b5f8-71835d3d3467", "comment": "Malware payload (Mirai)", "value": "991cd02cc21d31882e3982e8fe2d72959b4eacb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677432481, "uuid": "f37c3550-79c4-48f8-be0f-968bcea770f8", "comment": "Malware payload (Mirai)", "value": "6fded74b5fa2774d367a0dc3f9decc22ce045447da5fa1871c163cebe48a78d1c353c07212a4e25727f45bd4db4363bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677432481, "uuid": "b3ecf303-8ea6-4233-8901-f775747a9df0", "value": "T17E03E1B946040CDFDB0DE074CB651B415F6A5B62E1848D9BB8629FE2CD809FE34DF4A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677432481, "uuid": "2ccf653e-b669-41b4-a736-e06aa14dc2e5", "value": "768:/LFiOZ+phMrso3VabT/pU7CqOHHtwpQ//+/gnHCXhzcM0Jd/nJgGlzDpbuR1Jx:/hi5YsoUT/OGqOHNlPHCxzcBNVJuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677432481, "uuid": "843cba82-2e59-4638-a85f-c90c903d6e93", "value": 40208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677432481, "uuid": "005c89a6-ed81-4d4f-92bf-22969fb00b04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677432481, "uuid": "9cd75894-01a4-408a-bec1-9c790abe2480", "value": "SecuriteInfo.com.ELF.Agent-BQZ.15923.6523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038349f3-b5de-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677420066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677420066, "uuid": "f4de5c01-cb0a-492f-af8c-95968bdebba0", "comment": "Malware payload", "value": "a5536ba111fca5bd41b535d8cfdba593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677420066, "uuid": "961cb9c9-9175-43c4-b049-40d3539d862a", "comment": "Malware payload", "value": "37267f60f9d773982dca65bd3799cacc033b755d39ee6711ab5ddbe99c576cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677420066, "uuid": "d66a7281-25ba-4197-b275-58b20d67bf07", "comment": "Malware payload", "value": "adc11fa08b92d02ab3fb2b5141eedc255206386d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677420066, "uuid": "9c6a9ba2-fa6a-47b4-b669-487e84b60715", "comment": "Malware payload", "value": "e1073ba23b623bbcf19037df1c76af59bff9fbc581df5123161a41177563475535851bb7dda607006f31f42db5af2b3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677420066, "uuid": "dd0ae60b-c792-4986-9f83-f652795097f6", "value": "T13193F734AAECE237DE30C0B2DFA15965F460F57A34029826E583572656379C3B1E933E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677420066, "uuid": "b4cc9742-4704-4d17-ad49-b159b5cb023b", "value": "da2bda8fe160d264332564e8f360d4f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677420066, "uuid": "cfe3738c-2615-4b29-9b1c-b44c38302cd5", "value": "1536:ahUDofByDJWbMGcEFLPEPKOJUsy1+VMA:aIofBHbKMP0PvMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677420066, "uuid": "928fa72c-38f4-466a-83ab-a23bc1653de3", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677420066, "uuid": "234dbaaa-1584-430d-aa46-ff9fe28ae5fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677420066, "uuid": "68425b88-5bff-4c0b-adb9-0913c0907ac0", "value": "a5536ba111fca5bd41b535d8cfdba593.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d51226-b5da-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677418531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418531, "uuid": "fe0aca63-b3d7-4f3c-8668-0ac8362ec0e3", "comment": "Malware payload (RecordBreaker)", "value": "a2bbeba6f74f6dcc72d042967580f6a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418531, "uuid": "388dcd56-6d38-4e2d-acf3-faaada8ddc51", "comment": "Malware payload (RecordBreaker)", "value": "3737407d378b0e4f2d1c68c6290f56511fdaa53afc10b1f14f271b58df88c23d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418531, "uuid": "98326c3e-9455-4ad1-a347-05ce869c8d22", "comment": "Malware payload (RecordBreaker)", "value": "60d061eee8e3d5dc1a67a7739e437c9ffffdcf68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418531, "uuid": "48436303-d89b-489a-8d4b-dc76455c6f89", "comment": "Malware payload (RecordBreaker)", "value": "45e695d39fc32e7e26e5878ea3d524fab1e29bca00d8fb5759631ac4b4a039c32d30dcaae8e754ffdf0cdc2d6fda0f07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418531, "uuid": "bb35596a-edd4-470c-9fda-234d7f3c98d8", "value": "T14166239363391149D1D6CC358527BEE4F3F65A2B9F426A34606ABEC166339E0F203B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418531, "uuid": "dc4efdd7-3cec-4cc4-88ad-0e9d722677bd", "value": "161839a78ef6f07a30d3f07895f6fe23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418531, "uuid": "abd664e5-effd-4ca5-b2ab-c919548da318", "value": "196608:awL+Jc1ORLmMRG71wKSchcM9d7OUNw9Mj0SwuLJl:B41EvSchzzzO9PSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677418531, "uuid": "844b749e-3e6b-4341-aaaa-a10d6f4395be", "value": 6704640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677418531, "uuid": "c122c7fe-1987-44f0-9095-d18b7f6fdff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418531, "uuid": "1e79baa2-3c54-4079-8593-aae412c7ab2e", "value": "a2bbeba6f74f6dcc72d042967580f6a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4476bfe-b5b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677404015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677404015, "uuid": "28d109d7-6397-45a4-a8bd-11ba3f28a336", "comment": "Malware payload (RedLineStealer)", "value": "5136a899db345089e70bf788de6f4209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677404015, "uuid": "1dd2c67e-529c-4b68-9777-61ed7e5d3418", "comment": "Malware payload (RedLineStealer)", "value": "37586dafcc6c040199746a3696e5bdc64701e3afbad58da6612bc134b8f785af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677404015, "uuid": "335de9ce-c2e2-4f76-b52b-cdeced05f673", "comment": "Malware payload (RedLineStealer)", "value": "6a732ab682fbd059341085c0f759e2699661eb9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677404015, "uuid": "bdd3b2ed-867a-44e5-b8d7-dc8ce6a7a5ea", "comment": "Malware payload (RedLineStealer)", "value": "998b56cdc17137c2fd327914a31ca6f65c165540bae9f242de5a4b81197a774a934d5803cee625e4a4b053a23fbff370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677404015, "uuid": "abb482a4-af22-4de4-b8f9-0768d626d47c", "value": "T185B59E7B1F09D738C505FAF958043E9EC922FC98A8C7CABB77D06118AC71BE4911C56A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677404015, "uuid": "7a8dc6fd-cb27-4896-b472-b1c3e2d4fde8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677404015, "uuid": "73f8f70e-ed23-4b37-9658-1066ad4ea628", "value": "24576:NUOqlvdoXOQlhD+iI9z68fwBdHCMiQcN/0TqBpQL79QQlgPRKE+TwqbRUEiV8:NR7hf8z6jzCMib90GB4q0gPRJ+Twq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677404015, "uuid": "9e839195-ebc7-406c-a445-943f892d6f08", "value": 2279424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677404015, "uuid": "cc36a3f2-faf7-4fc0-a731-41383fccf871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677404015, "uuid": "c80d239d-d063-4f34-bae3-a74b19d9515c", "value": "SecuriteInfo.com.Variant.MSILHeracles.50675.13297.8406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc435894-b62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677453930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677453930, "uuid": "9766bb5e-4c82-4b18-8639-5c85e160630d", "comment": "Malware payload (RedLineStealer)", "value": "2a9b7362dc42ee7b1ca537426f846381", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677453930, "uuid": "61067bfa-0423-41a0-9f58-c5c8c07e84cb", "comment": "Malware payload (RedLineStealer)", "value": "38917fa4594d6540b4e94c419e1401ef02226b3b1fd0dceee02f917f59be4ebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677453930, "uuid": "4dab3477-38d9-4687-b2a3-878e2453a2e9", "comment": "Malware payload (RedLineStealer)", "value": "2fac7077b3075c66e4def78623f4a19548d2f403", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677453930, "uuid": "3105fcba-97a2-4fd1-8aeb-9424c39eb85c", "comment": "Malware payload (RedLineStealer)", "value": "d639c81208558506de14ece9af85e30bd4345beb10e394b4a36d57599f0ca58edee813d549e81a45dd697e1f4ac99d41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677453930, "uuid": "05bea596-ce1d-4b2e-ac4e-472c41ba89f8", "value": "T181452307D7E94423D8B8777018F502D30336BA11BB78879F268E9A591C326A9B23577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677453930, "uuid": "a99c91f2-7933-4d79-9c30-db8c585722eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677453930, "uuid": "f478b4a6-94b2-4adc-b36d-1777050786c5", "value": "24576:WyCFPBGgFGfi2MvYln4ZBq+107mINxEW2Rey9EJ4V:lCzxFcMwlnfPHTet9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677453930, "uuid": "6b50a519-2eca-4716-b262-beb509a1b80e", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677453930, "uuid": "048a1a92-80ea-4353-b19f-cad31afc2237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677453930, "uuid": "ae78f92c-6952-4f0e-96ac-f2f3bf9df7f4", "value": "2a9b7362dc42ee7b1ca537426f846381.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0403b3f7-b614-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677443260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443260, "uuid": "76538aa7-0aa0-4a61-b3f4-1c710a081329", "comment": "Malware payload", "value": "36534f7e89bc38ead7dc68cafe407ba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443260, "uuid": "f12166db-db79-466f-9f26-e970503bbcd7", "comment": "Malware payload", "value": "38f6c74c1b3726fab8336c1880ad23f9e25c1faf0b3b1d94d97f005d43d82ffb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443260, "uuid": "3b5c2983-037a-489b-8abf-db52300df4c9", "comment": "Malware payload", "value": "523441db8dc2c37abf68e5267aba192c1b0cec36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443260, "uuid": "c054cdd2-4ea8-4a0f-ae54-7fcb59dd1a60", "comment": "Malware payload", "value": "45cd88d1c5d8b49117df0b3be12809c03fc0d3e5d9ef6286399cb4a74052d29c8977ea90f90694d400773c71ba460465", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443260, "uuid": "a7a08e68-7c6d-416c-955f-4ecff4dceafd", "value": "T1F7A2502179EA506EF2B79FB12FE034C6C9AAF3777529A85F2445030B4E41B54CE42A3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443260, "uuid": "47e6ea72-b9e6-4d2e-9bf2-be0468873c54", "value": "384:5ftV14jYavbQNW4M26VGkcZq8qUazK36JAtkYCZtgCNKMf0lvCfI:d14j/vbQ8vcAbIDBMqMf0lvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677443260, "uuid": "ed307682-aabb-49b9-907f-998c6300c2fb", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677443260, "uuid": "d54c46c3-15f7-4d2a-9385-483d396ac77c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443260, "uuid": "db8cfde5-caa9-4a86-b419-7309d226a89a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06093a2-b5a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1677396331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677396331, "uuid": "f7164f65-bf3a-47b7-adbe-b4c68b938f49", "comment": "Malware payload (CryptBot)", "value": "136ee18e3a3e277569855f984027d9d6", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677396331, "uuid": "f9642c0d-6932-4c53-8f6e-86ec74ab757b", "comment": "Malware payload (CryptBot)", "value": "3bf71e43be44490d76f643f008888c869625625109a94f734bdf268f6222a90a", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677396331, "uuid": "c89f96b1-220a-48f1-afe9-072fa76d96d6", "comment": "Malware payload (CryptBot)", "value": "88a7d02c4803f49abe986a0f862fded6f8a9c685", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677396331, "uuid": "7a19237b-0df8-4641-abf4-f2992490a682", "comment": "Malware payload (CryptBot)", "value": "7704bc41538842a368e3643f635bf4305a165079c31f783786ca55c32aeb3786a0428bb89a58144412f4aece7ad15324", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677396331, "uuid": "a12daa08-7343-40fa-beb0-c82424f54252", "value": "T11A050124FA89B476C15211B38EBD8475622D7BF611BA11DF33C02C2AF9387795631BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677396331, "uuid": "12703424-9bb9-4735-a763-aefa918d2a51", "value": "12288:Um0WRtIHEIrgg/cYexLQwWjsmDbecwgMI0WQGkKIae9OYb3Af4H:pzyE2/neuJDbecwgMI3QWoOYrzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677396331, "uuid": "4ee46ad4-8fd6-4472-86ad-20ce1034000a", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677396331, "uuid": "8154a173-1cd9-4905-a4db-99ef6fd984df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677396331, "uuid": "313232df-904c-4280-8730-38281efdc08e", "value": "136ee18e3a3e277569855f984027d9d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8252d96b-b5e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677424574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424574, "uuid": "dd081beb-0bc4-4fd4-8014-ffdfdb5a8d9c", "comment": "Malware payload (Mirai)", "value": "a2d875fee5913e871280212405354f27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424574, "uuid": "fa930fc1-c65c-45e9-9d25-4d6b5ab41f89", "comment": "Malware payload (Mirai)", "value": "3c0bbb55679cfedbade6d10ffa66001a3824c99a62a21d7f7e9abda38f6c0fbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424574, "uuid": "893ce87e-5c58-4c89-9723-431c174c585c", "comment": "Malware payload (Mirai)", "value": "a9472a884a13d2c98791b1c2cc745ef04f3a1fcd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424574, "uuid": "fc8114ab-de82-458a-b6a6-4d4a06144778", "comment": "Malware payload (Mirai)", "value": "d37ac7f00de61b3437d4371e3a7e3e5905d3658e826be866870ed6f7f2157f66232d1dd4a7a65001f1be11694d2ba05d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424574, "uuid": "685c0765-13a5-4daf-a6db-ab0662266f67", "value": "T1ADA39E34D4AD9DE0D2554530BAF9DD344F12A144A2A33EF79AD68EA500D3AE8F10AFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424574, "uuid": "733cfa24-a0bf-49db-884d-d6a7eeb428f3", "value": "1536:ZkQ0ajzsX+adwtcWNQgnjZgW7BE9IpfkuMqsfs39exOMTLSIlCrCNZb:Zn0dOOwQK1P7BEKfkuQf+oxOMHSIlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677424574, "uuid": "37bac202-9b5c-4a59-861a-95d019751325", "value": 99640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677424574, "uuid": "a70db626-2940-4fb2-a3bb-2ebd858aaa9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424574, "uuid": "c95712f1-4375-485b-b0c0-ff3caf56536e", "value": "a2d875fee5913e871280212405354f27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc58d15a-b5e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677421262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421262, "uuid": "8f397849-2735-4bc9-8f2c-bccfe88040f1", "comment": "Malware payload (Rhadamanthys)", "value": "2f2f10c09855ca792986753cb72dc42b", "object_relation": "md5", "Tag": [ { "name": "2f2f10c09855ca792986753cb72dc42b", "colour": "#FEA06B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421262, "uuid": "494781cd-4041-4704-a1ba-b5f2468c339f", "comment": "Malware payload (Rhadamanthys)", "value": "3d3866b95697251c9113cd722f5fede84a45c80060f2e9cb662caef6e8702977", "object_relation": "sha256", "Tag": [ { "name": "2f2f10c09855ca792986753cb72dc42b", "colour": "#FEA06B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421262, "uuid": "c6895955-e881-4aa8-8792-f7374e627c7d", "comment": "Malware payload (Rhadamanthys)", "value": "726cab49acaa35d368b06899ab96ccffe132be8f", "object_relation": "sha1", "Tag": [ { "name": "2f2f10c09855ca792986753cb72dc42b", "colour": "#FEA06B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421262, "uuid": "4d45e89d-4ab6-42cc-afa2-c0735c951a87", "comment": "Malware payload (Rhadamanthys)", "value": "1ddbb15e7844f8c3b6ea819963a84508fe980ed987691c0e5f89d2b63fde2e87ee2566b0b1700ee8553f43d25a5d5064", "object_relation": "sha3-384", "Tag": [ { "name": "2f2f10c09855ca792986753cb72dc42b", "colour": "#FEA06B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421262, "uuid": "6f15e41f-2967-494b-ab90-555d56910ce7", "value": "T13254CF177F6C81A8E826DDF454B01B626BECD63623AF131B976C0026DDE43E05DE42DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421262, "uuid": "36619d1d-bb0b-4bbf-8b72-d1d8503fd0bd", "value": "34c076e543b95918c5f8b18c85e7fcd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421262, "uuid": "3a5ed3b1-cbb2-4e67-ab00-5a50abc6b105", "value": "6144:vC9CCO+HrcGRovA3JcH8P1mEu0WO01qD9plEXRbzNblVmTI3uv:km+LNRN3JcmffFDqXNNZpuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677421262, "uuid": "0a300bf4-8c11-4286-8fe0-ffc389bb638c", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677421262, "uuid": "64a39ba2-1f10-48d0-a6f2-56ac3f6313dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421262, "uuid": "d48e76e6-d829-4f28-8557-23fd3f26d225", "value": "2f2f10c09855ca792986753cb72dc42b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52171587-b598-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677390133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390133, "uuid": "898d0491-1e9b-47d0-baa8-7bee2481f452", "comment": "Malware payload (Mirai)", "value": "4485dc7807987a3d7e4fcd31ca1186da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390133, "uuid": "720589f5-1318-4adc-8b63-a1ec9613faea", "comment": "Malware payload (Mirai)", "value": "3fb7b030f1bf370bd4e9fd9cff4ac5b6693f81f107f525f246b53ab0c35a4326", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390133, "uuid": "24993111-3aa8-44d3-bd66-ab335294a2fc", "comment": "Malware payload (Mirai)", "value": "c1f4c78d252df178cb44b9472f907794c13cdd13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390133, "uuid": "b8c46a10-0edd-40c3-9440-65a98b988714", "comment": "Malware payload (Mirai)", "value": "238a311523222c3d8694f274586060105ce6c518463341d6bba2c450890eb381b3ecbf91469fa2a9c8e32ce63cf491da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390133, "uuid": "e56a579d-43cf-4f6d-ace0-d80e2d7919f3", "value": "T11B536EC6B4119E7DF5CBE7BE84224D0EB821722150531B27BB6FFD83BD721A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390133, "uuid": "2198d03f-5953-4cb1-bbb7-c9ca2087aa0a", "value": "1536:kPqRg0FGTbSX5xpLepSGorsF7QhOx2X/ZOqc/yA8j:p5VHV8I9cKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677390133, "uuid": "6b3939cc-63af-4dd3-9bd3-eb138f6cd3a1", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677390133, "uuid": "fadb9368-cfb3-4277-9adb-5facb102569c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390133, "uuid": "3b445c92-5ab6-47b5-abcc-96c7e873e128", "value": "4485dc7807987a3d7e4fcd31ca1186da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6efed91-b5e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677423857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423857, "uuid": "a094878c-8b5f-45e3-bb36-0c6000962b60", "comment": "Malware payload (Mirai)", "value": "f9c9a3beb0a8e2bc19095160ecc0b464", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423857, "uuid": "d1c380d6-b057-4fe0-bc23-349fead77278", "comment": "Malware payload (Mirai)", "value": "3fea6d750543a170539b6ec6d2b7de4fd998fdd95586f12168df9fb213868cba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423857, "uuid": "f494b41e-04b6-4c46-8f0c-b7b038d00d68", "comment": "Malware payload (Mirai)", "value": "c4360e3e19a38319882e1ab66bbb112743fd2612", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423857, "uuid": "632f2f24-6efa-406d-9bd7-ee9c22be83c4", "comment": "Malware payload (Mirai)", "value": "cf5f396a5fae84b362af1bf19316f32facfc22312c908a66db6500cc2cbb86019262a25ea1a3ccf8934feb99b3f74259", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423857, "uuid": "3506f123-9498-4afa-b8fd-cea9f4c032d5", "value": "T1EA13E16DE0E6A903CDED5E767AD79F2DC61094C172CBBF3997078C54A8A840F744883A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423857, "uuid": "fab505bc-8b99-418d-82df-c88785b850c4", "value": "768:F6JOJw1Zl9yEJ+mjJDLh7IG9IXtl95PRayJS5MXYWapEcGTQdSidPLe2nXWw:F1AUE3xz6L95PRabWq9cbitL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677423857, "uuid": "14acca53-f305-4d2b-98f0-c17fa4d31f64", "value": 41828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677423857, "uuid": "2c37618b-2333-4c48-bc84-17ab8de1f1a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423857, "uuid": "fb99d2b4-4026-4d68-886c-89946e19f2e5", "value": "f9c9a3beb0a8e2bc19095160ecc0b464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6969a1-b5b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1677403574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677403574, "uuid": "733e8b94-1aad-4b6a-acc2-1ad143cda50b", "comment": "Malware payload (AuroraStealer)", "value": "5253a5a1631e8dfec0d91393656071c8", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677403574, "uuid": "f83cf4ee-07fb-41fe-902a-8ba2ebe33cb7", "comment": "Malware payload (AuroraStealer)", "value": "40a3561b321f01b715274144fb75d79e4d3437cf10dcee86818b9a02f8849d20", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677403574, "uuid": "ff332e8f-0152-40ac-a989-104fa3b711d8", "comment": "Malware payload (AuroraStealer)", "value": "13db3be759b3d1746f08c7e40a64e06b840d5fb9", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677403574, "uuid": "2f78d11c-4e7e-42bf-9019-46fadef2f363", "comment": "Malware payload (AuroraStealer)", "value": "e0cc23c787bdc7d7582416fc14023bfa701ae2d5c259ba5b15436d232fdc505a8aafdff9b0a0a63fbdd2629a6a95212d", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677403574, "uuid": "d9a2f097-a2a7-4c3b-a0a1-009ba36a2f48", "value": "T1CF76AFB9B90428E6E56F427BCD96ACD813713E624F9766CB5064B7C309733E4EE32904", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677403574, "uuid": "07d2d0bc-7657-4dfa-963c-ce3b003e8353", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677403574, "uuid": "e1cf3ea3-d9fe-4fd5-aeb0-a30741f93cc0", "value": "24576:x94s6V9vqyQT0iAw7vyc6CD8aH465hV27+TYF5otaz4ihmfg0dGRX8N1f+2b39Yh:x9h6V9vq/AwryFCJCh1z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677403574, "uuid": "806234ed-1fe8-41af-a772-950f16ed8859", "value": 7808000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677403574, "uuid": "e5425f7e-aed4-4471-b4fe-93219725ce69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677403574, "uuid": "082d931e-b4e0-4922-b6a6-de075df7765d", "value": "innosetup-6.2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf3b455-b5af-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677399947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399947, "uuid": "1b9539b7-652e-45e9-9ee1-2f15247255e8", "comment": "Malware payload (GuLoader)", "value": "9fb914c9a670ac3f2d7b43552c65ad10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399947, "uuid": "26a9778e-e720-4bb0-8eec-d400bd121c15", "comment": "Malware payload (GuLoader)", "value": "412f983cf1fb087d9b21bed966aaf91b7468ed1c9f792fb32e5b0a6e9dbbf0c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399947, "uuid": "e473c017-57c9-47c7-8382-f0c59bf172d6", "comment": "Malware payload (GuLoader)", "value": "29139cf19cdb8a58e23be3d1b55558e323e51a23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399947, "uuid": "1795bfe0-c27b-4a87-bf2d-f6be048cf6ec", "comment": "Malware payload (GuLoader)", "value": "9ff03928c712f6764b5e9875698804f12de6627a550504f2864cbff9adeec5192bb6006635a769ef70b0357a062b6e45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399947, "uuid": "8c3d46b5-ce9e-4887-945f-213aab49b701", "value": "T1B2C4E02372106798FB3A4DF0002B5B8CDA109E1F246EE39E52E8B63957F51D7A73B614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399947, "uuid": "967f3b3f-6390-4750-9716-73b3054cfd90", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399947, "uuid": "a41d3e2b-0fbe-4dc2-ab57-c43c484ad5b9", "value": "12288:a5POYhOuOiSmJPpqYxc6V1qc4hllvZbh9ReJ9ah+xeGSCXQ:oOYzOC8OjV34pZjRG0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677399947, "uuid": "39717460-f1b2-4e54-b383-7eceadb7abd8", "value": 579728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677399947, "uuid": "55729332-6baf-4dff-bb93-5107e4452214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399947, "uuid": "8207f4ad-06ec-4531-aa6f-22e9a8475370", "value": "Quote##-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27788988-b5af-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677399940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399940, "uuid": "ad7d3986-845e-4c52-b518-cf949a981663", "comment": "Malware payload (GuLoader)", "value": "044283cc5bee1d0cdc415a9155061d51", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399940, "uuid": "9d40cf3e-1b34-49bb-abe9-663b8171cafd", "comment": "Malware payload (GuLoader)", "value": "423efe05f8bcafa36531cb05aadd42fa0ac6a171de0fa5b9749755c7c3a13af7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399940, "uuid": "296e8c6c-0352-460e-a2ed-8573e8f6a5bf", "comment": "Malware payload (GuLoader)", "value": "cb4a7579f065201c2a14c36a5dacd9adb1c775fd", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399940, "uuid": "949791b9-53bc-438f-9b13-ef171d933015", "comment": "Malware payload (GuLoader)", "value": "2706f3c189c09321a89d98fa54039540a74180bb39e0697df57d3798a4d704a12f66dd9f19c398254010639773b57c2d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399940, "uuid": "6b15fdbc-fa6e-4eaf-98ec-af0d73596512", "value": "T153B42312F4C568DFA41E8B790A8BFD4CD7AED00B075043265462B09BD748466ABBF8B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399940, "uuid": "84f79bc9-6466-41c7-8fc7-74149317db91", "value": "12288:yxp3qSCuI3+He3MeLKc1FrWKTJLb4LgHgs8An14ctyXX0I1En:yTxCuu+a7ec1pJTJ4kHpn9SXV1En", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677399940, "uuid": "40236274-ae42-424c-811f-300e946de88e", "value": 507587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677399940, "uuid": "85ee9375-1624-4efc-bf71-605936c3aa82", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399940, "uuid": "bbe2ebd6-6760-4583-a210-affa0e20c23b", "value": "Quote##-PDF.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9926b618-b59d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677392400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392400, "uuid": "4f719c54-179c-43fc-979e-3cb528ef1809", "comment": "Malware payload (SnakeKeylogger)", "value": "599268e9749309dce3e1d1af8ba94e2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392400, "uuid": "28f8f9cc-f772-413c-8527-b8a516e20460", "comment": "Malware payload (SnakeKeylogger)", "value": "437514ccd7f38a8b9192a914abac0c49058e13e55b1e1fbc832704e4809712b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392400, "uuid": "b2afb21e-2f09-4d99-8933-d98753d9f445", "comment": "Malware payload (SnakeKeylogger)", "value": "4bc329d734e3ff5ccd88394a40dff28bbba58421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392400, "uuid": "5e5647f9-a011-40fc-8a7a-27a8bb09b045", "comment": "Malware payload (SnakeKeylogger)", "value": "6ae0c1845aade0872555d8c904f154973e93c85bed0e4c2b28ab4bdfbc31ce106244016c11d674cf79d38dc0c58b2b9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392400, "uuid": "f1722f16-af4d-4206-96f1-9b036ff75f07", "value": "T118D3191D6BF88800E6FF8A7305B15112C776BC52192ACE0D5AD2F5192A7D790CE1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392400, "uuid": "8d442148-933a-4a51-ba9c-920ef6a5112a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392400, "uuid": "6237468f-28cd-40d0-bcd9-3e439627bc0e", "value": "3072:dAgAEcCv/IgOYrvQkHxZb8JIudwBZO3FbY:2FyI6tHXbcaOVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677392400, "uuid": "68afa15f-e4ab-4c9d-9297-27c31ade94e7", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677392400, "uuid": "d92ae2ca-40c2-4e68-8ec1-63d44f3bec56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392400, "uuid": "1b2bf25b-4fbf-4ab0-aa15-d1093b1be3bf", "value": "599268e9749309dce3e1d1af8ba94e2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e8d510-b5e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677421221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421221, "uuid": "c8be1704-1ae5-42e9-b281-a1c0b30478f2", "comment": "Malware payload (Mirai)", "value": "56a031e66afdf428886e5df4ad80ca70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421221, "uuid": "027c6c41-9a61-45ac-8095-24b28fb96724", "comment": "Malware payload (Mirai)", "value": "46aaca23aa0ab5d2fa29de1d232eb9026ee55b105240a07c9080337093171d26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421221, "uuid": "e0309f38-2c86-4852-8252-062329754407", "comment": "Malware payload (Mirai)", "value": "1ffca0d6a0b35bce66fa5465b533eebe24ca4380", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421221, "uuid": "91eaf6fa-5ce5-4cb7-a91d-b2ac2fc332de", "comment": "Malware payload (Mirai)", "value": "2a56699a7d75099aa8d1297335c5f8a558d2e30893e75e98fb9a4c09c30e1257678d99144c3027da09ce58783050372d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421221, "uuid": "b2ab16e7-53ff-429c-a559-05421593e262", "value": "T1C0C32B01F8418767C2D327B6A78E438D3B3257B957DB3311AA385DB42FC1B991E395A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421221, "uuid": "44ccb6ec-63ac-493b-b1a4-4fa0f241f646", "value": "3072:pmQJGr3wCJcznRWTu2d9fCZomtNDQFDP6dXL15:O3wCejRWTBmtNDQFDP6dXL15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677421221, "uuid": "61730de2-ae2c-4176-bdab-b90f7061ac69", "value": 119053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677421221, "uuid": "f5e88ead-63c2-4a56-9100-b0ffa3111517", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421221, "uuid": "129de083-f348-4d94-aa5b-57af380e6fdf", "value": "56a031e66afdf428886e5df4ad80ca70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a16883-b5b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677401170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677401170, "uuid": "3c40f533-5054-4d87-a8f7-e5ab0b080181", "comment": "Malware payload (RemcosRAT)", "value": "38108e43c7d71a48590efcefe16b1bd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677401170, "uuid": "9a6352df-d3e5-4b58-b997-c5745374e3a0", "comment": "Malware payload (RemcosRAT)", "value": "46b6798990aefaedd162220d0593c6b22aa72fa3afc71ad4b12d6781793a9e06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677401170, "uuid": "58a37142-5c66-4ab6-8d47-9e4ad8270d7d", "comment": "Malware payload (RemcosRAT)", "value": "da909791913776122d525a46de5b78e935e62d3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677401170, "uuid": "61ce032b-20ef-4fbe-981b-895499eacb6f", "comment": "Malware payload (RemcosRAT)", "value": "9f3fdc9b821c1e45e44b1253c71333d136c5cdd48d7600e217d1655038ae27b0aca24eb67f695d23d26998af933cf428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677401170, "uuid": "4237955b-5224-419c-9787-d82225a46052", "value": "T1400512179E66C196C4150AB7BEFB7F112B1086BA99E7620601CFFCB0674B74A3C095EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677401170, "uuid": "5267ecdd-7faa-4c71-96d1-55fbe82360ba", "value": "12288:K8CXIfnx1jABycx4tufgvhJUq9DTRcI9B8+EZAbVjsqrLx3dwYfGI4P/R:Jf7jU6QfeuqdTRcI9S+hbV4qp3mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677401170, "uuid": "27bf0d59-a728-476f-a362-83ed2d0f7752", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677401170, "uuid": "859bbe9c-67c0-4b18-9f0a-eebcc9d47d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677401170, "uuid": "436141f8-0732-4f64-a694-d2e55bab20f8", "value": "38108e43c7d71a48590efcefe16b1bd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920b34cf-b5dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677419876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677419876, "uuid": "f89121b7-3d98-4ca8-9375-8ee86072a617", "comment": "Malware payload (SnakeKeylogger)", "value": "920c91d79e412b1f62e1caa97c40aeb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677419876, "uuid": "8ea713fc-9a69-497c-ac48-3f34a2b8f0cc", "comment": "Malware payload (SnakeKeylogger)", "value": "46d50bf369a35eeffb327dd2a99455d298afbb66147e4f8e83803bbc8fa01e1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677419876, "uuid": "61cc555c-e727-428c-b43a-b6e081dd3d24", "comment": "Malware payload (SnakeKeylogger)", "value": "2bd3d3d19bfc7b3ef711736ac55e12f888f5e2ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677419876, "uuid": "8bee7213-308b-454d-a101-2fc225718c76", "comment": "Malware payload (SnakeKeylogger)", "value": "e542489cfacb9da430a06ea7390871fa10cf8e9d1b4ec8364135aa8cec653a60ce9a28112986fd02b6f280c7dfcd50b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677419876, "uuid": "2198a57d-a1cc-4c46-9a8e-f49057428339", "value": "T141140B4FA74A4934CEADE3BC54674514CCFEABC56223775FA7328824BE0418CE82E9D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677419876, "uuid": "5ecf1cb1-5c48-4aac-855b-592dcc1d276f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677419876, "uuid": "59aa019d-5878-4731-b85c-fd1717c5d7a8", "value": "3072:rjhkGuTsqa8TnhL2jtmT87AyCXbXjXbnnPNizp7PbXC2+AVavUP2J5vpmf0lG6F6:xk9TBajD7AyCXbXjXbnlipbCHAVavUPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677419876, "uuid": "72802544-f6a6-4b25-986c-3862332a0819", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677419876, "uuid": "20a3ce95-f3cf-4bf7-ada5-3c63d89a3beb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677419876, "uuid": "cbf2337c-4af3-4048-9b94-8e3be10fc39c", "value": "920c91d79e412b1f62e1caa97c40aeb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d938a6-b57d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677378415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378415, "uuid": "20193f13-3ad9-4fe5-93c0-be2dea97cc2f", "comment": "Malware payload (Mirai)", "value": "8da161929194843d1f35f81154dc9297", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378415, "uuid": "228b232b-7457-49ee-a2d7-1523e0a908d0", "comment": "Malware payload (Mirai)", "value": "4839f5c11e5cec7534658c81e2738f285740c3d21ebfa5de38d8a87e132bbc58", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378415, "uuid": "59e15cec-88b5-4857-bf07-b8f602b4c0b1", "comment": "Malware payload (Mirai)", "value": "aed8689c38686a5e794b3a110eb06e1dfa5d8b66", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378415, "uuid": "6340c71d-a1dc-4df9-b2f6-d6cc2f460355", "comment": "Malware payload (Mirai)", "value": "2d0521034f4e964d9b68dad3888a0296d2e39568e6b7de865305dd83551ed0bb5fb4511330148d06e836f3250204b78e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378415, "uuid": "f4b954d1-3648-49ea-bc6f-f92deaf53249", "value": "T1AD834A17B58180FDC09AC034477FB63BD97771BD0238B2AA67D8FE252C16EA11E19C5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378415, "uuid": "e74918bb-7ff2-4479-8bd1-66f20d2ae0cd", "value": "1536:a8uepVCfrxgeHce0xiCKigGYa+Kcybyu8HTQ00RoRVsFJysSU50V:aaVOrxgeHJ6iCKigGT7cE6H00JRVsCsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677378415, "uuid": "9dd52732-53fd-4f24-9862-b5b742822480", "value": 81472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677378415, "uuid": "02c78b6d-88dc-44ad-9d7f-3a31cccecc0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378415, "uuid": "3d36ca69-a52a-4796-aa39-7b7ed504f1b7", "value": "tamkjll.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c511a1b-b58e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677385721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677385721, "uuid": "19503ad0-0c9b-439d-9e10-3b852e7e5e04", "comment": "Malware payload (Mirai)", "value": "6bdf698ab292b2a33f574d797ec8b2bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677385721, "uuid": "8e605bd7-87d0-44ec-9f06-a454d53b7760", "comment": "Malware payload (Mirai)", "value": "48727cef3b85b515b96bde7b434692615920ae4e9363b8f758b0086e3d802761", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677385721, "uuid": "4f8649df-c262-45da-ad92-a641cd584da5", "comment": "Malware payload (Mirai)", "value": "d383d356c21a4cb987f06294b62445e0b3388746", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677385721, "uuid": "7dd7664b-35e1-44a5-9f12-c63ab9900c6a", "comment": "Malware payload (Mirai)", "value": "17208155e644af231ddbb33d21c6925dc849719764ada907b67196bfd94888e1f6b7a3493af35c1555734664f70a2067", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677385721, "uuid": "8c27a33f-1c62-4b97-8d2a-56d76652cc44", "value": "T1E623F1AF910500BBD04EC176876653F0BEF50F6AE162FA16F054A427B942F69788BD83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677385721, "uuid": "9dddb8b9-49b0-4a1b-80ac-53219c7e9137", "value": "768:LXLqTJnftkSmV1G+DbnpCgcC2aVv083wDRIB+aly2FNG7Zb8g3VcCBfJgGlzDpbN:L7qdGHG+DbF5Vb3w2BplPyCuXdVJu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677385721, "uuid": "2fcc175d-84c1-44c7-bfab-4a18d93db802", "value": 46144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677385721, "uuid": "69dcd89f-aca6-4a07-b9a3-a3ef11617979", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677385721, "uuid": "a55b4841-df60-471f-818d-eee98efd57e0", "value": "SecuriteInfo.com.Linux.Siggen.9999.21246.27417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0b78dd-b59f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677393079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393079, "uuid": "73b7fe5d-fd0e-4ef0-ab48-e4d9d6c14d6d", "comment": "Malware payload", "value": "7d2220453a1ebda86b9f9de7986db7df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393079, "uuid": "df408b25-c1b9-4129-b3b8-d965c4bcbd00", "comment": "Malware payload", "value": "48b226bb739aac1a4f9d90b898aeae795dff4a2035ae2805b8a43ba11ddaa667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393079, "uuid": "7c7da506-be32-4e3a-86bb-76d3e700aef7", "comment": "Malware payload", "value": "701af0ba3adf97d676f4520bf7eafcfda2e555bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393079, "uuid": "6ee05758-66d1-40d0-b898-1516c3ece967", "comment": "Malware payload", "value": "b4341eed3ad68bd2afa26e7f21c5f12329b4e30419734553958d6fa70e7dc8c93cdf33c5700a592a5c0697abed7ff7f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393079, "uuid": "605f9c0c-3aee-4a5b-a51d-57dec66019d6", "value": "T11C267B62BF4800D6CC61CF3606B5A7120221FD616967F78F7D697958CEEBDE12E012E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393079, "uuid": "2a500a19-787f-4408-b4fa-636f42a12c06", "value": "be2d56e421d8822f0045d5374eec2349", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393079, "uuid": "1a58a529-9bed-40ed-b6a0-cf3d0096b24d", "value": "98304:sXmf1qVFGaOn7s8zE/7nvueuZOZmPFkCZ1b68:LtqVFVO4D7nAZrkCjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677393079, "uuid": "7323151d-ccec-4710-860e-d8e9dec95a1e", "value": 4620264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677393079, "uuid": "7252e090-b9c4-435d-bada-378fe94daeaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393079, "uuid": "3c96dd35-c47e-40d2-aed6-c18406b907a5", "value": "7d2220453a1ebda86b9f9de7986db7df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99692eec-b624-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677450382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677450382, "uuid": "297e7cd0-8e5b-4bfc-93ba-4dff9a887b54", "comment": "Malware payload", "value": "0dc5ad64da8c340dcddfb69795eb8846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677450382, "uuid": "23da7bca-cffa-47dc-8e97-1732f78df3be", "comment": "Malware payload", "value": "48bdac61ff5095c27a9b2ac84f9b89670cbe8e1745798228aa66217c90f5a908", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677450382, "uuid": "2222df95-ce99-4cdc-a46a-ac310ec70464", "comment": "Malware payload", "value": "f51d181738fdf1519ac4b5d2a13fb081fb9889a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677450382, "uuid": "1fe35b65-a7b0-48e4-8d67-15a1755e5c2f", "comment": "Malware payload", "value": "4e6d1735f16fb278c2f5c865ecc610e1250e509f610d2bb9001301837f7e59542a4e9e10e3bbce6403ffbd5c6293e771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677450382, "uuid": "2c232b44-8278-4ba1-baaf-6035c077eb34", "value": "T1A7452347FBE89021DC702F7028F602D3053A7D566E3C46EF139E696E19B2970B67076A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677450382, "uuid": "42d14c18-8f15-4c9c-862b-9f2f45df12dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677450382, "uuid": "db1de77b-8442-4331-9569-da8b66f9ea4a", "value": "24576:yyDHSpa9fKNLSPj3zWaIjCZ+VLIxKnDPWQdOP48q8T51YYDHxSK:ZDHSpOiNePZV4V0GbWI8T5lHxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677450382, "uuid": "d5596074-c5f3-4ad6-8422-02e1472806f2", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677450382, "uuid": "b5d63572-8fab-4d4a-b226-aac26ae503e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677450382, "uuid": "d76caaf4-32aa-4a8c-89f5-3a6b2cfa9737", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823a8416-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "55048652-3183-456d-a5a9-5d62893bca86", "comment": "Malware payload (Mirai)", "value": "c89184121e1e1cb1c5e6d11bd3d1a2ea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "3f643df6-85ae-4cb1-91f7-45218791f9b2", "comment": "Malware payload (Mirai)", "value": "49585cdc4417890919645538b1adf0818b75dc91b9cadd6585a8f8252ac68849", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "de264fc1-44c4-405c-b361-89663e4f040c", "comment": "Malware payload (Mirai)", "value": "e6204a229323a9bd8c3e4f4b0e85e752746f127a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "fa0951b7-93ab-47e6-9f52-ea820eff2cfa", "comment": "Malware payload (Mirai)", "value": "4e929a033db33f577a7397f20dd360ed6027d68dd44f6b79d4ba24a696d3ba84568d924f9fb29284753e59df62e52b85", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "ed924fec-b3bd-4c14-a979-5b411762ec4e", "value": "T11ED35C46EB408E03C4C61775BAAF41893322A755F3DB73068E186FB43F86B6E4E67106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "0250d95f-4e54-4b13-bf22-7d3c92fb2d0d", "value": "3072:Dq6kTgG9C2rrF959GHAF2rcxWIrlraN3HM/9BKmC:udgGVrF9GHAF2rcgI9aNXM/9BKmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372604, "uuid": "4c6904ae-bae1-4462-8993-5eb950d182d7", "value": 137680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372604, "uuid": "f83e8f1b-1123-423c-97b4-cdb229d06848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "e7f4b02a-7fa7-4545-b80b-04428f6c7c4d", "value": "0xh0roxxnavebusyoo.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbff5fa-b60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677441127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441127, "uuid": "d81d5fea-dbaf-43ca-98cb-7454cdf346d3", "comment": "Malware payload (Mirai)", "value": "7a504c8c2bc13330d53453255c4cb51b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441127, "uuid": "75d940ff-c884-42e6-8b38-23cbaca43c08", "comment": "Malware payload (Mirai)", "value": "4dcc2e1f5c5439661720bf6e8af8da240baf225bcd4690cb6b12591f99035edb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441127, "uuid": "62be6b02-767d-4af1-9455-c66b28c947aa", "comment": "Malware payload (Mirai)", "value": "f55a0697f9d266843a41aa50bf0ffb11ab6b4fa2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441127, "uuid": "1699d5b3-3f66-420a-98d9-b83cbafca375", "comment": "Malware payload (Mirai)", "value": "2067cabcb189e033b5f2231f9d33640a933efba0b9c8ede64ebbc611147d53767ca7fe58357eac39a3424eeeba787a26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441127, "uuid": "0e546ffc-23a4-46a1-8bcc-2138a719fbe7", "value": "T1A623021320E7FD13E421847BD8159C687D044AB9B8DD7B77280112A5CD20A62FEF2ABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441127, "uuid": "02831861-e5ad-4e88-91e0-ae8292d1a131", "value": "768:/K7y1XGO1LCNgukEkvwtqPnH7u83nc0iF2a9q3UELv1Q06pMBwAA3i5h:312O1LCNguovDPH7Tcr0PLtQ/pSAy5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677441127, "uuid": "7e022349-0cea-40e0-a496-d12cf54d821c", "value": 48716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677441127, "uuid": "edfe7c1c-4200-4018-a5b2-a003a1c17be4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441127, "uuid": "82b727ee-e073-4981-a7a0-63af132b3523", "value": "7a504c8c2bc13330d53453255c4cb51b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a6f5ed-b5ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677434377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434377, "uuid": "c955b189-1c12-4c91-b177-0878c348f118", "comment": "Malware payload (Mirai)", "value": "3b29e7004a7550b9aef22ebd1f13ee3b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434377, "uuid": "5c25a355-98d8-4d27-8caa-dcb87e19879f", "comment": "Malware payload (Mirai)", "value": "4dd7335e0fab49c9216aa0a42613f49f8593d9ae88cc33f4153a4f1662c6b646", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434377, "uuid": "24375410-1dc3-4977-b60f-f8f199c5056d", "comment": "Malware payload (Mirai)", "value": "6b8b0c037e5974bb3b7fe972885bb84ab76f6786", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434377, "uuid": "81f66063-c159-4937-b2bc-8038994e7a36", "comment": "Malware payload (Mirai)", "value": "bb8b91e63a8fc5850c0cb01bc062792370fefd5a203034cd880570825e3b8677814592a8b0a9be9fc39050a340caa98b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434377, "uuid": "67baa542-bbd0-4e18-a283-13c79e5fde5a", "value": "T1C353B519BF610FB7EC6BCD3709A81B0538CC644A22A87B367934D468F64B25B59F3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434377, "uuid": "c97a5b67-16e4-4cef-b123-3cd48aacb488", "value": "768:iAVWeSUxEYGMm8sew5BheiTebiQ2ZFVyXiSA7mWzkCw:iAVWxsztwxjTIitZFVbmao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677434377, "uuid": "cca15b65-9b08-4850-a426-b72fd732af6f", "value": 61080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677434377, "uuid": "6a0f665d-22d4-4e8e-8bb4-fd17b12ebbfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434377, "uuid": "426de718-95dc-4f27-a877-8caf088bf578", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df338d3-b630-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677455544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677455544, "uuid": "ff44c71b-1e2e-42a5-912e-b0c18e9c85b7", "comment": "Malware payload", "value": "d2b39b0d5a0ed89873f1cdce0981318f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677455544, "uuid": "7c236186-debf-4d0e-a332-caf2a3ebfdbc", "comment": "Malware payload", "value": "4dd78c8a57093c3e3dbbb618616213c0ffc7640383d9d032e0108681d3f72c62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677455544, "uuid": "dbf5982a-9466-4ad5-8c00-479c48d8f884", "comment": "Malware payload", "value": "e3fbdda2287aa7751dec5c0ec7d0fcaf0e2e79e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677455544, "uuid": "7f73cccf-8608-4c89-8ce7-912c6b7518b0", "comment": "Malware payload", "value": "7a11375e9686f037df8ecd3f395f7bd6fdaf59432772540163e2378a95ff4581b6430be340bf18cd28065c63f8a67180", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677455544, "uuid": "693bb0fb-d441-4386-9f24-19a6b02ddf82", "value": "T146452217A6F84071D8A457B169F602C31975FE616A388A8722CBAC5E0CB32F4D73573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677455544, "uuid": "f7467927-10a8-455f-b2ec-28817e3c7c7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677455544, "uuid": "7591f171-16be-4312-bf1b-2e85c4ff6c15", "value": "24576:9y0F2iUjZZUtWzXrwlgP9edr1dcZ2xu2D+yigY:YG2ieZGWfkgP9qhdcm9ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677455544, "uuid": "cb28e4c8-f211-4531-a355-c7beb1ffbef4", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677455544, "uuid": "fd088b0c-7fa6-4793-a4ed-ed01046bb432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677455544, "uuid": "ba884021-3885-4bf1-a5e9-489e479d1519", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0116a480-b5a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677394292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394292, "uuid": "c6fbcd66-ffc0-4d41-a7ac-658f80b9c3bd", "comment": "Malware payload (Rhadamanthys)", "value": "e276ebcede82c5a87a523bc8a4b82278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394292, "uuid": "81ced3da-bf60-4c63-9d84-9f0f3bd46909", "comment": "Malware payload (Rhadamanthys)", "value": "4dd87e6f402d5f12af04639c2f79a5b64b6a01b6a2e573c81c8846704113ddaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394292, "uuid": "9cfa22d2-747d-4355-b158-1a52e646cd24", "comment": "Malware payload (Rhadamanthys)", "value": "70a515d45cd8cd4721e32add4ee53f6153c0bba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394292, "uuid": "7ea80456-3389-46b0-a945-2bde690a6eaf", "comment": "Malware payload (Rhadamanthys)", "value": "d6c7b496a603051dc0b06298877aa8c1b6b6412c7c24cef3ed83a66c911da5bbc1e4736d248d16a8089d5bcd69dc2e35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394292, "uuid": "bc4a4662-4ed3-406e-8277-8f9c5448a6b3", "value": "T17C54D01176A0D031D5A645F55934DBE86A7BFCF26A25884B33643FEF3E303D21AA6312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394292, "uuid": "b7ed4055-a679-4756-8143-8396db88cb15", "value": "9876fb6c6727cbfad64dcef15fc811f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394292, "uuid": "69d3d00c-33c1-4b93-b031-2fb5f542e477", "value": "6144:hZLn11XekEzqaAIcBmtVwezJ3w2+JujhKL:hZb/FBvotmsw97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677394292, "uuid": "7b9908a6-e37a-4238-a907-163378532228", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677394292, "uuid": "8abfd6bd-1e0b-49c4-9866-469f342be774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394292, "uuid": "adfd4620-3aab-41fb-b27a-328692641b29", "value": "e276ebcede82c5a87a523bc8a4b82278.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ec3338-b603-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677436337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436337, "uuid": "c23d1932-2737-44fb-8174-eacd54188d99", "comment": "Malware payload (Smoke Loader)", "value": "ebf7b56cdcab92336e6f4ca49c7aeb0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436337, "uuid": "0e16836e-fcf3-4fdc-9852-4459ac6be6b0", "comment": "Malware payload (Smoke Loader)", "value": "51f2e989a2b72b33cd952e90f1160b343295d5321609f97716f5be0ced84e470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436337, "uuid": "913e32dc-3eb8-4d22-b802-4a08ce72ddac", "comment": "Malware payload (Smoke Loader)", "value": "620fe172a102c32f6a59712b85538ddaafdce9a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436337, "uuid": "7d6d86b9-b0fd-4179-a9fd-d943d25ed066", "comment": "Malware payload (Smoke Loader)", "value": "162a357e0f774373c85eb277f07fc29c41e2c5461ce489ad0419a48a5f9797a2ec5ef5640206b25fa775b31ef8dec576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436337, "uuid": "e5d89792-0418-471e-9018-216480cb4691", "value": "T1FE54D010B540C472C45705B09838EAE92F3A7C71577E89BB37283B6F6D732E16B63266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436337, "uuid": "a221be1c-924b-4662-97e9-bd2adce296aa", "value": "61552f371d50dd7cc1d63f5028ea0b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436337, "uuid": "225d0548-6aac-45dc-9cb0-0f1045e34556", "value": "3072:3uvSlLNaxqF5LLHGtLZcLMGYPWbF02uJDg22WZuq4m8Zrb:eKLkx+GtLZ9UK2u9gFyr4fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677436337, "uuid": "a36ede71-6529-4d2b-8dbb-d7e785beed38", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677436337, "uuid": "6e0e7f22-b18b-4450-a992-406dded3bfe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436337, "uuid": "e1533b3f-cafb-488a-bd83-8da698593014", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c6ad35-b5b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677400420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400420, "uuid": "007b69d4-6878-47c0-9567-6e423e893904", "comment": "Malware payload", "value": "41b7d45010f372eb3a14cf6514561f9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400420, "uuid": "3b130e88-295a-4926-9f02-351316c89bb0", "comment": "Malware payload", "value": "51f61faae3c5d24fa016008ef9902a6b08945acfdee0e411942d79f6a115a5c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400420, "uuid": "490e2d53-8131-4a19-b40b-7825b4cbf815", "comment": "Malware payload", "value": "ed3be0895836d8cc42aa31ab901d1e82ca703d3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400420, "uuid": "9382cb65-41d7-4870-8ce9-1622504ba0d2", "comment": "Malware payload", "value": "fd088dac1aea5932e12c544ccf3fa4f81b94e1ae21deb28189b2b36c2e820ca7d52efacd15280604050649438beb7b46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400420, "uuid": "8b2d360d-74ca-41bf-8d45-e60d0f3f89e1", "value": "T186B38D1AE6CB81F3D04507302C5E96B7E13EFB512B6061D7E38E2D293CB55A2B5181B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400420, "uuid": "e10f2c6e-a80c-4d87-aca7-34cd4b282401", "value": "1536:47A8NSNEQab6YJgrg9U142bZtX1zWOafxCP/sFWgg:47AAm26YJZ9UjbZx1GfxCs8gg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677400420, "uuid": "30287c0a-72d1-479f-bb5c-5763dda4a62f", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677400420, "uuid": "e9cca859-70ee-4773-8bdb-5edbbe7ef057", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400420, "uuid": "2ce234b7-cf1f-4201-aa80-9abcbb8b831b", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.17783.25000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b99e830-b5ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677399222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399222, "uuid": "b558fc18-e34f-4675-9307-98dbfd80ee67", "comment": "Malware payload (AgentTesla)", "value": "3c655fe7fe775567f9b964010faf5b9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399222, "uuid": "f4e59b68-37bc-4a60-a05b-ac308b8ca539", "comment": "Malware payload (AgentTesla)", "value": "5270b5aa8be46c12f009d5f2628a0c5ff00dec22a7ca0d2d35542094fcf95348", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399222, "uuid": "1e77e128-9ef6-4b4a-9f2f-c53920132f90", "comment": "Malware payload (AgentTesla)", "value": "6108592d41c5b64499fbd6cebeeba0ddc792ead3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399222, "uuid": "7b6e3692-92c3-4c83-b89b-70b7e6bf13d3", "comment": "Malware payload (AgentTesla)", "value": "382b88ac8b68f69014c7ce88ec8a8378dc118d8e8f3241b6ecd7a072bd70d83fbf46e09d31343787480520a3e3e7913a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399222, "uuid": "03bfcfc8-6031-45a4-9f65-6dab1339b4f2", "value": "T112E433068249A2326EDECC49F253542376168B33F644247797B326DEADAFA011377F0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399222, "uuid": "54892864-7e67-4f6d-a390-6c72ec5aa1c8", "value": "12288:JbNXxqlBMHG8gAD4/+TxT7Dfzdvh466RjX1LiAJ1EPV0WdzBhG:J/qH8gAD4/oTXzdJ4LRjTEPhdzjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677399222, "uuid": "ad954a8a-b750-4d2a-9b68-821d62226995", "value": 679484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677399222, "uuid": "a0dbff2c-21bb-4aae-87b1-b9667a626f1b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399222, "uuid": "a65cda3d-8dd9-487b-89f5-0bb3d79b84b2", "value": "Bank Slip.pdf.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82007092-b5ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677398374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398374, "uuid": "02bba059-a57b-4bfb-a5ad-69a557e5937d", "comment": "Malware payload (Mirai)", "value": "f8e29c6a030680071f12c15ecdff7517", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398374, "uuid": "8c81c44f-b836-405d-934a-cae7f174f820", "comment": "Malware payload (Mirai)", "value": "53111d3b7022aa54a88730ab5a7f331a558cb12ea2335a1a2f628e6f0b7f0630", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398374, "uuid": "75f7bde8-774c-4348-83c1-3756a54b3813", "comment": "Malware payload (Mirai)", "value": "6fed5f99a6b3ce62f8029960911f099fc91c8c92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398374, "uuid": "73a297b3-7cda-425b-87e2-f6e88b369953", "comment": "Malware payload (Mirai)", "value": "6c7cbf519442645117704e31780f489a474bcb93b42ee8015dd9a5f3f25fca10d3fad37a573e82f1d73e2d0375deed9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398374, "uuid": "1a0a601e-eac1-4740-819d-f1ff8b79986e", "value": "T111334AC5958BECF5EC150635307BAB338B72E83B1129E987D39CA933E852A52D10728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398374, "uuid": "d859d797-d8b9-4e96-b838-40a5c841d10e", "value": "1536:HD0hOohiwIeufq7/p1jGHdkzHaISgc7r:HD4fhiwIe2Wfjk+zaJtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677398374, "uuid": "de763afb-5103-4ca9-be14-59e37ea71f09", "value": 54428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677398374, "uuid": "8b04d2ac-cd5b-494c-a580-aa66f2773010", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398374, "uuid": "7522e385-b98d-4b86-a554-e4cae158ef4b", "value": "f8e29c6a030680071f12c15ecdff7517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87869830-b601-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1677435320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435320, "uuid": "ccf97361-7173-4619-bdf9-44233bd24d36", "comment": "Malware payload (CryptBot)", "value": "6211375945c96fe6125d1574ad6ed320", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435320, "uuid": "3735ddda-0116-4635-9da1-d282216ac8f2", "comment": "Malware payload (CryptBot)", "value": "533d169364edf867fafa28fb948a564c032312794a5dc01f27464be65892775b", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435320, "uuid": "df872455-8acc-4962-a477-f3ef537e3ea5", "comment": "Malware payload (CryptBot)", "value": "08cb3937bcadf457a85ebf16663d4306d6e36019", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435320, "uuid": "14214f8d-a00b-4f98-912e-cec40a6cd30d", "comment": "Malware payload (CryptBot)", "value": "4e9b1a24e492017bab14c8383bc8778a599fbc6aeccf207e8163f0cd4cf913b3b821e5e1118291b9f750e98bfd616408", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435320, "uuid": "a7364bea-0d3e-419b-9e1f-8b12d75a9b7e", "value": "T1360501B1F05290B6E1A12072C31ED83B9578799344B2745B33E43DEAEE7D442E32B796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435320, "uuid": "f449150e-23a9-439b-94fe-c4773c9f0727", "value": "12288:UZqfR92g0kDvF1Kz6u61LLuFY4BCP7zLNhX6PzOE2F/MQGtPoc0KD2KfXYH:mARQqrCz6v1/uFfGtN6sF/UzRPYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677435320, "uuid": "1c7595f2-4841-49c9-a97e-5d07598bcbd0", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677435320, "uuid": "8e560916-21ab-498d-ad9f-e81923a64ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435320, "uuid": "1c2114ce-1c33-4afb-9a81-9938ec3f176c", "value": "6211375945c96fe6125d1574ad6ed320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b5acc3-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "1b40e9e6-2145-4eb7-b7da-276d9e4ed47f", "comment": "Malware payload (Mirai)", "value": "6fc317304413f2e9049bfd3b430a6d96", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "b4b2831c-31d4-4c33-a445-7495b224f8f7", "comment": "Malware payload (Mirai)", "value": "534d05a463f8aefc2cdcd597c8b6ae0983e5faa889fb2b3b71115c3475e224d9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "2b9ae448-4428-446f-8675-592b8a665bba", "comment": "Malware payload (Mirai)", "value": "b3084404748684364cf1477f0150bda9523f6524", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "042aa45f-6293-4f3c-9432-048dd3653864", "comment": "Malware payload (Mirai)", "value": "3fc493ea205a1c1ab36cd213a3b5c61448bdf6929041b36d8668970a9eba0401cd031f4d95cad209c979ec397943a258", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "5ac30ed9-09b4-4dc0-940b-bdef186228e2", "value": "T1F043F115F238AC604A71017CD6140913F71A83FA812F2BBB05510A369983F93AEFEB4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "6c2746af-0b29-474d-ad45-89675d3bedc1", "value": "1536:ooGm8GfLvpNnohxAW4zqLNyLz6ErwhNr+Q0X:oo8GfLhleSWfLNyv6E0hNqQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372607, "uuid": "d8761faf-6390-4d4a-a4ee-3d08f548e4b4", "value": 60332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372607, "uuid": "92b8750f-ccde-41de-b8bb-3fbd40b19f39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "98131a23-c7ef-403c-9f81-d0912712be60", "value": "hotnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d153c069-b58a-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1677384334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677384334, "uuid": "c5d7a481-853a-4974-a3fa-d3df3819abcd", "comment": "Malware payload (LaplasClipper)", "value": "6cf802202c529d7286a9f984c3da9f99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677384334, "uuid": "493f227c-ad84-45a9-8ecf-fb0f50d603ae", "comment": "Malware payload (LaplasClipper)", "value": "5404896b9d9e97b7c66c140ce2372ca9dadcc57879f809fbc0bcb3b39454044e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677384334, "uuid": "52b59f37-f869-4ba3-b152-1fa990d7b45f", "comment": "Malware payload (LaplasClipper)", "value": "fd7d93577a09e9dad272cda298973a5ee13bee06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677384334, "uuid": "fe0af8b2-d024-453d-a97f-9901e279e898", "comment": "Malware payload (LaplasClipper)", "value": "d0a5f7b58516bd1be1119f2a8e53670ea4d388b9f8df7a22cb0dde7bc7754767f3cd61f3261bf70b539cdd9740d9f647", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677384334, "uuid": "b9cad012-b38e-4cef-a176-88cd781cb2be", "value": "T164C6F0713E3BA0DFF18AD4749405CE339D161EE1462CE14EF8E96C7BB5C2A422186A7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677384334, "uuid": "c2c197b3-aa3f-4706-ab88-6d6efb8c58d2", "value": "6a415b91bd5ae308e37cb01df4159c05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677384334, "uuid": "de215e06-b401-4b64-86d3-38097d6933b6", "value": "196608:HQ2Sp/T3oRK6x5IhFzLlY90n0j3fyiMe0QK+O33GjULZB:HQJFT3oRK6xKrLli0n0j6iJLHeZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677384334, "uuid": "4a87ca17-d0f9-40d5-96df-9888a6be7ba9", "value": 12308480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677384334, "uuid": "e208975d-4b2e-4b0f-ae11-4953e5091b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677384334, "uuid": "35176b8c-05b6-4429-b11e-f2294e38567f", "value": "6cf802202c529d7286a9f984c3da9f99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4575d6-b60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677441153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441153, "uuid": "f5bfeb56-e53f-4617-be8f-6b33a5059e66", "comment": "Malware payload (Mirai)", "value": "5d18ba88a8570d2100c94a95c4008c53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441153, "uuid": "994f6987-8ac3-4782-ad0a-3376e1bd03c9", "comment": "Malware payload (Mirai)", "value": "545bf699065400ede022e7b420b8682b8ce3d8c22f0519bb0db380b9b83dbc15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441153, "uuid": "9df56fda-108b-4cc8-bedd-b4147f0c44f4", "comment": "Malware payload (Mirai)", "value": "ba6ec668ac929c92eac16c312d2f0057dd05bce9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441153, "uuid": "1059cc5c-b5d8-409d-97aa-ab11a57b03f4", "comment": "Malware payload (Mirai)", "value": "15ae2594ac2663a1fd84385692278d819d5dc87ddffc4722c8795e8aed6dab47c4b91a65ecf0cdf3509f44d91048831f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441153, "uuid": "e835a27a-54d8-4d98-abf9-0b7581aeeb4b", "value": "T149C2D07DE8A4BD47C9ED083848DD13B80C9D79C6B68D4F5D92261DC4BB2018B3C9E4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441153, "uuid": "1f8f89cb-4587-4347-9946-c6ec579ecb81", "value": "384:PmWuv+78AdGa2nS3xbjJUFbviosPlozhfbIAawprR9gICSk3kImQ0KnEzrEcftwo:P7ddenS3j6Koolozxfk5JmsEzrttSWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677441153, "uuid": "a5be4fdc-cccc-480f-a547-7c892281850e", "value": 27252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677441153, "uuid": "e8a2b1cf-5680-4f0f-b07e-47e690fa4950", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441153, "uuid": "1b9883ab-f7b4-49e7-b4a5-a1650211581f", "value": "5d18ba88a8570d2100c94a95c4008c53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea85c026-b5a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1677395113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395113, "uuid": "4c0b416b-f9a5-4af4-971b-a4cb33c8893e", "comment": "Malware payload (CoinMiner)", "value": "da92e640a7bd2daebb753d4e1d40371f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395113, "uuid": "54830cbb-23e7-4a8a-ad7b-0c40b4cb72b6", "comment": "Malware payload (CoinMiner)", "value": "549782257054f613f63d5ec1d0e1b69398f19c00a83765f923b0cce0cf599cc9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395113, "uuid": "5f293e51-c292-4037-85d4-dba78f267a08", "comment": "Malware payload (CoinMiner)", "value": "a960a3a88bfcd6bdd20458db3f284af02b960633", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395113, "uuid": "97f4fe02-2b62-45c1-97c8-dcf5bacd0d2a", "comment": "Malware payload (CoinMiner)", "value": "daa5eeb2e0e593ae621479fdb23d8b0f99625239e5d32a77b812fb298f0ec10307c922bcf656b2487824f8c59298f7ae", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395113, "uuid": "38fb2330-2aab-4683-a6e0-43f9622ee7a8", "value": "T12024E110B693D431CC5A45F04824D6F8697AFC619AA8898F32187FAF2D333D167BA3D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395113, "uuid": "ac1ace18-0bbf-40be-842f-0d8f10b7085d", "value": "4453019f24fbdf41dd3a4f06fe73134e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395113, "uuid": "b16eb180-e745-4513-acb5-5abca08db450", "value": "3072:8ySfLIhF1b50f3gAbEyJBPpK6xdQb2pzvyZsetiu6K8yTb:BuLgF103gxag6xdQbizvyZsyir0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677395113, "uuid": "9ab9598a-8067-4a43-ba3b-a950994cad19", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677395113, "uuid": "6e15035e-672f-4e87-ac4a-72795631cd6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395113, "uuid": "176ea2e8-92b7-4045-bb25-131e60c2338e", "value": "da92e640a7bd2daebb753d4e1d40371f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822570e6-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "a785eef7-0fe4-430e-8d46-a6c92efab6ac", "comment": "Malware payload (Mirai)", "value": "b7f94e5dcd3fa5f3b3b113d049b7986a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "7da2aa1c-c0d2-4d62-a47e-162035df7dc5", "comment": "Malware payload (Mirai)", "value": "54ed625b21ca37bcfd99b4031324e008a70a8267bf142194b4394ce9c1ac8c57", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "b703d642-f574-4589-855a-5d8621f66ae7", "comment": "Malware payload (Mirai)", "value": "e919015b3ba9baf85ea036ca43ccdbfb94c4e103", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "565ae3b9-5883-44d2-838f-294a68d5597e", "comment": "Malware payload (Mirai)", "value": "7b9a6980a97a2e51188e27e636b8ced725cbc83ba285a0d91625b3b70cf73b84c58fffa2da112080a2ccfcef70998703", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "f4b9a6c0-8e14-4987-a681-e32a85873d33", "value": "T17FE34C86FA408A13C4C51B76FAAF41493322EB55E3DB73068D185FF43F86A5E4E27606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "37428685-a820-4ae7-a46c-779e6a842754", "value": "3072:MR7vnRe36oeQDbr8ofYqNgMjJJt8ourcoMUsh8asXGM/9pW6l:qle3xDbrVgKt8ourcJU/as2M/906l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372604, "uuid": "708141c6-75c6-477b-a2f2-e5d2bb5e2bbc", "value": 152500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372604, "uuid": "5c90dc8a-01a6-4302-976f-1c6cd1c6fb9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "6cbc7642-a805-4a9c-b464-cc55a2ce2acd", "value": "KKveTTgaAAsecNNaaaa.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc08a698-b5cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677412242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412242, "uuid": "aa5cf9b2-9c55-44b9-a12e-08cddea4f0c7", "comment": "Malware payload (RedLineStealer)", "value": "441d38b5e2d7f2ebd865068412ff504c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412242, "uuid": "4aba3946-5967-40b1-a506-75e683954c59", "comment": "Malware payload (RedLineStealer)", "value": "562264deaedced518c2b6da95b5504159f0f30332bab03fa934545a0c45ebc6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412242, "uuid": "92ad7d93-2cfd-4f22-8eb4-a2469b2d2e4c", "comment": "Malware payload (RedLineStealer)", "value": "5560f6c900b953e6bcfcff43a8000300610cc135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412242, "uuid": "966ce3f3-a612-4a2d-ae13-edc8dbcdcb2f", "comment": "Malware payload (RedLineStealer)", "value": "e271b6a04e4243e649800a131ce0876ee4b2c61685a6da3aec5fb0e8328afbd26038927d2f74c9a78853c7f0d610b75b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412242, "uuid": "9f84b913-2ec6-4d30-be50-499c7eb922ca", "value": "T194352307F6FD8032D8A957701AF707D324367D725778839B624E5C1E2863A64B9323AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412242, "uuid": "848b709b-f2be-4454-a70b-36a88225386f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412242, "uuid": "dda930c3-a2f8-4623-96a3-2a105553cc55", "value": "24576:cyX4MVSFe1H7TIfezHfXLY8BbBVBwSvCwH5MuMBLU:LXFQFk7TIGXLxBVeU5Do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677412242, "uuid": "3d325d15-d28e-48b7-9885-8c5565d8ff45", "value": 1151488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677412242, "uuid": "4997be11-9e91-456f-8e86-9ef0d582c9c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412242, "uuid": "50723b63-33a6-487e-8366-9abf7783924c", "value": "441d38b5e2d7f2ebd865068412ff504c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0244d3-b5f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677429772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429772, "uuid": "a9d42587-2fa8-4c23-a36a-9313cb3bcefa", "comment": "Malware payload (Mirai)", "value": "d62d9b035284744a386919614cee0280", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429772, "uuid": "58c83479-c4e0-4e3e-b509-8fd54298d028", "comment": "Malware payload (Mirai)", "value": "56d1406eda7416008281ff1b38100661d08c851f4e4162d9b03e5b49e36fe045", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429772, "uuid": "8056f5fa-00d3-4549-9e2c-b0365a0b51b8", "comment": "Malware payload (Mirai)", "value": "a9afdff9808909bf3dbb5bb574e060dff6fabaae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429772, "uuid": "251c87ff-a5b0-4235-80c0-d3276d35543d", "comment": "Malware payload (Mirai)", "value": "a74c9fe473e1eaa13c7b792e06b71f4407290bd23b0460e36f779e1dfe7ef8526a988be9d60beda66c7eb7124cd02bb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429772, "uuid": "e6347216-677c-40b0-a04c-d88c976cbcd7", "value": "T151534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979996B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429772, "uuid": "e4ec6e76-edaf-4b87-9ff4-2d35b90298e8", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG9UmtTy5EMcs/J9iSzEv2xRgN0L6FV+tg6wW1:+5HAdOmGyZtTAdHiSgOxRgN+e+aTWGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677429772, "uuid": "7b7460e8-2e55-4d7d-a423-c9b66b8a5e11", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677429772, "uuid": "9eee54c7-167d-4c30-b991-808bee319907", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429772, "uuid": "d6bc6a88-ea85-406c-a12d-573004916411", "value": "d62d9b035284744a386919614cee0280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17edd49d-b5d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677415805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415805, "uuid": "f3de8720-e5fb-4d8f-9c12-0cd8cb7baa1d", "comment": "Malware payload (Mirai)", "value": "eb1d1d080eaad975860217c440f1551f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415805, "uuid": "4a502e3d-d524-4ba6-96de-1ca14034da7f", "comment": "Malware payload (Mirai)", "value": "575fa80267e2f3642e90a1aa08631a837368d536242292ab216d18a2ac6eb80a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415805, "uuid": "ef970997-44eb-48f5-93c4-028a418c4870", "comment": "Malware payload (Mirai)", "value": "533cc952c380428adbc924a5a1f31c262350f344", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415805, "uuid": "05634ac7-e68b-448f-a39e-c5a643f74074", "comment": "Malware payload (Mirai)", "value": "1ade6e192638f896fd83430b0c990fda1ec2eb210a68fa9c7d9abc55154cdd68ae58314a17d8aaf854fbed508ab79881", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415805, "uuid": "58dabb8c-b8ee-4cac-86e1-5e1fca8137f9", "value": "T1EB335CC5F543DBB5D84204703072EF339E3AE6FA215DDA87D3E9A532AC53502A50BA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415805, "uuid": "4a18dcd1-2d2e-43cb-a266-ea2ee2b6db2c", "value": "768:ytYRSjaQ9DaZ/oJlExakbMqu8iMlkvKy+h9lCTm/4RsvKQLDJIgMjz:WYRSjaCu1wlPElly+hPCq/4G3LNIgMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677415805, "uuid": "57d56448-e1ec-4e94-bf17-50c155b43f85", "value": 51380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677415805, "uuid": "ffa92fcb-ecb2-47e8-ae1f-808c9b0a3374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415805, "uuid": "ddd8a55a-7d91-4c2f-9571-5574b4fb87a3", "value": "botx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5ae10f-b60a-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1677438977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438977, "uuid": "ea459347-33ee-4a0c-8619-6948db430c13", "comment": "Malware payload (LummaStealer)", "value": "62dbb62630d4c7d4b2e28fd4b4fc298f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438977, "uuid": "d671b884-f0cf-4ff2-b38e-98b4a2a30eee", "comment": "Malware payload (LummaStealer)", "value": "576e98766117e08407bef39fe4e8eaa08b69c2f6f8499ed8ea6dd8568e4f0015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438977, "uuid": "d7126d8c-3a88-4ce0-ab0b-c9b6a7e529ea", "comment": "Malware payload (LummaStealer)", "value": "d6f6f9ba4a94e83e94bb9353452fde6a100c7039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438977, "uuid": "5a6f760d-521c-41b3-a173-e170f6ba0a59", "comment": "Malware payload (LummaStealer)", "value": "c7438ce760ba9b49e5135b23f488e27efa3466174f6abbd6669a575af510f41e89ab4fe219d59b396ed3f7f73bd6b775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438977, "uuid": "6e7ff0e6-103c-4adf-bfab-9ea9342d52a6", "value": "T14044F101B891D070D44F46308824DAF83BBAFC615A65899B76F87B6F2E703D177793A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438977, "uuid": "22c39060-c8e2-4f57-a306-6af118400ed7", "value": "8119127351e3b87a6bff2fbdc0425751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438977, "uuid": "7d3b5973-284c-47e1-9403-6f6aa90eda4d", "value": "3072:3RI2SLThJrTF0SS1ym20WaNEWKpEk8o1QesUj9iJzSQmKjdftzXpX7:hcLFJrN9aNXm58o7sMcJuQB5VzZX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677438977, "uuid": "5a286915-02b7-4820-bf18-62159d4f8531", "value": 263680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677438977, "uuid": "48ebe298-f12e-4814-b076-11f776067e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438977, "uuid": "8221e3e0-66c6-4129-b11d-7d101b10666f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13896a7a-b5da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677418375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418375, "uuid": "8908d072-bcdb-4b90-95ce-d5b85666ac05", "comment": "Malware payload (Mirai)", "value": "27b617f6dbf1fed0f25d656be162fef7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418375, "uuid": "d8d7c06f-5e09-4a87-bade-bbf3d9fe6760", "comment": "Malware payload (Mirai)", "value": "577944dd88c2f1db64a8922534daf4a612d0df9b92b7ab6d632a58a474618771", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418375, "uuid": "8ef2039d-f612-4da3-b4d7-133b9738b578", "comment": "Malware payload (Mirai)", "value": "2bbb8d6783b99a577eb1752db6d40ebc5eb9a351", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418375, "uuid": "0199cfaf-4b30-4698-97ca-2495f23a9e82", "comment": "Malware payload (Mirai)", "value": "2147e6ab69c614e0cd507321f19555d67a8ab09cc7697373daa48f626424d9410b057b4d904d9c811e2f6c4ce1cf42c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418375, "uuid": "598a37fd-8823-429a-a1b5-7b58c65c3c25", "value": "T153338EB5E42A5E90C15602746428DF345F23A6C4E3836EF607A5C3E24457BAD7A0EFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418375, "uuid": "f61e7a56-3ea9-469b-9c59-de756761aba2", "value": "1536:9ak4Fo5dNwX4EupnVIK5FkCCS0ob+10m+:9r4mRk0nVIK5FkCFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677418375, "uuid": "5a3b193a-11d9-46e8-9380-a1321317c15a", "value": 51588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677418375, "uuid": "d0554c63-4428-4432-bb56-2374c6fb5564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418375, "uuid": "b35b4040-d4d8-4b2d-803f-c970da0d0670", "value": "27b617f6dbf1fed0f25d656be162fef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb9b4b9-b5d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677417155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677417155, "uuid": "e9d87d34-2b54-479d-b3ef-caa222b68e9a", "comment": "Malware payload (Rhadamanthys)", "value": "3273b0729ac7535b4d54ae753d8522e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677417155, "uuid": "62ecaa4b-6797-4b9b-ab1f-9b0efc428074", "comment": "Malware payload (Rhadamanthys)", "value": "5938cbd607fa237f9235646483971665a6f8dbf2d47d4e59556c0b7b2788f6ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677417155, "uuid": "52ed05ed-f6c8-4f6c-9209-38e40f8f123e", "comment": "Malware payload (Rhadamanthys)", "value": "1dca9eadb8551e3345cf5b252882ca4ed5addbc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677417155, "uuid": "f031da3f-9681-4948-a635-4b8f06390d30", "comment": "Malware payload (Rhadamanthys)", "value": "b05965fc2605ae12b81b1b63b24eab1836edee41ee9497d7ccd2aaf56bfa4053d3e2be5607e27bbb29dd676500d6ae8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677417155, "uuid": "35e2bc2b-9b4f-41ed-943e-8cb4d31a49bb", "value": "T1E4028B116DE710DAF237077057DAF6FB0A65F5B5652EA1F831019A488B30AC4CC71E71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677417155, "uuid": "43de4059-b4ba-4890-a105-6a17d5be7b05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677417155, "uuid": "683454ba-d2b6-4105-bf00-7ad8bc8ca157", "value": "192:j92z8jWEYqLDF1bhxXGjcJr9emxan6yUqdwcMnY7vkVhVZadf:j92oCYLDFHBGjcJrQmxan6y/2cMnYDk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677417155, "uuid": "9424b0d2-3437-4522-a650-4fea3c64ba71", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677417155, "uuid": "8837de5f-7770-42d5-b113-dfda911517bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677417155, "uuid": "6d6eaa85-ef14-4284-824b-578fcdcf4752", "value": "Gloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729a69b8-b606-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677437432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437432, "uuid": "f7b43561-6367-4591-9efd-d0291f7a7e47", "comment": "Malware payload (Amadey)", "value": "18696f12c63768d2866ecf26235c769d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437432, "uuid": "5ad32bee-9789-4d15-92bd-8419839eb3f7", "comment": "Malware payload (Amadey)", "value": "594655a39036554d6f71909fa289d7c4de09081d1d42d2bdfe5d963685c23ecf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437432, "uuid": "db862b2f-ef19-4afe-8f85-28df563b889a", "comment": "Malware payload (Amadey)", "value": "8e5124d95e98ad39f07e9204df20e5a5185498b9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437432, "uuid": "c6f248cd-5881-4ee7-992c-02299dad9e3b", "comment": "Malware payload (Amadey)", "value": "5a954f7163af0f266a3ffb04f7e8dac6ee91a42b0cd4eacce576c826341cfe03ab68896831e25f14d37a9454d29a331b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437432, "uuid": "b46d5f8e-e7b4-42d0-a36a-a5c11a57c6c4", "value": "T12745232BD3D85063E990277198F202C3153A3DA06E79466F978BAD4F18736E063357BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437432, "uuid": "eae3af99-a78f-4794-8e97-326a92537e93", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437432, "uuid": "fcf4aa7e-572e-42f1-8683-57c88cd55563", "value": "24576:GyGpfxceBoP5HmbMPxLx9k6zxdTfkulVgOS9iOiYIXODeCJ:VGpfn25Hz57k6zxdjkGVgOCaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677437432, "uuid": "2499f2f9-c76e-4dcf-9e2f-4e1854c97326", "value": 1178112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677437432, "uuid": "29e9c6c5-a1f3-4fd2-b308-05fdc21e9acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437432, "uuid": "ed497981-530d-4a63-bad6-d0871d2e9c20", "value": "18696f12c63768d2866ecf26235c769d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aec5b67-b591-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677387007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387007, "uuid": "f833e268-38f6-4ac6-9490-c5488466992d", "comment": "Malware payload (Mirai)", "value": "340404775f87a12d359600dbb973a570", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387007, "uuid": "575b48f4-54a5-482c-a05d-956ff5cd5039", "comment": "Malware payload (Mirai)", "value": "597c27c7b0303ab7dab3164c15d68cceb1181d6d0c84d139b619e49cda80b98f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387007, "uuid": "7af92686-2a24-45fb-a7dc-79331d296298", "comment": "Malware payload (Mirai)", "value": "3bdeba6fbcca6990dc7a9479e6c0daf3cff96cee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387007, "uuid": "b9e819ca-153f-4384-8480-645d4ed9100d", "comment": "Malware payload (Mirai)", "value": "522755de92eb16bb2c177b248aafbcc9e190a3bff60d01ecee453dba5f1eafba2125c06d96743b97f7f2b68a32198f00", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387007, "uuid": "014552b9-e34f-445c-92ea-f5cac7d9ba4c", "value": "T1A7435BC4F643D8F5EC8705712077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387007, "uuid": "1e76d97f-3178-4a1e-b668-0c8a00191431", "value": "1536:JeESt/basV2rcZhG6+KN7TqopW1ZzWOIaEjrqM0s:JeESt/basVTgW7Tqow1ptXESP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677387007, "uuid": "0abdae38-26c6-43a9-b37b-f92c25fde1b7", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677387007, "uuid": "11e17b93-8519-42b3-8487-ccc58f1ab76b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387007, "uuid": "6ac9b36c-659a-4472-9cbb-972571576281", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55183283-b5c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677408606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "7e2eed35-bcc5-4b9f-8ebf-61761c0cf868", "comment": "Malware payload (Mirai)", "value": "69096ba789b85581cd26efc22d3c61e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "d0972b88-09ce-4587-96f5-b386684cf31d", "comment": "Malware payload (Mirai)", "value": "5a4b337dd7a0f2f0e7b381f09e7d60433e431b6903ed27a743eb1aec794a0ebd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "4961815c-d5d0-4dc6-8a65-adad283c5848", "comment": "Malware payload (Mirai)", "value": "40f296e38daabc5c514ada6f7b3462cbf6430a9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "358a7854-3cd5-488e-8c7a-8e47a87695a6", "comment": "Malware payload (Mirai)", "value": "7872af0716ad6337594c603295783021c449e7309cb7eacd1727e9685b356981edaebc51160a13a3d0d8596438657020", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "7f70f620-63bc-4c2f-9400-32ec473cf0c5", "value": "T108A31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "c48142c6-8fe0-41ee-9004-f153438b66e2", "value": "3072:VSx+i6mqaObhNjnPNKV+qKmZuqQ4DPwXXtse:y6mRObnjnP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677408606, "uuid": "73d76b51-4ffc-4a00-8544-d69d9c8a22d2", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677408606, "uuid": "6a31946f-ee4f-4971-b6ac-dc18b929b76b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "4a194d11-f96f-4e6d-ba66-96583f80cc64", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7c4aab-b5a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1677395709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395709, "uuid": "5dd0a60b-7aad-43ec-a3d7-168a73874f10", "comment": "Malware payload (Stop)", "value": "ec7a59120aa48d773c8716798409ef6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395709, "uuid": "9222352c-7e2f-40e2-859c-d451f401cddc", "comment": "Malware payload (Stop)", "value": "5a7eee6544891c81cbeb11840147702208d7af4b076aa850e1d0adcfdbcfd338", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395709, "uuid": "73d3a897-a3ba-44c5-8268-c6ca0f073e67", "comment": "Malware payload (Stop)", "value": "c48161f62e5407188c0fc96b951c16d0e300b20a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677395709, "uuid": "d9c12f5a-f170-474c-88ce-39a2e6f39fc5", "comment": "Malware payload (Stop)", "value": "c529c8f364b85b950a3d95defedfb21ebeee0c3b3d0934b84a7414902c7b8b9b2d70ba3c234647947db4e6b10585c823", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395709, "uuid": "c0b69a63-7054-4b38-90ae-f4a2a0c1d511", "value": "T167F423207D90D4B5D812217068A8C790ABBEFC71C795C6CB73587BBFED783921B69212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395709, "uuid": "13580042-bac7-4ee5-862b-e0c3c001bd81", "value": "4453019f24fbdf41dd3a4f06fe73134e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395709, "uuid": "1dab57d6-1b7d-4420-bb27-de0e9e65e1ac", "value": "12288:rxtRoRjat9byFQ6B1gBxW6nzHVUE/QabtItb2kOajEzmZ0Ua8:rhoRjaPbyFP/gOYzQZtCkOaNZ/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677395709, "uuid": "a123dc7b-ed79-4647-882b-aa72fdd64038", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677395709, "uuid": "9ca5ce45-eec2-4346-bd80-129f39aceb52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677395709, "uuid": "8d2250ec-b90d-48e8-aab8-4fb98103e0d0", "value": "5a7eee6544891c81cbeb11840147702208d7af4b076aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb74b52-b603-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677436025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436025, "uuid": "78d8b60d-0441-4e55-b4b1-80db2e7e213f", "comment": "Malware payload (RedLineStealer)", "value": "25d78766320e070e919341f94ba31198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436025, "uuid": "393f24b3-8bd7-4dc0-9a32-d3f3690f624c", "comment": "Malware payload (RedLineStealer)", "value": "5bd5e99be6fb711647f59d7ab4348a45c547f4760eee138762895f1d8f5d8b28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436025, "uuid": "355c260d-76ec-4cdb-b0c4-f1295f92a80d", "comment": "Malware payload (RedLineStealer)", "value": "d35e68c99164aec29dfba978c0246c6fdd03ee2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436025, "uuid": "2bc2fc3e-8466-4592-8344-617effaf3fa6", "comment": "Malware payload (RedLineStealer)", "value": "882c98bc863628a89bc9dec706b240e5eda6f335dcde38de0d28dc507094b1803245ccc4ce6c10733af3060a5401214a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436025, "uuid": "3de6a205-abf8-41c5-a2f7-3db2472ed96d", "value": "T18684F100B481D432F4520874C839D9E9697A7CE3769989BB32173F6FEE307D06EB6295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436025, "uuid": "075aac34-5957-4d91-92ad-4d1c47bd5616", "value": "61552f371d50dd7cc1d63f5028ea0b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436025, "uuid": "d2669274-d99c-4309-a1b7-80e9cfddf22c", "value": "6144:OTLzSpggC0qOd5YOOv1C9bJeZyGNjlDMLz8ES:OT3SfHh41C9bUZyGNlDMn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677436025, "uuid": "726c7895-eaea-4041-9d6b-fc6ccb8bc25c", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677436025, "uuid": "b734b778-fc76-4dbb-81f1-e8e363f1ddad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436025, "uuid": "477d691f-f304-4246-9bf7-dfae9f270285", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088aac7c-b5be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677406331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406331, "uuid": "019fa080-9e0f-4828-a221-bc15afd10aa7", "comment": "Malware payload (Mirai)", "value": "d017690d752a37ad293fcc8164941c78", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406331, "uuid": "428da2bd-db36-475d-be00-3378facc2866", "comment": "Malware payload (Mirai)", "value": "5cde13097d8da6dfd254c3fd9502c6e649f0a8c37b8ed10ed79ba8eb32c5aad4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406331, "uuid": "fa8693d5-cdbe-4e80-9e06-b1a5d3648d53", "comment": "Malware payload (Mirai)", "value": "8f72a8263cb1dc7a280bc3dd9f74cfb6839a829a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406331, "uuid": "b43495b1-f101-40af-bf27-77e79df7b49f", "comment": "Malware payload (Mirai)", "value": "69aa37e056a7b4cfc2528cc2da638e61c19011284dd3d3331be78d95c39023c4ff0693211beaafca4fe0485259f1bfd6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406331, "uuid": "379f7758-f09e-4c24-896e-5a717c1fc0a9", "value": "T176131995B8918A17C6D013B7FA2E518D372663A8E2DF3303DD252F11778B82F0EA7651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406331, "uuid": "029d57fd-fab8-4580-9eb8-21d931354aa6", "value": "768:tSwW9qZD1q2NVKYKO4jTXo9IlRTcSPMt5Q9fH/NPllJdL:lWEdVKmMk0RTcaMt56HV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677406331, "uuid": "dae354d3-0c79-4a0d-b7d3-8613a2e40be4", "value": 42436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677406331, "uuid": "f5c75d83-2ce9-43f5-badc-ff78186f3c36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406331, "uuid": "806a18d1-1db8-45d8-9517-981ff440b489", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a6c1a4-b606-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677437434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437434, "uuid": "f2993f9e-1481-4ecc-ab2f-100eee9f51c9", "comment": "Malware payload (RedLineStealer)", "value": "07074e179e6a038e0d737b3dcf8a2034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437434, "uuid": "9b88b952-b34a-4b2a-9e4a-20c9121b41c8", "comment": "Malware payload (RedLineStealer)", "value": "5d4d7cafd59fa20f3037fe2502fd1a0969d2bff13218d6354b93839e28151e0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437434, "uuid": "d66c5693-b162-4e71-bdfc-010154901599", "comment": "Malware payload (RedLineStealer)", "value": "de39f51c75821133f9368caca4280c33ce250dc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437434, "uuid": "52088151-adee-4be2-b289-2524285a2c7c", "comment": "Malware payload (RedLineStealer)", "value": "1f51e644cc407e94458bbca97d99972d76481523e82c73cd765c8f02834c9172d72922b6ed05ffad94ccf8ddc70a5ed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437434, "uuid": "ad218f92-96b7-4a6f-aef4-bb7512d84e09", "value": "T182A40207E6FC4422E9A527704DF603C30A3ABC615E38476B274FAC5A18735B4B63676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437434, "uuid": "51eb7125-aa4f-406d-8b9a-6cbe03e5ff4a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437434, "uuid": "5bcc0883-7398-4366-baec-85a903895881", "value": "12288:hMrly90RBBHfL6GAggHmDz8K14OAD1aPS:My8BHzFcgzZumS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677437434, "uuid": "ae481e99-380c-41d6-affb-790ffb93c70b", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677437434, "uuid": "63ed75e7-076a-4231-a1e3-9b66f3f28b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437434, "uuid": "388ef084-65d0-4072-a9e6-74b84d3778c3", "value": "07074e179e6a038e0d737b3dcf8a2034.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b28a2e-b5f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1677430327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430327, "uuid": "4d6ea7eb-c629-4e18-aa47-dc8c35ccb724", "comment": "Malware payload (PrivateLoader)", "value": "646f9a44ad9c8719b45951a29f8d3c6d", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430327, "uuid": "03d3b491-e695-4659-b81d-b5ecdaa4a9ab", "comment": "Malware payload (PrivateLoader)", "value": "5e02b528b2cb0f1884c45c6dc3b095a8a6a8a9ae775aafa265d28a46af969c28", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430327, "uuid": "a5b02947-6d53-46d2-ad4c-40540ddd761c", "comment": "Malware payload (PrivateLoader)", "value": "84f73e2b59176f319c52790e55296995088b48aa", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430327, "uuid": "23f37b49-b0b0-409b-8a26-562d8f0af0b5", "comment": "Malware payload (PrivateLoader)", "value": "34677446abdc8e75d49adbad9b366972d6feb84a92355f09d6126adb88672d7fb3998e2ebdb37634a8c9433f32e04926", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430327, "uuid": "595effb1-883d-4562-9a53-c7f1cc7f209d", "value": "T1C766332322650049E5F1CD3CC627BDA471FA13BAC74298BDE8EFA5C539535E0A263D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430327, "uuid": "9bc0fdd5-92fb-4254-88b0-6f4b4a49438f", "value": "3ce373431b23a98306ac88d16ec3e778", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430327, "uuid": "4078c9ff-efb9-4893-a791-0ca1c89707c6", "value": "196608:58t40NmBV779xciWmIiIrHRmgi4EPP1EZ2RRT7/8:+y8SVDBOrHRmgTE37RT70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677430327, "uuid": "90bc8fd7-2e17-41f5-bbdb-686084cf3e69", "value": 6562480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677430327, "uuid": "2b29b1cf-cfc0-46c2-99eb-1c85c904748b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430327, "uuid": "061ff84e-e6b0-470c-a961-a9b72b6ee1db", "value": "646f9a44ad9c8719b45951a29f8d3c6d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b2ce07-b5b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677400418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400418, "uuid": "865a6e42-2752-465e-b377-5e8550bb1a49", "comment": "Malware payload", "value": "a0fd287a92a792925f23becd35b67fef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400418, "uuid": "38273109-ec1a-4aaf-9707-1d4a2432a1eb", "comment": "Malware payload", "value": "5ef394e54aadd92ee53d69cb8e8996127a46ff28a4d51885e61a165242798277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400418, "uuid": "6c8b2746-cf8c-4166-b2c9-0bfbdc226bc4", "comment": "Malware payload", "value": "7823e603790e29e87995ae86208d940847b9e84e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400418, "uuid": "b254efd6-93bb-4798-b449-c29ebdc92dc9", "comment": "Malware payload", "value": "f2d431fe9a9743446e07f0b88a5849176516530bfcf2ce5cc2a4e60ba0dcbede2af28ef7a3b750965be3cf80d36d45a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400418, "uuid": "e13bd363-3aeb-49b0-a6b0-c11a777fb1e9", "value": "T178068DB27285593FC05F1B71887B8A2C683EBB99762349578BF4088C8F75540792E39F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400418, "uuid": "26795024-02c8-4122-afea-a296e0f8e8f7", "value": "24576:0Spkm5i3oFfOOThLFbAdB/Plh1GutLfzvTNr1+iYhNBuSqZsNg0xbPsOrl5IVb4P:TpC/vYhNQSqgrl6iLxdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677400418, "uuid": "e7137ec3-db85-4054-bec1-732fe4f17138", "value": 3727360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677400418, "uuid": "6f56a557-5e64-4e71-8772-a5d9e68c67e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400418, "uuid": "4e378d62-a675-4585-9a87-e0805cd4c915", "value": "SecuriteInfo.com.Trojan.Virtumod.14630.27601.21700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47741210-b5af-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677399994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399994, "uuid": "28c08959-0e91-4f27-8f64-d781c22ce1eb", "comment": "Malware payload (GuLoader)", "value": "4ce23c67160357c2102f8c5f6f669adf", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399994, "uuid": "2a8f57b3-7f22-4524-ac2a-d59430729275", "comment": "Malware payload (GuLoader)", "value": "5f50b2bbd132ec4fcb465de520ce20c653579588069de9dc8f14579ebe2d062c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399994, "uuid": "fc8f8c7f-f079-4121-b196-80132ecf36fa", "comment": "Malware payload (GuLoader)", "value": "f3f8eff2149c3a7fa540113133c61b6065968058", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399994, "uuid": "7baa42eb-6474-40a4-a935-ab798c228b7e", "comment": "Malware payload (GuLoader)", "value": "7714adae01c2877457dcf191b296f19974eb991ad6beb62828e9ce7295b93ba0148815f021f33fea39b869e6a72b1abd", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399994, "uuid": "56cd8470-fba3-4543-9da2-621b5c040607", "value": "T142B42312F4C568DFA41E8B790A8BFD4CD7AED00B075043265462B09BD748467ABBF8B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399994, "uuid": "53d24ba7-159f-479a-9fe8-5f23b05a322d", "value": "12288:axp3qSCuI3+He3MeLKc1FrWKTJLb4LgHgs8An14ctyXX0I1Ew:aTxCuu+a7ec1pJTJ4kHpn9SXV1Ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677399994, "uuid": "8fc968bf-1aaf-4329-8945-ab1396f1be07", "value": 507625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677399994, "uuid": "24dcf180-c48b-4baf-a80b-fee413bfc853", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399994, "uuid": "1d122bda-7bc4-44c5-bf49-a9ac0f1c557f", "value": "sales contract-876 & New-Order.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17293b22-b5d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677415804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415804, "uuid": "f3de5bb6-cf31-4d0f-8733-f372299836a8", "comment": "Malware payload (Mirai)", "value": "3b62552da0812fbf2c14f737319f8104", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415804, "uuid": "04e7fec2-7e49-4f53-8cb2-edb498d0faef", "comment": "Malware payload (Mirai)", "value": "5febef67530bca92f2a85b3f12e87f6a48d25b80cc0b17ce1e5f6965dd0df3a4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415804, "uuid": "914a7572-ffec-406c-af31-f7ca85fa9f34", "comment": "Malware payload (Mirai)", "value": "f0b5249c7f596eaf67828676a028c023356a6250", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415804, "uuid": "34f92927-e938-4ebf-b9ff-ca8ad5860d4c", "comment": "Malware payload (Mirai)", "value": "be8dc38fdad862044c074855a2e2a4bbd30a70ec25b075d134f50bb357684680cdbe2d85d6741daa92f6b5b113badb03", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415804, "uuid": "0db1dce2-2eb3-4702-a0c0-400e5076c3fd", "value": "T18CD34B46FB818F13C0D6177ABA9F42053723D79593DB330659286FB43F867AA0E63906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415804, "uuid": "b3c2fc41-c5e0-499c-ad7a-22a4ccae71d1", "value": "3072:FMHPp2YD4jMB2CSHfFBR5KVbweCS9j6RM/918mywPoIlq:FMHPp2tjxCSHfFBzK+XS98M/9OmywPo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677415804, "uuid": "77642e39-3e1b-48a7-ac37-2ece3ba9be6b", "value": 131723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677415804, "uuid": "ffa2007a-376e-4f0d-ac4f-6ed4f112e710", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415804, "uuid": "b515b77d-a9d2-4862-8d04-4cbf29a1faaa", "value": "botx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822f2f37-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "f31379d8-230c-4823-b103-cda710269aad", "comment": "Malware payload (Mirai)", "value": "0253ab99f4f7a149f7d6e5e76e59b37c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "715c15f5-1c4a-4d5b-be3a-7ee52a2d61e7", "comment": "Malware payload (Mirai)", "value": "6114ad023792f1117bddbba675868f524415a50546083a1cdbc8200b4aa68b1c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "804ca2fb-f5ee-4f9a-8494-6168f87f1083", "comment": "Malware payload (Mirai)", "value": "08eac6a10b1fcc8848655732f0a27d9dec99d683", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "bcf4f6cb-95be-46a9-a3bd-4489415920ed", "comment": "Malware payload (Mirai)", "value": "33102c5d632efe46915672cfab958629a6fc502adf48e6508f3162d6da6ea43e33a8ff24157ede4a085668e9be158a0e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "266da257-a8ff-4c0b-abb7-8160ba534716", "value": "T1F2A2E119BF1C868BC832693551D9EAD21292FC72F2DCCC082940D16FB4A33E92474F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "b19c5a63-571b-4724-bea1-d4876c9934cd", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKi:O98o08kxofBE+ZkXaqGbp2F2TWul0c5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372604, "uuid": "43cb40eb-8acb-4b66-ad5e-0875b8cd29ff", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372604, "uuid": "7d508033-a0cc-46cd-a421-0f48e15163d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "239e6261-2ccd-42e8-b3b0-159943b683fe", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a35fd9-b5dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677419796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677419796, "uuid": "5c313dc2-d506-4ca5-bcd5-fd20a08de337", "comment": "Malware payload (Amadey)", "value": "71214a7ca3b5720aad9b7ca0acf85aa0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677419796, "uuid": "05228c0d-d250-4c94-b0dd-1f27b9243c87", "comment": "Malware payload (Amadey)", "value": "614d110fb60d09254ee5601a84a3a1a16e98fedb0236925a667147903d96aafe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677419796, "uuid": "605fa566-d2f7-4cef-ad27-1d5459d64539", "comment": "Malware payload (Amadey)", "value": "e314a7d878f8bfcc350d7bebb4158550dff8e091", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677419796, "uuid": "72c546cd-a6bd-460d-8bb6-b38c104af87c", "comment": "Malware payload (Amadey)", "value": "039d18d581397d6707ada5812f257486fbca94747053366bfb4272db87befb54298d498111eb526b749e62bc05bcd1b7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677419796, "uuid": "2bd89d99-2c11-4650-866f-c76d5f8a5746", "value": "T1C535221BABEE8437E8A51F7019F213D309337DA6DA38468A2346AC554DB3170B27537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677419796, "uuid": "c23ab1bd-1feb-4c93-8ec1-9d8acf8d66a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677419796, "uuid": "6b961cd8-8dfc-4e92-a871-4cf800ad1ca3", "value": "24576:lyA0VZFBNQ9qeuSjIbnZUlJI1do/p7Sqjx4FFndg:AnK9KuIZ1kpXjx4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677419796, "uuid": "1f6f1937-d3a0-46e3-9c50-ba7e7fdc5bc5", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677419796, "uuid": "dad6d3b2-75ee-4a0e-b496-4e8e5964f73c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677419796, "uuid": "98ab2daf-39d5-46f6-91b8-c686d5377cd9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac49a34-b5ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677398335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398335, "uuid": "0fb8425f-6307-4f29-95f4-73fc095f4571", "comment": "Malware payload (Mirai)", "value": "79e99383eef7f072f87f84fdc62e475c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398335, "uuid": "58cd6df3-ab3f-45b6-b16f-3be604ef1d27", "comment": "Malware payload (Mirai)", "value": "61a012d5c41e9cc46b59a252ef46b600f2bdf443da42d16d6b7ed4e8c900a95f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398335, "uuid": "15981766-da66-4d91-ad16-3a9d8a399f8c", "comment": "Malware payload (Mirai)", "value": "23de3e796e9bb4cec97ddbf269dacc6cae547dc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398335, "uuid": "d477085b-6d3f-44d1-9de7-71b822762085", "comment": "Malware payload (Mirai)", "value": "96f8be2e673a02bd2138819cb00ebaac5a29dc607bf055142c65a84729227dc50637c49a7ec489027fbcad9d34def933", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398335, "uuid": "d7dfb234-0265-44f6-bc2e-76ece1360427", "value": "T144434CDAA400DE7CF99BE6BEC0120A49F634635045930F27EB67FC936D721649D2AD83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398335, "uuid": "f87dc72a-81f0-4b16-bda3-2219c0cb1aa4", "value": "1536:XnffzLrqgGSa+EugE/1F6ZxxOr+BeBnaIQ8t9Sa:XffzLrZaXArhn5Ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677398335, "uuid": "2ec82d9b-7727-4cfb-bc77-e321a530afea", "value": 58968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677398335, "uuid": "b51776cd-973d-45e8-8e45-fc66de9c1bf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398335, "uuid": "93685208-53f8-4d51-9167-bb795b360f7b", "value": "79e99383eef7f072f87f84fdc62e475c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82285343-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "8cb82ffb-1acc-496b-9a2f-6308f9934090", "comment": "Malware payload (Mirai)", "value": "ae441d774763ea0f3796953ae9d0ae8f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "9327af7e-865a-4ef4-810e-9147f6c6f59a", "comment": "Malware payload (Mirai)", "value": "61aa71150cd4ae70c19fbb4d96b8f5f102631a61c38ddbb067ee3badbc155a8b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "bdf58c87-5272-439f-befe-7a123962110d", "comment": "Malware payload (Mirai)", "value": "f060669b33f461cf45a18748183172c3a98ac094", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "39977b1d-02ed-4396-8e78-a10b013a86db", "comment": "Malware payload (Mirai)", "value": "3b2276a29e1c1101b56e2d3b20cf47d230ae67073a1dc626b1371c8ecfb6e6501f6975c8da3937fc22295bff2cdcd97a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "fb32bbd3-e1b5-4e2f-a949-3602b615cc62", "value": "T10BF2E094C8F5836EE278257B8DDE3D471080493941688EEFE75876131CB7F91F62A362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "b6c1b32a-dadd-421a-9a78-b47c3789a9c8", "value": "768:ahMMqgqt7QPonZ4nJZl+dcaSRR+3jJq4wO4Ih/afOw7s6jAEnbcuyD7UHQRjM:sMMfg7QPonZ4JX8SR6tq4zhxanouy8Hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372604, "uuid": "6f1c9c56-54fa-418d-88f7-4c74eb05b69d", "value": 35900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372604, "uuid": "6f3ac1b1-6b92-4708-885f-341b8b20a3fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "d475351e-8874-43cf-a2e3-251e0eddd52c", "value": "hotnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935d4085-b608-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677438346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438346, "uuid": "6f0a0c9c-563b-4208-830c-5e9f765d0d54", "comment": "Malware payload (Smoke Loader)", "value": "758384bfbc3559d73f1f604888d0af4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438346, "uuid": "23873292-7363-426f-984b-7572b36434a7", "comment": "Malware payload (Smoke Loader)", "value": "61b466c76ec7747cb41f23d55824acc239240ae1390e3895e031401b223fd0ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438346, "uuid": "ffd028ec-60fc-4735-bd77-89e28e006146", "comment": "Malware payload (Smoke Loader)", "value": "fdff7f0e001d055f37f2c76ad800c47e4460ed2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438346, "uuid": "198261f6-cdca-4f96-a14c-32803309a500", "comment": "Malware payload (Smoke Loader)", "value": "57b374a8bb0c8ada8409fbefea06877eff23845191b68fbc011effcb857135a038d12a8b12cc272abfe0d23605810833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438346, "uuid": "8ecec157-0dcd-4583-a978-d426e81582bc", "value": "T1B954CF10B980F477C8D606308835D9F96E7ABC62469CC55BF32B3B6F2D702B166A7351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438346, "uuid": "e3d0f272-4c1d-4060-8c77-15d7c4365284", "value": "61552f371d50dd7cc1d63f5028ea0b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438346, "uuid": "aa8ca00e-4508-4235-9496-a643513d7c1b", "value": "3072:ClWSlL/gasBF53W6XjDrjGDYeofTjxDd52+r:klL/nsXjheofTjxDj2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677438346, "uuid": "80cbae17-fff4-49c8-9695-f722cdffe6d8", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677438346, "uuid": "33234a62-ab19-4a31-86cb-e45d149df792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438346, "uuid": "9eb7f9ad-b43d-4cf9-8560-aa0a735e5728", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570f2557-b598-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677390141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390141, "uuid": "529f5334-5094-4348-975e-6f39135ebb00", "comment": "Malware payload (Mirai)", "value": "cf91774caf9d6005cc05475c693247a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390141, "uuid": "edeefd79-9cdf-4420-a89f-210a8f60e425", "comment": "Malware payload (Mirai)", "value": "622ce04ef7c7e84c019ad7c9edd3d57e8b194dda753500f299f0d6c4c48ddc4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390141, "uuid": "fbb7a4c8-07a5-4fe9-b92f-afcf0beed3b5", "comment": "Malware payload (Mirai)", "value": "b094127ddf02ca5d3390808971e6a2ebeb78ba43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390141, "uuid": "e368ee5c-16e8-4c59-97b1-2118734a5623", "comment": "Malware payload (Mirai)", "value": "1a05eddcd6ca8a9120d5b246a3719307f20ea9cea3c686c1b7ef55adf439020f7822ccad1b3a45f99dac4df0999677fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390141, "uuid": "63d1ef14-e331-4663-af7d-a33463b68aa7", "value": "T145B2D1A44BE15A07C2B0B479A37C8F536B3B15E4C2F635262B1193BC9A8145633FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390141, "uuid": "3a4f1d94-3f73-4796-b059-65f3d52583ca", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BEMtP1hymdGUop5hu7z:4GHKQFH0rs3zWoDDRsjt7LB9U+BEMt9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677390141, "uuid": "cbd0dd59-bc16-447f-b5e0-5bf3405d5557", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677390141, "uuid": "fc893c12-f2f8-4289-93b1-16a3b19c613d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390141, "uuid": "ae393314-b788-468c-923d-f34888d47230", "value": "cf91774caf9d6005cc05475c693247a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e298a9-b5ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677434373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434373, "uuid": "b9316862-0ee0-4cf2-9acd-9127beaeb348", "comment": "Malware payload (Mirai)", "value": "d14f4b18f787cb287c9c9a7cc10a709f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434373, "uuid": "9423581d-0d89-490f-9290-ae55e8aceca2", "comment": "Malware payload (Mirai)", "value": "62b1498d1e9889f5533975bceeec4b8c1482e545ca35aa7c28b9e151aeab55b0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434373, "uuid": "28f7e1f6-e6be-4eb0-85d0-99ed7b1ee8e0", "comment": "Malware payload (Mirai)", "value": "62c91b0bbc69e32a49eb50935990131e935857b5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434373, "uuid": "b60691b7-206b-4682-95a2-ed086c678a06", "comment": "Malware payload (Mirai)", "value": "88c6481d748752ffcd5f68bda2e0fb6df84f0b8020a9db60682abf9dcf2ffe7698732020f7fb869b952570db2921a80c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434373, "uuid": "1c4b6969-c13c-4292-a37f-9f085990520b", "value": "T15743851E6D168FBCFB59863447B78E219A5833D627D1D642E16CDA002EA034E741FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434373, "uuid": "bae75843-8e5a-4309-970b-555d394911c4", "value": "768:bvaLxUxyQpPT5rhmu3rFtmmSnoh2Lt3ug+i1EZi0e4fyMnup//dujgtywsz:bvJFP1jtYF+i1x0lk16gtL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677434373, "uuid": "c538677b-87de-42c3-976d-c68e3ee2083a", "value": 59768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677434373, "uuid": "c0e7822b-881c-4762-88b8-6be3a1bedcbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434373, "uuid": "b56f2138-fc5d-4c04-b487-85b68a5715f8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47148228-b5cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1677412448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412448, "uuid": "556f1454-781c-40c2-b808-07bf7a2355f5", "comment": "Malware payload (LaplasClipper)", "value": "75db4d25515abe6ef95076fb0d9ff68d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412448, "uuid": "d03401ca-48ab-4f14-87f9-578c6321f26c", "comment": "Malware payload (LaplasClipper)", "value": "62c4f89507adb77c702fb8ccc69518db7df077db99f667bc382b94ca54446d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412448, "uuid": "a3772ca0-15aa-4ffc-8a44-5628a5753790", "comment": "Malware payload (LaplasClipper)", "value": "027e6834049159faf5347e87eaa1c4e5fff7c65d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412448, "uuid": "60a4d6cf-8c5c-42f4-b81d-a9a1c49e2e9a", "comment": "Malware payload (LaplasClipper)", "value": "645e1c8c6fb97fabb29c2e69be59e24dab240cd99bbba805b0052e8e74721facbd48a7b1196155eea0ff8f6872a03280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412448, "uuid": "bab8d3c2-a64f-41c3-bf42-da18a1a6ee33", "value": "T1746622B755240183E0A05E788C73FF7472BA4DF4B611A8781AD66EC33E937E4BA22553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412448, "uuid": "b7683497-734f-4739-848a-88d0c0fe8e76", "value": "560f5833a24923f2c6cd395059c32581", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412448, "uuid": "74137e4d-8e23-418f-9814-0f0ea5f9bc2d", "value": "98304:Q2MzdA1+mlgKW3clKJZHLkUiMw/1PKGqyW1MnylC0IBzdhCyPsismtQ3b:Q/u+md2LHOf1PwPMJayWmtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677412448, "uuid": "928f772e-4f48-4fe2-b3f5-6a522df7aad8", "value": 6614016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677412448, "uuid": "4deeab86-4d56-40ec-832a-228b46d7f54f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412448, "uuid": "3f68d96f-cbc7-4808-8303-413f23574c03", "value": "BTC-GENERATOR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2de3a1-b5be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1677406657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406657, "uuid": "ebf39643-bb94-49df-91fc-f2b27b272395", "comment": "Malware payload (Gafgyt)", "value": "fd86a9ae706721a9135b9a8b3adbf555", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406657, "uuid": "1117035c-c072-4b79-b8e2-f2ad15dc8daf", "comment": "Malware payload (Gafgyt)", "value": "62fb57dae18d58a65e9595189d19b735d9e6c2f8546128b652948cafc01a92eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406657, "uuid": "73345ccc-4fc9-4a6d-b8e5-310074886630", "comment": "Malware payload (Gafgyt)", "value": "9bb1a98a48faad6bf7d13e7f3647d66bd2dd2336", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406657, "uuid": "4b9c1ac7-9e91-451a-9e17-9af8808713e0", "comment": "Malware payload (Gafgyt)", "value": "2fdaa955426c829b20fe451fbd0ef1c496084ce024c055b6bbcd3666617b945e085172ceb3e1b4c3ced7f8f1b4882808", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406657, "uuid": "69e1999a-825d-453f-8645-ffadc74a0a48", "value": "T1FBD3E73B7B270A23C0C9507116E31332AEB5DE5934B943D7A9D07D9C6F3A98834267E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406657, "uuid": "dcbfe52a-9297-41a2-a584-1868555cafdf", "value": "1536:tAvwLioZzPd/oD2EStm2N95dIt1RbHgdvN1DGhyIUQKTSThcR4Ni:nlvg2NPdQA9DGoIUQK+ThI4Ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677406657, "uuid": "60199f4a-6d2e-466d-81b4-d3c04e0e9de3", "value": 132416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677406657, "uuid": "4fa68395-b7d8-42e4-9d12-13671abd5102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406657, "uuid": "86fba5ae-6608-4c8b-8630-cb27d3ff2f3f", "value": "fd86a9ae706721a9135b9a8b3adbf555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d8873c-b60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677441161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441161, "uuid": "ddbc149a-f21a-4c20-ad56-565e5ab68a0e", "comment": "Malware payload (Mirai)", "value": "d232ae8c3943981f219d6136a5f742e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441161, "uuid": "37e7a7af-b28f-4f1f-9da5-fe341721acc8", "comment": "Malware payload (Mirai)", "value": "633cb57da02cdb724c3893ad98c105397b1fca615cca71856d7ea456591809f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441161, "uuid": "3ecd79c2-b6a5-4ea5-85f3-117eea037947", "comment": "Malware payload (Mirai)", "value": "9a850a5a3dc75015141d84612ea8d31f3ae515e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441161, "uuid": "065b3da7-6d2d-4241-822f-6772dae10f19", "comment": "Malware payload (Mirai)", "value": "8793ec4018a1bf738fa417261826e159aa6bf92c133829dba6766ea84f06166e491e941744de764610c9c12a6c03eb5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441161, "uuid": "39cb7403-9d45-44da-a9e5-d5a62cfba30e", "value": "T185D2E1017240FEE1C5B00231E8678A9B72267D79D1D134FB8A3D0DF8A6E9A1D47F8983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441161, "uuid": "40517583-aa9f-4f5e-9d3e-6dcc641a28e4", "value": "768:eusHfRavjynNKnjFcZIhQzhKMXgN29q3UEL71:IRwynNIOQQ1KMwZLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677441161, "uuid": "d702da6f-a85f-4d6a-adf9-99b9f009cfe8", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677441161, "uuid": "592b2bc1-e082-4c9b-98a1-ca1513636884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441161, "uuid": "edd6d7e0-3487-4c6e-98cc-0792343ac693", "value": "d232ae8c3943981f219d6136a5f742e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f323212-b618-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677445238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677445238, "uuid": "922f5ca9-322a-4326-9b9a-fd6ac5a10ef7", "comment": "Malware payload (RedLineStealer)", "value": "591ef7ab7ff540a2b8a14f76b47b70e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677445238, "uuid": "a85d08da-2b17-4434-bb9b-86a0abed27dd", "comment": "Malware payload (RedLineStealer)", "value": "63456741926270966aad2ad0eceb4420ee8c7df94908199c6238c410934d3c65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677445238, "uuid": "ee32a32a-2a1b-4711-ad30-16ade3827b73", "comment": "Malware payload (RedLineStealer)", "value": "a3da779b2c477e89535dd7c22bfac81d8f0437a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677445238, "uuid": "d135a658-258a-41df-9e9b-355da48ca4a5", "comment": "Malware payload (RedLineStealer)", "value": "1a7886bae58ebb2b5d2ae8b629e444f4b9313d9721bb21f3fcf1900b2a90cf194f66c2a297b9eb448c29a3430728d9b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677445238, "uuid": "18cc01d6-1cf0-4615-8859-1db8bd3b6a81", "value": "T1F7A40207BBEC5472E8746B7008F602C3073ABDA19E74975B224F6D595C72668B23273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677445238, "uuid": "1200eb94-f752-4027-ae04-b2d16e417ce8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677445238, "uuid": "f864ecb4-672c-4bde-b356-2103bee1f0ca", "value": "12288:JMrty90hrVyl1e5Qy5K6OMsSLoJfUIetmyv9T:My6xyG5QQD+SLOf8tnlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677445238, "uuid": "af313d29-4a31-4789-9ccf-c4313c54137d", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677445238, "uuid": "031b592c-c016-438d-bb77-52b183c0c636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677445238, "uuid": "f8dd961a-a6d1-4b13-ad71-fc7d1263721b", "value": "591ef7ab7ff540a2b8a14f76b47b70e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cafb715c-b5f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677429850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429850, "uuid": "3a8abd4c-8f91-4724-af25-d8efa3d795f1", "comment": "Malware payload (Mirai)", "value": "f5aaeb8593a023d577065e0dadfd55c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429850, "uuid": "ebcb5388-05b3-464c-b44b-37e7ce3d861a", "comment": "Malware payload (Mirai)", "value": "6408d8da2a1594b8ecb8c8ccc45694f83ef0bd94ee114da416cf4adf489d046c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429850, "uuid": "3fe7284a-b5d4-413d-bd76-c1bd8f481e9e", "comment": "Malware payload (Mirai)", "value": "4ed5bff7d58025411c4de46a9ed8ece78d15b5b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429850, "uuid": "a6773f81-aa03-48c8-85c8-1ab5ed8bc05c", "comment": "Malware payload (Mirai)", "value": "5aecf886ae64be7d197214f4cdd31a7c531ae028aec5c5fa74a840eea27face212a35316faa7c6ccd30d42f8bea796d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429850, "uuid": "eb8fc8b6-6658-40c1-afd6-44893b61eb0e", "value": "T12D82DF3052AB35F5DBE10430FAEE8EC697160BF9D1FC36D316596B788A4110621F93CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429850, "uuid": "3184db22-a38f-440c-ae60-86b1acf47724", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaGOhymdGUop5h5li:6GV0P6+kom0tVAoNvm+to1GOs3Uoznli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677429850, "uuid": "e6016a0a-09bf-4cad-a807-e3acd942bd34", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677429850, "uuid": "7bc69174-f201-4360-b249-c790e7832f61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429850, "uuid": "5e478345-7995-4a43-8cb2-981875d56c0b", "value": "f5aaeb8593a023d577065e0dadfd55c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6480ad0-b60e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677441035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441035, "uuid": "4587fe70-3597-454c-ba10-46ee127caf66", "comment": "Malware payload (RedLineStealer)", "value": "96ce9638cbab319e48b595caa145df24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441035, "uuid": "6699905f-3ae8-4668-b58b-000d803503fc", "comment": "Malware payload (RedLineStealer)", "value": "6472e3119d29cabe43e97ce28970ec4438cfc20c996e44a245cde26d01998123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441035, "uuid": "ce8446a4-367f-431a-8364-9af1aa12f384", "comment": "Malware payload (RedLineStealer)", "value": "6433499222a159d715df73b5e00af865590a59c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441035, "uuid": "58fe94f9-d672-40b1-88c4-2ffa91499597", "comment": "Malware payload (RedLineStealer)", "value": "dee173528b60033f527f666da735be2a0390a1f24649b2d9cb3d1f4cb4a5512c9fbcd1a6ff732e83b10444f8e2e279f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441035, "uuid": "98117e08-02a6-45c0-8afa-2996740872de", "value": "T143452343EBEC8463E9B467B02CF643D32537FD606B38836B635F685A04732A5227175A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441035, "uuid": "88696bda-88dd-4883-a02e-07c3daf2f3a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441035, "uuid": "075c5f45-f236-4f06-9e75-f9c9a7b74ebe", "value": "24576:GykzVVHuby4iLqFt7M98qpEbxG+EoNLeUOyM6w9XlGIJ:VkzXObyfW2qb8ALeUO2w9lG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677441035, "uuid": "4b8d3db9-4cd3-4410-850c-cf1d0c43c22a", "value": 1177088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677441035, "uuid": "e7f43bbb-4d3e-4be7-84e0-0a967fdd3907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441035, "uuid": "ca5d53e3-a3a1-4a7f-b15c-38870621a062", "value": "96ce9638cbab319e48b595caa145df24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad6f663-b5cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677412347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412347, "uuid": "527118b9-800d-4e8a-a7a3-0632519649b7", "comment": "Malware payload (Rhadamanthys)", "value": "2741fd3970890559b9ef6be52a9063ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412347, "uuid": "1adcf1eb-c718-4bd4-a3cc-8e849cddc381", "comment": "Malware payload (Rhadamanthys)", "value": "64d1a2523aa2654066d25f80431ac6d20cab5c071de623064ebba22528d6b239", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412347, "uuid": "4abd7854-44bf-4fc0-a7ed-c721a9d3a816", "comment": "Malware payload (Rhadamanthys)", "value": "a9bb3400a0bb5f23b9188201c989307e347b5dad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412347, "uuid": "22cfcb41-25fd-4e59-a538-05d4d4b0e999", "comment": "Malware payload (Rhadamanthys)", "value": "d18449b01bee840cfb1a30fab1224e2cf3fa059c783af85970e54ffc7b4fba77f34b32f58e7be6aa613c0b2a585b29f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412347, "uuid": "ddd1cc80-d598-4312-b9c9-d3b59d974b8e", "value": "T193B40142BAA7C5A1D1155172BEE33F121B7591F98CC7612A04DAFCF83A9FB5A39080DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412347, "uuid": "c106e49e-54d4-4f79-84d0-c44998ccbb1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412347, "uuid": "6e74572a-f130-4a62-a419-ff304c111d04", "value": "12288:mEZa7i7RfZA1w37LgpfUhKRgQnYE0VVgE4:gEQW3vgpf1+QnRiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677412347, "uuid": "6421d69f-78b4-49c6-b52b-cd7f8c9915b4", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677412347, "uuid": "e812c4bf-0927-430f-aa83-90a57ac84632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412347, "uuid": "e3c7f8a3-f63e-43b1-ae27-3f47f6d8c865", "value": "activator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0acfd0e2-b5d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677417931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677417931, "uuid": "bd31b09d-424e-4af0-9b39-dafabe6192ce", "comment": "Malware payload (RedLineStealer)", "value": "9f39123257a422f59398f60a2d831d5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677417931, "uuid": "2e053cfb-9177-44e4-8421-d372f076ffa5", "comment": "Malware payload (RedLineStealer)", "value": "65bc2f5d60df332ef7d5e4870862726c8da08c85cd7bac9ac0d3ff639486437e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677417931, "uuid": "c136cdcc-77c0-468e-8ef7-5b235dac7047", "comment": "Malware payload (RedLineStealer)", "value": "5580f42f0edb911e87e4dcd6ba1e5b1365459b32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677417931, "uuid": "19e6feeb-d9a5-4247-8e22-815f58493cb7", "comment": "Malware payload (RedLineStealer)", "value": "48262651728a734b3bd8f457777fac16b3d045a335c6c52ced6e1052f1f1ea149a8c6cc58fc739b9c22f07b4127522d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677417931, "uuid": "727427cb-e091-42e3-8204-b3c3498264ec", "value": "T17C242B91A7E95C4AC4A8123E44B0BD59B9732E4F54CA576D25C0F3FEAC32D4C9A02F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677417931, "uuid": "2f916239-611d-425c-92ae-e34cbac80124", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677417931, "uuid": "8819fd4b-5b44-40c4-95a5-5965420359c7", "value": "3072:mAdtRzW7gAPxgYOyf6ejqiC1Q7ohwVRYkrzpiuR:3v9APn1OJQ7KnOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677417931, "uuid": "9ef4279e-f52c-4947-a16f-6151ad4c56a7", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677417931, "uuid": "a1f89172-a6f5-49a6-b1eb-88fd459ff94a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677417931, "uuid": "bf76734b-e365-4c5f-9ea2-14e032a1a56f", "value": "9f39123257a422f59398f60a2d831d5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551bcdd9-b5c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677408606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "dbf7ac73-df53-44e3-be70-af8a9cc8daa9", "comment": "Malware payload (Mirai)", "value": "20cecddba18535a9a4728f58ecee5c62", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "5f52836e-cc7b-45d9-ad82-adb1e0cb33c2", "comment": "Malware payload (Mirai)", "value": "6703cb59a983f11aeb73d0f9fd0f8002e0cbe8ee074fb741aeeb5a760871baed", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "4b75e006-1e2c-46e6-ba96-c0a3b7a19922", "comment": "Malware payload (Mirai)", "value": "f0a80396dbed49fb0c96a612f0b96e201763fcea", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "9c8bd335-4998-4355-a5e6-2eeee5dd0b4b", "comment": "Malware payload (Mirai)", "value": "c5da448c226b5c815872de664e75c35e48c7c53cf8db9d12b9b1d1ebe0397b8926f39887f9fc0361288bef2676b17f4d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "79b7247d-4966-4705-bff6-a5b5f006c4f9", "value": "T155C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "5ddda985-0c3a-4cac-af44-7ac1c9067b27", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpD+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EF+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677408606, "uuid": "700bae55-7d2e-452b-b3c2-524b4b7f7c97", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677408606, "uuid": "05fd3b60-7fed-4834-ae92-57a90ec17779", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "31f2558f-9fab-4340-925a-69ede64ffc3b", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06666e61-b5be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677406327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406327, "uuid": "36bca7a3-bb27-48cd-b76a-8e75bf87fea7", "comment": "Malware payload (Mirai)", "value": "93cb931f4c8be33d497550b9daee9567", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406327, "uuid": "5353b814-702b-41cf-8cec-841fdee9f2ae", "comment": "Malware payload (Mirai)", "value": "67b4f3827d88a0565a37947f72899b4d43dcf4614ab7a3ee37fb099e1a48ab3b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406327, "uuid": "928aa38f-432b-4efb-8401-8db890a6fc27", "comment": "Malware payload (Mirai)", "value": "9c15d79f4c02967af5248eb0b0ea455e2739e24f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406327, "uuid": "c1be2d9f-9264-45e5-971d-95c8ec03b037", "comment": "Malware payload (Mirai)", "value": "6b5bf51368cbee5c5ad58756975a7bd027fd04254f8dd1a4f83aa67016ea09109d9e236624de3a8d5b48a50eba2dc413", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406327, "uuid": "74f4db7b-6f56-4a9f-8d56-2c559e9d69ad", "value": "T11143841E2E218FEDFB6C863547B78E209259339626E1C684E15CED011FB034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406327, "uuid": "7da28216-f9b9-4a73-aad3-c2db158e543f", "value": "1536:2A1lLplScxORe2na04YbV2fnV5dRXA5g9T1e:31lLXScxN2na0wzTAmRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677406327, "uuid": "c772dccd-7bf7-4130-992d-dfc940dccf4b", "value": 55252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677406327, "uuid": "9eb0fabd-96e6-4fdf-8394-1009cabefacf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406327, "uuid": "f236cd0c-23c8-4f6a-bf0b-46c51dc432d9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47130f42-b5b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677400422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400422, "uuid": "28fc004d-4bec-4afc-bbf9-72c6cc19f5db", "comment": "Malware payload", "value": "4ab595c16a4576aeda55305364461f91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400422, "uuid": "1a6f0631-a35a-4229-a96e-d9813faf47d3", "comment": "Malware payload", "value": "6a73f8c3301ba886250ecc2e5dfdf33d40408179d9ff7653b09bc2255e375f17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400422, "uuid": "721ae809-c87c-4701-bd03-67b332f8d3be", "comment": "Malware payload", "value": "aec4d4cdd48ad60aceff806d2b30440a08c7b650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400422, "uuid": "1f7ad926-f4c6-4dbb-85b0-be8a3f6cf5e5", "comment": "Malware payload", "value": "d80ae89d6c3ece23609f460740eba681c93919369e131098a9c19ae4688262e618607f63fb1671db34d4fa78f52d921e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400422, "uuid": "9d5d2c62-c986-4046-8903-2d03bec8c92f", "value": "T1F1257C137BF28091E66217731D526334DABC57846D38CAEB62A4EE6D68350225E3F3D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400422, "uuid": "76fb98cf-7c58-4372-aab1-e68f072ba402", "value": "6144:tebnj6Y/XyYUWlJGYjyGNidpaJUWOpKThOWZ8OAFeCwhWftj/UUOzorr5CQU:tebmQl9moGkzd9Z8OA0WWUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677400422, "uuid": "266077e9-4df0-4133-8fb2-f80463d38d60", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677400422, "uuid": "74d534f2-1c32-44f5-8701-02bda1095d76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400422, "uuid": "8f5f3e2a-5b10-4fac-9e18-cf673ff90f9d", "value": "SecuriteInfo.com.Trojan.Click3.22934.10818.28105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb062a1c-b5f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677428132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428132, "uuid": "56502453-6846-44f0-9ad1-fd897667bd7f", "comment": "Malware payload (RedLineStealer)", "value": "5414696716d21ada49f55cfc3c52649c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428132, "uuid": "5511ad0e-a0e4-4c57-87ab-ae1448830354", "comment": "Malware payload (RedLineStealer)", "value": "6c2256abfa4c98bb023580d3f2bccc8f2faccfb43e6564df1ca3eaa7d47e6805", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428132, "uuid": "2d42e707-b560-4ce9-af35-66d5ecd1d3ca", "comment": "Malware payload (RedLineStealer)", "value": "5630ab7752e51eb76c4ba6c3de5daba9826a2bfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428132, "uuid": "650a9a71-2d86-4182-8220-4745f34cac5d", "comment": "Malware payload (RedLineStealer)", "value": "8f577a7473c4831b3d686ca66e638a67fcde2249e30e44a604410e7b0632235a02a048906f3c2453fefd8efc6f9c8d47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428132, "uuid": "c0dff987-644c-4928-9e1f-b61c1f31b41a", "value": "T13BA4F10BBBE88072E875577059F203C30A35BE506B79829B234F6C5E5C726B4B63476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428132, "uuid": "11bd094c-3c81-499f-997d-dfd0bbc31974", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428132, "uuid": "c61ad294-3b62-4519-9a5c-4e221b43992e", "value": "6144:Kxy+bnr+lp0yN90QE+SQiX1gw6SXi3Nh2cKMWBSJwl/7MF6bgIGn10aqJ6F3zFdl:vMrdy90j/B6qi31j4ew1A8S+w9Ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677428132, "uuid": "901f2ced-9e85-4767-89c8-20af1f6cc046", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677428132, "uuid": "572b161b-6bb9-4b9b-8f54-d06e365ed48e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428132, "uuid": "4eec3bd0-0e19-43ce-92c7-1a5a00644dc2", "value": "5414696716d21ada49f55cfc3c52649c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a7c565-b60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677441107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441107, "uuid": "60e60927-467c-4f1d-94a7-3de6063642c4", "comment": "Malware payload (Mirai)", "value": "300d4aaf2e45c41f3c5d657344db57d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441107, "uuid": "5bca919f-24c0-4f91-a87b-af5428391f01", "comment": "Malware payload (Mirai)", "value": "6d1283edb167b4fd7162490c3ed4f15e9bed406341257a5814c82317cabffcab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441107, "uuid": "c660b7eb-00a2-4bb6-841c-78d603f0ad5f", "comment": "Malware payload (Mirai)", "value": "df7e16a6999f208bcee6a0f49981f96c247de443", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441107, "uuid": "445b10a6-796d-4f8c-b1b0-852348633087", "comment": "Malware payload (Mirai)", "value": "6c7af73a380130bac32cddd2a3b1ed62be32b6cb51c2c8d507e47da1c792c980048adc7629dbcb350ea0494136918db3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441107, "uuid": "879741d6-d0da-4c5e-9fcd-78bdd6b63768", "value": "T187338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441107, "uuid": "8dc34a1e-ce52-4b3b-946a-9f86082168ad", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCv7:jaQFwtOGBvQXxfs3kgCJt/qMF/RCv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677441107, "uuid": "78c5b475-ad6c-427c-b9e6-63fa7dd54083", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677441107, "uuid": "b808c1e1-7743-4289-bbe5-161106e13538", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441107, "uuid": "16bf60bf-9c6a-4391-ba14-fae839a5419c", "value": "300d4aaf2e45c41f3c5d657344db57d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593886ad-b60b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1677439537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677439537, "uuid": "e0262ee3-8ee6-44ae-9df5-5d7e6937710c", "comment": "Malware payload (Stealc)", "value": "c4f3a39d7d4b75e5aeab50c5ddd24a64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677439537, "uuid": "471e0acf-8d97-4699-ad8c-a3c28140d045", "comment": "Malware payload (Stealc)", "value": "6d9df22ed6d7844b938c9b2c3f413e2c7e3306a047dc807fdca6d0edbc2d2528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677439537, "uuid": "026f83ab-4647-45a0-bd79-6274946c2d56", "comment": "Malware payload (Stealc)", "value": "cb83ac380db99c67a26baebcd8773a81b1901eed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677439537, "uuid": "4875aab0-0d43-4179-8fe5-825049e5c5a6", "comment": "Malware payload (Stealc)", "value": "e87814916d014522cdcb69c8ecebb9d5befdec62988064e56aafaa8ad4738256f94d87d9dc817e52031faf81239f52b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677439537, "uuid": "daf98072-ea3e-4216-97f3-5a9e2f228e6a", "value": "T1B354E011B581C0F2F45605B19834DEE92AFEBC7142A8C98B37D87FAF3D703C166A6295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677439537, "uuid": "aafee57b-de74-4a1b-9819-4f856019da8e", "value": "61552f371d50dd7cc1d63f5028ea0b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677439537, "uuid": "033a0063-79f5-4398-84f2-c77b3b5c6e86", "value": "3072:TWSpLLKa1BF53JQZVnZrHsE5W0USAsF6w7AgPD1rrat1TpGMGfr:yyLt18ZrsE56zw7Agr1fkNGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677439537, "uuid": "c367ea5d-9461-479c-b8dd-710ea0888bb8", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677439537, "uuid": "74d90545-90e5-4d27-b0bb-52dbc1b6ba94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677439537, "uuid": "8f58600c-22f1-4450-ab0b-8c647351799d", "value": "c4f3a39d7d4b75e5aeab50c5ddd24a64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b7648d-b5b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677402009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402009, "uuid": "eaf1e025-9e40-41d3-8c82-6d143a32820b", "comment": "Malware payload (Mirai)", "value": "98bbd734e56a8c1939feb087f317e304", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402009, "uuid": "7b8b968f-c7a6-4d11-8069-f70efd350038", "comment": "Malware payload (Mirai)", "value": "6e14f7fdd298a208d537d7a3cc68589bb932d4cf1d38b559c07fe145c1e3d2f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402009, "uuid": "b0393832-517f-415a-8e13-8e9c4c1b45f9", "comment": "Malware payload (Mirai)", "value": "87881200b143fd2251b53df07f254be7b8977ddc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402009, "uuid": "1845f403-7ae7-4b4c-99cd-e44d8e4eaf89", "comment": "Malware payload (Mirai)", "value": "4e3947917a9f6573a73c5cf7e60e76e62751775db1464f6c80239de53b78031e1ff24232a3e76778e8461f0e3c2353e1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402009, "uuid": "dcb2d96c-94de-40f3-81e5-242a43289df0", "value": "T1371318C4F553D9F0EC5A06703076EB365E35F1FA222DE553D3A5DA32BC82602EA0699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402009, "uuid": "43705c90-75f1-44bb-8ed4-fe335baf6c57", "value": "768:xMlB2zs8ssGfrRI6aQ2nEenzsq8uDOycN95VlVs:YYzs8ssGfrRI6aVnEegWOrNrVla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677402009, "uuid": "9c26062f-3609-46a6-b269-a6a26eadb0f4", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677402009, "uuid": "8ae21a39-5e74-47c2-b3f5-d1ce66a4f605", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402009, "uuid": "0847bd40-a9b9-496d-b6fb-30aeb25345f8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4721b9f1-b580-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677379807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677379807, "uuid": "777bcd79-02cc-468f-89a3-3c50f93068ee", "comment": "Malware payload (Mirai)", "value": "dfd9e98410f0918d7b3c89e16bdc0380", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677379807, "uuid": "d4bcf5d8-f86f-4331-bb1b-cbc346201021", "comment": "Malware payload (Mirai)", "value": "6e29738652c01bd6ed58bf57cc1ec408ba11a7b3a7cd45cb3eae0deb3d396337", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677379807, "uuid": "8494dfb6-7786-47ce-8c88-2cc5c698498b", "comment": "Malware payload (Mirai)", "value": "cba09b54b42f7483cece1d6f6f6c56bf269df8fd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677379807, "uuid": "0ec380dd-b0ec-4e9f-89a5-e38ae18499ab", "comment": "Malware payload (Mirai)", "value": "55e761380a3ba7ae4b14b4dfdbbc00ab17d11eef7a714973e9797a62b5afd2e7feb291ae3220adb33ade450b39f25020", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677379807, "uuid": "8fc8f126-806d-49dd-ad28-7dc242aa9d9d", "value": "T10313F1A5538D6082FC3899728D2552CB15A25BBCD1AD313447E82BD116DB0FBEFBC583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677379807, "uuid": "9819bb02-9bac-4cd6-9653-a08d9ac51f70", "value": "768:gv8vFBQ5lZv71twBg7uOVjRxGxGpCVaZ1W5L9bm1r4iXuYwe7RM+s3UozGzC:gvOi5L3waFjQ7VaZ45L9or42us7RIzG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677379807, "uuid": "b8bf1960-6e98-452e-ab2b-57430e67e396", "value": 44000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677379807, "uuid": "eb9a8c76-25e1-4159-9de4-176b9eb62479", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677379807, "uuid": "f7c82d71-0aa4-460a-871f-65b6091a169a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a88d936-b607-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677437848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437848, "uuid": "8db76835-395d-4785-946e-b3bd6c968177", "comment": "Malware payload (Smoke Loader)", "value": "d6cf4080706249aff22c9b449dc45a0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437848, "uuid": "746133fc-ca68-4922-94f2-3678f383305a", "comment": "Malware payload (Smoke Loader)", "value": "6f4f420018f7c51f4b3e6428f2e8493e80195d8199919f3619498dbb0935f8b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437848, "uuid": "ef405862-3340-45d1-8309-29618e5792a1", "comment": "Malware payload (Smoke Loader)", "value": "b61e4a52de48044f94d154e9bb8259a16911fb6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437848, "uuid": "ec5b0147-2161-41df-8910-b7c25bfc5158", "comment": "Malware payload (Smoke Loader)", "value": "6fc87b3ce1f8d15a3dbd10715c892d6578756c162eb9b44ca4b0f54ed24a04ecf413f1962d6a6fdbe8bde344d889fe8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437848, "uuid": "760eba25-6d62-4d1b-b180-441489761735", "value": "T1BC44D010B4C0C472C89605B49835D5F92F7EBC627B98899B73293F6F2EB02D156BB361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437848, "uuid": "c063b6bc-e1ab-46a2-8ab8-ddf26b50387d", "value": "bec0a8a77ea6e846112173ee928054ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437848, "uuid": "dcf51360-4950-4087-9e82-f9cce8f6dcf1", "value": "3072:543EumL/h0NcYDxAuMB5wNoJbcdh7MfUurvkrvoj:a3EjLZ0nso777MfzYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677437848, "uuid": "eccab368-5ab0-45f4-af1c-d76195f41278", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677437848, "uuid": "c726802f-ef8e-4464-b668-266d881cdca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437848, "uuid": "9e8e7702-5a05-4d15-a3a5-187c7d53fb8d", "value": "d6cf4080706249aff22c9b449dc45a0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a21df5-b59f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677393045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393045, "uuid": "e42c7876-ba44-4d2b-a2b6-232a4fe60922", "comment": "Malware payload (RedLineStealer)", "value": "09267c4eda3a0cf1288720aef4da011f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393045, "uuid": "84051bac-bde4-43d0-a8ee-b55de7849bda", "comment": "Malware payload (RedLineStealer)", "value": "6ff6a54b9857a5d24f703f911524abdac458b741aef81a74a8b55555894285b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393045, "uuid": "6a15a631-6203-4778-b6fb-a2e3d02db4bb", "comment": "Malware payload (RedLineStealer)", "value": "d31a2095aa0a73d8bc09d695513203e55c176928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393045, "uuid": "ad56e146-a2ea-485d-9878-a29e519c6b42", "comment": "Malware payload (RedLineStealer)", "value": "414e3cd93bdd4bbb3b8ebc29620de3f5f498e9a0591d450f105930734167cc85d0af087dede96a25cf3b9e7aa4f55a95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393045, "uuid": "39b0cef8-a124-454d-b7c0-d6c4ba423747", "value": "T1EF94F20BE7E84536E8B427301AF706D3163AFD615B34829F268E6C5A1CB2670B53537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393045, "uuid": "e82a8e42-1434-465f-91bd-535a510147ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393045, "uuid": "9d56a0d9-08e5-4e99-bf88-c63725730c4d", "value": "6144:Kly+bnr+Gp0yN90QE0Q0WHWC+dbx1A59C7ai4Y3HaBWAeDMLu5/z8mS86:3Mr6y90hWCWbxy59C7a3Y3PfMLmW86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677393045, "uuid": "36f5f3ec-b898-4b4c-89ab-f8f1ae4ecf26", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677393045, "uuid": "049436bb-d93a-42b9-83bf-d9ae29618212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393045, "uuid": "bd204534-8782-4573-8e18-c22a169106b0", "value": "09267c4eda3a0cf1288720aef4da011f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02441057-b5be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677406320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406320, "uuid": "42ad91a1-6225-4e1f-949c-3614386dca5f", "comment": "Malware payload (Mirai)", "value": "c07f5f56035457a5faf33c490f185a80", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406320, "uuid": "81f027a8-1c41-4f92-91bb-7d64990bc5b9", "comment": "Malware payload (Mirai)", "value": "7120a2dbb1faac455fbba9ecf6bda0a90d7d4a56e34828d99273ec984c81fa32", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406320, "uuid": "5f6f3abf-e8f2-46e8-990c-0a51c9a636d9", "comment": "Malware payload (Mirai)", "value": "ff532390f414358a40e0ae4ca770d9dde7bb62d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406320, "uuid": "9d13ccc5-70c2-4043-bf69-766680c0caf9", "comment": "Malware payload (Mirai)", "value": "ce2e2cf9a7b73ca4a971dd4a39e22843795fbfdaaecb93737213cc80fd813dd1e86f94098a30927f2e369b8ed6eba77d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406320, "uuid": "ef54bc1a-b27d-4a8e-9866-c27b691ba3ac", "value": "T171035CC49893D9F5EC11017124B7FB328B36F13E10AAED8BE759D532BC43A05A20729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406320, "uuid": "ff5f0fd6-1402-44c9-9b83-1b446dd96a25", "value": "768:fyDwe2jd+xIPTWrC8QY1Fsu2cUioZwV3sUqXGhV5Ig:Awe2j02PirLhY5ZwCUGGhvIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677406320, "uuid": "b68ca5b4-4725-464a-bfe7-be6bc3010a18", "value": 38832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677406320, "uuid": "fcb14cf7-d99e-4bd1-b127-44226a50f18e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406320, "uuid": "4a8602ac-4ade-4b4c-af3c-1dc64831c26f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca5d702-b5f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677431517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677431517, "uuid": "3ec17482-e5cd-4555-b26a-331452f8daad", "comment": "Malware payload", "value": "23fc9a127a03dcaa99f007fa78a6f0e9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677431517, "uuid": "8f63734d-72b6-46fb-b825-0f0c42b81641", "comment": "Malware payload", "value": "7182f9d243644013794b697cdde416ec941c2f819ea386884ce1317aaaa88be5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677431517, "uuid": "a9b4ff8d-f15f-42a4-9029-5a8cbd017283", "comment": "Malware payload", "value": "c5e8c16f63a280299e06168e0ea49f5b537a113c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677431517, "uuid": "4d993e67-f663-4cd2-a579-7063bcb8a8ae", "comment": "Malware payload", "value": "f29be5e67efe200d80e15553059cf06a6d4ba02c66d96be940741922d72a0513287ce242563533bdf77f4a47ff508513", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677431517, "uuid": "31239c1e-edae-487e-841f-cd34dcd59bb9", "value": "T156760286FF59A93FC87740730F9A5631366A8D158A42A747798C371C28736EC0F89BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677431517, "uuid": "6a262350-7057-4036-937d-d11d1dd4ec84", "value": "196608:EB5pkj2chjBGLhqxVTFWlQu/+AAnxnirJ9Tk20OP:EB5pkjJjmAVTFXu9Anxn8AQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677431517, "uuid": "69e56c11-2c6d-4c56-afbf-6b49f68151e6", "value": 7719848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677431517, "uuid": "3eafb353-b82e-47ec-a002-d6f70f408ba7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677431517, "uuid": "c403e962-5916-4117-9dc9-8d0fdbc6fb91", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8f58fe-b5eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677425775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425775, "uuid": "894ab4f3-5bc5-4172-879b-d37f83db3580", "comment": "Malware payload (Mirai)", "value": "d576bb3b9c6b2bcf139742ee78169e79", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425775, "uuid": "5d108938-487b-4dfb-aa9a-1091cc6002a7", "comment": "Malware payload (Mirai)", "value": "72607a6947873676c455af20f9ca0a2cc8b3db0ef2d063a530e35f994283211b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425775, "uuid": "470445f6-a312-4e70-ac15-0efac148384b", "comment": "Malware payload (Mirai)", "value": "6dda8276b4b85974ade5819ec99f2ffc135182d1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425775, "uuid": "3e9d7424-1491-4ab4-9f67-cacb85005308", "comment": "Malware payload (Mirai)", "value": "3abd139cda037479e2e357301ce0e5addf79d2e40c56f786a207abeafbcb6f4969cb338a4962f66ef61b064ead0042ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425775, "uuid": "510a8518-a5b3-49f0-bd69-7346979c3e53", "value": "T169E33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425775, "uuid": "4e108e81-fdc0-43e2-a0fa-a324975b4caf", "value": "3072:yJTc2PBSpmB7Oabvzj4dlRsh8ZQIld2MXkkTM/9zY:yJTcGFOabvzj4dLsh8/2MXkYM/9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677425775, "uuid": "4b3f8f49-ff31-46b7-9697-e0a899d9eb9e", "value": 150602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677425775, "uuid": "34fd86f1-f5a0-47de-80dd-2b275f42e151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425775, "uuid": "2d6162fe-2632-41bb-b70b-2858ded32b80", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550d4cf1-b5c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677408606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "e87383fe-5407-40a4-9295-0cf025829600", "comment": "Malware payload (Mirai)", "value": "716acb2e09206518af9307c1303716ca", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "7becf2ac-b792-4622-8457-65104c320a06", "comment": "Malware payload (Mirai)", "value": "72b2902b5994a96c85b4c5ac6cb1674cff92dd135cd5789c1f828fbe2e1060a7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "1344c2df-0e38-481f-bcb3-ca6b2c7f574a", "comment": "Malware payload (Mirai)", "value": "a055093d9d2c228851ed1cd096c96afe20dd9c3f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "148e121a-4bec-4011-957b-7fea158756e5", "comment": "Malware payload (Mirai)", "value": "9243beae1d2183ea439f1f183b781a1de85d6701081a4e43778bdf148d18a2925dfc4059aef891478124c7d69eeb50f4", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "99d338a8-ebfb-4cf1-800f-188f3a8facbc", "value": "T1C6935D27B552C67BC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "1599b88f-5f64-4985-aab2-68e041e892d1", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3byPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKLifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677408606, "uuid": "f7cce2b7-8e65-4a85-89f6-e1b90ad1535f", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677408606, "uuid": "d6c228c7-847b-4bfc-b969-6a5f55b181b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "77580a04-28c3-4847-9c17-49d6bee1888e", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ce557c-b5cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1677412604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412604, "uuid": "3a6438fc-5728-4ba5-af19-5f255439123a", "comment": "Malware payload (Vidar)", "value": "d40cd0fd015b070968dec65c7033a590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412604, "uuid": "ddeff541-2ebe-488e-b474-3364e2e7e02a", "comment": "Malware payload (Vidar)", "value": "733501d537884cca4a051c6669c594411f55c910a4b71a0d31e5c622641b841d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412604, "uuid": "4004a610-5c08-4267-8fe2-4cec6029bd74", "comment": "Malware payload (Vidar)", "value": "cd14ff9c04e8bfab30b0e9a7fd2ac56e2be59ffe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412604, "uuid": "b6b63c3f-e6bc-4908-8c84-4064c2fd44b6", "comment": "Malware payload (Vidar)", "value": "8a918b7dd55a26e901662c95b531c47e0f7a59b2870c8ff9245dec21c15f66012c235286a5476d8ed29b95e7e857a057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412604, "uuid": "39411aec-06ec-45c5-85a8-6e8c85bcf9c2", "value": "T14BA4CF033F9CC1B6E4138DB44530A322576AD4B2678F6787B3E814299EE12D95E387E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412604, "uuid": "eb5aeced-2117-4028-9126-395db361479d", "value": "60e548caf08a49b383f95d28d5b1adf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412604, "uuid": "f1c67462-d342-4dac-8414-5b43e3df0fcf", "value": "6144:YT12dUBb1VByTIKlHrWcRTPGEMo01eAt64YF6eSyxpy/ibwH76y:YT12diB6lHtuEdRWjYDtpbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677412604, "uuid": "97802bc8-32d8-47a9-82a4-e7e0561212f8", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677412604, "uuid": "627ea6c4-380e-408c-b9d9-235e001f7d9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412604, "uuid": "9647ba36-8fa6-44c8-915e-a5c2c3205991", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912550eb-b59d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1677392386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392386, "uuid": "d6269a59-8199-4d45-806e-47f903ada837", "comment": "Malware payload (SystemBC)", "value": "513c17ab6d8ec79ea6c5e196da67722c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392386, "uuid": "d953d3c4-4f15-48c7-9a10-989319d323ab", "comment": "Malware payload (SystemBC)", "value": "75404543de25513b376f097ceb383e8efb9c9b95da8945fd4aa37c7b2f226212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392386, "uuid": "a32013f7-3fd4-4c5e-ad90-c169ca7bf3b6", "comment": "Malware payload (SystemBC)", "value": "3a831bc0c30c6c330070d3065c4c7b39305a9822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392386, "uuid": "30c96435-8b5e-4833-a82a-fd61af884703", "comment": "Malware payload (SystemBC)", "value": "170df035597d1f419edbecd7c44f3dc4771723af43079ebd07ee996d4e542b8f79a726d58579c749f5c2292049ef8bb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392386, "uuid": "180bc442-f803-4fe5-98d5-99ba2f262bfb", "value": "T155F1E526BA904163D337E6BE7B4F5336E47F6A725330A009DFB11D1064B58B3CB26609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392386, "uuid": "abe0e7f3-cba5-40c7-8182-d9315c848079", "value": "c43eeea4eb37b541724563a3273bc88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392386, "uuid": "4666c989-d50f-44be-b793-7908aa9b72d0", "value": "96:PNoCMDnHFBkGNutaR/3Mnh/MM4odWLqhZAoUyLh/b9U/oo2i4glifqw:FoTH7kGsaBc/ZbdNdh9i4mBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677392386, "uuid": "9a6caced-14a8-4655-a7a9-7325d8c0e80b", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677392386, "uuid": "8ad5a245-ce35-46f4-9e37-85f0651b3bdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392386, "uuid": "ae2436df-7b8d-405d-97e1-c719f4e35823", "value": "513c17ab6d8ec79ea6c5e196da67722c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a007009-b591-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677387006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387006, "uuid": "bca60e64-d862-4ddb-ae56-d6589858a28b", "comment": "Malware payload (Mirai)", "value": "5dd22df45e9598169994095212df2a36", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387006, "uuid": "3be772c7-f0be-460b-8aaa-47424e7472a5", "comment": "Malware payload (Mirai)", "value": "75fd98fef4bf68f6bf19fe3837e659483f7c12c3a3ecbc79bb449321db43d8cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387006, "uuid": "3d77bdd6-0800-4fc4-8ab5-bec900edd141", "comment": "Malware payload (Mirai)", "value": "b51d3744d87d19a5667d7d6b0a4bf778106a92dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387006, "uuid": "d2c66126-34e4-40f3-b94e-e5f297e461d1", "comment": "Malware payload (Mirai)", "value": "aba89b8fc2257c64b06454499525b7db0692bf554c898cb8c7f0d70474d70042c6c3b0a24ad7d6d95a1858c12e8fd26c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387006, "uuid": "d20ef394-aaf3-4093-aee3-09430ae77268", "value": "T169C2F1E53E77799BDE25013D34AC9E3752B5E011D7AEAB13A240920C20071BCBB728DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387006, "uuid": "4cbdb13b-972c-4a2a-ad62-f41723832cfb", "value": "384:MG1DMwk8JPyG3GDZaEXVZVBy6HInRiWLRYh4Sw4cGJYeRzOFGBzd8QSxYDZxNy0r:HMwoDZLFbBy6HQHRYfeAxdd8fYDI0NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677387006, "uuid": "f3ad64f7-d332-4c98-9923-4e3827366777", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677387006, "uuid": "2bce9a83-ff51-49b0-a9cb-29a06bb7a07e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387006, "uuid": "55cf6d6d-5beb-45a1-b288-c71effa6a6fa", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d06ccf-b5e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677421256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421256, "uuid": "10c45d39-07b6-4003-b28c-ae0148055404", "comment": "Malware payload (Mirai)", "value": "3c9e497a6ef8e7af3f44a99393f1f626", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421256, "uuid": "45f22f9a-8f91-434b-ae0d-0201bae15b89", "comment": "Malware payload (Mirai)", "value": "767cc9416dcf742dd6bca844aa07f048e710a3826061b057bcf8577afd81ae5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421256, "uuid": "1cce9a09-3cb1-4939-b141-5800840da190", "comment": "Malware payload (Mirai)", "value": "2fe032944d3d3efb4c4c0b6baf782c41438a5915", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421256, "uuid": "30f736ea-f8ae-454d-8a0a-2bc10a0a88ca", "comment": "Malware payload (Mirai)", "value": "7009c268f0953c886dc0d6316741707a5c07fe9877dc02c372e77da38e006c2b52123cc961a7f892860819ae82d49403", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421256, "uuid": "6e244741-1216-42cf-aed5-7e83d915b335", "value": "T1A3044A05EA408717C1E3277AB68F424D333397B563DB33159938ABB43FC2BA91E26951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421256, "uuid": "4728755c-6558-4355-adfd-c0e03d60d749", "value": "3072:vd9CEoaapp3Gwz1LbaugSTCx3vcG/WABM/9DLN7mgwwBLUQQd2:l9loaapp3F1LaiCx/cG/WyM/9d7mgwwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677421256, "uuid": "3ce66c87-cd78-44e0-ae64-152fde5aee4a", "value": 179694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677421256, "uuid": "55690870-e2e6-45d1-8258-eb504040482e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421256, "uuid": "887095e8-5dc3-42c2-8d42-e22e997925b2", "value": "3c9e497a6ef8e7af3f44a99393f1f626", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b67e94-b5e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677421242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421242, "uuid": "7a7ad561-4b3c-46bf-a9bc-baf8b7a7b466", "comment": "Malware payload (Mirai)", "value": "536a84e7690245ef1047c9a0630ebfa8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421242, "uuid": "f47b18cf-4909-4d9e-981b-482270d3b3b1", "comment": "Malware payload (Mirai)", "value": "76c4faba7d9721de9acfc236c1aaea7158d6a2ae5cec009e2d475e414a6db3c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421242, "uuid": "516bd019-2096-4e94-a285-5dcaaceb14f9", "comment": "Malware payload (Mirai)", "value": "c0ca56b13c1e5715882e278e264f57b13fcddace", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421242, "uuid": "3bb9f2eb-2ae7-49e3-80d2-0e4d6b26dd46", "comment": "Malware payload (Mirai)", "value": "e94449f3354410dcb3f873e1d6b6c1c7aa48f72ee08dd488cf24e71408736fa9566617eb3ad1b1b6b05ee7c54a2086d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421242, "uuid": "c5b0edd7-e7b8-42bf-8759-c18591feb987", "value": "T1C9C31901F9008767C2D327B6A78E438D3B3657B957DB33116A38ADB42FC1B991E395A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421242, "uuid": "d37188f9-9517-440c-9727-afd304ed2245", "value": "3072:/mXJ2iDeWOFS4tvCTek8tHXsmqSQQxhPp4XRv5:mDehE4tKTVmqSQQxhPp4XRv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677421242, "uuid": "faddeb5f-d23a-4ad1-a4fc-6d38a140ca4b", "value": 126479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677421242, "uuid": "12062197-46c4-47fb-acea-0b6b26a59a6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421242, "uuid": "9aea03cd-c7be-4543-85d1-5107e0808e59", "value": "536a84e7690245ef1047c9a0630ebfa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0cbee4-b60d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677440433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677440433, "uuid": "c40645b0-bd55-497f-acbc-bcad0548aba9", "comment": "Malware payload (Smoke Loader)", "value": "d87275bb4bc88e24ed1f3356bb725a66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677440433, "uuid": "89fc1eb2-65ab-426c-86fb-c5d4ce5d27ce", "comment": "Malware payload (Smoke Loader)", "value": "777a98db2b04de56c57e9d4485d4e8e8bae7e28cb0b276742862fcf22ce85f1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677440433, "uuid": "c8dabfec-1412-4d95-9ef6-852f0130c30d", "comment": "Malware payload (Smoke Loader)", "value": "077aa7537b98b67f3a7507ad28cfbb4a98ee5919", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677440433, "uuid": "997df674-4f03-4b4a-8c05-d0cff8a6f801", "comment": "Malware payload (Smoke Loader)", "value": "f7b3b9522124960033a3ede0f17da5c031bba93355f5932f1ef2405dcd21caabbdaf6a25cb4f8b1ef31dcf1ceaf5287f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677440433, "uuid": "2f475b4b-4fc4-4579-8c10-a67fbdee306d", "value": "T19954DF11B690C072C44601708835FAF96A7AFC72965BCA5B331CFFBF6D3139066A7266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677440433, "uuid": "bc917c8e-8557-4ea5-bae2-c4314e48df68", "value": "61552f371d50dd7cc1d63f5028ea0b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677440433, "uuid": "a53fc41b-6116-48b2-bbfc-cd735215fbfa", "value": "3072:CDrMZKLXaM6BF5DRJZuUiEaGoxcfAKjmdFJWtDzPbyXlpo/2Rqgyr:qrNLK17Bi7qftY6VzUlpo/2RqgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677440433, "uuid": "26d78af1-90b5-4608-974e-3ff9224223ce", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677440433, "uuid": "628d9f62-15e6-42e6-b069-8484cd6001bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677440433, "uuid": "5b45eb04-c2c6-4756-8b47-008e4836dded", "value": "d87275bb4bc88e24ed1f3356bb725a66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86384346-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "7960548c-f440-4eb9-ab18-377bd7a70edb", "comment": "Malware payload (Mirai)", "value": "f0cb9b1735a5e85b6b87ca293356e43d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "a909d0b0-865e-445e-8e6f-3cb4f0250e5c", "comment": "Malware payload (Mirai)", "value": "777ad6afaa9e21288fa639687ec43c2fbc879a748d59d8f87671f9e723b82c54", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "c8c24583-221b-4c37-8d85-8f006f3dcb16", "comment": "Malware payload (Mirai)", "value": "0244ec066b7d69a2d7ec48691c718c50e14129d7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "527873e1-cb56-466f-bb47-643705b7f70c", "comment": "Malware payload (Mirai)", "value": "b9223803732bdb85e04b041a0667fc3d08fd242a976f267de9d14f7088f9967988291a628eb00e1da4e6d2cb441fa15f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "1442d044-7e0b-4e7f-be68-8fb04d649488", "value": "T18A531782FC81D902DAD4137ABA6E51DE33253399E1DE7207DD126F503BCA91F0DAB252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "ce08586b-6c1f-4b9e-b093-5053e722b304", "value": "1536:8RvYsn4tQHe+k2BcOiGVqBtV1NNPGTJ78:8RwsnQ2SJJ+J7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372611, "uuid": "265ad750-a408-4205-adb5-10325e2d9d8a", "value": 64052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372611, "uuid": "ba1f1557-34d9-475f-bcd3-bc739cae2baf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "ae468032-6d4b-4a49-8325-93501d1f4e8c", "value": "0xh0roxxnavebusyoo.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b055b0-b5be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677406324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406324, "uuid": "459924fd-2df3-436d-8b1b-b284cffcb062", "comment": "Malware payload (Mirai)", "value": "e39ade54bee5157f28e85d84d9fc7b3e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406324, "uuid": "9e9743ed-ac52-4083-9319-49d6fe6b8de8", "comment": "Malware payload (Mirai)", "value": "7797bae3a8bf4708b005cb3f892a8fc838afcde849e16fc44557b259f76b5f89", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406324, "uuid": "363b251c-1ed2-4422-9bfe-bd6fedd6ad41", "comment": "Malware payload (Mirai)", "value": "57e5f550efc5891d30a81db0e21dfc6a75d55c9f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406324, "uuid": "c5b81fea-7094-4c68-afea-13cb3a3bc370", "comment": "Malware payload (Mirai)", "value": "57b42a26c6392cc384d442c778bc857878acf2db8b79877a64939aa03609363d7803db2ec134a2acb980429d7919f097", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406324, "uuid": "c66f52e5-9bce-49ce-a89e-c1c4b09aa5f4", "value": "T1C0B32A46EB808B03C4D52776BA9F42453323DB54D3DB73069928AFB43F867AE4E23516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406324, "uuid": "761a0b32-2687-4b0a-b846-a16499aa6820", "value": "3072:nOVG67CMsnb6GVrLKcCGql3zOXTHKrgM/99+HPk9:nOVrGVb7tLKcCGu3QTHK0M/99+HPk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677406324, "uuid": "93f967df-67f1-487e-bb10-4651ec52cbbb", "value": 114457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677406324, "uuid": "f85a3d12-dddf-4eb4-8f94-0d4fe8d731dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406324, "uuid": "d665f33a-e48e-4303-baa3-1896812e3d4f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6a6c98-b5a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1677393618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393618, "uuid": "86f90f0a-f698-4d56-b1b1-5ed551453ca4", "comment": "Malware payload (njrat)", "value": "7b1f4a8abf0064ca581fd8816799af57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393618, "uuid": "3021b7f8-42e1-47b6-811c-ea49bc3e5943", "comment": "Malware payload (njrat)", "value": "77fb0419a75b3a86b744f8f7624ea7c80712fb90a9458a835a8c15babc9eb032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393618, "uuid": "d4a3d3e9-9462-4f6b-a560-beb2c06e6704", "comment": "Malware payload (njrat)", "value": "c8699ba7adc11dd1a104625cf81b67bf8c77019e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393618, "uuid": "9caac01c-02c3-4acb-beb0-0d1a4413e2e8", "comment": "Malware payload (njrat)", "value": "ab54d91e73eb43c339cadc7fd655ae38107eb1c9c475d7c8c091789535d1b56c36f3ce3feeaa3638440dca30e9452e0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393618, "uuid": "67aef3dc-d45e-44af-8f20-ca039c71473c", "value": "T146033A4D7FE18178C4FD157B09B2D41207BAE04B6E23D90E8EE564EA37636C18B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393618, "uuid": "c4da9dd3-31cc-4fdb-8f0b-392ec2b289c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393618, "uuid": "3b74b600-594b-4dcc-8653-76ead4cba4fe", "value": "384:yJbTUiSmL1G5k2gyk/4sP9S/ksVW07rAF+rMRTyN/0L+EcoinblneHQM3epzXnp0:YbX32bk/4sYssVW+rM+rMRa8Nutpct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677393618, "uuid": "45f9a6b0-a7a1-4b1c-afb8-e5af8004eebc", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677393618, "uuid": "bd8f0f2c-6fd2-422f-89c4-83e685e8d525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393618, "uuid": "d7280dcf-5da5-40b3-9451-a05529071d2a", "value": "7b1f4a8abf0064ca581fd8816799af57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f20cb25-b5e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677424568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424568, "uuid": "661f3d97-80c0-4820-af7c-50a34a82a424", "comment": "Malware payload (Mirai)", "value": "211b5362a9eaaf4f1854e830dace1359", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424568, "uuid": "eab069a0-952a-406a-b6f2-d013f22de5c9", "comment": "Malware payload (Mirai)", "value": "782cda31ba590167ed739a1007ac461b82c4ba5ed526015c86ef650cecc4ec3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424568, "uuid": "f0331348-b83b-45f6-be67-db82484d2857", "comment": "Malware payload (Mirai)", "value": "43a78c5b456fd3952f6c11d1adee59f3f57576bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424568, "uuid": "5d12af59-35e3-4319-8f55-c363b13b1b13", "comment": "Malware payload (Mirai)", "value": "370de244d3abe5e7f10ea5b46319859722420929c6ff818103f530374d3e0b01a569056badacbd0e9b23c986878ad8b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424568, "uuid": "6aee97fc-b8ff-4f69-83b5-ecb33e43a246", "value": "T1A7C2D0E0B726FD31C420AC3DE53B4D893A51063C91FF353664259D399EC1A5A62F88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424568, "uuid": "b1fd9c7d-39d0-45d1-aca0-c4ea35acc0ee", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrd9q3UELum:OKy4qfqoeJdXWgwLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677424568, "uuid": "3d9000ab-a76b-417a-8d36-50aec348cf62", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677424568, "uuid": "8ed3e4f4-959f-49e1-bfd1-fe7490d17109", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424568, "uuid": "1d52dd00-f623-4f0a-aa8e-90a884d3fbb8", "value": "211b5362a9eaaf4f1854e830dace1359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26795da-b5be-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677406642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406642, "uuid": "c07acc07-f250-4ff3-829e-9db1cb1bc708", "comment": "Malware payload", "value": "c949b620670d35a30792e1a95bc30819", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406642, "uuid": "4fdb8e7e-456c-4ee1-a604-7ad347651bc1", "comment": "Malware payload", "value": "7d57890cd431432dc4492be4d90f0dcbdb772a98516eac4aa53edb39111d4af5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406642, "uuid": "ea11e9c4-05d8-499e-b62c-68d064803534", "comment": "Malware payload", "value": "a18ac6b0f01867021368329484e26c6d71cf0b5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406642, "uuid": "d183423f-0d4d-48f3-abc2-0b2ffd63fb14", "comment": "Malware payload", "value": "2868c980bd81ee5c41dc4afaab8ec6bf678f004d0515016ef6964673cf22bd1ef855fab46c4712856798e6b60248b05d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406642, "uuid": "a43c968c-e8ca-4c6f-8881-b1f0b665228d", "value": "T12613F1510805CD97E76725BF6BDF07ACF461DEB9684DC732286721CA181B105F3A2B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406642, "uuid": "ccff42b6-4721-490f-b13b-a924a6f469cc", "value": "768:+WHAQ/jxWyV/vmEXDmi99CQCy6qmRgk0Z5ewDOTrCG1LJ5b:9XdlV/7XDmozCyEOZ9SmSJ5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677406642, "uuid": "8b822f40-39a1-4b0c-8044-687d193c99f1", "value": 44236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677406642, "uuid": "bfcc98f3-5dae-4d7d-8627-8ac71714ab60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406642, "uuid": "e97f7a32-1041-46b3-a3d1-816abef417c4", "value": "c949b620670d35a30792e1a95bc30819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1d4f25-b5cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677412806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412806, "uuid": "3350168a-8c8b-409f-ac24-41bd35743649", "comment": "Malware payload (Mirai)", "value": "ef5fabea3612a6f98e290fbbab6934e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412806, "uuid": "a3dfd0d6-4807-4c37-81cd-da8e3ec0de8e", "comment": "Malware payload (Mirai)", "value": "7f21b755aecab2fdad958467c8e00ba5ea8c22cf5f6c8dfe2eecf456a9773945", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412806, "uuid": "d053098c-3d53-42cb-ba6f-7e85f453a465", "comment": "Malware payload (Mirai)", "value": "c6bb5bb13c0918214a9202c351ac0a32d1c82c02", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412806, "uuid": "55f868ce-0088-4a0c-bc82-d4ea3a4eeeae", "comment": "Malware payload (Mirai)", "value": "ac0aadba3df8c347831e90971fb004cb95dea60597fc9de80cf633969a916d2f0cd02aca3e818f83e02832334a6b8ec2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412806, "uuid": "4f25e632-d9f4-480e-99e7-700d5fbdda16", "value": "T17CE35C46EA808E03C4D61776BAAF424933239754D3DB73068D28AFB43F87B9E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412806, "uuid": "1fc84fd8-e335-4488-8ce0-060825d76098", "value": "3072:zv77jPmI47aSDV2u4AUDjNLPMvEn3ExYM/9QzjTf:73aj7aSDV2uJUDpQEn3EmM/9QvTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677412806, "uuid": "7e41157d-838c-4faf-a339-311a37cea361", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677412806, "uuid": "6f9a1eed-2515-4ce2-88b6-c7b6f796a664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412806, "uuid": "5d3ece5c-119a-4835-98aa-2d7991381029", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5057f9-b57d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677378425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378425, "uuid": "6e140e85-f863-44f9-bccc-131d058ec093", "comment": "Malware payload (Mirai)", "value": "539042f9945e6128e3daf7e0f76e180c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378425, "uuid": "302b279a-258f-450d-8b80-585936f4180f", "comment": "Malware payload (Mirai)", "value": "7f469ffbeb4ceb1f00e72689222396680d2b27c5e4562d36a727a2e46b48d6dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378425, "uuid": "e52ebb00-e535-44ef-b54c-c11e0a522b7f", "comment": "Malware payload (Mirai)", "value": "041f4df5ae245c617c607f6bea53348dc2678c42", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378425, "uuid": "f08a1fed-a0c7-4b9c-ba63-0292ad66e47b", "comment": "Malware payload (Mirai)", "value": "d11c6188c8985a877b357ab13115cdfc6d9645c583f1bf2aed8f38b062b7d80be5751ac66a68b0118157a999e910206c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378425, "uuid": "eaa3a54f-393f-4a75-adcd-c97152c7ce9e", "value": "T163B3B65E3E218F7DFBAD823587B75E22964833C627E1C585D16CE6011E7034A342FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378425, "uuid": "dc4bc965-7d2a-47f6-b06e-704986079380", "value": "1536:FZbuKiR7jR5nHVuXoT3VWTTOeYyhfz0s8VEfercOZWY:FoKa7j/Hg23VWTTOeYyhfzhMaOZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677378425, "uuid": "25d6a581-c7a1-4669-927b-f1e636f884ff", "value": 109352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677378425, "uuid": "870a3914-88f5-4e39-a999-0dd760a3a1d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378425, "uuid": "24df80c4-d46e-4cce-8b93-300bbd4a3be2", "value": "tamkjll.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2e547c-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372408, "uuid": "7985d04e-1873-4fea-be2f-63cb9e5ad7c3", "comment": "Malware payload (Mirai)", "value": "34ff3a05c29ee6640107658a9d5c1b95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372408, "uuid": "78d21ed5-c7d5-4292-80c4-8365247f4cd4", "comment": "Malware payload (Mirai)", "value": "7f8a6142a76b2e3679ed643cd7f7b307d7b444347fb9a4a12dc895764314ddad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372408, "uuid": "5cdcb757-ed56-48f5-9c78-894e348a546d", "comment": "Malware payload (Mirai)", "value": "ad848758279896836cf9dc1821fdb4df4ad439fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372408, "uuid": "47ad7927-75e5-4c7a-8499-3464a96c17fd", "comment": "Malware payload (Mirai)", "value": "5e710712da0acf7392bfe9300e17cf140d5becfd3d48f8ede792480d0592ed9b8865d15b237c8006d8bccfe021b4e158", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372408, "uuid": "d66241de-e1ba-4041-9973-7901ee96d245", "value": "T16E534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979A96B1E365181FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372408, "uuid": "a81673c7-9f10-4dff-8007-2399a85d64db", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG5UmtTy5EM2y/p9OyDQvSFRMNYL6FV+tg6wWG:+5HAdOmGyNtTAdHOyUaFRMNae+aTWPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372408, "uuid": "2e32da14-4454-4b94-8ac6-9ccdcbf8d7ab", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372408, "uuid": "07c6d20d-2d53-4212-947e-505499686120", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372408, "uuid": "bfcb29fd-765c-44dd-bd07-858e9324794d", "value": "34ff3a05c29ee6640107658a9d5c1b95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5e9f13-b5cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677412137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412137, "uuid": "73d8969a-b379-46d7-a48c-9fdc9fa38066", "comment": "Malware payload (Amadey)", "value": "a0c18e494318c8a2590f5aa651acb365", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412137, "uuid": "517a864b-42c0-4b4e-99a4-d6017ceec07d", "comment": "Malware payload (Amadey)", "value": "7fc8e1b0767bfe07233f7c687cc3d5cd747531af0dd880775b1ce0933c26d9c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412137, "uuid": "1145919e-28c3-443c-8c60-c3238a51962f", "comment": "Malware payload (Amadey)", "value": "881c51763810892b7b24a967ff8b4aa69d141eb4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412137, "uuid": "390e522b-a5f5-42d0-892b-65790778bc36", "comment": "Malware payload (Amadey)", "value": "b48adcb17d7e0373099af5fdd35a9a6f2842a7a63d86874de5e119af0922a4ca2658102e3b83821f01e17822b956f87b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412137, "uuid": "59e58de7-ded0-4d39-912b-421478081b34", "value": "T12A35231BF6EC8432E8A567B004F603D306767D629A78428B634DDD5A28726F4FD3136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412137, "uuid": "d7c8bf12-70fa-41d0-882b-f0face6c81ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412137, "uuid": "fbdf99f2-ab83-4e5f-8773-c386cf1279da", "value": "24576:TyCsAXcIdx6u9nzTyRmPtXHSbJe3mGu9Rha6G9W6+sH:mCsAX3dx6u9zTyRmZHSb7xN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677412137, "uuid": "a16ec2e5-1db6-4ed3-bc64-829e70ff0bef", "value": 1154560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677412137, "uuid": "6dc20da6-cae1-422a-884d-ed9c7d5c0258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412137, "uuid": "ed697945-b93e-4ee3-b089-89137da244eb", "value": "setupforwindows.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8de2f8-b631-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677455949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677455949, "uuid": "2db122c0-1021-44c2-8846-ae01902325af", "comment": "Malware payload", "value": "cd6ad5385fb0ab66de88a64a335da8a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677455949, "uuid": "5807ce4c-41b6-40c7-8fed-bcd3c2b30d06", "comment": "Malware payload", "value": "8182b0e3dc7fb2aebf6c1c7453ee41b82b93804588b8e0765d28caeedd125d44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677455949, "uuid": "5810cbc8-9811-4ef8-8196-6348eb7e7650", "comment": "Malware payload", "value": "6958031c2e143bce1a3668fe8fc656f3093d75b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677455949, "uuid": "40b46759-39a3-482f-97b3-4b2b2a17db8a", "comment": "Malware payload", "value": "bb59bbc7189fc002d747a11f5fdd07298b7639eefab57f964ab39da41c993257561543b917a53db0d41fdc15da1057d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677455949, "uuid": "c238750f-726e-4e3d-b169-97027faf0a19", "value": "T1B2452397FBE48076D87453711DF603E32A32BD526A3D469B638BAC190963664273833B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677455949, "uuid": "2bbbb09a-6efa-49bc-9402-9b8d8acba1a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677455949, "uuid": "85ebfb22-d7ff-409a-abc6-dbf2e7b0e2f6", "value": "24576:WyIZeVwJ2eo+sijjFhfyT8AWCdelv8oK4oh0:lI46J1oDij5JK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677455949, "uuid": "655dc7f3-119f-49ec-bb11-001585eab5c9", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677455949, "uuid": "825bbeb3-1acf-441a-9ee5-688d91d55c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677455949, "uuid": "c9adba17-accb-468d-b09d-7e92c0e613b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3107934-b5b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1677404013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677404013, "uuid": "95ff8652-4298-4d48-b0bb-859bd000ad1c", "comment": "Malware payload (AsyncRAT)", "value": "1237a749cdfe8065f70beb76026fbf58", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677404013, "uuid": "0b8c68ae-2c63-42db-b965-d2b2e176049b", "comment": "Malware payload (AsyncRAT)", "value": "819d812044fccc25692d6f0919850536d3486bdfdf296bea08ea3291fe1d425c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677404013, "uuid": "35a98f3b-fded-494c-8dab-07f20b38db1c", "comment": "Malware payload (AsyncRAT)", "value": "9e9febe7441cfaa52135c32ef1827af10bdc81bf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677404013, "uuid": "019c8b01-15a9-4451-a0d9-2065b8f1ae45", "comment": "Malware payload (AsyncRAT)", "value": "ea36dc4b2f8cb12f996311fd38ab90d3b16be5a12b7716997fcb37fbe90b9c7bd4e79454604a2f3415995463dfd54a76", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677404013, "uuid": "d0be4e2a-4541-4003-bebf-6bc0c2fa343a", "value": "T11195D0212EB29DD1C0719939036BE13912B07E2306B2EE62A59F7B1F7FF99C4141D6C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677404013, "uuid": "eb47a11b-6357-4979-80ff-c0b3c98f7ca5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677404013, "uuid": "76460ba5-ff4d-40dd-a3a1-8ebdb3ec9937", "value": "49152:zGXOVDKuXtwIarveK9plB91K70myaigDmXI:ieVDx6IaaK9plBXO03xgDmXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677404013, "uuid": "3a7121fa-ba1e-46ab-ad2a-a6207e5cfc8e", "value": 1918464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677404013, "uuid": "05b3c934-b6b8-4248-92d8-12d1ac3d082d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677404013, "uuid": "98c18d0d-8fb8-4ec4-9a01-89e404831d07", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.23162.8781.31099", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5f7bc6-b5ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677434365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434365, "uuid": "6bf5154d-c16d-4cf9-895b-88c532fd20f7", "comment": "Malware payload (Mirai)", "value": "482eda0a53df5adbbcfd3475650673f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434365, "uuid": "9d26be56-f785-4685-b2f7-a36434029c99", "comment": "Malware payload (Mirai)", "value": "81d90028f086bed52eb140262c805309c5709d0beb5c10546e5c6818cc491916", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434365, "uuid": "062b8ead-0e26-4f48-95e2-245c51c6fba2", "comment": "Malware payload (Mirai)", "value": "4af2e789e3f2a9d4ab68e8511b5159bf513590a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434365, "uuid": "6e012eca-3630-4032-a0d3-eb979d05323d", "comment": "Malware payload (Mirai)", "value": "d3976720ebd75125beeb1f09dce177fecd572a547e411c907081d04286021e1bfe61a1558c9f75c0a7a1b9d41b30cf0f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434365, "uuid": "7a6df40f-2028-4001-8d4d-a52f3dc71b33", "value": "T13903D651F8825A27C2E1137AB6BE4A8E332073E982CFB617D9214B107BD551F0D63F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434365, "uuid": "f9f1f269-0556-4d8c-bcf8-16903a3e4436", "value": "768:ZqILBdhxPh91eftcG5dm80LyFBWEu/tOr4MkKvlw9QSo8qMurE1Jomsu/NkwrkkH:c0zmf2G5dmSBWjV8kZbJqa1MuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677434365, "uuid": "4ce8ad3e-8918-4a74-b86a-c8116f9ae9cc", "value": 38116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677434365, "uuid": "0c656da5-196a-4c55-acc5-d8ff181788c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434365, "uuid": "75aa09dc-265c-493e-8819-28845c9c59cb", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84581285-b607-11ed-88f6-42010a9c006e", "comment": "Malware payload (RunningRAT)", "timestamp": 1677437891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437891, "uuid": "38a1adc6-f00c-4508-a8db-5066e34fae00", "comment": "Malware payload (RunningRAT)", "value": "6378a3a153dba78e21c4d7f96d4dfec0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437891, "uuid": "4745e5ef-09b3-4199-9d03-4cb2aa855404", "comment": "Malware payload (RunningRAT)", "value": "829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437891, "uuid": "a6660196-95d7-4a95-8c36-ba67f4973ee3", "comment": "Malware payload (RunningRAT)", "value": "a5cd66f84195cdd90362c62746cfefeddc49ed6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437891, "uuid": "ffcbf2bf-1e73-468a-92cf-450e1569e9cd", "comment": "Malware payload (RunningRAT)", "value": "4c8ca33b0ec1ac6cf504b9ea200fb7d20e1ee8c705903325901e61d01088cf625c3d229f1e7ad939e5759fe477249666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437891, "uuid": "091dcad2-09cf-45a0-8673-c26a95bfb977", "value": "T12EE2D0C9A2FD2945C2750B3E9D536A0C2426EC1AB295473F1EC0312FBE36B287C34676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437891, "uuid": "ea6df1df-b5ae-48cc-96b7-fc823339d41a", "value": "3d2b95b998469ac775106242f347c0e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437891, "uuid": "e36358b6-10b8-48a7-af65-693a0b4b5402", "value": "768:zkw/iOWTK3JWhOM/qZh7UJGcZ/iGUOnbcuyD7U7s9:/QK52fqZSIA6GUOnouy87s9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677437891, "uuid": "f2fa5c35-15eb-4973-bce2-091889068313", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677437891, "uuid": "980037fe-b303-4f61-9bb5-df481c932bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437891, "uuid": "eb65e87d-7514-4af2-8827-c3d938bb5c26", "value": "6378a3a153dba78e21c4d7f96d4dfec0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f52ead-b625-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677450969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677450969, "uuid": "42963db9-d67f-4407-818b-cd0269fc6619", "comment": "Malware payload", "value": "e2c8c450081018674210abf9de68fdb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677450969, "uuid": "8aa802db-f298-4088-b785-1032901ce84c", "comment": "Malware payload", "value": "835573cece49e4198054ba35a154234ea1ff843d3585b0a89ab9b2bd34074b78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677450969, "uuid": "4e2c1bc9-96cd-422a-8dc6-00561b8163a8", "comment": "Malware payload", "value": "771f80864fbd9e58afb183ebe26385b23058b2a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677450969, "uuid": "942aa13b-a446-4ef1-9979-d6893719696d", "comment": "Malware payload", "value": "f811d6ad3ab5b055b14b0888f1015ce969babc605ba035c2661b45d1f9d1bd0a3d97fd4642b79188abfc153d6aa441cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677450969, "uuid": "b47163a9-ff43-42f2-a808-e086c327253a", "value": "T11545234BB6E88162FE742B701DFA03C70A357EB12F3A8297134A9C991C56075FA70767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677450969, "uuid": "1c4cdffc-a1dc-4f3d-965f-095372b0e77f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677450969, "uuid": "6cb54733-41ac-426b-94ff-2d447773a07f", "value": "12288:wMrWy90n+TayekxFNyVzjS7JcKm7CTCV2AdunJHV2YmU2sTfm33CZu7bi3bS+NSm:2yUynMjGcBX2FV2STKCQlpeh9KFS7Cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677450969, "uuid": "16e4fcf7-d1ac-432b-826c-e235b5e80c12", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677450969, "uuid": "477bbd23-7d39-4b45-ac6f-8eaa70599b22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677450969, "uuid": "2cbf0ab0-4ae0-4d5b-ad89-07c8e77217e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbffacdd-b5e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677423006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423006, "uuid": "3da6a54c-a74b-4fce-9756-f2b4315c5b46", "comment": "Malware payload (Mirai)", "value": "faaf38260a472930dea7f4c4f24411f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423006, "uuid": "63eb285f-c792-4089-9c74-0756904da5d7", "comment": "Malware payload (Mirai)", "value": "8546ba44f51fc2e083364a1d28f7c2aaf572b3f26de9bc00d3081e79bb795495", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423006, "uuid": "6993a4bf-b7a2-48f4-8fe5-424c8b929d76", "comment": "Malware payload (Mirai)", "value": "d2558f69ae93d743b31baa028470aecb6d0f07b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423006, "uuid": "3ac47c5a-77f1-49f3-8d3a-8dc1082f515b", "comment": "Malware payload (Mirai)", "value": "6d12eaefaf52323bbcb6143fce2f2bd0edb0112ba1f6e21dda91a744d93cb47a75717150ba716360247dda4dd99e36b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423006, "uuid": "c1e42801-bedf-4b06-bbff-5168651c6614", "value": "T10F43F110ED671262CC302F366EEA8E4D0571DA7AC5BF6E5EF3492768D5830815F68AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423006, "uuid": "e3b99fdd-1bd5-4dd1-bfcd-d06c7cb14ea8", "value": "1536:OyN0koV3BQ619dSKFPRl52L1Hak8DaAqBCdCLnA2Z/7:10koV3SqSKFPL52L1H58DaAsC4LnFZ/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677423006, "uuid": "f27b44b5-ff30-4ce2-83fb-b215bc9079c0", "value": 56572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677423006, "uuid": "f431654b-0a98-4788-8759-550d363f7277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423006, "uuid": "d99b16b3-9ba7-4754-96b4-e71ab8b5c4bf", "value": "dark.arm7-20230226-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b699155-b606-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677437447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437447, "uuid": "a20fa50e-8f00-402a-b5aa-6150a742bb71", "comment": "Malware payload (AgentTesla)", "value": "c3e87b51d4d3e523f234a07e32eeae27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437447, "uuid": "99c733fd-192b-4d1c-be57-d3854343aa5b", "comment": "Malware payload (AgentTesla)", "value": "8553df1ffeba525257607fddac37d402062fb8b724ebe1f1921e6a0226b37634", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437447, "uuid": "28214296-c5dc-49a8-a89a-307d5f792bbd", "comment": "Malware payload (AgentTesla)", "value": "78951e958059d39f0d8e8afedccd3eaa130640e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437447, "uuid": "ad9e9781-ec32-404b-a484-ee00669d0712", "comment": "Malware payload (AgentTesla)", "value": "6d009466dc951393ca917c2ca616ab877e348958c6276363065b9aab2acfa64715dde964064f0797664b809577a82ca0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437447, "uuid": "b33c9635-81d8-4aac-b01c-0a6fd0145518", "value": "T195E1B510EBEC4733DDB24B39ACE362C147B9A7456952CB7DA8C4211FAC063594763BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437447, "uuid": "230474c8-470e-4b27-b2cf-cfd3ec0e8db8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437447, "uuid": "db16e0e8-a747-4915-94a8-b05eebf28420", "value": "96:h0BOC6lh+7sO3rnK1cilAkog5iZvwMOTT2nZGkUtqBzNt:h0BO3lhY2xzogQvwarSqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677437447, "uuid": "b3d86fc2-d48f-403c-8d24-1c49e09f50a0", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677437447, "uuid": "333cb105-7c2d-4f97-87be-f666c2364eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437447, "uuid": "604cabce-7e21-4d32-ada1-c1cae30d9ec9", "value": "c3e87b51d4d3e523f234a07e32eeae27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4986573-b569-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677370085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370085, "uuid": "b881dc61-8e09-4c7d-967e-ca6bb14936cd", "comment": "Malware payload (Mirai)", "value": "6558bda989ec3fc09ee0470bdc6dc5ba", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370085, "uuid": "aad5401e-f24f-46dc-b67c-46102aa9763b", "comment": "Malware payload (Mirai)", "value": "857785b29beb5b4f229a23549b4235fbcee3f2d4854f5c1b850feb71d9b95bf1", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370085, "uuid": "89259fe7-1160-4262-bcc2-41b7f3b4af4b", "comment": "Malware payload (Mirai)", "value": "8603cf120702668c0cdd6aed30a7b76d65047325", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370085, "uuid": "261139fe-198a-4ab1-a65b-4ae7ff3f51c4", "comment": "Malware payload (Mirai)", "value": "83e7df5946975c91c1736a4f41b1688619b7440f7eb47a1362b6be71e63c199b462c6e59c7b57501836a8bdd5387a50d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370085, "uuid": "0937abbe-388b-4e31-a7e6-08abb2dc1d6c", "value": "T1B7534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370085, "uuid": "bca66f65-c5d9-4626-9173-94ee846930aa", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQqLiKimfFoktCe3fYRMh:WShU3q7cEDlCK/0Di9i8Fok06fYRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677370085, "uuid": "a6bc0e01-5b27-426e-bb08-a31c6af98a8b", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677370085, "uuid": "c5cf109d-c60c-4995-a0be-c36ae4cb6598", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370085, "uuid": "8cd9b6de-c498-475e-be43-12a4fb7b1a76", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a31c0f-b59d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677392553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392553, "uuid": "e801af6b-13a2-4b77-97b1-80a3c983176e", "comment": "Malware payload", "value": "6de5d012e62d89d1cd13da4b73fa4c1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392553, "uuid": "b6edd693-4c1e-4421-a826-1b7ea87030fb", "comment": "Malware payload", "value": "867db0a04a8d54490d8cbf67b8de79c258f0f0a87bf865fbf78e529b85e6a0e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392553, "uuid": "552e0625-db6f-4299-a2a8-efca483456d5", "comment": "Malware payload", "value": "3d599243acff3846c234422b8e585146368004e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392553, "uuid": "83854e81-db75-4401-8756-7da666e56c59", "comment": "Malware payload", "value": "5f7e42d01e469f5578d750896f9257ac2a48d8c33daeaf40d43016687eb944deb6e08d2af7da65a1843cdcb9a26f0f7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392553, "uuid": "8e3af566-d0a5-4e29-9739-de6a64adf4ff", "value": "T15CC63308B21516E9FC22313D8D21D126DCBBB17B9702C49F498856A74F533E6F93BBA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392553, "uuid": "bc5d85d1-3c99-4832-aade-dc13c8943fef", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392553, "uuid": "43ee177e-6a04-45c2-8282-fac4e25c1525", "value": "196608:CqgOOyqaCsXDjDyfVW3q+09iq2pPeZH2WliXYrHW1mnFwoxCO/AhNOnKES:oOOybCEDmlh2pMH2ciIrHW0nKyACP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677392553, "uuid": "53e36cca-afe0-4353-a8c2-a4d29f475da7", "value": 11803528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677392553, "uuid": "577757ba-1c9a-4a41-ba40-05178f43a665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392553, "uuid": "7bab3902-953a-40ee-b158-34bcdf781e84", "value": "6de5d012e62d89d1cd13da4b73fa4c1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496ad4df-b602-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1677435645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435645, "uuid": "85ba9b5e-0d68-4c19-a33e-5bae1b7e1cbb", "comment": "Malware payload (GCleaner)", "value": "b508e2c6087106f5931c4de29dbf3fd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435645, "uuid": "77b02421-4e87-424c-a975-eafa453de63c", "comment": "Malware payload (GCleaner)", "value": "86a1d5c55b17007a02cc79abbcae676cd83002dc027e10d4992634033402b30e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435645, "uuid": "64d3a2cd-4127-4e00-992f-52f8625409a3", "comment": "Malware payload (GCleaner)", "value": "b7ffed0a15ea8159e705822c88ba710c7110e147", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435645, "uuid": "1343618d-83ca-4c42-8692-c3ee7d97591a", "comment": "Malware payload (GCleaner)", "value": "77de2cb600d446be7eb5f496e26874b8091d1a7241467020944b2e1c96c2beafdec8ba8ef6c644fe86a96b16388fedab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435645, "uuid": "5e39304d-f388-4bb8-a814-493dd2028aa7", "value": "T143D5334881552DF9D0B2DB723C7C6E00EBB7B6734ABCE546B34C4F5D2B2A656020A27D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435645, "uuid": "fb6c9082-2929-465a-8110-fabef7725aad", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435645, "uuid": "70ab41b2-7c2b-42f9-b865-308122e85fa9", "value": "49152:AGj6FyPbk8KGEj3/vp8stTt6my/5Ewkkyj03G5/S1OKz:deggE23HpVx2Oq+0yS1OKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677435645, "uuid": "cdd8f5ef-17dd-4d2d-b8e0-1aac8677f093", "value": 2830712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677435645, "uuid": "2287a964-7e58-4b77-8f12-1b3982e88527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435645, "uuid": "ac5e790d-5ff4-44e4-8711-8c4c03d24a20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122d9a7c-b60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677441136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441136, "uuid": "7935b8fe-f8d2-45ef-ac9b-39aa597acdbf", "comment": "Malware payload (Mirai)", "value": "4a9039b002dd1af06a1a1d9482b16b15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441136, "uuid": "b15997f4-a4c1-4ffb-9712-46f0a6a31479", "comment": "Malware payload (Mirai)", "value": "86ed14d1320a0ba9f7c2ec31f775b2fc6ef80dc0b3f6f8a912c91e19cccc98a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441136, "uuid": "b52cd3d7-a05c-4c90-ac15-38da47ce650f", "comment": "Malware payload (Mirai)", "value": "162701da51b7aa2b791f33b924adbb48ccff5a16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441136, "uuid": "b4090357-af8d-4876-a8a1-36bf53b70473", "comment": "Malware payload (Mirai)", "value": "cdf176bd73d2beb555340515d3a280f29f0dd09dc71e4888c90c520c39ee0942246edb2e33b3764b80598c1eca99f648", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441136, "uuid": "2516f94a-8045-4512-b533-291f33eeba24", "value": "T171333BD6B902AD7CF98BE6BE80270E0AB53123541053073777EBFC937E321949956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441136, "uuid": "10cf798f-9c28-4dae-bb5f-c922ad38cc95", "value": "768:8CeKEfhe5Xdrben4I1fN5KQnaodgFHx+iPuvWeffpqmUJT6r6Lu380Dg:dsfIBZeXl5nKFx+imvppqmUJQ6Lc81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677441136, "uuid": "95c7d96e-7913-4152-bd73-d442c0359c98", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677441136, "uuid": "3d040769-2482-4f16-9d26-ca6d3d56d574", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441136, "uuid": "92dabb0a-d3b1-4e1e-87f3-0bf4d49c243b", "value": "4a9039b002dd1af06a1a1d9482b16b15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52960590-b602-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677435661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435661, "uuid": "85fe373c-51d2-408b-beb9-38d580fff982", "comment": "Malware payload (RedLineStealer)", "value": "d4c28033493d42ee0f3504e163185d86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435661, "uuid": "c89bbe0d-9852-4506-a39d-53c63e545b10", "comment": "Malware payload (RedLineStealer)", "value": "87517abbcad09f64261b35b8379f5766819749008ca1e146082fccf99872002d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435661, "uuid": "c52a5715-2cf4-4853-8971-84e1e2fa5805", "comment": "Malware payload (RedLineStealer)", "value": "e1a5d924878e38334fd2af17fb710d54a8fd1b38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435661, "uuid": "c8a99a52-d8f4-4751-a66a-5bc8df9bd040", "comment": "Malware payload (RedLineStealer)", "value": "28fe3b63375fd992413a92d1cbeafc5257c5a0e6f70bfa3f4a083c39a0a072d8dac29496d913ca1229ae93870b93d100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435661, "uuid": "7dd0f003-1901-424d-80ef-37745faf1e74", "value": "T17A65E330E0CCF730D436117665F3B467C929A9E0B6AB5AC756A1CA390E243D1CC75BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435661, "uuid": "2b863e42-a198-46d4-848b-409e891502e1", "value": "0c09b077bbc4941fe51c751209f46580", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435661, "uuid": "aa40f150-b914-4164-abbd-9db5cc38ec74", "value": "6144:ATlRsO3DlYaypWrIFYgj2NQHpg3+K+a6SICMl5WJuh/cn:ATlR6aUlFY+2NKOlICdCcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677435661, "uuid": "41c3b13f-ba8a-409b-a92f-43c8cc8d854c", "value": 1517056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677435661, "uuid": "ce6bf02c-88ce-452d-9514-ccd7d63ebf63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435661, "uuid": "7d23ad34-c48a-4608-b1ea-17d7aef55567", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b85574-b5be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677406329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406329, "uuid": "743d82f2-026d-4291-aa8a-b4080d454b16", "comment": "Malware payload (Mirai)", "value": "3b776572ee82718cc87315160d0de527", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406329, "uuid": "31691616-ea44-4dc9-a6e2-29481e032130", "comment": "Malware payload (Mirai)", "value": "885b7d061fa0bcfcd7b010a03f7e46ef7122aadfb7acdb9ce347ca14cc840683", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406329, "uuid": "b91933dd-db04-4083-a0b9-e118df8acc43", "comment": "Malware payload (Mirai)", "value": "ed5d7e5efaf931039de204c7354dff7e684b6bfc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406329, "uuid": "4b65a3d0-0074-4bae-a127-c89c0cdf582b", "comment": "Malware payload (Mirai)", "value": "d9dd1f23aacf01b6b506e36aa125adf236ebd684d7251593972a579647ca91f140d4a7822ece004180278b1798295877", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406329, "uuid": "be0cc07e-268c-49d1-b979-29e7abc8757e", "value": "T1F843941ABF650FBBEC6BDD3349A9174534CC641A21A83B367934D418F64B24F49E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406329, "uuid": "ff92f12e-fc54-414e-8dc1-c9501ff3fe3e", "value": "768:DHWDn/4COJOCNloYC/mczb9tLEaU9rRB5qKe98e+besNfHS0XXiXxpwoXO:D2D/4CeCP7ifF48HbfNfHJLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677406329, "uuid": "2f61c855-e84b-4e6f-b9d1-2657e65b4dfe", "value": 56404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677406329, "uuid": "62c32a59-64fc-4fbc-bf54-f4ff6531940a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406329, "uuid": "01c62324-86e2-432a-9c3a-aabfad685863", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18be2538-b5d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677415807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415807, "uuid": "007ed53e-14fe-4aab-afee-1a511235d83f", "comment": "Malware payload (Mirai)", "value": "212e3550c57920e36e34e9626226faea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415807, "uuid": "8102d9e7-3343-4608-90ec-faf1b2c62af7", "comment": "Malware payload (Mirai)", "value": "8874f6a677389640186acc5a822fc57f66b050c9f7829f57b354cf4641f8f9f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415807, "uuid": "c92f945a-7570-4971-90db-eb8cf9d54075", "comment": "Malware payload (Mirai)", "value": "736314c17dd06ac41604ee1b0f9d33d9bda45ad2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415807, "uuid": "e7d8fbaa-ddb1-49fc-804d-cf8f0b27c9cb", "comment": "Malware payload (Mirai)", "value": "4642da2d8a471b10937858a1d6c6cd19314039d1415564e7f69d3fd2d9a20a4a1febc9134f78783e7a736914d3f0cacf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415807, "uuid": "70b07ff2-d747-4ae6-9f5d-7e5889968413", "value": "T11F434A95F8828A13C1D1127BFA2E968D3B2563E8D2DF73039D301F61369B82B0D6BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415807, "uuid": "e2306a30-879b-4c63-98dc-5e0fd2cdd7de", "value": "1536:L5wmKQGZbpGaRWKC51It5XcmZuAb+10mM:L5wr5gKGabXcmYAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677415807, "uuid": "60ddd811-aadf-40d5-8530-cb083af0eb4e", "value": 55688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677415807, "uuid": "e05122b6-33a8-44ab-81e3-f08ca9ff6e2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415807, "uuid": "a7864804-d67c-48af-8285-e822a148eb84", "value": "botx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c543b14f-b5f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677429840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429840, "uuid": "41c8abce-5958-4083-9711-8fd913170da7", "comment": "Malware payload (Mirai)", "value": "0386a3d6d3a9354198abb56cf8f957d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429840, "uuid": "084d4919-9f2c-4c65-9156-2d5ee6197114", "comment": "Malware payload (Mirai)", "value": "889b00c8b73238c1711c9f5c85fd175358bf3bfc04b0f45cf95cd00c20921042", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429840, "uuid": "f6a7ae8d-8378-4682-9579-93bf24085eea", "comment": "Malware payload (Mirai)", "value": "c2c6c0576433e98b83832de9fa766f9e0a742f98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429840, "uuid": "184b8371-1085-40cd-b257-fa43d42a6212", "comment": "Malware payload (Mirai)", "value": "28cf0fbed9cd08d5bfead76ad5963cb7d117bc1028273368f1e87d82ae9ba9d5b61d9bcc19d3e794debd90ae0b1e8e76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429840, "uuid": "273a011b-9302-4515-99ad-2048d5e83787", "value": "T1F0633B9AF801DD7DF81BD77A4453090AB630F3D512830B3B639BB9A7BC721985D22E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429840, "uuid": "01a0bdbd-6a02-489d-9d01-2e8c30219ae2", "value": "1536:/gwl1AZMorDYT9X8VBDG1ox6OjpdJn77MVtqGtQ9Q:/gA1A+aET96G1y6yp/nDGtQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677429840, "uuid": "7a8e479e-d61e-41fb-8d4b-dfdf07a3f29d", "value": 69644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677429840, "uuid": "998c5c25-199a-4675-b9be-26337947bbfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429840, "uuid": "4837bf1b-a301-43dc-a52c-f606464900f4", "value": "0386a3d6d3a9354198abb56cf8f957d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9034ba9-b569-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677370093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370093, "uuid": "10336d60-2b8d-48b5-bb0c-9850d862251b", "comment": "Malware payload (Mirai)", "value": "4e1e59d6f824a3e87599e46987b0953d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370093, "uuid": "35bf7f28-f7bc-4490-b9f7-d64920bc8b4a", "comment": "Malware payload (Mirai)", "value": "8a211c3d82dde0b96be7b29df7bf4e52cbc23b6b992d7cf992dd93e76f7ac50c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370093, "uuid": "d5ecb071-9865-4c62-a35b-4dcf805efa29", "comment": "Malware payload (Mirai)", "value": "352a205b15da91f059b1658dc48f652a906ab44c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370093, "uuid": "7d929088-29b1-483e-892a-c537024b3d03", "comment": "Malware payload (Mirai)", "value": "26638ffe828b909df161d158d7793de80927ad9eea2b832115cc33d40cea43197b88014834dc93e41f952e81bdd54911", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370093, "uuid": "d7c9608a-4e7b-4e09-b8dc-ec2ee3416628", "value": "T15E73F756B8814B11C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E36D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370093, "uuid": "8af1940a-56ca-47d3-9a45-270051943e5d", "value": "1536:2lntExPgXkpdDHkM7kdxO4uKGWkcaoN0sIci7XzWv+AcY5sYIWh:bxIXCdEdlwlcaZXzWv+AcYuR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677370093, "uuid": "2deeadd9-2e44-4d8f-9460-2422d63e9af3", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677370093, "uuid": "bbfc397b-9b71-450b-a9f5-d47cc34b61a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370093, "uuid": "234bba43-9133-40ea-9f4f-bf3e61403c3a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3c2142-b5ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677426931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426931, "uuid": "5292a4d9-a51e-44a6-a3d5-5cc9efc42e1e", "comment": "Malware payload (RedLineStealer)", "value": "622f0ad352c6dee48bbe8fb13024b28b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426931, "uuid": "26854379-7c2b-4983-9425-5379b78e367d", "comment": "Malware payload (RedLineStealer)", "value": "8aadd9d8717e19197364ac4c543dbb4030ad83f4225d7c307e21183aecc529ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426931, "uuid": "58df3eb2-09b4-4f36-9303-596789de31f3", "comment": "Malware payload (RedLineStealer)", "value": "c5053d8cbcb5884d0936c5f610005ceb237073a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426931, "uuid": "9e72204b-b31b-40e1-a3fc-2e41e55adeea", "comment": "Malware payload (RedLineStealer)", "value": "33f95bc1f13155142576fc1528d571a0bfc9ee6a732c4d12594f4278e386b87a941052e792797fade22de8747c0c6dbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677426931, "uuid": "52069c54-7e25-4ddc-8192-21dc26f6362f", "value": "T15BA4F14BBBE88032E87567701DF103C30A35BD606B38929B678F6C5A18727B4B13576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677426931, "uuid": "f47d4745-88b7-46f4-8e50-81a1e8105dcd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677426931, "uuid": "f379ef94-1c65-4dd7-a834-f86a881b2d59", "value": "6144:Kky+bnr+/p0yN90QEHSQiX1gw6SXi3Nh2cKMWBSJwl/7MF6bgIGn10CqJR7xsOSx:IMrry90w/B6qi31j4ew1A8SeLx7SqNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677426931, "uuid": "c1927814-1cee-48ad-8126-4304fdd8a657", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677426931, "uuid": "b4c20a4e-c362-4b2e-93e0-397dda4ac0c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677426931, "uuid": "9b5a6e44-eb18-4890-9922-c0092905cd18", "value": "622f0ad352c6dee48bbe8fb13024b28b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105054e8-b5da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677418369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418369, "uuid": "b3c8abd8-7c81-4ee0-bcba-a9ae59b99c70", "comment": "Malware payload (Mirai)", "value": "9d7958f23b4ba90543fb3353012c304a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418369, "uuid": "23071b15-5583-47f8-a70b-cf361b2b3d10", "comment": "Malware payload (Mirai)", "value": "8b817a2ff6eabf7063f8d89f3af49de60a9b4ffd864da5b303575a60155ff15e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418369, "uuid": "ed4cba62-ac07-4293-baeb-836ec6798ec4", "comment": "Malware payload (Mirai)", "value": "2c181419f5137d55fe2f05be90a0fe1c0a37c3b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418369, "uuid": "67c62c81-0275-42ed-8cbc-5c8aa9d645b7", "comment": "Malware payload (Mirai)", "value": "d50079300c417e0ae0e323e8e5431837b7021ec454afb3c437ad43dd6f5329b83b59f23d0d219252cba53a245c1bdf8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418369, "uuid": "522f666f-d137-45e5-ba1b-df6867d7dcbc", "value": "T1D4631856F8818F15C4D502BAFE1E154E371717E8E2DFB2139E206F603B8A56B0E2BD16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418369, "uuid": "48b5c026-9b7c-4418-9b59-96e797190063", "value": "1536:t/nO1aCTYOgTBo3cuozK+MazjjTQ1M5iOV5l3ZmOb+10mU:oa0Y5togW+Bz5V5l3ZmOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677418369, "uuid": "e11689fb-6500-40ef-95e7-9c6103b39151", "value": 68284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677418369, "uuid": "c132e611-3fa3-4cc1-abe2-c6770d2b0e3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418369, "uuid": "f7a803b1-9461-41d0-aa4a-c224974d50f4", "value": "9d7958f23b4ba90543fb3353012c304a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64389b91-b5ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677427530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677427530, "uuid": "402b8a20-a855-4561-bd59-4f5c6f43430b", "comment": "Malware payload (Amadey)", "value": "87524f05c8208bab21b031001c044b55", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677427530, "uuid": "81b95dcf-b3c5-458c-833f-5a25b9712a08", "comment": "Malware payload (Amadey)", "value": "8c66b4e6e50ce430799bc257721317b5737d0d4123e8e34fe7754750afa80aec", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677427530, "uuid": "50f8df7f-f50d-4adc-8bed-b9f5c8c79422", "comment": "Malware payload (Amadey)", "value": "58de1525eb0ec0de88720ca2b93cb966dbd5ee7f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677427530, "uuid": "ed85b759-a853-4de3-a067-6243b5dd0f48", "comment": "Malware payload (Amadey)", "value": "9eb5e87752de26d6eb93be8013c55ba764748057685865bca84d319443a69543f5b160087cfe3b110401c812498cce2d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677427530, "uuid": "73a88169-938b-4d0a-a0a0-47b61c2bd6d6", "value": "T1E1452257F7D84064E4F993300EB707C706357E616BB486A7264E882E0C73AB4E67672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677427530, "uuid": "345659f5-f821-4f57-9ec9-b9dd93068df5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677427530, "uuid": "1998a705-79bb-46d9-b5a0-160c6b71e616", "value": "24576:Py92rAfcfGHAg11ZOsaPuLBie4N5Wds1:a928fcfeZO7PuLBizKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677427530, "uuid": "194ee8cc-d538-4c98-baab-41e3a6a87657", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677427530, "uuid": "6c357a27-7873-4fc9-a023-7b67e032e41a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677427530, "uuid": "2a9853f8-4055-4114-9690-8265da6d4d3e", "value": "87524f05c8208bab21b031001c044b55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da591f4b-b62b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677453498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677453498, "uuid": "12196f69-de1e-461e-aed8-feb1930a50a6", "comment": "Malware payload", "value": "5b806359ba0c1a3670f24c250f0222f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677453498, "uuid": "32c8155b-c63b-4826-aac5-881f39ad4562", "comment": "Malware payload", "value": "8c6d27f57139841c0c7c2f62e8f876fff1b19bcc65f24fc88ccaf8e912842e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677453498, "uuid": "a98a4919-1c41-4cf6-9092-69bf94cdece3", "comment": "Malware payload", "value": "4c6dc512cf472a9c3172b6c01b0e9626573e47a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677453498, "uuid": "3043ad75-c34f-4459-9e23-d3d7fd9a2732", "comment": "Malware payload", "value": "f22654b5ae539010c8d5c0b7f7fcb684516e230ed3a1d49d552aaa6e69dc72656e3bc1b525ae2b8e965036d578138097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677453498, "uuid": "374fc701-0b9c-4bae-ab7b-5003887b629b", "value": "T19F6622AAA2D41205D1B98A78F6B36DD5F1FB0A5F8EC15C3C70AFE9C22B734509313652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677453498, "uuid": "5fe9af6e-0504-479a-bc2c-8b98ab71efd5", "value": "e15d8fdaba025278971a192141f26d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677453498, "uuid": "e2c66283-4ab5-4507-b891-b0f5f1fa5174", "value": "196608:Y9P2ij7qzHXtWYXQsmTM4NeP5B4HLqXJgVnWB:YStWYAsm44NePouZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677453498, "uuid": "7c738546-cc4c-435e-a981-c4a2d8a3d63c", "value": 7026688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677453498, "uuid": "f3ffdf77-18d9-4320-b476-0f16170bbd9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677453498, "uuid": "936d668a-5b33-4944-8fb4-b5f25906d4b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46562aa6-b580-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677379805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677379805, "uuid": "52de6f60-c20b-418f-9972-63ed7f3d1894", "comment": "Malware payload (Mirai)", "value": "2e76986c0edf0a1b6708a2af9fb4569b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677379805, "uuid": "66ad590b-e5a5-46c4-9de3-fc389a8e7ca6", "comment": "Malware payload (Mirai)", "value": "8d019134803d0b47a77309e3505eab1af09069edf846a20d187aa7b362ec1e55", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677379805, "uuid": "5ae7eb8b-4412-435d-9f9d-e804cfa253bc", "comment": "Malware payload (Mirai)", "value": "a2a3fde7dda496471e2d544187f62683589f6c76", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677379805, "uuid": "6a42c9d1-87bd-4233-b955-be6cb5eb2b60", "comment": "Malware payload (Mirai)", "value": "0fa2ec1c4dbc8947dcbef8d587f80afc4cba7ae82ab9f59e8b594c97e66710cd887195aa7fd1f6facc09477c321379bd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677379805, "uuid": "6a4fc9d1-0577-4cf9-9a53-180e81dc2d96", "value": "T11F63011833B7A7E2AB360B70A8D541C4B5CAB4FA536DF5830B64491032A7D5E36B4BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677379805, "uuid": "6a30e4bd-64f2-4416-87a0-e6ed02ce35a7", "value": "1536:VfcZgjouD8IIpS9vTK+ALO7FXQtzklNgaKhkhswVLk1vgTrO+cxu:VfcZgjX8IKsLK3iRQtzHaKyLk1vQJcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677379805, "uuid": "c3ebb4b6-3714-49ba-b653-ada7ff81d9ba", "value": 70896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677379805, "uuid": "a3ad897f-8c1b-4a81-bd38-f4760354c560", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677379805, "uuid": "e802e44a-7e15-4790-800b-b8d3892c9d2d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86683cc8-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "9c1f5546-7c2a-44e3-a9b5-8c81bee96775", "comment": "Malware payload (Mirai)", "value": "aef6acfb82d01bd145f96b14b6bb0bc8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "6a626eb7-4a1c-4708-b83b-d4cd74551a72", "comment": "Malware payload (Mirai)", "value": "8db9ddd23fad1cc4c6bd6c22d7c84ba6dc47c61f686aa8dc80df3216acb161f5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "80d175d1-86f7-4934-b778-3924980d7573", "comment": "Malware payload (Mirai)", "value": "138931758e0c9e838054b0f26b5f63c4b0b9b6b7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "8d9ad38c-81b3-400f-b00f-7ef3bf5f6c41", "comment": "Malware payload (Mirai)", "value": "592ae8b17e0674c96ba9e396b591e6d4fd0f8d632529ad887cccb302fd054eed0e7aabb5118a472eaf85fae5dd7ed665", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "7df0810a-cb3f-4074-9b0e-62e5747512b5", "value": "T1F103F1646B4C1A66D1748DBE6918C4877B8E36A0F1E7336A5714DB3CEAC314318781FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "ed4aa3c9-eb5a-43ee-bff0-d93db4862280", "value": "768:67BlyoHTJyXHw5Op2TjMViOhoJYF4QSdPHKLxTxUZ3Hs3UozcU:CVHTsHwNgVzoJYEd/K9TiZ6zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372611, "uuid": "78435ad3-ae56-4c8f-b137-417a5fa7d06b", "value": 38732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372611, "uuid": "f813edbc-d415-4d73-8975-4523174cfddd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "fe958e9e-98cb-4e3e-a46f-00318aacc3a7", "value": "hotnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87515c78-b5ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677398383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398383, "uuid": "1a84f85d-8697-4aed-8a6c-27433b227191", "comment": "Malware payload (Mirai)", "value": "9f15ee8cb566af0d2a5858199a6d790b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398383, "uuid": "bc717473-9d7c-498f-9339-063596e7348e", "comment": "Malware payload (Mirai)", "value": "8f0ac6ff8782f2ff9a595fc7afb427fbc436f3d67fce8380de1024adeb67a205", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398383, "uuid": "c089cd6e-0851-499c-9779-abbc90a826f1", "comment": "Malware payload (Mirai)", "value": "d376bc1a0235294c756e3dd70d44d2aa5eb5bcb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398383, "uuid": "cd43ca16-a638-4ee4-8b78-58834495f4f1", "comment": "Malware payload (Mirai)", "value": "246f89b2ec5093feac0d5c041e65aa7c09cdbdca9b2ed26fa38f8dd7943e6b892f1efee6484ae882b4ea76f93ec0d79c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398383, "uuid": "3b4f8ac8-02be-4a95-80c5-4d00ef4d60b8", "value": "T14973B519BF610FF7EC9BDC3749A92B05288D651A22A93B357934C818F74B24F15E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398383, "uuid": "b033ecdf-83d8-4885-9cfd-3da13088a8cf", "value": "1536:8glwwF62at29wRhY3Sa5KOLQIKmtTFppE7jdHL:8wFF62asgUT6dHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677398383, "uuid": "33c19351-0899-4d7c-b466-2a99c2f78b9c", "value": 80256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677398383, "uuid": "5a35780a-52e8-40d8-b11e-74fe3e3349ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398383, "uuid": "d146889a-4783-492e-888a-507352781c1b", "value": "9f15ee8cb566af0d2a5858199a6d790b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea97c77-b605-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677436916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436916, "uuid": "bdfbc601-a7f7-4514-9fef-2d15bc3c16b4", "comment": "Malware payload (SnakeKeylogger)", "value": "021d7a5cf849147853fb37b7add4e84b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436916, "uuid": "49612ad2-3ca6-4cb7-b17c-ea86f695d1aa", "comment": "Malware payload (SnakeKeylogger)", "value": "8f6cef21db20e718c2a31bc02aebe81d1fe050e3bb7d6fc69855e6685897e9cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436916, "uuid": "9bfd4264-7843-4a8f-a2db-c6270a516a0b", "comment": "Malware payload (SnakeKeylogger)", "value": "cdf6e2589d7626942b2062b0f03c55104deeeeff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436916, "uuid": "71dc930e-2fc5-4f6d-ad81-c790c177d0a5", "comment": "Malware payload (SnakeKeylogger)", "value": "9e04c20cebda6c4a9f125e76f60f42228f8eb781be24ff01addf6a1653becd2977a2e7a713fe90ef3b3fca7ec9e15e5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436916, "uuid": "69b8daa0-9bd8-4365-8353-bfd5edcda19b", "value": "T14284DF01DE95B624D196CABB912E7100CF3D84363125E132FF9A6CC87F61BC11AAF65E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436916, "uuid": "17cffe1d-0d27-48ba-8c0e-e8c8373f672c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436916, "uuid": "33661a86-76c8-4c81-b958-342e47ce05f6", "value": "6144:t0DZM0QSpCyiNDlIZ6bPuFDutOc6duxKLoloXypgE0oQ0ZRgY3MfoCDxIN:tmu5DqZ6bGFDutOc6duxKLoaiGd62BAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677436916, "uuid": "008a64b6-05e9-4060-900f-ed11401d0106", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677436916, "uuid": "0ee69d5e-eded-4ca5-89d7-f12610acf598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436916, "uuid": "b26c3f96-cbca-4511-bb37-91b7bfebc2db", "value": "New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6856b50f-b582-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677380721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380721, "uuid": "274935a9-69b7-45b4-9115-206f1b43d687", "comment": "Malware payload (RedLineStealer)", "value": "99dba29fdf4a377da85d47b917b977ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380721, "uuid": "98d78817-cc1e-4662-9863-26ff4212abdf", "comment": "Malware payload (RedLineStealer)", "value": "8ffd9ac72bf65c1da2b826a326c5cb48b14136267f5aacc7fc60aa900e973857", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380721, "uuid": "bce0a751-092f-43cc-95ee-b57ca5dce61c", "comment": "Malware payload (RedLineStealer)", "value": "8a5353baed96b1376c08d29805efee206a2d0c7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380721, "uuid": "893ae1d3-55f7-4913-a9a1-b4f38f0f0be7", "comment": "Malware payload (RedLineStealer)", "value": "9b889432e1b427b26ef419d3650ad7cb782badfb78e400492044a63dc70ac52e5860ea76e71fac3c9810ca4c380102d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380721, "uuid": "3049478d-2ccc-45d6-a433-643716cb315b", "value": "T1B624D1DCB980C472C8464974B834DAF4697AFCA29B95898733583B7F2D303D1A7B9352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380721, "uuid": "2bdca947-3471-4bca-b36f-fdcda25192ed", "value": "4453019f24fbdf41dd3a4f06fe73134e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380721, "uuid": "77c768f4-d89f-4bec-a933-e3eff1e60de5", "value": "3072:jz54vLvhx1b50A9OQhhJ9tLuJulnV1qLYRfLNQfMb:fWvLJx1ZHztMYiLYRfpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677380721, "uuid": "b6c5591f-1a6a-496a-9e2a-acf871130d5f", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677380721, "uuid": "ea6a9524-0ae5-446c-abb1-924a66c57c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380721, "uuid": "1be79976-4652-4629-b2a7-60a7dcd559d2", "value": "99dba29fdf4a377da85d47b917b977ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55055218-b5c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677408606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "60b089dc-ec51-41bf-a02f-1fa3899161db", "comment": "Malware payload (Mirai)", "value": "aa6df7e3acba56e1b8056c9330fc9410", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "b5f5c7e6-715b-4a9d-b7da-de36c3644fab", "comment": "Malware payload (Mirai)", "value": "90fae94f5a142ba8e53a55009cb589304bcd8c7ac31ba45c9ccbd003cc609e45", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "bc7623ba-40c7-4073-a4a8-3353bea27d26", "comment": "Malware payload (Mirai)", "value": "93021ee1c732275aa9bd8be1e8e8baa42769f2e6", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "f3dbb1a3-55bf-46d0-911a-4fffbf44888b", "comment": "Malware payload (Mirai)", "value": "e80759954eef095231ddc800fc29f5cb5acc340423ef8ed0a869e0564c5cbcf8a20e385e701c03930004d9e3f1be876a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "65fcf5b3-1a99-4f64-89a5-a1ec3aa549ca", "value": "T132C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "27ae9f01-02ad-42c8-992b-4425745f9024", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBe+EdWfRZrmW+IFj:Ted0W0MZQHcd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677408606, "uuid": "4b557b2d-fcbf-4a0d-8aa3-f11bc54f4fc6", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677408606, "uuid": "94c5966e-5e5e-486e-b74a-b8aac4d5e034", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "2096d579-4d05-4e31-ba75-181444a31bdc", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1351861f-b608-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677438131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438131, "uuid": "22fe2f51-e296-4e68-9900-cb98cdbe1f54", "comment": "Malware payload", "value": "722b9b7d9ab853b79951fe561c481279", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438131, "uuid": "e96ad466-b6b8-49ea-afcd-ee0e55f427ac", "comment": "Malware payload", "value": "91172ef9596f7df910afb094ea6ea4c69471149216cb7463073c09236c1ada3d", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438131, "uuid": "78d68b03-3717-41d0-badf-42aced9246ad", "comment": "Malware payload", "value": "5bf65adcd0a69d54b1c0309db269cfe3804d12cc", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438131, "uuid": "5d565616-52e1-4bb8-9696-2c18807d4b0e", "comment": "Malware payload", "value": "574bb89eef85280b4549875c75d7752bfa323d53b78eb9b9a02fc551ec8a5826d68d42356940fa99c6ce3a3afc1fdc7d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438131, "uuid": "dae3e995-a618-4355-91e3-44db8c425ccb", "value": "T17652C0A23E8C860EF13203BDE9D20380C53ED327078F7625565D66D3F7D440A9BE9225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438131, "uuid": "4f5f7878-1e02-4c3f-a335-1404ab739587", "value": "384:qEhtEoO0LfgX0pFMD+WOBSC7eVKJULfJbXQTpVmW3imIGCwc:CMLfBpmDkBLj+bXajmWyTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677438131, "uuid": "772e90dd-986b-4b55-9555-1efe3ce4ff20", "value": 14371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677438131, "uuid": "91fac61f-49f7-449e-83ea-75088d99903a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438131, "uuid": "26d206ac-a358-4ee2-9fcd-b9c065cb838f", "value": "1283765b-03d3-43ee-9512-08db16c63277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb84527-b5b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677404135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677404135, "uuid": "a62852aa-356a-4d64-a4e8-36f9d013d350", "comment": "Malware payload (RedLineStealer)", "value": "4ccaafe6390905c61f9518ec6a021351", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677404135, "uuid": "bdb183bd-ca51-4396-84c6-ef862b2d4201", "comment": "Malware payload (RedLineStealer)", "value": "91186724faca1c94198adaeac0585c866f19a6c817c31bb73779f6810c42cd64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677404135, "uuid": "c24e62a6-cd32-4194-98be-4666ac00f7fc", "comment": "Malware payload (RedLineStealer)", "value": "c380d005237736b238b916287fe87a128409955d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677404135, "uuid": "9f814ff7-4317-46a8-abed-08a0a6161a65", "comment": "Malware payload (RedLineStealer)", "value": "d7cc7b79240ae89776ec013cd0fd3f5daee422cbbace2b131dc9e006d0bd028d4e16ec4c6d1927ed991ebeddf93e5559", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677404135, "uuid": "a6cc787b-46bf-4f3f-93ad-3f208fec8458", "value": "T10174525013E387F5F18853FE16EE41EA003CD5B1C74BB94E219C68FA7185536AAA62FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677404135, "uuid": "16c9f7eb-7e73-43df-ab88-11437f8231cb", "value": "34d637b1652e4219761cb3e35bae0627", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677404135, "uuid": "63667821-2fbc-4ffa-a0db-e12c0a8730fc", "value": "6144:RILAHRva43nAAxgYro60YpxySFuN0pkh2fq:RwAla433ro60uxnuN6kT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677404135, "uuid": "62604c1e-6924-41cd-b4f9-a74cc920139b", "value": 358344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677404135, "uuid": "b43f308d-2de4-4bf6-abd4-de4a8912a603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677404135, "uuid": "944df6af-8680-47d6-8c92-876cfff973cb", "value": "Bot_easy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75732e9-b5f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677429790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429790, "uuid": "0c7691d8-e716-4654-adfd-09a9af4d63de", "comment": "Malware payload (Mirai)", "value": "07ead098188d21ce043f17d973e727d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429790, "uuid": "dec54c17-ad7d-49c1-b366-df05dd405929", "comment": "Malware payload (Mirai)", "value": "919cd6fc993e39c437b45d528b5a3bfc79adc77afec1abb41eaa2267e11c6cc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429790, "uuid": "d8b7280e-795a-472f-9246-387004943309", "comment": "Malware payload (Mirai)", "value": "e932e2ee733e14cee50bb4a7cf1ade2d9068e7b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429790, "uuid": "9413ea4d-5d8f-4c61-9ec8-4b126701f8f7", "comment": "Malware payload (Mirai)", "value": "edd1854496473889015196d2095df11641c769748d6e584230a505b720937164a33d4b69f884354d278eb80fb0146009", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429790, "uuid": "4fdca409-d05a-46bd-9771-0e59f912d3a7", "value": "T12C230271890F9EF524703C36EAD9939376E12AB1C6773013D6280A382FA57531E57E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429790, "uuid": "8a46ada7-6fd1-4db0-ac9a-4513a5c321fb", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3cp9q3UELbUXfi6nVMQHI4vcGpvo:DECFd+A6YHAxccLRQZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677429790, "uuid": "2b2bfa2f-1d13-4790-b247-3a4f9a005c9b", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677429790, "uuid": "faa01e14-5962-49c6-9e96-8cbc840da2d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429790, "uuid": "d70df1f3-b375-434f-863c-b2824d5f7fb6", "value": "07ead098188d21ce043f17d973e727d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701b2cfd-b60d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677440435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677440435, "uuid": "8a4314eb-96c5-4a68-9b52-cd3986e8d2c2", "comment": "Malware payload (RedLineStealer)", "value": "9ed1d7d5c099a29df7c61efac990f993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677440435, "uuid": "1e330f1a-5b44-4f1a-b00d-2463610e8e65", "comment": "Malware payload (RedLineStealer)", "value": "933d8e7c40120f0c690249dbf2cab78013a482725323107d27f76f0880ce6864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677440435, "uuid": "016ad66c-2a4b-4c0f-b981-e29dd2d3a00e", "comment": "Malware payload (RedLineStealer)", "value": "6dcdf9afb1b8f11e646bd23ac7308e4c5c131529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677440435, "uuid": "46a704b6-d184-450d-bdbd-e06a45baa389", "comment": "Malware payload (RedLineStealer)", "value": "1e8406118e039fabc81336a695686befca595cb42631efd4b735815dc5c044ca2a153997fec0a0efb7ffcadf3b1b9ab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677440435, "uuid": "7930b61b-66ff-45b7-96e4-f0fc76147953", "value": "T188A40247E7E84472EC645B700CF642D30B3ABDA06E78975B234F6D694872664B23273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677440435, "uuid": "0923b1ba-734b-45e8-a763-247896a773d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677440435, "uuid": "3b6d2361-9b43-4d8c-84f0-1f2117ff83bf", "value": "12288:5Mrzy90qrVyl1e5Qy5K6OMsSLo5fUAMvC6H:eyNxyG5QQD+SL2fJ8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677440435, "uuid": "767f3141-1186-4564-86ad-52b561d28178", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677440435, "uuid": "38a2d20e-fdeb-45a0-8ba9-9dc3e43c10b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677440435, "uuid": "ce26d872-e73c-46ba-8a41-61194cd3e9cf", "value": "9ed1d7d5c099a29df7c61efac990f993.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3854ab1-b621-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1677449138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677449138, "uuid": "eaa5d9c8-2bb5-404f-af3a-c25e097d5f5a", "comment": "Malware payload (AsyncRAT)", "value": "2ac48bf829c73ca01e6f74511846c312", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677449138, "uuid": "e8a79a5c-bfb3-49aa-bd81-7e61fcb0d6da", "comment": "Malware payload (AsyncRAT)", "value": "93ae50604af0d299ed4e55ad99ee4dc32d4d5005888f05e8ea6e376f3da64a6d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677449138, "uuid": "5da2d08d-5927-4548-a504-f05d46e3d6b4", "comment": "Malware payload (AsyncRAT)", "value": "b59fd36ba27c72bfa20d5ebd4f35c5696ef75f00", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677449138, "uuid": "41126686-1a27-48bf-b827-ca46382a1947", "comment": "Malware payload (AsyncRAT)", "value": "87ac61c947c481ed8956c0b0fb6e23bc078368dffd5006e6a95a83afe5a2eac39def497a994a205975a733f3a0b7e194", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677449138, "uuid": "1ff46ab5-7531-4511-92cd-92b9015e40c7", "value": "T1D1A35C335622BDD4E77F3EB0F5442D950C643A5B83B28B6CFAC00DA978E6610DF568A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677449138, "uuid": "8e0a4449-6e6f-47d4-91e0-c62940944828", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677449138, "uuid": "f1beed14-dfdb-4764-81c7-7b378665dbdd", "value": "1536:UY+ke5yxwfYbN6HLWSWhn0+6ZQvqqVSYxyKIoOOefI1N:UJcBgQ0lyv781CeON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677449138, "uuid": "4dda2376-b6ff-4226-acf9-d147c8c64a3c", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677449138, "uuid": "f1451285-5149-4b3a-a038-1c1bf093f807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677449138, "uuid": "37c9857b-575b-4244-9c42-058180f9479b", "value": "2ac48bf829c73ca01e6f74511846c312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2693c74b-b600-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677434728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434728, "uuid": "d2de4be6-54b9-4d08-8336-421e6feea3f4", "comment": "Malware payload (Mirai)", "value": "427d6994fd7123210ceefd2ea1712f88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434728, "uuid": "a69e1854-435f-4bff-9370-d4c8b63b54cf", "comment": "Malware payload (Mirai)", "value": "93e8334d0f342b253a404e33e125ee1e9a121e00548e89a4a758bf64ffbc1fd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434728, "uuid": "c1e0e34f-2e53-4f69-bd5d-a1319aa33627", "comment": "Malware payload (Mirai)", "value": "ee16aeba40480044a952e1a24cce379223b640d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434728, "uuid": "45f170c0-1593-48ef-b71f-0c0447519770", "comment": "Malware payload (Mirai)", "value": "f7c7cc76e6147b3d102d2f07801107ef4128b613a5f98713f9e53546ccf1f17dab50a5daa87fbe8f6c47d73cbe2509d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434728, "uuid": "172c8e8e-2aae-4839-860f-4a087535b993", "value": "T10EE2E072F0A489A9D10E01B9152F660A0C3D7A2FB52485E6EB7CB7FB56D1F0F8B045D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434728, "uuid": "02f2a0e1-d99d-49f7-b768-7eb48c6e6426", "value": "768:S1GLFEmf75w4po8o9O2dsR7jj8CgAvQ0UrOhQogP7nbcuyD7UiyqJ:GGL2mtwSo9OosBFg6Q0UrOhFgP7nouyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677434728, "uuid": "82955bd5-7742-4afd-8e74-25bf1add85a0", "value": 33272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677434728, "uuid": "0cf02bd6-de3a-4800-b645-727eb198e56e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434728, "uuid": "38275f66-f4d0-43c8-9335-58c64826933f", "value": "427d6994fd7123210ceefd2ea1712f88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1588b3-b59d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677392220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392220, "uuid": "8345162e-b0d1-4097-a9d1-0de9128af310", "comment": "Malware payload (RedLineStealer)", "value": "ac2be175a8a1f22e0582d157c2a5356b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392220, "uuid": "18bba9e8-a04b-420b-b2cd-5d9fd0de2dff", "comment": "Malware payload (RedLineStealer)", "value": "94febd6b7d6e64bc21d687afbdd29386c4ba1ff7cffd0ce04d695a648ccf7684", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392220, "uuid": "c1031ccc-c907-49f6-ad48-4468480f3bc0", "comment": "Malware payload (RedLineStealer)", "value": "e2ea28e8f076cdf2cc9b181dab7f1b0ae48e9714", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392220, "uuid": "1e1bad26-d3cb-426d-a246-7d8e66cc6287", "comment": "Malware payload (RedLineStealer)", "value": "e63b545308cc45a007eae66f7b01766c5f209814818c57d1447529406e2bf34548f29b0ff58b0ddf258a1176279acb90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392220, "uuid": "6bb83eb7-b4ae-4248-b82a-ba3d23a25f04", "value": "T12C94F107F7EC8422E875577018F603C31A3ABDA15B68835A378FAC5A1D725B06A3536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392220, "uuid": "34a40aac-58bc-40e9-b6f5-abb581e3ef87", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392220, "uuid": "8d037ede-6071-4fac-9350-8d46e05fff60", "value": "6144:Kay+bnr+dp0yN90QEYb0ZkVFIhHvxg6SdVljJbjT+KMAEBovy6GWOIUOPVi:yMrZy90m4iSvxgb3l9VXE+vbGfhO9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677392220, "uuid": "fba552c0-3391-4e07-affb-7d56b70df014", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677392220, "uuid": "b6a6f16f-72c3-4a4a-bf0b-4b8bbcd40c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392220, "uuid": "ceb6c4b1-68ca-4ef1-86a2-694faa38218c", "value": "ac2be175a8a1f22e0582d157c2a5356b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61770fd0-b5d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677418076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418076, "uuid": "ea319c86-6586-4847-875d-59dd88a0451d", "comment": "Malware payload (Rhadamanthys)", "value": "6676b64f2459e06f45e8c7e82ffcaf4f", "object_relation": "md5", "Tag": [ { "name": "6676b64f2459e06f45e8c7e82ffcaf4f", "colour": "#B2E79F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418076, "uuid": "b5147e2e-4c9c-49d3-a02f-a3f030115d8e", "comment": "Malware payload (Rhadamanthys)", "value": "962b05c14c7265fc313ccc2dff7fa89c175b06a574da75df6b8294f7f8e492ba", "object_relation": "sha256", "Tag": [ { "name": "6676b64f2459e06f45e8c7e82ffcaf4f", "colour": "#B2E79F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418076, "uuid": "937407fe-7fb3-469f-b540-9a0dc50a9a1f", "comment": "Malware payload (Rhadamanthys)", "value": "9b6e8718ea0814a4ae6e5676003d8c1f1cce96af", "object_relation": "sha1", "Tag": [ { "name": "6676b64f2459e06f45e8c7e82ffcaf4f", "colour": "#B2E79F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418076, "uuid": "e980fa1d-631a-4dd9-b26d-b33e12a3cc88", "comment": "Malware payload (Rhadamanthys)", "value": "3959e7155c9de2d34678472b3e25cfea9d1b49b1f89c2d445d2df6b21a5d460317d16add3ec9d4d52dbc3876af8709e3", "object_relation": "sha3-384", "Tag": [ { "name": "6676b64f2459e06f45e8c7e82ffcaf4f", "colour": "#B2E79F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418076, "uuid": "2754732a-6595-487b-8803-6413ce770484", "value": "T14954CF177F6C80A8E826DDF454B01B626BECD536239F130B976C4426DEE43E05DE42DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418076, "uuid": "b313ff3f-ba33-4572-942d-e5654be5ea98", "value": "34c076e543b95918c5f8b18c85e7fcd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418076, "uuid": "be775f68-0c62-44ff-a882-4533484c5bf0", "value": "6144:jCT6qOZhdMQxGRovA3JcH8P1mEu0WO01qD9plEXRbzNblVmTI3cJ:WT6VNRERN3JcmffFDqXNNZpcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677418076, "uuid": "c907825f-c226-4711-9fc3-7dd841317e71", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677418076, "uuid": "e74f64f4-9dcb-4692-9129-1b843dad179a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418076, "uuid": "d0d9aa96-8b14-4cf5-92d5-778e64e5473d", "value": "6676b64f2459e06f45e8c7e82ffcaf4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5b51e4-b5e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677421262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421262, "uuid": "21cab5c2-7721-4f6c-9b03-dc6f0fd48570", "comment": "Malware payload (Mirai)", "value": "9b7af72a50da5cd6b5c8a14c0580e420", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421262, "uuid": "efedbada-f13b-4ced-b525-bcd6fa7d9934", "comment": "Malware payload (Mirai)", "value": "96a772465c0192428c5fc96721226cc28561f777416c574de00a11390ca9ceef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421262, "uuid": "491f440c-671b-4801-bcc7-a0be0d3b20dd", "comment": "Malware payload (Mirai)", "value": "783f1713573f7e8c620e97d7d499d07539203e88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421262, "uuid": "6182c10b-86ec-4324-9757-d7e9f6feb0c4", "comment": "Malware payload (Mirai)", "value": "99ab82c5d95869414d67ff5326f91c7ae63454f1da42a1abc5bbbcd0edac655946dc0f756774001b3a41409c2712a2a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421262, "uuid": "de771959-f7aa-47f8-95d6-ae17a328146d", "value": "T1ACE3C86E7E21ABBEE168863107F36F70C39561E726919382F16CD7181E7124D1C9FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421262, "uuid": "02ccef28-ec29-473d-a99f-9cb9515bba21", "value": "1536:3d7jY1TxEq+/7sU2rKExat+FasaO2rKEHa5DaPa+EzvvroseeIFrWu7ZcHDKyshB:mf3yi1zvvroyqZcHDQhmvj3q+13Botx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677421262, "uuid": "03654798-c77b-4673-9387-a6112ebdeb31", "value": 148038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677421262, "uuid": "ccaf42f1-96a1-4491-93f1-0fb49bc1ec05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421262, "uuid": "79133b69-54db-4ea3-a341-721cfd058363", "value": "9b7af72a50da5cd6b5c8a14c0580e420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97eaf4ea-b56d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677371782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677371782, "uuid": "1f7699af-7dc2-4ce1-b144-d44ffaf496be", "comment": "Malware payload (RedLineStealer)", "value": "4159b56ceabb23d1fa3ecf5a1faaab31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677371782, "uuid": "fd9340da-7b32-40d4-884a-d8d2c5f5a3ff", "comment": "Malware payload (RedLineStealer)", "value": "96e778e9fe65225a131f9e3c2c05c44a5ceec6549812beff030460641aea6500", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677371782, "uuid": "8a3453f3-eb2d-481a-a89a-ad11f3319e33", "comment": "Malware payload (RedLineStealer)", "value": "5bcd17ad33982ed9761fb921f8a7d3e395df2f2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677371782, "uuid": "afdda784-7d70-458c-ad34-105947c10a1d", "comment": "Malware payload (RedLineStealer)", "value": "54b85c4de7c1bb2bcdfa4cf8629c5853559d75e912596a290761d4a661acba5d8333b41aa6f7700032f525c8566ced46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677371782, "uuid": "6301af49-cfe5-4745-b2fa-428790d6fb1e", "value": "T1267401D2B541D432C8474C71B831D5A4EA7B7CA25AA0CA53335C7F6F2F313E266AA352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677371782, "uuid": "44fa6b6c-05f5-4fa0-8495-3a31648f6c7e", "value": "4453019f24fbdf41dd3a4f06fe73134e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677371782, "uuid": "23be77d4-351d-4bf9-b809-6bbd5375dda8", "value": "6144:VJxLs9147QkYoS/Zl5A3OTcLwiNge6EIH5kb:VJx49KlSRlQOTcLgEWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677371782, "uuid": "ab19df50-b879-4a28-806a-cb62083c39f9", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677371782, "uuid": "a2fd3e24-8086-4efe-8422-7f1c26f20111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677371782, "uuid": "56bf8f18-42f2-4ff6-99da-01621d0c9655", "value": "4159b56ceabb23d1fa3ecf5a1faaab31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5914689-b568-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1677369657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677369657, "uuid": "b8f88214-65a1-41e2-8ec6-f8538aa47279", "comment": "Malware payload (TeamBot)", "value": "b1737ee23f46fd10a95c3233ad44c021", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677369657, "uuid": "03b53e5f-b843-402f-8f83-a46198b59fc2", "comment": "Malware payload (TeamBot)", "value": "96ff65df1aeabb5cae329dbd72dff0cc280d2ceca1e5da8da4b0ac555e861e55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677369657, "uuid": "0f42c419-38d6-48fa-a08e-d4931638f31e", "comment": "Malware payload (TeamBot)", "value": "9e0d0bb417f617b986256d479ede2c9260375acc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677369657, "uuid": "1ab93878-f898-4450-a231-c65cc0b6bf5f", "comment": "Malware payload (TeamBot)", "value": "13143289ef89ea0f0ebf5693f734bb0da712135ee3d79b7991478e3e0d4348a883e8d997d3362409d7c9f0905a31fca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677369657, "uuid": "9905db5e-ced1-4e53-9d92-f3d25aec64b4", "value": "T1E724D011B591CC72C84744708824EBF8EFBBBCA25695899B37583F6F2D303D257AA316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677369657, "uuid": "4632c039-b1e8-40da-ae0b-dc6926a93913", "value": "4453019f24fbdf41dd3a4f06fe73134e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677369657, "uuid": "f636a501-9cd7-46f1-8f2a-e3301dabbbaf", "value": "3072:h2kFLmhd1b50ovBw/1xyigcCmgnCq24hOmw/qiLIb:sSL+d1w/j2cpCCqFOL/qVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677369657, "uuid": "90cc7bf7-bdfc-43ad-a99c-1cca4cea5bea", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677369657, "uuid": "fbfcc274-fac5-4c55-bc05-986ab8e3207b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677369657, "uuid": "34ec8da3-11ae-4556-987e-dc8211328d01", "value": "b1737ee23f46fd10a95c3233ad44c021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccabe1e3-b616-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677444455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677444455, "uuid": "bcf665fc-47eb-4ce9-96b1-f6d1dca15139", "comment": "Malware payload", "value": "3fa3c60b5ffce7bc6bfd75475ecab3d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677444455, "uuid": "1d6956ae-aa7b-4e6e-b622-cabb138e5d3d", "comment": "Malware payload", "value": "987fca5057b22ac67535a28e3b63f876e3054ce8e7628534b2fac8e41e85ad08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677444455, "uuid": "df8ffc7c-a398-4727-bbc2-c4d8725b1666", "comment": "Malware payload", "value": "ed9992ce16476925bebdfca2d5c038f9033c164c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677444455, "uuid": "6acced37-22e7-45ee-954a-c51dfbe5e229", "comment": "Malware payload", "value": "1572eefdc6b36a80ba4620b76d07aad5474549d44e3d76178fb689fe054bb620dee401dffd3366910d2589a68454fbbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677444455, "uuid": "0ff30b35-78d6-4d29-a3d9-27855c6eff05", "value": "T1BF5523C820E80F5AFE45A1732B19E7B2A47C4DFBEEFDD36866D10D9B324238526841D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677444455, "uuid": "14854ad6-2771-4972-97a7-12861bf338e6", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677444455, "uuid": "63299c91-37b4-446e-a4b8-f081393b6f8d", "value": "12288:UZg/SuNj/9XVbBFx9EHtptoBfBYvcRp6QEMAiqzs6WjMne4i6ED9ghIWiEWdEVTn:UYRbj4oZ2cRNEl95ne6KghIwAQTTRmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677444455, "uuid": "dbfefa2d-21e6-4680-95c3-ee9256d29b4f", "value": 1343420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677444455, "uuid": "f1ba870d-8f94-4dc3-89db-68d4d6480e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677444455, "uuid": "d1998376-7885-45ca-9bc8-3a31fc2d4830", "value": "NetflixCheck.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b4b062-b5d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1677414493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677414493, "uuid": "52672b90-53ee-4695-9f5f-d8c066ac721a", "comment": "Malware payload (CoinMiner)", "value": "21c35b06e8048aa8d07d9e2423516c02", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677414493, "uuid": "befcd452-1bba-4e36-ab12-4365e5ace1d2", "comment": "Malware payload (CoinMiner)", "value": "98fcd30002462d9efb03f43cac3994b62c60f393a7b1bd039103d46f34612ffe", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677414493, "uuid": "830c1866-c0fd-403e-994b-367e6410bc9d", "comment": "Malware payload (CoinMiner)", "value": "a8145eb4bd427b905207e021ff50c2c068db7cd2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677414493, "uuid": "502a0a9d-fcb4-40f9-81f2-062e72d69005", "comment": "Malware payload (CoinMiner)", "value": "d36ffcd809994629b3267cbf1403800c0d2c055c79b72283895f247afa72b555fdb7cae8e3e31ae4b8c0f2c2d00bf906", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677414493, "uuid": "504ea0a6-1c00-4743-b0b0-f7120425335b", "value": "T18924E111B680C472C85A44709834DAB86DBEBC719B64894B33587B2F2DF33E267B6F51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677414493, "uuid": "922b3644-b7f9-4738-b45a-7f8c7bfa92a6", "value": "4453019f24fbdf41dd3a4f06fe73134e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677414493, "uuid": "b55a9658-7b3b-466c-a75e-3288bf55de8f", "value": "3072:UXtlLrh21b50VYPvSFuL9pIfW8GqrLXmu/ocSqhxXGb:0TLd21KYv+uLQprTm1qhUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677414493, "uuid": "0a60f526-8542-4d45-b68b-f64a19f41d22", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677414493, "uuid": "67497127-a3cc-44f0-9914-c939f0d61434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677414493, "uuid": "75e2591a-0832-4348-a3ab-6879a008cfa2", "value": "21c35b06e8048aa8d07d9e2423516c02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0702fe-b5e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677423005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423005, "uuid": "5567f236-361e-4835-96b7-6aa865c81e12", "comment": "Malware payload (Mirai)", "value": "7e06e01092956545741ec61d4a7dbf32", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423005, "uuid": "a72e9294-8a35-4630-b8de-1d74188671bf", "comment": "Malware payload (Mirai)", "value": "99823157d4749a98be58309ea5776e35c3caed4a672bcd841e7c4e6aa1cb8f2b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423005, "uuid": "d75756a4-e4b1-485e-81f2-f3e0733e6769", "comment": "Malware payload (Mirai)", "value": "bef23e60c8e14832c3c6e56270c81c3b2353d802", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423005, "uuid": "6edfcdb7-59ef-457f-8109-d8842222cf80", "comment": "Malware payload (Mirai)", "value": "96e43087c4c265dabdc4352ff0d543c32df0a2c471e31c81a301543a660a10862b5a2d32de96f6bb66a68ebacdbfa36d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423005, "uuid": "7976d011-7692-43df-9e49-17af8322e0ee", "value": "T142E2F1A2A4DF0744D6BD96320C1E69482E3CD36B91008579EBC1B70EF792F652D4A387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423005, "uuid": "545c37f5-dc24-4309-8f4b-722ffb81ce81", "value": "768:uABVXaWSUC26KQZN0vRJLkaDKLJLH01s0KZc+nbcuyD7UHQRjw:3LfZC2YZN0jVKNU1sRZc+nouy8HyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677423005, "uuid": "1ab8be8a-67d0-4b89-87ad-8ff56e0ada87", "value": 32060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677423005, "uuid": "6951f88c-a946-44ab-9cb1-a959b2ccceae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423005, "uuid": "9138eb6a-a105-4b67-abcb-de0c0240d535", "value": "dark.x86-20230226-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75bd735-b603-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1677436366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436366, "uuid": "1686d482-0353-4d9d-9749-4fc431a50f03", "comment": "Malware payload (LummaStealer)", "value": "fe250c4e95a38bc320232da60c89eb21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436366, "uuid": "f6bb4a1a-1467-4c63-b69c-d738f3b35b9d", "comment": "Malware payload (LummaStealer)", "value": "9a0fed112384f29989d39d10f2a087e23fa2cf29b93b4f65e470a18018a9e411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436366, "uuid": "6543a781-1d2e-467c-a95c-f7c06468e5cd", "comment": "Malware payload (LummaStealer)", "value": "53f3fbd341610d321a42641253546247d0a6301a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436366, "uuid": "81cf120f-65d8-4485-8ac4-950e8473ef79", "comment": "Malware payload (LummaStealer)", "value": "f8941b5ede270e1bf496b609a6a54a2906864217dc467626cde0eec7f0a22b069c391a763842a2ede6a16310e068443c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436366, "uuid": "431df645-d07a-45a9-a9a2-ecfe490a9ae7", "value": "T176C4D2D53342D95BEC975A304E53C3EEA758FCA1AA74319B2370F36E063A9C31A64781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436366, "uuid": "13b81929-c78b-4ee5-af37-7482b9b3c1bd", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436366, "uuid": "adc9222d-2ad1-462b-966b-9cc4b6f7f079", "value": "1536:4rae78zjORCDGwfdCSog01313SXs5gAUzg4gxxpTA+P3Bg:QahKyd2n31C85CzgZPTAQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677436366, "uuid": "c5c0b0c2-0427-49cb-87fc-2eaa7703cf67", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677436366, "uuid": "44f91f0b-6be4-4254-8464-5ed71c1acfaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436366, "uuid": "f2f4cb61-77bf-4e36-a5d7-d7f800c17cbf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334cb3e3-b5f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1677428736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428736, "uuid": "f4e61e55-5578-49e4-92ba-c16370a72c53", "comment": "Malware payload (OrcusRAT)", "value": "b3c049b9160e55f747cf584b109aa3a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428736, "uuid": "9bcf4b9d-3adb-41b2-80f7-7d0c3ce5f592", "comment": "Malware payload (OrcusRAT)", "value": "9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428736, "uuid": "20652cf0-c761-49b6-a4cd-ab46a465d943", "comment": "Malware payload (OrcusRAT)", "value": "7731a49d69b16377c0acf234fa037278bc741923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428736, "uuid": "6438598b-8f85-4ba0-80bc-dc8a1d266286", "comment": "Malware payload (OrcusRAT)", "value": "777255b81b55573a5f3fd3735a9de66d8cde9e1afded754478b4be04b9d6adf358c3396ddeb516316c840d56237d03eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428736, "uuid": "c4ffc36f-f73a-4b75-9f0a-d0d3baf2813f", "value": "T14B262321997832F8E6F6A3758F52C78B6D8066C21116CC671AF856A3D5E10EEF207DCC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428736, "uuid": "3f973680-04ef-4c8a-b5b7-8e33d9627d36", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428736, "uuid": "12c560ca-be26-4213-ab40-0b8e87c8b7bd", "value": "98304:AW1+5Ax7m35LZqTXrzxRERF+jtHPudaucpm1COO9lXf6Wnlgb4:AW1Gl3pZqLr1dVv/vf3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677428736, "uuid": "adf1925c-d6a3-417d-9f58-3dfb06758843", "value": 4653056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677428736, "uuid": "1fa548eb-8a54-4686-99e0-de405bee0d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428736, "uuid": "1b103990-edca-4d7b-800e-8d78d95a19de", "value": "b3c049b9160e55f747cf584b109aa3a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d1bdc0-b582-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677380875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380875, "uuid": "44e42ca2-1101-4427-b17e-85d95ff8046b", "comment": "Malware payload (Mirai)", "value": "1b4e15e92b0978a13315c68acb543a15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380875, "uuid": "6e23e3a9-ac95-44b8-919e-d1a6d68b0a1f", "comment": "Malware payload (Mirai)", "value": "9b1ba515875c6fd3ab3035a375555ffbdfc287c2e67fc55c168deb25a3f63ae6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380875, "uuid": "48c65ef7-8de4-43ac-846d-a344b104500e", "comment": "Malware payload (Mirai)", "value": "ddd1c258113ce54f06b8bdce16428d599627dd3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380875, "uuid": "0ed1df5c-04bb-4fd1-af1d-0597467b6d30", "comment": "Malware payload (Mirai)", "value": "6916178df973fdc260015220c5a1fbed6b231bdd8a1159385cbf08bf817f3831110eb59c4d87ab6c418ff11776147a46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380875, "uuid": "ef7548f8-aeae-4a76-82f9-db6a775ec7c3", "value": "T171230158E0F89597C5FA7D7868EA13B0924533C093E643C8E3650E88DA1B21FE8CF099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380875, "uuid": "f9a62714-4329-49cd-8587-e1f6964c345c", "value": "768:QznqKaiUxf0myocB15HcbJvGwhfAv+//15AYJzGZAE1j9D3W1:QbqDNcB15Hse2XEQu1j9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677380875, "uuid": "503cffaa-39f2-4880-b28c-7d5c4564c553", "value": 46724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677380875, "uuid": "14fe28fd-8282-41b1-aae3-51cfd977359f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380875, "uuid": "c4b67bc6-db2f-4de0-98a2-3fb2b8eebb61", "value": "1b4e15e92b0978a13315c68acb543a15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6acf7e6a-b5d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1677415085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415085, "uuid": "960b1e31-22b9-495b-a9cc-88d4c2e0a18e", "comment": "Malware payload (CoinMiner)", "value": "8e9fe0d0efafefa00a222ddee017327a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415085, "uuid": "8ebb8465-0929-4b62-8c28-66a4ccd455ac", "comment": "Malware payload (CoinMiner)", "value": "9b4a1011466da15c2ef7ad0a1f462b7903d3c8158c16b0c67c3e75ef992e979b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415085, "uuid": "ffef5576-cbe0-452d-84e3-0b4df2d55eec", "comment": "Malware payload (CoinMiner)", "value": "602bf696e8533ff030193435d09ccc0c964871a7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677415085, "uuid": "48d4eb81-cf83-4887-b7eb-531ad82becb3", "comment": "Malware payload (CoinMiner)", "value": "780d80d847fbb97d31100f3b265531d89c7703700c71b10bb080a4e8db9dfacaec7cf1103da82b654bdf42ad2d5682bf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415085, "uuid": "8d548c68-9669-492b-8621-61e434b29634", "value": "T1418623F91280339CC01AC8349133E985F2F5555E5DF9D5AEB2EBB6C07BAF810D642B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415085, "uuid": "3419eead-24fc-4597-95a5-78bf82f3cdcd", "value": "1b2324c097913513bef0f7e95aeec8b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415085, "uuid": "0951566c-8eb1-4bcd-829f-1a556c1c37c9", "value": "196608:8uQvsuIUKKL2bGeaaQHCy3bYGmcx0lv89Fgt6kG8X:DQkyL2bB/8LYV00lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677415085, "uuid": "40130c10-e656-475e-95c7-327663174bfa", "value": 7998976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677415085, "uuid": "6708d9dd-8f7b-4f08-8d59-34506614a771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677415085, "uuid": "31c651bb-4d3a-4c56-80d4-6bf4a2e64617", "value": "spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcdc98e-b605-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677437132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437132, "uuid": "dccedf30-e5d7-484b-9fcc-efa0e20cb56e", "comment": "Malware payload (RedLineStealer)", "value": "424513be1e7b7de6191b4e12b6466682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437132, "uuid": "fbfb7090-3673-44bc-8605-10da3182cb3b", "comment": "Malware payload (RedLineStealer)", "value": "9d691ceaf5c3ba1d783f80fc905c10eec95f93404c9656c8d93d8c660c38b783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437132, "uuid": "dc786b06-9576-42fb-9365-10125186c9f4", "comment": "Malware payload (RedLineStealer)", "value": "27eee0912c20ca0f170897f3324c50783fc189f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437132, "uuid": "667f52a9-00ba-4ecd-b29d-7b1d66345d50", "comment": "Malware payload (RedLineStealer)", "value": "e8c9889e3afa3b34e033c6c8b11784ae9950e4b08ee3d05f8c2530508b345c36f01a4aa7aa39035d393d7c07bc7c9c5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437132, "uuid": "ed887f1c-1958-4b6b-b9db-90250362d6dd", "value": "T146A4F107E6FC8422E96527705DF602C30A3A7C615E7843AB234B6C5A1C736B5B63177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437132, "uuid": "f5ce8f0e-f306-413e-8b49-1ff7bbe93b40", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437132, "uuid": "e90f9fdc-b21e-45d7-85e7-925e29771696", "value": "12288:1Mrny90OBBHfL6GAggHmDz8K14OP/7WVrOu:+yrBHzFcgzZF/7WJOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677437132, "uuid": "36aa7765-0a4f-4413-96e2-5fbebd344379", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677437132, "uuid": "82857b69-b5a8-46f1-91bc-7a9a10a075ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437132, "uuid": "efbbeba7-950c-44ce-8787-88f7985e3acb", "value": "424513be1e7b7de6191b4e12b6466682.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1801e6-b5eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677425795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425795, "uuid": "0fbe2d3c-8cb9-4f6f-8ca8-f5841f152b86", "comment": "Malware payload (Mirai)", "value": "484dfe5265c95d3c3562a1dc4e94e9fe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425795, "uuid": "42364259-bb50-4a15-ae4c-80e92acfac09", "comment": "Malware payload (Mirai)", "value": "9d83f74b75a9ad244b2f3af4e0bda7240cb0ba5befef0f91cba7f13426c3fbbc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425795, "uuid": "29d19ba3-7cbb-40f0-b579-278969af47eb", "comment": "Malware payload (Mirai)", "value": "a4c03cb879e16029d71ff0ac71d464492ee0a9a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425795, "uuid": "b427ee8e-3309-482e-8006-f38296d802dd", "comment": "Malware payload (Mirai)", "value": "27fbd246d1f23426dc20f4cec0c4ac1d6ebdd9e3c07c01ca177f948f2ce0282d1119cdf0e58beb9b3b5b38d8d57f3da8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425795, "uuid": "634e82d4-3e88-421a-8efb-aa49495fae1e", "value": "T13B83A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425795, "uuid": "bf50996e-d014-431a-9da6-98ab2d092484", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTq7ZDYovZ73x/nL8y8QI:Rakdn2Eo3ePu5GTqRYo99Be037Wp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677425795, "uuid": "d1d76255-c17a-4e50-a2c4-0223bcf8df82", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677425795, "uuid": "30aab4f1-4c3c-4866-adf9-fcdc9427a20f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425795, "uuid": "d041ef81-3a74-4646-854e-564757abe463", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991127db-b59f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677393259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393259, "uuid": "b564852b-185f-4191-9381-121baacfe18d", "comment": "Malware payload (RedLineStealer)", "value": "933a2dbdefe113baa4457275c170b640", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393259, "uuid": "e97dcd0c-072c-4fbf-914e-3eb8b8e40128", "comment": "Malware payload (RedLineStealer)", "value": "9dd5c9bd8dbc8dd7c9b3b81b755e3fbaa411234991889fb630eed48c2f0a9608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393259, "uuid": "004a57dd-b757-440a-80d0-b39743cac98f", "comment": "Malware payload (RedLineStealer)", "value": "1e1d600715f8f345cef766ee90594eccbc30bfe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393259, "uuid": "00edac97-ef65-4da8-8a69-41e6f8785141", "comment": "Malware payload (RedLineStealer)", "value": "60a78fb5d9e5bafd526efbd425889f7984f1935f332fe704d0a30dee7ba7edf933ee82ba669925cb24066e7194661f7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393259, "uuid": "8fc0d4e2-f89a-4476-80e3-466bf0cc03be", "value": "T1B5352213A1FC8137D8B597B00CF651D30535BE611A3C8E9B63CE9D592CB35A0A27972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393259, "uuid": "602be1df-468b-433c-8c36-d2079b64542c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393259, "uuid": "d1fd5346-db53-4c05-91e2-074d2ae19dea", "value": "24576:Ny52cm0Of18uAhoeV+lIydNGq/HkN6qsRCBix0DPKdNS9W2:o52cdOf14EjMxesix0DPKdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677393259, "uuid": "0224a643-e655-4c59-9d2c-b71768959260", "value": 1119232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677393259, "uuid": "d0f6eee7-e9d7-49ab-9154-606f522488d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393259, "uuid": "6eaa1414-fe01-4757-a0a7-6162c597fc53", "value": "933a2dbdefe113baa4457275c170b640.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3aa405c-b569-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677370084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370084, "uuid": "9646ddf9-cff4-411c-996a-ebd396961ba5", "comment": "Malware payload (Mirai)", "value": "a910008ae5e3b96522632e688178526b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370084, "uuid": "c5110108-a1d5-4454-9890-88ddc35f8a87", "comment": "Malware payload (Mirai)", "value": "9de31d7f8e6a36d20f9ca66a4b7e038252f7ed4cb30164213d35b8e25065a151", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370084, "uuid": "6bce9449-7aad-4236-a8fc-75a5bd660b4c", "comment": "Malware payload (Mirai)", "value": "7e8f7f3de753ca6c98a6d563450e50ac3216e064", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370084, "uuid": "3e781b32-5109-40f5-94da-1a71019bf527", "comment": "Malware payload (Mirai)", "value": "b1d5f5816ea1ec7ce682a098ffcf52346bb3f54ff8bf8bcc51ec1db37c5dd506ebd7c7a021337dd4a5b0c91338f265ea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370084, "uuid": "43949a63-de86-4a4d-a548-70cae0ec0527", "value": "T11783D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370084, "uuid": "25390c7d-f47f-4823-9478-ae74ff68cace", "value": "1536:iVLyu95KfJkj752dCexuV/8UZlDwfkJ4MYfW0:iVLyMg8Fezxu5VD1eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677370084, "uuid": "12409f3f-34e7-43d7-b368-1e91ba6f3407", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677370084, "uuid": "274dfc8b-6544-4ce3-87f5-43175ba377b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370084, "uuid": "f38d6165-d080-43c3-81cf-48a38845f14a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e235be6-b5f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677430204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430204, "uuid": "61888a39-f65f-4de9-bdd8-f87a424ac077", "comment": "Malware payload (Mirai)", "value": "d743594e9f45bc7610e4af5aef6991df", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430204, "uuid": "6049ab49-d2a9-4262-9c6a-2fbd6f048425", "comment": "Malware payload (Mirai)", "value": "9ea82784426d5645e0e795e1e8ad13ffffa00a37dcc44011f45e69ca88c688e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430204, "uuid": "c04d0283-bc69-41ae-9129-5e089befa5e5", "comment": "Malware payload (Mirai)", "value": "3d8be2481f63acb31d6a283fec43294d0669d7bf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430204, "uuid": "0dad91b6-24b0-42f4-9c8f-111782673186", "comment": "Malware payload (Mirai)", "value": "8426ad2be389737976b9d39ae39c430989618637df32ed6f77d34af8fb74a48cd4aeea6ce9eda6f3482dce2aa606f70c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430204, "uuid": "9a4554a1-e62e-4e61-94d9-561aec27ea2c", "value": "T140D33A46FB808E13C4D517BABAEF41453323AB64D3DB730699285FB43F8A69E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430204, "uuid": "930c813b-e058-4daa-8619-e0b95d24dc7b", "value": "3072:XqefnV9CD+qfBINMZ8QpsEYI+L+UMK/HcrvHYIM/9rJ:X/fnj6fBkMaQpsEYIE+uOvHtM/9rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677430204, "uuid": "5752cf84-42f4-40ba-9b47-2594e6aacc0d", "value": 133941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677430204, "uuid": "840b6398-2d47-42be-8f7a-95bb635ff218", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430204, "uuid": "eabe9e7e-c9c1-4154-9ece-e08add05959a", "value": "jklarm7-20230226-1650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8578a0-b5ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677398365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398365, "uuid": "fa73125d-3b89-492b-ae81-0ce90fa7666b", "comment": "Malware payload (Mirai)", "value": "04529ab27cbfef6f7a2d2c324519c4de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398365, "uuid": "b6fa317b-0ff2-4f00-8935-a781e345a911", "comment": "Malware payload (Mirai)", "value": "a0126b694c93e29f50477e5bed4b2a45cb342ec05cc18e12b875ad70fbcd5d49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398365, "uuid": "53a5e83f-fd10-4d43-a371-fefcffa881aa", "comment": "Malware payload (Mirai)", "value": "e5612df976d1c1f3de6c9afdf15718cf50ef9d45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398365, "uuid": "706a74e8-c572-4ebb-8de8-50a28d585f8a", "comment": "Malware payload (Mirai)", "value": "a23e096710e6bff038005e26bfcbaf1c503a904bd63a06033b6bec33fc489ac79b1307d22a53391caf643f7f704ff6b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398365, "uuid": "d230463d-f0bd-408c-82f4-7ea0fdcf2bdb", "value": "T198430795B8818A16C5E423BBFB2E019D332263F8D1EF7207DD216F15778A81F0EA7654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398365, "uuid": "83d81f59-a3f3-437b-ba2e-5428dc4f5c54", "value": "1536:Iqu9QdgapVMFlyAef/a0nd/Nt5sfDK//HUFhdqhFdHx:49QdqyhfiUVb+WnUFXidH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677398365, "uuid": "bbf4f759-3666-481d-8b13-b482d4c08260", "value": 59992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677398365, "uuid": "47a104bd-bfb6-4ccb-ad98-0c3cf094ea7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398365, "uuid": "36a10c4c-9f0e-4805-81a6-56406e266cb8", "value": "04529ab27cbfef6f7a2d2c324519c4de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9e9933-b601-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677435333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435333, "uuid": "4b82e660-5eb4-4b49-a531-c82b2d4a153f", "comment": "Malware payload (Amadey)", "value": "8834207416b720ecd0f8a0846904b867", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435333, "uuid": "26923b2a-91ba-4a57-96f3-7f210fab940c", "comment": "Malware payload (Amadey)", "value": "a0476c747173025673b69d5c9d2fbccd34d924202a00bf053a0c162f3cdea65e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435333, "uuid": "39e1404c-f89b-47d8-a2ea-dacb9618f2d9", "comment": "Malware payload (Amadey)", "value": "c8fb75f8b147cc51105e05cb39e2c284feb197ea", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435333, "uuid": "8027dc2c-9182-450c-b4fc-b2f586bb2626", "comment": "Malware payload (Amadey)", "value": "5acaec8715b1223f664f0d19ecc1c5717affae35618f9d4f83b10677bc6df4c3b9fce1bc44917251a0f63728ac52d1c0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435333, "uuid": "ae69d4aa-8396-4808-ba43-d7b431f05085", "value": "T105452307F7B98171F4F60B701DF612D7073ABD616E78874B634A2A5A09722A0363937B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435333, "uuid": "0c306ba5-4b1d-4baa-9c74-f366a0ac49b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435333, "uuid": "e0178a1c-0abe-456d-9c81-f84ab8eab913", "value": "24576:Yyt5fgFi2Ltu67WszEvHYF15MvTb6W9EOEH0o8jo8QXB5PG:ft5YtuK1zn1ab9+0Sl/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677435333, "uuid": "761db0ce-5d40-4ed2-a63b-5f68260a7dfb", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677435333, "uuid": "6905ebaf-4a8b-47dc-961c-7cbeb67e8689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435333, "uuid": "1a96ca34-4a5a-4a72-9459-ff6e127dd3b2", "value": "8834207416b720ecd0f8a0846904b867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8159ed40-b59b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677391501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677391501, "uuid": "7585e829-975c-4670-b12a-c08d5854d08a", "comment": "Malware payload (RedLineStealer)", "value": "f61248b22b735ec8262034b6c9f6ff73", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677391501, "uuid": "71fa3c32-9536-4ba4-93d0-86d85566f667", "comment": "Malware payload (RedLineStealer)", "value": "a11e99df86278965c0de4caedbff2500270166f88977e766160e33fd9df975cb", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677391501, "uuid": "1189f7c9-7dae-4e01-964c-97b0eaf04239", "comment": "Malware payload (RedLineStealer)", "value": "6a327ab5d7f0b99acdde0cf58235d60251a5ee34", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677391501, "uuid": "da2acc2f-8a86-4198-8e62-4758ba335c3b", "comment": "Malware payload (RedLineStealer)", "value": "8c52802378010ec71e4f8a12ad3c20e6f265217a72e62970a4481f204f86195a1e15117c7b21ece7fd0d7c3dcaf8c27b", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677391501, "uuid": "afc3fb6d-dda0-41ae-9ec7-e7cf376eaa78", "value": "T147F4732F58C691E1C5C08832F7EA80FD15F54B7F5999A3B705A403F8EF9222A72521E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677391501, "uuid": "b4d58403-29ba-46f7-a6e3-273fe36175ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677391501, "uuid": "386bd716-8cea-4c8a-9a4c-9f50f5c8a5c2", "value": "12288:ZDMr5oK0aRcdNXcjsTj42CrQcLsVLTNsud:ZGaK0aRMJj4lr3ud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677391501, "uuid": "500586fa-23fe-4f82-b23d-4eb8976b431b", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677391501, "uuid": "afe45064-1950-49fc-92ee-1907148af458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677391501, "uuid": "f4f4de3d-9c30-40f5-a5a6-898147110a7f", "value": "f61248b22b735ec8262034b6c9f6ff73.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3524d6a8-b61e-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677447637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677447637, "uuid": "c80d8a0d-fed3-4c76-891c-bba98236bc0d", "comment": "Malware payload (DCRat)", "value": "274aa684c9366ec70a90510906cb823f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677447637, "uuid": "53a549f5-0120-410d-a738-4d3c273ff1fc", "comment": "Malware payload (DCRat)", "value": "a1612631fe4d0f6d85f1293ac62776c6134c326a7ee368eacca23ce9a09afa49", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677447637, "uuid": "2dab42d6-983d-492a-b705-f8f60807c395", "comment": "Malware payload (DCRat)", "value": "bf38b69febebff5c50c61441c7a0f25b9e7ef8f8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677447637, "uuid": "6e150094-1370-4bbd-9480-11256d7d2a07", "comment": "Malware payload (DCRat)", "value": "2c7f291ab9f30ffde69c66c96c7103599badcf3432a73dbd937461bb438122a8abad1cc569170b35f6317f91cbd4f0d6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677447637, "uuid": "57de506f-7691-430f-a828-2969439531a7", "value": "T164E486342EEA1029F177AF7DD9E47596DA6EB6A33707994D00B102CA0723B42DDD063E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677447637, "uuid": "72876618-60b8-47e8-b3dc-ad09a2737d5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677447637, "uuid": "78976901-a9ce-4814-9789-bdcbf3d4abe5", "value": "12288:u+NE5/OWqCKUeBjdhf5x8M1kBcFct4uAAum5k+wvHrx:u+NPbBjdthhut4uAAuLvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677447637, "uuid": "879a7b7f-01a2-4df9-aad5-6afe64607403", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677447637, "uuid": "e31dcd5a-9130-4d39-bddd-7881e1d9132e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677447637, "uuid": "3896112c-e42a-49a4-a7f9-30d6d3bd8ba3", "value": "274aa684c9366ec70a90510906cb823f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1062c0-b5f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677429828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429828, "uuid": "907f3193-7584-4fdd-8c68-f90c9446f20b", "comment": "Malware payload (Mirai)", "value": "4fb8280ee3e45e3ed79d518c37e6fb44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429828, "uuid": "854ac942-cde8-4e08-8329-5bb3c67ae969", "comment": "Malware payload (Mirai)", "value": "a1dbe9435c1ae4a69d4c1d94a240eeca9b5f7db7273dcf9640ca79f9babe80d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429828, "uuid": "4a76ea16-48a8-4766-a56c-c40fcefec896", "comment": "Malware payload (Mirai)", "value": "e9bc578753662cb08ab8bc4fc37a1fd636433893", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429828, "uuid": "d5a1336b-0f71-44a5-a4d8-2e935325d4e4", "comment": "Malware payload (Mirai)", "value": "d8d85567fe4630c354d3f9730042e1546934061cbdd9764a48df8a476b6e99fdd284b4c02fc7b91576931f8b27cfcc39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429828, "uuid": "6ebe52c4-d091-4d3a-af5f-41a85c785e9b", "value": "T106A2D025E3456EF4DFAF9C9453C1C3C27AE546C62686C8E240FEAF013516446F789D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429828, "uuid": "0f2ac751-286d-4404-9f0c-65ae34e0d74b", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C59wznM4uVcqgw05VxJx:9RxsSVsMD6xiJJE5zRWNvp4uVcqgw09D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677429828, "uuid": "6994f1ee-9d18-4ebf-a10b-858716b3fc8d", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677429828, "uuid": "dd9be133-0cb5-47d3-9de4-bab53b4b9973", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429828, "uuid": "28bee835-3962-453d-9ae7-8e3bd3af6174", "value": "4fb8280ee3e45e3ed79d518c37e6fb44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac42444-b60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677441338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441338, "uuid": "ef826f14-81d4-424c-9726-f0dd798bb03f", "comment": "Malware payload (RedLineStealer)", "value": "46ec6cda81711654c3d1a70a7413c09e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441338, "uuid": "a7283d44-9027-4254-87f6-3d7e2786c1c5", "comment": "Malware payload (RedLineStealer)", "value": "a2e5bb8524f905be0101b48b509b37d793de9019c4c3f0edc0f6d0fea4d38863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441338, "uuid": "7dc6a245-91fe-405e-82af-5feaaaf2d96b", "comment": "Malware payload (RedLineStealer)", "value": "1136bb983e874e1fd80b6322fceb7b93087f5711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441338, "uuid": "810f8665-1bb6-4309-811e-5eca9eb4ea54", "comment": "Malware payload (RedLineStealer)", "value": "241fd3812278d4ffd4b3b9abd9db718dbb9f25911de82464982d5bcffbc4064ea873554c2256677b95bbe523b93ea2ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441338, "uuid": "41ce608e-e8b8-4d36-9820-2c33ca59eab9", "value": "T1A974B55D088AE918DB4B8B742253C94B3D3CC2DA13CDE9DDE79249E0078E7BCB49AD45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441338, "uuid": "57699c7e-b386-4056-826b-ddae3b7f8965", "value": "ae02ebc1e8c04c1e04fbf9093bdee9f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441338, "uuid": "be2ab842-561d-4c6f-b7ba-f0e8baf07478", "value": "3072:xOwtFRQ5gABj6m0xCkyFiVGmhvNwae8bQSQk7I09CPUQ2GAmx8:xOwtFRQmABj6JjhVTCY0UQ2th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677441338, "uuid": "0f429ce2-5b29-4bb0-96c6-4438ab089325", "value": 358144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677441338, "uuid": "5182daf4-23c4-49dc-9285-1ea7c5943951", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441338, "uuid": "7d0a4c21-c764-4535-baa5-1ebde929399a", "value": "46ec6cda81711654c3d1a70a7413c09e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50feb2e-b607-11ed-88f6-42010a9c006e", "comment": "Malware payload (YoungLotus)", "timestamp": 1677437973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437973, "uuid": "585fdf64-55b1-46ec-941a-736d95100677", "comment": "Malware payload (YoungLotus)", "value": "3632599571a4d48730d07a09343d1bde", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437973, "uuid": "82c6f136-5cef-46e4-ab6d-8ed09e5d9f89", "comment": "Malware payload (YoungLotus)", "value": "a3cd7a6ace2b75e39ea2a4ff5a3e4e27c840dc32606cd74990224814b2d3ac9d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437973, "uuid": "c7b65cea-f893-4d5b-80a7-cdc85c4e8feb", "comment": "Malware payload (YoungLotus)", "value": "83b1ede8c8f10b92d7296d375fb0612e0b080da3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437973, "uuid": "47b0b0e4-8bff-4a55-bc08-c70b60b3b8a3", "comment": "Malware payload (YoungLotus)", "value": "f45ea75b472edfc67e1dd17ae43974677a64cbf668675830aae17d5dea28f4746517cee4f176df9d9072d16c9cbe43a4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437973, "uuid": "e9140c8a-124f-4a52-8dc4-f4ae6bf63034", "value": "T1F5B36A82F58600FAD74A067534BE33329678A9550FF08F979F56EFAD2C23183AD79241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437973, "uuid": "2f3f5653-62dc-4081-8283-91d8b8494913", "value": "efbedc2d31c01d615e0f9cc07136a4ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437973, "uuid": "fd1c2920-9a7c-4321-bd8d-424ec64c2a6e", "value": "1536:Oh3MU/5bLDCMtm/ejs5x2WcHG82RqNoRKV2KoyqkvILnzZh/Qz6r:mt5bLDtm/ejs5xqHG82RWqWILzZRQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677437973, "uuid": "dffd3bb3-9a8b-478c-a807-0ea67542c63f", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677437973, "uuid": "bbffd090-b9f0-42a9-b7b2-aee9d5b44d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437973, "uuid": "4bac6c5b-703e-4b9e-8b81-5f6913ce636c", "value": "3632599571a4d48730d07a09343d1bde.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84752093-b59f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1677393224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393224, "uuid": "20a9693c-1ac2-43b3-acce-4507bc32cb79", "comment": "Malware payload (GCleaner)", "value": "816091e8b995c57bd04f5f326ae23f0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393224, "uuid": "b94b7cbd-8e8c-48e6-9ffc-baf4b7ae3266", "comment": "Malware payload (GCleaner)", "value": "a3d7b71b897c554fabca6a2cadba74f5fc19103d20d2e8a0d7ba3ba16a506acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393224, "uuid": "48ce67e8-ef97-45bc-b83e-ab55495dba6e", "comment": "Malware payload (GCleaner)", "value": "588d3b90d62f49da5e7c051e63b98631d6acec82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677393224, "uuid": "5db0bc33-c470-4566-a400-7fa6a7e7f83a", "comment": "Malware payload (GCleaner)", "value": "27071f2fa31cd601b6a739e5eaccfd291f30555eb5fd1f03c3ae167dcb4e95f99a805e2c51126d19c41d76d3d5eb4226", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393224, "uuid": "381570d0-3847-4677-b010-e6e9b5015f0c", "value": "T14564F1B178A0D831CDAB313084B1DA951ABFBCB619354A4BB2B83B6F5E707D01A75347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393224, "uuid": "936a2076-e61f-40e3-96b6-2a54fdc3d0c7", "value": "8c965d062b338134cc0af1a9d38bf4da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393224, "uuid": "3acf4f0a-2766-4b47-8b1d-e61625014ad0", "value": "6144:3CpTwLi3jyeLgvhttOLDGhVhCE/rz6pDq0Kjt3N9a:3C6ezyeLg5tADGTmq0Kjtd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677393224, "uuid": "94b707bc-ded7-4233-a1f3-96bd1b1f6286", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677393224, "uuid": "cfec944b-9770-4755-b9a6-39a1d82e059c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677393224, "uuid": "07c350e9-7491-4b06-ad0f-b7a247f561b4", "value": "816091e8b995c57bd04f5f326ae23f0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5752430b-b5ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677434380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434380, "uuid": "c7241734-9e48-470b-9a3f-2830c9214d80", "comment": "Malware payload (Mirai)", "value": "72acdd517f02ded59b670358d06340b9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434380, "uuid": "bcfa76ff-4611-4ef5-820f-4b6a619367a0", "comment": "Malware payload (Mirai)", "value": "a4a064f8bb99ae86ab32b55266ccb2d676a4876f4d2865df9e8d1bdfa1fff9cd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434380, "uuid": "b8d028a1-509f-4514-8f04-edb3ae3e9908", "comment": "Malware payload (Mirai)", "value": "5edd242d972d98dd79a64a379738ad2ff98083bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434380, "uuid": "7a4cd337-89bf-4047-a298-f2bfd6dd073b", "comment": "Malware payload (Mirai)", "value": "870600ebfa4d5594bfc76e523e268607a9dbb43c8500cff406183e080f3dabab2a0b00ad7a9d6217748a939e5bf5d0a9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434380, "uuid": "4fe257bf-1ffd-4dff-b257-70e68fd5cc9d", "value": "T10C231741B8818623C6E4137AB66E46CE372563E8E2DFB3179D221F503B9682F0D67F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434380, "uuid": "33df0ee5-8c17-47f8-af03-12a087860561", "value": "768:p9T3kFvFsOvIZg3VevqKxpn9m+/8KlUfPoV1//N+WX7JTzLgwl:L3kFvqOv0Q8lgxfM/z91l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677434380, "uuid": "bdd292bb-5d2b-47ee-ba14-45bf5f4e159b", "value": 46864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677434380, "uuid": "c7270df3-f3a3-4907-aac3-9276ca178b79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434380, "uuid": "e332b8f2-7915-4df1-bfc7-ea1a937bbf05", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79cb036-b5be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1677406651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406651, "uuid": "854edf8f-031a-4f1c-86ff-7e7b9db1e967", "comment": "Malware payload (Gafgyt)", "value": "b5b94360323d7ff9b34a591f424aed9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406651, "uuid": "3cbf795a-ebbf-4bfa-b098-e2011d66e701", "comment": "Malware payload (Gafgyt)", "value": "a4d7294a5884c13f0941d9363774e378852148c10859ea9151762282a6ab4000", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406651, "uuid": "45876fb1-75ba-400c-b824-3f99ea7b26e8", "comment": "Malware payload (Gafgyt)", "value": "6c3afcbf59e43747167ce4c75cb902225f7ab338", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406651, "uuid": "513187b7-23ed-45e3-bd98-1e00c985fb6f", "comment": "Malware payload (Gafgyt)", "value": "2a3a359ba015be51a5ec65f49236d59d8698d3dc942555e2d78863fce3116f0f0b02b961006e0a25f18a724be2926fce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406651, "uuid": "ecd4753b-ea2d-4533-a4ef-eca0ad521c20", "value": "T118F3936AAB61CEB7D80FCE730A9A4501118CDD5642D92FAFB2B0E51CE76B84F04E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406651, "uuid": "8b3d3c02-7b9a-4b8f-a3d7-3572fbcf2647", "value": "1536:GoXeTy1OHivUetUuWsQhkjGy1lZRpCo1oN49kFK4pJ9wwwwwwaN7EEDF+teLM9ql:GoeiiKjG0ldSkNUQNrDF+tsM9qSX9bNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677406651, "uuid": "85cf812f-fb34-48ab-956c-06fbb6003e5b", "value": 160503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677406651, "uuid": "12fc876f-7cc9-48e7-83e5-dc2f635da7c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406651, "uuid": "07f218e7-f75c-4162-81be-0841eb70f8af", "value": "b5b94360323d7ff9b34a591f424aed9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fefd29f-b5c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677410450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677410450, "uuid": "5dca2811-749a-423e-ac50-2cc83e995a98", "comment": "Malware payload (AgentTesla)", "value": "3e5be507b42104bcedd7c7427e21b31e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677410450, "uuid": "a92213bf-b47e-4ffa-909a-18bb92ad6b8c", "comment": "Malware payload (AgentTesla)", "value": "a529a6dabf9969e29428cf96de190c79aff1b6325f6072e128bd998f7248c82d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677410450, "uuid": "9e604a77-a177-410d-8465-c83df0eddfa9", "comment": "Malware payload (AgentTesla)", "value": "279863e039fa0bf4ac97f9c0e154fca6894515ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677410450, "uuid": "62e37a71-31c2-4a09-8692-a9cb56fece9c", "comment": "Malware payload (AgentTesla)", "value": "13dcb2695b898214c852d84ef781199974c8526e43fb69e1a9cb33c40b41915f050a51bee34d2a564d5536d8d03f833b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677410450, "uuid": "3586a17d-dfea-4048-9d95-c37a4eac2a2a", "value": "T1AC45B084F131A0EDC7590B64C8A731D84BF872177F675D3A6F1E7A80E669136A30DA83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677410450, "uuid": "fbf5658e-2f07-4b2d-82e6-607565a233cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677410450, "uuid": "67a25fbf-9bb0-447e-b202-3452d311a58f", "value": "12288:2um5PkirqpZX+5hOSc8Pr0quboHkoRiZF5mwPpZNLy28SZNeydpZUDOOW4S7RqNZ:o5PVM+fvP6oRAhu28SO4MDEJRUIpndd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677410450, "uuid": "b205691a-72cf-4ba5-98e4-122e1fd91ca7", "value": 1198080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677410450, "uuid": "f574eaf5-5b22-42f9-8096-2bbbea111c4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677410450, "uuid": "3a2387ee-7bc2-4dce-83da-79842559afa7", "value": "Mashreq-Funds Transfer E-Reciept.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823540f0-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "f2e57389-b78a-4f41-b902-15b7dbaf25c1", "comment": "Malware payload (Mirai)", "value": "12ee9af560fce093142be73eecc67aa2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "10691b8b-b138-47b7-9fb7-02a31883d7fa", "comment": "Malware payload (Mirai)", "value": "a63eb8fcf12d878891ef9afeb5252057d0dd0e923238fce7ed2e25d362a6124c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "a7279670-147b-468e-bad4-322afc23e521", "comment": "Malware payload (Mirai)", "value": "6e727b3da2b104ace2a5da94b8206eee87fdac6c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "19e1c9fd-0dc0-4403-ad38-bd63b76850a3", "comment": "Malware payload (Mirai)", "value": "f77c94e6e262d8ea93d8fe865d9f5891dc3bf77c887f3696f158ab0892a4b40540fa4649441273cc7826bc93eb5bbc00", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "40738455-aca6-467a-abc6-ce11dbeff09c", "value": "T1E0D33A46FB808F13C4D517BABA9F41493323AB64D3DB730699186FB43F8A69E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "cbfaabf2-b106-4509-8be0-6f7b3c410310", "value": "3072:sV7n/uabUqPIwNRW8mJMEYIFJmuEZIHcrvlZ1M/9+YJ:g7n/usPIMRJmJMEYIFIu6vlnM/9tJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372604, "uuid": "fe966bfc-a690-4e40-927b-fab10593f530", "value": 133941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372604, "uuid": "b7fa734f-ac51-4b22-a872-a3c09f1d686c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "3703be92-7d3b-439d-a416-c163a34d8b04", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74c56b9-b5b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677402007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402007, "uuid": "56358278-5358-4851-82db-c78782f700c4", "comment": "Malware payload (Mirai)", "value": "c6d4035e519d6549dba75a5717c25eb7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402007, "uuid": "e60e6d85-9e2a-406e-b254-ec6a4cfcc3db", "comment": "Malware payload (Mirai)", "value": "a64d6da23a6e85234786480f86fa8d6cf51ff2644c4048b9f43756f32f837be2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402007, "uuid": "e55c232b-d36e-4e94-a734-39626a02e75a", "comment": "Malware payload (Mirai)", "value": "bd5a300d10cb0e3b9f584fd43eb32b5577c270f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402007, "uuid": "2acc0db3-1065-400c-af92-3efa8acc24e9", "comment": "Malware payload (Mirai)", "value": "e72181787bf7e4721a32a32924dd480a03f4cf5e31c463a25cdd97469d3ebdf0ae69c829263a5a4a7fadf4e5cd8afb7e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402007, "uuid": "1d80b462-3923-46c2-b7e9-50dd3de0dce6", "value": "T126C33B46E6818B13C4D61775B6EF42453323A79593DB73069928AFF43F827AF0E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402007, "uuid": "6a284154-1cdd-431f-a295-1e8641d9ff66", "value": "3072:FQ23+iQ6mK8A0ufWY7qmt7qg++EuNM/9ME:FQ23hv8A0ufDeiv++E4M/9ME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677402007, "uuid": "8b77317b-d0c3-4975-8e68-e60895dd45a2", "value": 120454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677402007, "uuid": "31879124-5ed1-4ba0-9c37-0beb0393e7f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402007, "uuid": "59e19e4e-fe52-4298-9455-16272afc288a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83dc53f8-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "ed757175-720b-4aee-8b68-65c37bad5002", "comment": "Malware payload (Mirai)", "value": "eade447114210cea5e98acdd91c59137", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "a4bda44e-f933-496b-bb3c-95efd612f036", "comment": "Malware payload (Mirai)", "value": "a673b1eaafc14ce7bd216adf36d92dee9d5fd8a526d83c6d1012463aa57df7a1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "55bb74a6-24c2-44f8-974a-d9ac97728788", "comment": "Malware payload (Mirai)", "value": "d042f7593a64e3ade2d349af966bf48b652bfd47", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "7e19cd7c-f86f-4b1a-a815-ae517f62f4b9", "comment": "Malware payload (Mirai)", "value": "bb366f87c2c6f4abd7eb23ff172b792b73a309ab36d8732e227bb798dc61b360bdd240eb07354a05b76a4d94356b29ed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "1727d397-7818-4e4b-9026-8589a32dd085", "value": "T171230271890E9EB164303C76DB99D7D376E12AB1C6673023D6180A3C2FB56131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "e4f1f092-f710-4d26-8c10-20bcb94b97fe", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3E4T9q3UELbUXfi6nVMQHI4vcGpvE:DECFd+A6YHAxE4SLRQZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372607, "uuid": "fd4a514b-aae2-4b73-9432-76ce7150a3f6", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372607, "uuid": "60150eb4-33dd-4ab0-85dd-b79295cc96b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "936fc8bc-e1b0-4c63-bbfc-145ff6e78681", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d41930d-b61d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677447275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677447275, "uuid": "1c7c0aa5-d500-40e7-9f85-ad1e47137e00", "comment": "Malware payload", "value": "ee6f8b444cf1d833efd0d8d283d86f88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677447275, "uuid": "baf25161-ceb4-4e76-866c-233e576427b5", "comment": "Malware payload", "value": "a87610328f5259e727b6c1ab481ff0c781ab91ad2428ad690bbfcd031e380498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677447275, "uuid": "7c053bff-c01f-4385-aaaa-f7d27f25cfdc", "comment": "Malware payload", "value": "07f70a75ad507d9e7b29c284ccfec5097de4bd9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677447275, "uuid": "92c9d450-ad45-4f88-b27e-4845d39e0fc9", "comment": "Malware payload", "value": "660b7f6b3c6973eb452d90d0e309e6f3c830ac07fd3d38f214ff8e68f53a30594da4f96d6c037f59fdd42890e9ac0edc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677447275, "uuid": "eac88428-f367-4908-b641-51d8fe430a19", "value": "T1DE452303E3EC9032E8B5A7701EFA06D31636BEA02174C79653DA5E6E18711F4EA71763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677447275, "uuid": "feea79cc-3433-4323-84b2-42a83d85fe31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677447275, "uuid": "7ad43ecc-ca98-427c-a51f-d407a4938e3d", "value": "24576:by57mvWno4Be7zxw9GTgBo7pKxuWHyF+RaC7Gc:O56vn4Bw+/Bx36x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677447275, "uuid": "791f6538-8068-49de-ac41-c73e817bfa57", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677447275, "uuid": "afc87492-6f93-470b-beab-4d159b3b3abd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677447275, "uuid": "c239aad9-3643-49b7-a77e-01d3e74088a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c71e2a-b59d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677392396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392396, "uuid": "2560e506-3894-474a-b2c2-f51b044f69f8", "comment": "Malware payload (SnakeKeylogger)", "value": "052f932d8ef6e9725f4cac0a62130825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392396, "uuid": "135aa7e0-f672-41bd-a431-6ab58ebda9eb", "comment": "Malware payload (SnakeKeylogger)", "value": "a98573c602f3f9b21577d6cf08f71a4780cb5012b0f2445c57830df1f32a2b2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392396, "uuid": "84d82cc7-1904-4405-993d-043eacc17600", "comment": "Malware payload (SnakeKeylogger)", "value": "bead2891c615e75fdc1728db40acd0e4972e8fd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392396, "uuid": "3914f7d3-a8b7-4433-bff6-38d8355417ac", "comment": "Malware payload (SnakeKeylogger)", "value": "9fc80e1224f18337ebbb52c15e024d91202b14f31e10a5371f61dea5738cfc85fe75e8827a362145172c5ece42adbbb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392396, "uuid": "b20e2b63-908d-46c1-9bea-b2b7a8f31569", "value": "T1DA244A5A7BE48810E5FF493304B09561CB3AFC521A2ADE1F57D1B52A1F38690CE16FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392396, "uuid": "03034423-8ab6-4dba-967c-52f13d905e28", "value": "12115494f2c86ccfa8a7bf3471dfac33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392396, "uuid": "2e8995c1-e721-4ff6-9391-2999bcebf003", "value": "3072:6qqaM97eOTPiK3DruiiF/XbKjPo18ljAgAEcCv/IgOYrvQlqQArb8A8xwBWjO/Fe:5CteODDmzKtwFyI6UqQArbOOtbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677392396, "uuid": "60449d64-0a1b-4fe7-8369-842eabbce33e", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677392396, "uuid": "8ef3773a-15ff-4610-8b09-b3ba31ba691b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392396, "uuid": "bd9fa161-f87f-48cb-a621-7fb7e0e74c53", "value": "052f932d8ef6e9725f4cac0a62130825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8de207-b5e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677420964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677420964, "uuid": "8ae4492b-2c87-4d09-a773-f7193d82be72", "comment": "Malware payload (RemcosRAT)", "value": "8f21dc2b7545fd97e5cdd7cf505574d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677420964, "uuid": "3a79182d-98ec-4851-8132-ffb338780d7f", "comment": "Malware payload (RemcosRAT)", "value": "a9965688e4d34b92334193a59ab471709521d24ea65f1f9e97caaab3470e1e25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677420964, "uuid": "0a05e9fb-3bd1-4d4c-9cfb-d084b99cd409", "comment": "Malware payload (RemcosRAT)", "value": "0a90ee6f1c8fd83e28b60668ff764cd73732d230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677420964, "uuid": "0dd5ea6f-954a-46d9-b4ec-72a015512114", "comment": "Malware payload (RemcosRAT)", "value": "90dd3986482420dfc3d9f6009c7b33981f92b0da298d32974dfb8abd62ea38c1f1b2f161440dd3d3e7671ecd271d9438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677420964, "uuid": "6512b5a8-441a-40be-83e4-6c73b0d67f79", "value": "T1DF057CB871E1E279D6008A3269A97C3063F28EA5DD33E511ECCCF5F2B535EB12B15216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677420964, "uuid": "2a7775c6-7246-429a-88d8-0bf4c34a1a05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677420964, "uuid": "be4fb553-4440-4fc3-bd64-57c14f98fb78", "value": "24576:tcPMm4ShLdxw6XQ7daCpmyyFAghQoBluh:tcPMm4Sh/w6XOmykAxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677420964, "uuid": "400f843a-0981-4236-b94b-97789f8a387f", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677420964, "uuid": "c8504432-f776-4c89-8e79-5e8ec33b329e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677420964, "uuid": "794f4995-63b5-4ede-b96c-2c3a3259c7cc", "value": "Consignment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4997efbd-b5b0-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1677400427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400427, "uuid": "bb024a26-7507-43d6-acde-57de55c996e5", "comment": "Malware payload (CoinMiner.XMRig)", "value": "0e955e40dfa3d306c6371e166e62858d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400427, "uuid": "157a8fa1-d96a-42b0-bab4-e20ddf6e523b", "comment": "Malware payload (CoinMiner.XMRig)", "value": "a9ecbbb1a4de3f9019f7955182af88d2ecfbb6fd38da526b31cb8e7d9b62b517", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400427, "uuid": "d1ce6e7d-3731-48d8-a62e-357f8a1cbc8c", "comment": "Malware payload (CoinMiner.XMRig)", "value": "2d58403258335c4d772a40d79c0da6734c06db12", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400427, "uuid": "e37e2415-0ce4-4329-a08a-491e814045c3", "comment": "Malware payload (CoinMiner.XMRig)", "value": "66c45e47f83717dae42fd7c8a2d434cadccf0a3cd2ed8dcacf02b5b0a9febeb7cd91e204f3d46f7eca15cdbe693f743a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400427, "uuid": "275b802a-7d31-441e-96dc-e1e3849fffa0", "value": "T1090533434176FF7DC86CB735C942A06B30B22C653DAD5210B3B73A279E798ADB506D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400427, "uuid": "3d3d9af7-58f0-456a-aef1-71eb94374b41", "value": "0d0547c661a8867c50d327aee92e64b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400427, "uuid": "ccd5a142-f540-4b0c-a922-f1204cb7fb57", "value": "24576:5ejkmdYzo53wP+QONMfS25DfQA628JcM+JKdUV:qkmdYU53wPH5LF78+M+UdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677400427, "uuid": "f8c4a50d-6a99-4419-94e2-3f849b7e775c", "value": 852128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677400427, "uuid": "6c5659a5-f5e4-4a59-8f34-80f414c26b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400427, "uuid": "072b8a06-e398-4d99-ba4b-dec7720eda60", "value": "SecuriteInfo.com.Win64.Trojan.Agent.2G5ELT.4490.2041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c829051-b590-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677386822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677386822, "uuid": "653ccc50-52fb-4719-a7b5-c18012fcea14", "comment": "Malware payload (Mirai)", "value": "f795930057d7822c1dccf8a4bb9604ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677386822, "uuid": "50b60f94-22c3-4a35-a18c-b1aaecf36aaf", "comment": "Malware payload (Mirai)", "value": "a9fb9e8873da1055f6daf0ef1c61fb7e7a3c8a607b845aae015a34654c3b8c05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677386822, "uuid": "26324305-4cfa-460c-83b2-56272abd886b", "comment": "Malware payload (Mirai)", "value": "bf42ce602322757c20764e0f6ab27597e2e22e46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677386822, "uuid": "43b3a34e-8784-404e-bc11-53a8983a13f5", "comment": "Malware payload (Mirai)", "value": "3125f8a79509947436992b47d001fd213feaa7dbdfc7b201dc8b090516dff99281969649294803743fa7ec6cfeada113", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677386822, "uuid": "9826f240-3758-40ed-927c-997d6af12d76", "value": "T1F4E32B56EA418B13C0D61779B6DF42453323ABA493DB73069928BFB43F8279F4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677386822, "uuid": "dd2513eb-8807-46a0-8345-01361c3284f1", "value": "3072:qJLce3pCsJ7ltaLHbz4NhCQJctYJ1Fd4mXkkTM/9UxMY:qJLc69ltaLHbz4NEQJJHdnXkYM/96MY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677386822, "uuid": "8a186b92-9e58-4353-9f1c-3ec30c98379b", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677386822, "uuid": "eab4502d-9ffd-4381-8501-a1b4c1702489", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677386822, "uuid": "e25cdbd5-1fb6-4ae9-b288-25bc45f64370", "value": "f795930057d7822c1dccf8a4bb9604ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0329f0-b5f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677429207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429207, "uuid": "2d561fb9-69fa-43a0-9472-1e4307b9eda7", "comment": "Malware payload (Mirai)", "value": "17732cfd796bd51076c615870ba8ce50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429207, "uuid": "b54f9bbd-824e-45a8-8ef4-1867dd2497a9", "comment": "Malware payload (Mirai)", "value": "ab731ce405bace0d28d3395c6e9df4a14a55571bd53f1845c7d615365001fd19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429207, "uuid": "6730798c-3dd6-4d33-9a37-247178a339f0", "comment": "Malware payload (Mirai)", "value": "35315de794fea8e60a05d2524975ffa78e21e3ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429207, "uuid": "60db3516-4a45-4df7-8c32-9ba8fc829cef", "comment": "Malware payload (Mirai)", "value": "441047e82b7400db8d330b1968fd510ebfbc4b9465f48da633ccb50cd8521e3b514d98bfcac1ddb02d841ca49335dc6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429207, "uuid": "d36348a4-cbb8-43b3-8266-6b77622a2696", "value": "T1E7B2C0CC60943084C58D7C7C6B8D4A664F6CA0C0BAED9B16E354CDD8B3BAA8F345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429207, "uuid": "944dce35-88ad-4364-b237-3756fd5478d2", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpNZqSWvp:4QlS07FUXqIYSXQKquzqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677429207, "uuid": "b23b4c85-8686-4a3a-a4e2-8b60de87bfe4", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677429207, "uuid": "4e9ac1bc-4f33-4c2a-a46e-df6a02a0bb47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429207, "uuid": "b095ba74-c878-4d30-a72e-21904075fd2a", "value": "17732cfd796bd51076c615870ba8ce50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083c9098-b5da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677418356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418356, "uuid": "13e1c56e-cee6-4d1e-b9a4-653db36c14e8", "comment": "Malware payload (Mirai)", "value": "92fbebcf322c8012b9afff40f892ea50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418356, "uuid": "78c8b5c4-7afb-40a0-990e-7dd883efd172", "comment": "Malware payload (Mirai)", "value": "ac59b072e1dc8b5e97ff86b05d6af10d195aaa1c366cf3a2808b046478ac97eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418356, "uuid": "5fc34a64-93d2-417f-b699-878dfa5091ee", "comment": "Malware payload (Mirai)", "value": "20e4da28ced709ee48819785c88533ffe91e2c56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418356, "uuid": "7f3de499-f810-4d9a-bfa7-f6587ecb7e34", "comment": "Malware payload (Mirai)", "value": "318ed29c23fdfbae4ce58f56ebf2a2fe5ba2b1d56d854250aef5b648047df54a986d717c6006ddba28b331432293ed96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418356, "uuid": "5e93a667-b142-487a-b3f7-ebde0ceeda20", "value": "T1744319D6F801ED7EF84BE27A94564E09F93077C002820B2763F7BEA36D720596D16E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418356, "uuid": "d3c6413a-af51-4846-959b-23063ac449cd", "value": "768:dgeSY7jIcqZ/gVejVsdjarebFjuD8c8KjZ+NByZW0uzrsKDeGFaQLDT5q6VKQ:ejuCVsFRF6D8c8K0NByZWZzYG1LP5qWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677418356, "uuid": "24de0790-5822-4878-8093-b807125e3ba9", "value": 55796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677418356, "uuid": "0171ace0-7f4c-48b5-85c3-7326ff30550e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418356, "uuid": "8f9ff5a1-5722-4a05-9b3e-1dbf564d064e", "value": "92fbebcf322c8012b9afff40f892ea50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22b6a37-b5e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677423849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423849, "uuid": "62d010ec-ddf6-4d6b-bfee-92cef68d4318", "comment": "Malware payload (Mirai)", "value": "441176795bdb9d49bddbae2a7dad3d71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423849, "uuid": "1f4074ac-5438-4dc1-b997-862b339a9c46", "comment": "Malware payload (Mirai)", "value": "acac867677391173f80d4458d187f7c11d7e778e5611b4d43312bf5df2d53805", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423849, "uuid": "187caf2e-2b91-4c4a-985c-ed6f0885e788", "comment": "Malware payload (Mirai)", "value": "cabcfd4bfaeb6d7c2a7b455ea933128ae7275dd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423849, "uuid": "42e4473d-24d9-4654-8c6e-013fce3ee26e", "comment": "Malware payload (Mirai)", "value": "c446862ceabb5f12866315e1e2f584ae1beb309b3f3fd3fd20f8b8f09c72f620f14c490198b99c9ad93c49aac8d97080", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423849, "uuid": "b09b2680-8765-49b9-bcc7-3b2396086e26", "value": "T116F2F1FCEA0ECD0BFEBF74615D7297485BE09B9D3225CE8AC14D9D0141C6097221CA5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423849, "uuid": "24cd7f71-f488-4d44-ae31-efb730843efd", "value": "768:qWtO+PqIEP5aGuilC5qxZPFiIm80nIxsJL9nN4uVcqgw09S:q+vqIEPkGQ5qbFih8JxsJL9nN4u+qgw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677423849, "uuid": "e04a59c0-f5bf-425e-aaf2-c6ba92a7794b", "value": 36572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677423849, "uuid": "a2734563-65fc-48c8-b10e-745eb05977cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423849, "uuid": "cbd14586-7e0b-4479-83df-692908dfbd5e", "value": "441176795bdb9d49bddbae2a7dad3d71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffb5c32-b5ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677398397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398397, "uuid": "cf438c69-16d9-4786-846d-7c9171c5b4e1", "comment": "Malware payload (RedLineStealer)", "value": "df1c0c9e1341f1481586ad721469d653", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398397, "uuid": "b11b90b1-6a3f-4ff8-af9e-543bd88d8270", "comment": "Malware payload (RedLineStealer)", "value": "acb3e828f803f01190fa3030f6228ae9f301b4893b00dbbdb92257cb6983842b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398397, "uuid": "8b7e9dfb-56e5-4be3-b76a-a6a4d08870e9", "comment": "Malware payload (RedLineStealer)", "value": "1faedf848cac8588e5963b065e354a027e07453c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398397, "uuid": "6c71b94b-83b2-4883-9d4d-b81e598f339e", "comment": "Malware payload (RedLineStealer)", "value": "15483eadb0b36e1e3dcb731ba9b5a3ecf17ccbf54d986382a29c83b2597ac077ed901c4fd9a5b5643f010ce3387b79f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398397, "uuid": "7c489ede-e61d-4418-8bf8-c1ee403a9dcd", "value": "T1D194F107F6F89132E8B44B7059F706D30636BDA19B39826B274F6D1D0C729A1A63473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398397, "uuid": "a2696bbe-2794-4aae-a831-fc155d32c67d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398397, "uuid": "108601f8-cdb3-4847-9d43-174095e25ac9", "value": "6144:KNy+bnr+hp0yN90QElkpPP5sL+lpt/jJeYArEL+Gc8c7P2fgcX5Wy+:rMr5y90kl59lXYjpn8cr2fbAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677398397, "uuid": "d5bf5e51-bc10-4765-a15a-8aa117d488b9", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677398397, "uuid": "9fe4d244-01c7-4a62-b257-a5d3649dc589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398397, "uuid": "33ec09f6-b736-41d4-a408-4451a80c8f46", "value": "df1c0c9e1341f1481586ad721469d653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0af863-b57d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677378421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378421, "uuid": "d61d3e54-12ab-4bf4-b133-26a83655fd70", "comment": "Malware payload (Mirai)", "value": "6087ab1db1ac80e13403ad17f66ab350", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378421, "uuid": "19ac29e0-448e-463a-976c-76f7adaf6ba1", "comment": "Malware payload (Mirai)", "value": "ad98aaeed09e1a6f8c3006a04f607e5c70bc7bb13f414692f4ab382043aafefe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378421, "uuid": "9f23fc90-a2df-4def-9df9-656ac39c7ad6", "comment": "Malware payload (Mirai)", "value": "413cafddf91039d0d3c217ecd46f8fcebb4f21f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378421, "uuid": "db2046ac-91bb-4f16-a579-f344355c37c7", "comment": "Malware payload (Mirai)", "value": "f444f772ccbe8b82f700914bb45804a668abf9327c7789dc989660865f6a804762e7a55c649828001b2bb2c0dd957b55", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378421, "uuid": "bf5926c7-195f-4ba5-a39c-e3e7f2f30877", "value": "T1F1931846BC819F12C5C902B9FA1E158E331353F8E2DEB3139E10AB2477C696B0E77995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378421, "uuid": "0fd6d50e-ede4-4cf0-ac2c-3706c8d53578", "value": "1536:80nRt/ODgzcFEGYv2OUbVvIwkv2+56g5FeDE9xlkrWMdGL8J3KHp15Qnug1WbsZi:dt/ODNYOOgWC+56g5FeDE9xlkrWMdGLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677378421, "uuid": "65ca1b7b-e131-455f-b339-fc8fb48a862f", "value": 95616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677378421, "uuid": "437f3638-efb7-4655-9cfc-fa722ec1f1ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378421, "uuid": "6917ba07-dee9-4488-a771-f9e6ce636261", "value": "tamkjll.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7429e5c1-b616-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677444307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677444307, "uuid": "1f227510-b9b3-41ce-949b-697145f049d2", "comment": "Malware payload", "value": "b280cc4e78a7bff8d072713f8b4beb29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677444307, "uuid": "a1943c27-7e54-4843-a623-0aac2f808081", "comment": "Malware payload", "value": "ae3ae350218998f35fe4582d010844c4f62490af30af438c1735e5037d115fc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677444307, "uuid": "e1bd7331-a7ae-4c65-9422-fb54bb5ea680", "comment": "Malware payload", "value": "76e5ab8eda5c292b4f602e8a73c037f4623cb172", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677444307, "uuid": "b8d006b7-e350-4465-8f6f-27198724613a", "comment": "Malware payload", "value": "fb9a883a68f9f5645dc64e96e94cc013481bddf0c940b243a8fae693d5be238341cd94f932e395d4f78c819b3e6f6cd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677444307, "uuid": "d09a1605-7442-48a9-bd37-470ca1f84011", "value": "T1DCA523425243579ACA8249F6C38DAF38E855BFF0393A8C79354C4C694D325DEDB8BB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677444307, "uuid": "eae8659b-40cc-4113-a18a-08a8d41cdc40", "value": "df9a7bc1c6c6cd97d04c3762fdde6719", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677444307, "uuid": "c593e9c4-2122-4c05-ba98-2608700fe342", "value": "49152:BMJt5dwHjwTFKLpVI1M5crh/XBSgqJXEjvZ80eYcZxXBkK8jXCv:Bot4DrVaEcugqJUDDcZl4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677444307, "uuid": "67f1872a-157c-4fe5-a464-5b6e3d3e824a", "value": 2136576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677444307, "uuid": "10a503fd-3b48-4730-8e39-1422ac597ccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677444307, "uuid": "f20b26a6-8404-4cf7-beaf-e2fd58efbcf6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c582ef9e-b5e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677421250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421250, "uuid": "a77675fd-9496-4975-b32d-c7f1b24319ab", "comment": "Malware payload (Mirai)", "value": "63db0627c73808e4e861c5011dbd50b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421250, "uuid": "efed5173-755c-4267-bdbe-af8db2f26f90", "comment": "Malware payload (Mirai)", "value": "ae49bfa762b78487ed03a3b18dab28f026addae0bf8561065431af5041c75e3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421250, "uuid": "5ec9322c-eafb-4413-9a6b-b523f6bc0b72", "comment": "Malware payload (Mirai)", "value": "ff71ecaf3ba62465db6759360dbe8067206ccd31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421250, "uuid": "7ddd5c0b-1af4-4b31-9e0b-d9910e0165a2", "comment": "Malware payload (Mirai)", "value": "e9f76112f0f0a1898e50a5da5bddda159d5deb23d8f02da1151d11af55ab8f086a415613255d55e5c699bc51b9d67668", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421250, "uuid": "345abf79-27a0-4000-b455-efd08735b626", "value": "T125B34B13B70C0B93C5CB59B129AB3BF18769BAB102E761C1A91AAEC01733D752523FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421250, "uuid": "1c7c118a-8286-4e7b-b5ce-5f3948f17808", "value": "1536:rQTCEqZ3T2H6j/uOsc4HnOzOVU488F/z7Dmag0PDrsfCfLo5:rExoDjGg4HnOzdWz7Dmag0PDrSCfLo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677421250, "uuid": "403d09d0-8407-44e1-9add-52d23348f44c", "value": 112267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677421250, "uuid": "6924d208-711f-4f14-b959-5e62e0e7c7b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421250, "uuid": "fc3ad639-ac9d-4a48-91b4-13e933a70952", "value": "63db0627c73808e4e861c5011dbd50b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180433c4-b60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677441146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441146, "uuid": "a9f95ddc-eef9-44fa-b053-0e527b5eff81", "comment": "Malware payload (Mirai)", "value": "d079212aebd3fb026e3ccd339bffa21c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441146, "uuid": "80d92965-1977-470a-82b4-69efec9b6254", "comment": "Malware payload (Mirai)", "value": "b008dd9315cacdce38fd37f2769f03290b53a208e098dca0a6daabe03612bff4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441146, "uuid": "3731bc20-2116-415e-a2de-244d1a392a3a", "comment": "Malware payload (Mirai)", "value": "8f5895199e42978e6edfd8c651a134c2aa4492c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441146, "uuid": "4812ca1c-ed37-41df-a7e0-effba29a672a", "comment": "Malware payload (Mirai)", "value": "b9e9bc5b2def6b2892405f51367a0ce8cee7d3e0b94e8f5fea067f2750d91f7852864cafcb8064c3683803e54fff45d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441146, "uuid": "63bbc4eb-ad56-4a17-9ec2-72fd3af32a40", "value": "T197B2D119C0AE6EB4FEAB7D395D41E2817B619BDF3A61CDC026C15B110622D3C1F9C6D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441146, "uuid": "682bf087-884f-4d9c-8be3-43a2f4e6f2ba", "value": "384:XA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoz7M4uVcqgw05VxJn:DApCdvwJr69VJoA8FZtxCo8yo4uVcqgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677441146, "uuid": "ce1f0440-5058-47f8-adde-05f50f7ad0c5", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677441146, "uuid": "95b581a6-7f61-4a29-a2c8-a06020bdd5a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441146, "uuid": "0b46b2e2-0789-4639-8ae2-2712f04b2ee7", "value": "d079212aebd3fb026e3ccd339bffa21c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457038a0-b580-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677379804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677379804, "uuid": "a613c463-cefd-4f88-8510-f9b6512fa7c4", "comment": "Malware payload (Mirai)", "value": "0957153f2b46670b1e904d0a45fe0fd1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677379804, "uuid": "6e852165-4278-4282-93db-c8fc75fc7fa0", "comment": "Malware payload (Mirai)", "value": "b0b1cb2d77977f6e830b639d9e62fbcd8cf0953d98ad53075f51c79a77bc348c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677379804, "uuid": "a1ed76b8-77d0-4cf7-93e2-d80328406dba", "comment": "Malware payload (Mirai)", "value": "3b343a8071e0b9bf3faa117570379a6a6097e802", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677379804, "uuid": "7b0c2b1a-ef8b-4393-be50-ed072f590dc2", "comment": "Malware payload (Mirai)", "value": "cd203c53b0d1dee2bbd0bfa618cf9ef8a4a3336f94035f1c657e59f000320880476ec5051df27dddd198021342667c1d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677379804, "uuid": "1b7514d3-22ab-41db-a311-57ca623fe2e3", "value": "T117F2F192DBED8E0DF153503E4E8AB34760C0BE0A944FD826DBD83137A16435D2E6DE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677379804, "uuid": "fbd7a3af-942b-4832-8add-7cb67680d8c2", "value": "768:HkJ7XrGvV2XQ6bbPRlM3NoZjkZbUqoN6NZt/FXcFO9nbcuyD7UHQRja:HkpGcTbbZlM9oRkZQetBcFSnouy8HyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677379804, "uuid": "3fc12594-bad0-4a9b-b95a-9bb16e329ab4", "value": 36144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677379804, "uuid": "6508c80e-5053-4c28-8baa-a20946c14986", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677379804, "uuid": "98164dd3-48be-465a-9435-4acbeae9c778", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1cd111-b5e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677421233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421233, "uuid": "34725110-005a-4d64-8aca-ae401b20fcc2", "comment": "Malware payload (Mirai)", "value": "8baa13bc3a620dbbd9c497bbfd888aac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421233, "uuid": "d2404be8-05b5-4024-bd1d-1cd36360be64", "comment": "Malware payload (Mirai)", "value": "b1b082b65ddcb8eb586185ecc32999b70cc677ffc61ddfe1fa8efc955429dd39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421233, "uuid": "34271de3-08b9-406c-8f95-e5bed6576c76", "comment": "Malware payload (Mirai)", "value": "e8543cbf2d382014be29130335c666cc14418d4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677421233, "uuid": "e450e6a8-a6ac-405d-bebe-da3e64b96cd7", "comment": "Malware payload (Mirai)", "value": "c458c18099b137f9bbb6b25752cbb7902292910beedcb17351b19cfd28707e84943be65e926966c49634d69f85419e7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421233, "uuid": "c76c025e-5923-4941-8a92-53e7c0c93dd2", "value": "T1B4D33B05E4608757C2D2177AB78F464D37336BB897CB33215A34AEB42FC1BA91E39960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421233, "uuid": "b2bb85cd-f7d7-4597-934a-0d8454aad750", "value": "3072:Nh0dCwa1LRcgKWf7kHAZrm9M/xWBSj81QPN6GjmrQ9YJrXFT2:NhICwa7cghm9M/XZjmrQ9YJbFT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677421233, "uuid": "c41079a8-359e-48e0-aa74-7707d3481daf", "value": 141605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677421233, "uuid": "1f295ea4-7da5-4365-b07c-1486e65912b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677421233, "uuid": "0aabde1a-30cb-4444-ab46-56d5bd5be266", "value": "8baa13bc3a620dbbd9c497bbfd888aac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52af06f3-b5eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677425782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425782, "uuid": "4334404c-febd-45bb-aafc-c6a3835e1c4a", "comment": "Malware payload (Mirai)", "value": "99728743f1b7da3d75dc74f2817fee9d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425782, "uuid": "c70bff6e-4113-41f8-b555-3f7034bea756", "comment": "Malware payload (Mirai)", "value": "b22d67505c4e7c9ee2b7101301fcebe78627ae809df8262e1b22f3a2d7b95eee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425782, "uuid": "ab608ee5-0e08-4b43-a053-05a86bd55af3", "comment": "Malware payload (Mirai)", "value": "0b119afdad327fca6c8c859aa644b81d35ce8074", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425782, "uuid": "57243acd-4388-43cd-9cee-847858ad16e6", "comment": "Malware payload (Mirai)", "value": "3839d675e5be3ebfdbe07be22f4c894f7501f432ed7189c0b1c3d2df5c988f293958609a674896ce48772b8f4a51e2b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425782, "uuid": "9f04b922-21e2-4045-a24f-278aa6cd2a86", "value": "T13A83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425782, "uuid": "3acd5d64-e174-490c-a6b0-c1a73d06b4f6", "value": "1536:iVLyu95K5nkj752dCexuV/8UZlDwfkJ4MYfWB:iVLyMgYFezxu5VD1eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677425782, "uuid": "6a1c44ff-567d-4681-b110-947ff80d35d9", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677425782, "uuid": "c3988c12-a921-45a3-86b4-70a562aea466", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425782, "uuid": "2ff42715-2771-44da-a020-27b51cb615f9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c5273e-b57b-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677377734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677377734, "uuid": "c44d699d-21ab-4d30-b267-ece393306aba", "comment": "Malware payload (DCRat)", "value": "634cb3c93819d1b352413d38e581b9aa", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677377734, "uuid": "2c9d3b0c-d470-4230-aaec-861e6574cf41", "comment": "Malware payload (DCRat)", "value": "b25d29f7409907d3a089cfef3a90cfd4a29d9f6ac85f5ab768a1a932593b56db", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677377734, "uuid": "b61d23c0-f42c-4b98-b6db-8f1460de2ed0", "comment": "Malware payload (DCRat)", "value": "6aab21b7d43a24ae064b15e53fe3d3d7bec4fca5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677377734, "uuid": "e9793f95-a62f-4d73-94e9-58da475a5fe2", "comment": "Malware payload (DCRat)", "value": "c4ca2a4571b5785032f47f647530efa7955b56dcd7fec125528840654bfe649d1f8fe48c12921609114f0d154c60788b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677377734, "uuid": "7caef97f-ead4-4e54-9ff3-e7f7c75bf9d2", "value": "T1D9657B027E44CE11F0191633C2EF455887B4AD526AA6E72B7DBA33AD65123B73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677377734, "uuid": "49b1783f-fb35-4d52-9beb-b068cd2542e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677377734, "uuid": "3655c0e7-0c0d-4569-bea2-37f8cabef43a", "value": "24576:PtL9ME1R6+nwMr6N3/60GETdrw6l6NB3zca3cxA4jkPsFLDzrO:FLeL+nwM+NC++6WB3zcaMyev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677377734, "uuid": "475bd989-1b3e-4f36-bb01-97c535236087", "value": 1532416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677377734, "uuid": "b072bb7d-baa9-496b-96a7-8f7d5a4cdba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677377734, "uuid": "bb0f091f-2d3a-42eb-b715-2d135dc00736", "value": "634cb3c93819d1b352413d38e581b9aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de3cbe8-b57d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677378422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378422, "uuid": "4c7b012d-45fc-47ba-865d-ee30f0b192d5", "comment": "Malware payload (Mirai)", "value": "5f4d18c0ea598b4ce056beaabbe8ee59", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378422, "uuid": "7d5d8154-f213-4a18-b7da-3d14712d5684", "comment": "Malware payload (Mirai)", "value": "b4c411eb832cf1747ba3eef3cb399c24396b9e66942acfa621c1b1e755cc95fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378422, "uuid": "e9fff73b-d29f-4cab-af78-ead91bada512", "comment": "Malware payload (Mirai)", "value": "a03fb20a01bf9630bb4d33d0441fdacb1df0cf27", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378422, "uuid": "86894742-fefe-4732-b7f3-0c4692f5bccc", "comment": "Malware payload (Mirai)", "value": "846e1eef2b6289d06a1158a804ab261b2bfb45cb0894c36ee430aef21eb43d6299d114a98e64df0fae6c06d44bf270ac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378422, "uuid": "7942d99d-9c38-4677-9f27-7d14208a295d", "value": "T1DFF34A46EA818F03C4D61775BA9F42493323A7A4E7EB73068D14AFB43F8679E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378422, "uuid": "51f7fd66-f1b7-4e54-be91-7185d87900c6", "value": "3072:A2qOD771NoOA/FFeDE9xlkrQMdGL8J3KHpd5Qnug1WbsZC70hivo90LKwaD5qOpZ:A2qOD771Ng/FFeDE9xlkrQMdGL8J3KHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677378422, "uuid": "b76ce840-c8f0-4779-b5c5-b38a3de5f229", "value": 170350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677378422, "uuid": "480a56b3-e580-4158-bf9b-59e107ed0736", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378422, "uuid": "1c3f438c-b702-49a1-b9db-06ab53ae39a7", "value": "tamkjll.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0587ba5a-b5be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677406325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406325, "uuid": "22c015be-80ed-440d-a367-f5d0ea9ac5ff", "comment": "Malware payload (Mirai)", "value": "9f69e07ed320883657832e213cabb3ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406325, "uuid": "98197f61-6b72-4d83-b8ef-eca36b8991b9", "comment": "Malware payload (Mirai)", "value": "b6764881e41d7263c738c62cf68c2ea56e8bdfeb80a326a51b7a3d6f043b87ae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406325, "uuid": "00defa21-a9ad-4612-b593-8c98797d7bc6", "comment": "Malware payload (Mirai)", "value": "b5b077f47a2256537d418c00a65fb0dd77030429", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406325, "uuid": "e7ff1f1c-273b-4257-a7f9-83c4b21b48bb", "comment": "Malware payload (Mirai)", "value": "ce62390ce399bd7e069b2346b68e4886a50966766dcf8ded1baf7fa0b93350f87f1cca7330cbfaa7b2a3a3c72573446a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406325, "uuid": "9a5904b6-f8cb-49c9-8852-143029c9c221", "value": "T1B1F2E695B8828A2AC2D462BAFB2F418D336173ECD2DF7357CC140B14A79B51F4E63A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406325, "uuid": "fcd08e1a-c704-48db-a67b-373845bd8673", "value": "768:mvO4KCeHMweUO3fiY04VN/GoCysTcSPKDt5s/N:mWYekfimjnsTcast5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677406325, "uuid": "486fd506-70fa-461f-97e0-2ca39fac14ec", "value": 35320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677406325, "uuid": "cc2d54ac-2023-4e0e-95bf-f0008ef8ee7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406325, "uuid": "218572c7-7e78-4fa3-b152-1fa7c420b5f8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311237a3-b5f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677428732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428732, "uuid": "1168d291-417c-4b82-b507-9403bee71adc", "comment": "Malware payload (RedLineStealer)", "value": "db9e01a5609dc07d2722fc4cb65e2eb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428732, "uuid": "6e9bb726-9115-46ea-8518-6dfb100daae0", "comment": "Malware payload (RedLineStealer)", "value": "b6fe05440df2ee8d5268bbdb1355fcb3604b9b72e71047f59dddb0c31abd5894", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428732, "uuid": "6869090f-228e-4f47-8c5d-8d2acbcdbac7", "comment": "Malware payload (RedLineStealer)", "value": "c740c1c7de32c75ea822c4cd455c6b5171df63f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428732, "uuid": "873c09ac-f1a3-410e-ae8e-2f189ab27102", "comment": "Malware payload (RedLineStealer)", "value": "d8aabfcd02a9641b45f2b9804efb7394584ca05b51d4b2e3a0e2f087dedee71bc271e95a8c24ef0438929d8e19ab172a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428732, "uuid": "b0c5f297-d6a1-48d6-b58e-0639df5eada7", "value": "T162A4F25BBBE88032E87557701DF203C30A35BD506B38929B638F6C5A58726B4F13576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428732, "uuid": "a5adc1bd-4d17-4480-a0be-11e4c9882611", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428732, "uuid": "cbaf3bc6-e261-4165-a9cc-a41f76aa0734", "value": "6144:Kry+bnr+7p0yN90QEtSQiX1gw6SXi3Nh2cKMWBSJwl/7MF6bgIGn10CqJR7xsOSt:pMr3y90a/B6qi31j4ew1A8SeLx7SR//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677428732, "uuid": "4a1f5afb-b4a8-4d72-840a-7f57cebea28c", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677428732, "uuid": "a4d9a158-356c-4627-bd2a-a6470177bacc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428732, "uuid": "d88af4f7-9a2e-4945-8819-4010b792bd28", "value": "db9e01a5609dc07d2722fc4cb65e2eb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0a4156-b5f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677428130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428130, "uuid": "fb76227b-3be0-4f9e-9057-be86f08f5f27", "comment": "Malware payload (Amadey)", "value": "458b4f14d198a98b22c9389d1900e836", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428130, "uuid": "12f25097-9906-44f9-97b1-bb61f40ce2a9", "comment": "Malware payload (Amadey)", "value": "b95b26552cc24f5e527decffcd2a16a16cc9af9c5fc2216e785d5630bda4b7a1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428130, "uuid": "8c6f3c79-139e-4049-9e0e-21ba1e759c66", "comment": "Malware payload (Amadey)", "value": "3ee94070db3edb70b06c021e106f8ba6d421ad08", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428130, "uuid": "b025fd53-6801-4c00-8562-0df9e0e4c8a3", "comment": "Malware payload (Amadey)", "value": "2ae662bb5ec088939df5f99c21282ac0171db24f8904c5ed457d8498ddf7e7961213e94c0d42e7a2eeb9d08ad2430447", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428130, "uuid": "bd871a62-b4fd-4e19-a198-986dfca56d66", "value": "T14A45234776E84431ECE463B01CF603CB4636B9A4DA354286638FED6D19B2570FA3176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428130, "uuid": "15ad7d96-9a92-40a1-b4d8-bb5e306d0f1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428130, "uuid": "7a2ae313-2937-4b34-a60a-6111cd8a0327", "value": "24576:7yXDt3g1IQxAhnOS4yA/Q1qsFKLXnrHuvijSCk:uzt3gWQxyn4TZsY7OvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677428130, "uuid": "00d18d01-cab6-4196-bbea-0e58847f6c74", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677428130, "uuid": "e4158e90-b846-4473-b824-170f39513e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428130, "uuid": "5183d44c-7259-4cea-adb9-4e26ce40f439", "value": "458b4f14d198a98b22c9389d1900e836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003c111e-b5ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677426932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426932, "uuid": "95802479-cf8f-4ab5-82c8-46f9b20dedb8", "comment": "Malware payload (RedLineStealer)", "value": "c202b544bd101442fdbc052ca06a24c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426932, "uuid": "04d0d259-0489-4334-930a-b1afa2806eaf", "comment": "Malware payload (RedLineStealer)", "value": "bbc8b42899356e85ecd2fb5277b7fbdf296094bdc006504147b0be21895ccdc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426932, "uuid": "e23803e6-ac99-4d22-a760-177d29230a5d", "comment": "Malware payload (RedLineStealer)", "value": "85009b7017f8e7bdddd93513bfd78cf34384e4d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426932, "uuid": "826d6ed0-0b8e-493f-ab51-b028bb1a3374", "comment": "Malware payload (RedLineStealer)", "value": "e9c7bdea9c101ca89ef1640984ddf1ec785430e88b3113d17e2b46f28bf45cbfbae83153a0fe6e70737625314ef634ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677426932, "uuid": "84d2ea8d-e4cc-4963-88b4-6bb8c560de9d", "value": "T107A4F10BBBE88072E4B557701DF203C31A35BE506B79869B134F6C5E58B26B4B63076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677426932, "uuid": "012eed8c-47d1-46d2-87ac-96857a78cdaa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677426932, "uuid": "f7ad99c5-be2f-45ac-a8b9-b25259737955", "value": "6144:KNy+bnr+Lp0yN90QE1SQiX1gw6SXi3Nh2cKMWBSJwl/7MF6bgIGn10aqJ6F3zFdr:7Mrfy90a/B6qi31j4ew1A8S+w9L6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677426932, "uuid": "0c95e587-4cd2-49a6-a500-1786fc438396", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677426932, "uuid": "6d0361a7-ffec-424d-a379-2b099550ef17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677426932, "uuid": "38cea5ce-b24a-4f72-9a8a-0260e44565dd", "value": "c202b544bd101442fdbc052ca06a24c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4b6184-b598-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677390120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390120, "uuid": "4cfb6a4a-db37-4026-ae42-e2eebf4fa20e", "comment": "Malware payload (Mirai)", "value": "0df9acda9b253f14bab59070c975db24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390120, "uuid": "00402fbe-f0c7-4ddc-b7b5-4dcebef03610", "comment": "Malware payload (Mirai)", "value": "bc25e9ffedf00d3a55887e38ae657c50b352f9172868608cf77eee9b4027b776", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390120, "uuid": "d7652d39-5547-44d2-b955-ed8bcbfe5b3a", "comment": "Malware payload (Mirai)", "value": "8c75107ea8a8edea158e2d51f4278bce9a5c7781", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390120, "uuid": "d16e8b97-aad8-4572-bc3c-3947935552d7", "comment": "Malware payload (Mirai)", "value": "e4d9cfd953ebf3643249b2c1273217252e80754aaf929f6648e3dc70a97ffc5bb1dd343a49aa315d1c754e5ed3cf4e6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390120, "uuid": "922ad71c-ba12-4430-b02f-ed8c53cbe7b7", "value": "T1DED2E12CD99D7945C59E3EBE54CE46B5384CB1C0635EFA8E1726440CBA27A9BFC0B0B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390120, "uuid": "fecf5a58-331a-4582-9a0e-e19fdca729bf", "value": "768:D1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNdVJbKWUa:DbDs06t4BEub4sU/MbUf+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677390120, "uuid": "29019ab1-2ca5-4211-8dac-bf8b6f1dc078", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677390120, "uuid": "f1a186d7-ba0a-48f7-b05b-98fa7509b2a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390120, "uuid": "58db750d-f57d-416e-8acc-c526b2f51e9f", "value": "0df9acda9b253f14bab59070c975db24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51214fa3-b596-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677389272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677389272, "uuid": "3e6459bc-91d1-4b19-a587-fc2686c0010f", "comment": "Malware payload (Mirai)", "value": "b0f8b2d5ffa50956192e4526dcb3c30b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677389272, "uuid": "179f4f81-3f51-40ef-b379-05ae958137e1", "comment": "Malware payload (Mirai)", "value": "bcc469a31c23aadf3d7834b63c49e523787361a6c33320bbe634359bad3ebb6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677389272, "uuid": "202b512c-f48e-43bb-a62b-2e8f4023483c", "comment": "Malware payload (Mirai)", "value": "576eae7ef4cc661153a9f643afbf29b3edb0e2e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677389272, "uuid": "8281724a-b935-419a-9924-f49d40217109", "comment": "Malware payload (Mirai)", "value": "6cce15f4abfa6a138de4bb51874932fe3b4f4718573fcae8da85f905e8015689c7bea676c88a6fdcae926f998622a1d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677389272, "uuid": "59942651-e6df-40f5-a9f4-0004b853b441", "value": "T1DCE2F19393729452CE782BF2F95A85CE2ABD4B6CC57B30B31A15561C2D5A0435F2C893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677389272, "uuid": "6e15f30b-eb23-43e8-9ddc-ee847b7e2b50", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9XN9q3UEL5Ir:Porm1vpALgUJgLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677389272, "uuid": "7575f84c-4d10-4250-98dd-6ca6c633489a", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677389272, "uuid": "68e65535-ff68-4e30-a8c5-9a7705ec59f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677389272, "uuid": "678b5ba4-19ae-447d-ac8a-f3d7dbc01e86", "value": "b0f8b2d5ffa50956192e4526dcb3c30b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8674b4-b5b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677400866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400866, "uuid": "bd475d82-d0ec-4006-a942-04f098127a4e", "comment": "Malware payload (RedLineStealer)", "value": "b77cb1bf8062b7a0734f07555a690f61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400866, "uuid": "7b2450fe-6463-4fe7-b51a-1a59665f26cf", "comment": "Malware payload (RedLineStealer)", "value": "bccb7e1c5e7b21621285670474ec0f18eadec7588495fdb29cc7b12743178773", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400866, "uuid": "3faed714-7cb2-4b5b-8899-694aa60207a3", "comment": "Malware payload (RedLineStealer)", "value": "59c3cd4c4f26f4a2d6e816726a7450f7aa0aefa1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677400866, "uuid": "485a162c-8ecb-4519-b593-fa2ed318e815", "comment": "Malware payload (RedLineStealer)", "value": "012875a503e624909ef634c0f4079d3f673649b48fea89c21084780e83781e80910bf34dbc81c645eefdbce9187e18f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400866, "uuid": "db643cf8-3e85-424a-a603-77982c467316", "value": "T18994F117E7EC8073E8B5577019FA07C3173ABEA15A348256378FAD5A1CB2670A631327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400866, "uuid": "23027e8b-0fc6-4fda-8466-b24888b4eafa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400866, "uuid": "3032a447-f6d2-421b-96a2-fec3f7c01870", "value": "12288:EMriy90q9LNxS13DWiRNZwphWUU4rHUf:WyfLozMphW96Hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677400866, "uuid": "bfa18ed2-4c0a-49f0-a759-af433a678138", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677400866, "uuid": "78859c5f-c018-4d0b-b8f8-53c25bfdaeab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677400866, "uuid": "910f1559-fd4e-4caf-8eaf-1ad5029aaba9", "value": "b77cb1bf8062b7a0734f07555a690f61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823d0963-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "451eb6d1-2cda-4964-9296-238b06d84186", "comment": "Malware payload (Mirai)", "value": "5981dab94ee47fa0eea52f66ee8a2131", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "3b6a5314-12ae-423d-bab5-e3e86b6abdc8", "comment": "Malware payload (Mirai)", "value": "bd805531ff8448cde6eb057866b260dfedbe8abc23de9bea8290d6e051959b56", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "7082d425-1a0c-4709-b5a0-e63bda912955", "comment": "Malware payload (Mirai)", "value": "100b28fbdf878b81d01ff2239ea3a5698e5d75c5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372604, "uuid": "15c763ed-e6c7-4173-84a2-0be02821cfa8", "comment": "Malware payload (Mirai)", "value": "2fc2468b06706391fccbc1558482e6db0b2c05f381da15b14aa9199d707e51d0ee34ecfe01d0ad3843dd2ed1834ca78e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "2acc5960-431c-42dd-95e8-d8c67725501d", "value": "T10AD34C46FA418A13C4D517BAFAAF4149333297A4D3DB730699185FB43FC67AE0E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "d6f9bb3f-d245-4fc3-b140-21dce8f6ba70", "value": "3072:ZgauByoyut54A17i5tmFz7rRUQ0IqTDHUAYM/9kAYj:mauB3yut54A17gmFz7r2QiHUXM/9zYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372604, "uuid": "3d819606-119c-4806-b4ef-90082b60bf6a", "value": 136306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372604, "uuid": "d0072c99-5289-4ebc-a200-c12ceff55a24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372604, "uuid": "f07f1455-68c8-49e2-bcef-5df24010d58d", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44924c61-b598-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677390110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390110, "uuid": "38ccdb8f-05e9-48d5-8021-17211e28475f", "comment": "Malware payload (Mirai)", "value": "35cd95d3c9706283ed21dec0b697c471", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390110, "uuid": "b262a456-ab26-4513-88e3-08ed745f0fed", "comment": "Malware payload (Mirai)", "value": "bd90624612614c3482bce7c72a5b290a4c24e5a9bddf622d72b7fb6aaa6ec3ee", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390110, "uuid": "e0e9e437-9f90-441f-8838-9ffee0ea69e2", "comment": "Malware payload (Mirai)", "value": "f6f9d33dcc582ba5489887c78ac9cb41afe15b5e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677390110, "uuid": "269a6cd8-a056-4098-8968-20ccb15c466d", "comment": "Malware payload (Mirai)", "value": "253963adca085911ae8dfa6071a5e4a6eafaabc85b97b15c3a3632516e7d9c4eb947bb2179f235317e4f4450660d4799", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390110, "uuid": "1cad08a1-fdb8-4b18-a68d-ba4127c4b1bb", "value": "T124D2E0F7E1BBA2F4D4F2B871246ADD80F695306B8624439A416FFE85DBA734C5130E12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390110, "uuid": "b2970198-04de-4b4c-be06-4dccf2697c03", "value": "768:sYSoXdJZgicCHD+C98MP7L1YVPb2XkLFUSx0s4:sYJdJZuCj+CiE7L1APbasvt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677390110, "uuid": "b121cd6c-5773-43cc-b8da-6ebc3be04c8a", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677390110, "uuid": "2d1ff274-4625-42e1-865a-7b4decebef2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677390110, "uuid": "fa07c8aa-3f5c-40d1-b00f-746a653fb5a6", "value": "35cd95d3c9706283ed21dec0b697c471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ff43eb-b5f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677429781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429781, "uuid": "b1450c01-e0e3-42f4-9b51-4fe8c981a3e6", "comment": "Malware payload (Mirai)", "value": "4ef69fc1847947a26cbf49da91d4a044", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429781, "uuid": "04d056ac-1dd3-46c6-be55-b40430d49868", "comment": "Malware payload (Mirai)", "value": "bdd961d0ed29aec2498b4716c3e25ed7fe101149278b3370f8c3d28f1ae11190", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429781, "uuid": "5239dd64-a93c-424b-af8a-4baa6242dd07", "comment": "Malware payload (Mirai)", "value": "453bfc00b350aebd14fb40204f1e1b44d3692552", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429781, "uuid": "9487ca15-397e-47eb-a41e-3aee45d71185", "comment": "Malware payload (Mirai)", "value": "a18cbcc8b96145a6277259de32f940e43f3a555728a3104bb99636e7ac9eed40fe3928c1cba2cc2078c87bbee19aaa5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429781, "uuid": "8a80ffc5-7db2-4896-a241-ac09fb99e6e9", "value": "T128330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429781, "uuid": "20879f3d-ed66-4cfd-99e1-3d0f26a7ea47", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGh:r/hqaJMDg9eqK806MHdkfQX6HuCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677429781, "uuid": "4164200c-ce07-49db-a78b-f5da7afbc24f", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677429781, "uuid": "5fb92fe3-434c-4ee9-9e5b-f2d7e0d3544a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429781, "uuid": "2321fa90-be80-4f50-a922-1c170f047645", "value": "4ef69fc1847947a26cbf49da91d4a044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b1d09f-b5b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1677402225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402225, "uuid": "b59b1a17-0c75-4674-8cfa-da0c75c27f61", "comment": "Malware payload (AuroraStealer)", "value": "3f31bd210e7dfd03d5068289b6dd4038", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402225, "uuid": "3b8dc459-167a-4de2-bbf9-646843ddc049", "comment": "Malware payload (AuroraStealer)", "value": "be393666930fcd6564cec396d8b9732f34f6fdb9cdbd2283f21723a060ddeff3", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402225, "uuid": "6b080d80-dd58-4025-babc-a998202ee75d", "comment": "Malware payload (AuroraStealer)", "value": "4a2d098fe1fc26796b31161bcb5c9d7c1f4f9aa4", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402225, "uuid": "0b9c1fe6-0cc8-4461-9d80-e0f84963e96d", "comment": "Malware payload (AuroraStealer)", "value": "8f8c1cd93baeef9c92528460f174a4484fa14ee44d917d01bcdf1557c3a85f8e41ed3db3069817e85a0e8015153f3a77", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402225, "uuid": "250f79fc-248a-4ba2-ba32-cc74b8442e42", "value": "T1C4360034F4563B72E84EC1B406B01DA803E56EB5236B5BC42231B99F8A27E6D9F74D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402225, "uuid": "c9aac55e-e923-438a-a5fc-de966c54b169", "value": "98304:+yKr29KVJT2Zbq7K+uldELn0uNjN/aEKKKrYroE:+brVp4bql0uNjAEiIoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677402225, "uuid": "4ed3db22-fc4a-48f4-990f-a3c19fc5a6f1", "value": 5246642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677402225, "uuid": "fac62be6-fa33-461c-a3b0-2ee96abbcb48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402225, "uuid": "cb52d338-52e5-4ad1-804e-44a4a839d77a", "value": "innosetup-6.2.1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ddb885-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "a1b4039d-09ee-4c19-aab3-d5bb32a7b49f", "comment": "Malware payload (Mirai)", "value": "f8389122f50ef0483e68c8cfdd6f6cea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "d1f1a5ef-b46e-48ac-ba32-2c1bb022c54e", "comment": "Malware payload (Mirai)", "value": "be4852b39414fd61ae50f607f03d76db652e4de74f0bfe95f84f2b32c4bab195", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "0b563982-d3c1-4328-a6b1-b2fa7ab8eef5", "comment": "Malware payload (Mirai)", "value": "62911322d6b41938ab57cb4acb6c8d8d556e4f40", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "8fc95649-e080-4789-bdf2-e0287afeadb6", "comment": "Malware payload (Mirai)", "value": "4b38927bafb540c181fb9d298e4de5efaf6196545d60a5bb909cfd68523f23bfbed4d19856908c2364e610f6795617a6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "40c01eb9-30cb-46f5-9cec-2e3e755f84e3", "value": "T1CA4329C8E6D7E9F4EC090A313137EF32D6B6E13F252CD993D7946963AD41642D4022AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "6519fa75-b20b-4cc1-92cd-42b6b92e302f", "value": "1536:CVKFOD7prJkaNup1COy7O/HgepDaLiwui7EPZP8x9:XFOXprOfPTy7yHgepDaLru31Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372607, "uuid": "3c4dfe04-857b-44e2-9c1f-cafb3dba59a8", "value": 58128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372607, "uuid": "c87e0337-606f-4153-9cce-f9b441d91f2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "239a98bd-59c8-4a4f-b3aa-e80174e82dd8", "value": "0xh0roxxnavebusyoo.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09a109b-b582-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677380896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380896, "uuid": "93666305-7b1f-4fba-b5d1-cacbe0ffb2fc", "comment": "Malware payload (Mirai)", "value": "14a10e7adbe63e5b55f55c5199e1e9ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380896, "uuid": "4ab9fbe1-6893-4a92-ae44-1ecbce4baf7e", "comment": "Malware payload (Mirai)", "value": "be4dedb232420b27daac40e04396e0869ab570a3fbb70a19dc0d941d5f0bab12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380896, "uuid": "9145bf70-c081-4923-bf7c-c1a93ddf1f1c", "comment": "Malware payload (Mirai)", "value": "ecdc052ff39680042af2af5807d30606e4646426", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380896, "uuid": "7e04891e-3ea1-4f65-a440-23b7cd1e5078", "comment": "Malware payload (Mirai)", "value": "35e6b3b85605b11afb94548a5b1adecc623049bc1b95b28037b3250dba9547c37b770ba062ac0a4c6f0c069cca3e64ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380896, "uuid": "2f783c4f-b057-4327-81cc-cd0ba5a59ddd", "value": "T1F423F22205C46CB1FDB0547BDAE461C622D68EB7C1E2B17301F876486ACADD312BF6C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380896, "uuid": "1c5d6059-e7c0-412e-a35e-516bedfeed34", "value": "768:7Uy5kGE5Gu4liUDR0SaqxktUhphCqZQcikgLUR5SgpCiZ9mwPecI89q3UELjd:7U8E5bwlnSYp4qZZT5SgpX9mwKFLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677380896, "uuid": "b1f2a51e-b064-4841-bc9c-37edcdbf6016", "value": 48372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677380896, "uuid": "08643aa8-e827-4cfa-b947-b81f23c87f26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380896, "uuid": "ccb86387-ecbb-48ff-a964-1198f3578e25", "value": "14a10e7adbe63e5b55f55c5199e1e9ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e0c5b1-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "66055cb7-2393-42c4-8c3c-8f7ed89cf927", "comment": "Malware payload (Mirai)", "value": "a0e34a6a26bfbec776affbbe9271cf0d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "8519e350-1415-4334-a14d-22b03cfa2ece", "comment": "Malware payload (Mirai)", "value": "bfb88ec0b29fe5c4a1fd4a7e93032e49bc965562e1fee610162e1c70ab8271af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "8b99d38f-997d-4420-a044-c45096586cf2", "comment": "Malware payload (Mirai)", "value": "17da14e5ba26ba87cb2ab1dee053b7584719cbde", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372607, "uuid": "d5437cbe-d9c7-4310-8e9a-8772aaf4dc1e", "comment": "Malware payload (Mirai)", "value": "786ff8a2948fec0b40a8a4791ec2b7db0b83d93942ecc854a5a7e6d02260efd21133f98fb50490e5c34c3b0547687fca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "e62fd177-b807-46d0-a693-b0231210e22d", "value": "T1153349C0954BE9F5EC150635707BEB338BB6E43F1129EA9BD39DA933AC51A11D20728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "b8fed634-922f-4fee-839e-4a465f168d74", "value": "768:ogAhOXHiXl+efOr0g8WfRAE7qSDclSYh2uLvHQ4NXy78imWgWfr:ogAhOXHiXl+eUj9fmSaSoMiXa5jgWfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372607, "uuid": "22639cae-6b56-434b-a54a-21fb71d33f3e", "value": 54492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372607, "uuid": "7cd290f6-c741-466c-9c20-b371becb123c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372607, "uuid": "041eb813-893c-4bf0-af2f-2205ee66c289", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0c69e7-b615-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677443785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443785, "uuid": "367f6d08-0178-4ad5-b63b-8530785d266d", "comment": "Malware payload (Mirai)", "value": "f7de53c9d5caf0c9653b93050d914fec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443785, "uuid": "2731c78a-580d-4f80-b5cd-0f1d497eef62", "comment": "Malware payload (Mirai)", "value": "c00fe72d643d291fe30def6ac89721dcd9c2a0f4ed6d93a55500f2ec663a044c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443785, "uuid": "6c3e6b59-30f2-4c83-bc7e-0a3f5f09efca", "comment": "Malware payload (Mirai)", "value": "1626e2d4169dd383f61736670836a731c4f5fa28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443785, "uuid": "4684015d-b19e-4b12-a379-1fa813e2eba4", "comment": "Malware payload (Mirai)", "value": "23cf2c881630c3cd11a3085857e7bc57a8e91c14bf97f6cec132d885f6400b99f82bb7acbcc7cc8841dbc145f94a7a62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443785, "uuid": "2afe96fb-27ad-48c5-9df3-79cf01eeed42", "value": "T1B5B2C0B27025F8B6C7A6007799EDCA43BB800EF8D0F8B3295465099DEAD5D42BAF1107", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443785, "uuid": "ec4d2604-d979-41fc-b752-d37826a21afc", "value": "384:tZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3p4hymdGUop5he:QX9nxn8o9wnBoWzEQf2EjKb3p4s3UozE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677443785, "uuid": "36f810ba-2e36-470b-aec6-be0ae9beef19", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677443785, "uuid": "4b1074c2-453b-4e94-b50d-4645ae3fb661", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443785, "uuid": "8c23b41c-7fc6-4eb5-ade0-ac5906be742a", "value": "f7de53c9d5caf0c9653b93050d914fec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e720ceb-b607-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677437882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437882, "uuid": "7c5d3026-f6d8-4aa8-9a5c-0a9bb54faa89", "comment": "Malware payload (Smoke Loader)", "value": "be14a4d4a26d0b9a478967ed36f569df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437882, "uuid": "9c0b7026-2a70-4af6-8516-77325eb79e8e", "comment": "Malware payload (Smoke Loader)", "value": "c1790a04ef26812df41cf7e74d73bea3d4cdccca2358e75efcffc0d0bea93c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437882, "uuid": "7ff9c09b-670f-429e-b797-f35f76f70a75", "comment": "Malware payload (Smoke Loader)", "value": "cd825dd71537fe2abe4e3bb0e15f01536b5a6192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437882, "uuid": "066baf71-bb00-4c21-a7ba-863667b89798", "comment": "Malware payload (Smoke Loader)", "value": "5976c08ea8c48577f60d790e5a6f0438b65f8213a50414ffda1d59f02fa37249aa0ab92d54607aea0c884d64c38cf962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437882, "uuid": "e35ea0e2-8a3b-421a-b207-7f60bf2e0de2", "value": "T12554DF31B581D437C84605B0D835D1A56D3ABCB28659B9A732283B2F3E703D27BBE365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437882, "uuid": "10c7f136-90ba-4753-9685-9432229edffd", "value": "a4462dfe3ca2f0662e413d525718c3e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437882, "uuid": "59cdcffb-22d2-4583-9e49-2194c0bdf4c0", "value": "3072:bOUNmLwMOqshc83DHRU1O3If8Fv6vPHkqVHBD0/OpPMr:KFLSqs1RU1O3nv6v/VVHB0GPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677437882, "uuid": "383af7eb-782c-4a3c-92ca-b04d9af3861a", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677437882, "uuid": "9b44fa20-8a15-4bb9-83f5-d67009fa426f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437882, "uuid": "748a6a26-6b36-42a6-87f4-d3ba600c2012", "value": "be14a4d4a26d0b9a478967ed36f569df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcb6d1e-b56e-11ed-88f6-42010a9c006e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1677372033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372033, "uuid": "bde38d59-0921-4351-9987-50a28e88e0cb", "comment": "Malware payload (OrcusRAT)", "value": "5b57d2022c736cd5218df873456104e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372033, "uuid": "d9fb68b2-7073-4c97-8c1d-b87179081da3", "comment": "Malware payload (OrcusRAT)", "value": "c2def6823301dd51f674bfae8cae527f0fa450a835bc2f3e3d91197f7e53b250", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372033, "uuid": "0d2b54f1-3b1a-428e-a828-2543d4a94aec", "comment": "Malware payload (OrcusRAT)", "value": "ed8ad733c18308d669ca2b470ee07de061ff1aa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372033, "uuid": "57374e6e-dd82-4942-aefd-e971cc3b3821", "comment": "Malware payload (OrcusRAT)", "value": "684898e9d327e37375c45b122635877d97005ef88fc324a8e605cfbdb4e4d5a8b2ac91cbd31c7cac9a7f0b63df95934c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372033, "uuid": "d7eab3a3-f6ec-401f-a378-884ba70a6300", "value": "T12F15BF013FACBD47C1BE3679B7731ACA07B8E90A6052FB4E185451AE1D9BB01BD12367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372033, "uuid": "48f44d9e-d202-4ed5-b020-b5f44075c9c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372033, "uuid": "f76cad35-3d92-4e98-9ab4-26a19a8b2999", "value": "24576:OIJu4MROxnFj3vBukhrrcI0AilFEvxHPsQjOooi:O6Mi14qrrcI0AilFEvxHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372033, "uuid": "812ce54a-b443-4351-a82f-0520163a21e4", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372033, "uuid": "41cf33c5-bcd2-4b4a-b6eb-3a63af8bda2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372033, "uuid": "ec0fee8e-8cfe-445a-a1db-6a7b820c86b0", "value": "5b57d2022c736cd5218df873456104e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa536c5-b5e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677424561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424561, "uuid": "c4d2d7ed-c863-46c3-b6dd-bc44606f7703", "comment": "Malware payload (Mirai)", "value": "d9cda6408c089bbe6b61838b894a671c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424561, "uuid": "c218224a-6170-4527-a757-4cdefc7fb44e", "comment": "Malware payload (Mirai)", "value": "c49c93ab2d51dc003fb6c85d64433bdd5e02c013a2edb3ebf767fd8e3cf4571a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424561, "uuid": "7a7340cc-c665-4e7d-8be0-f5a4384a3a35", "comment": "Malware payload (Mirai)", "value": "5337864e1b18bf26b84e9e7126d7fe8efee0a346", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677424561, "uuid": "84bcf125-830d-4ece-9a34-ece4b3bba354", "comment": "Malware payload (Mirai)", "value": "30130ec77f2422248bcdc47c0febc11d6889a6f0d1870bd3d91ebb64f805972d80ef986559e73efda63b083d314b500f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424561, "uuid": "4076cc31-1863-42d7-b152-a8f686521bbc", "value": "T1ADB2C0CD61443084C98D7C7C178D4A664FACA180BAEEDB16E354CD98B7BEA8F3459079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424561, "uuid": "728a31f0-fe72-4028-b755-aac984945ad9", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpwZqSWvF:4QlS07FUXqIYSXQKquoqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677424561, "uuid": "2a962cb2-3784-4922-bfe9-89ef9b3621ee", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677424561, "uuid": "4d70ed2a-df07-4cd9-92ac-97c0b0f90d7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677424561, "uuid": "9e3b469d-6fe7-40d6-9aab-0459538c6d59", "value": "d9cda6408c089bbe6b61838b894a671c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693a1ec6-b5b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1677402627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402627, "uuid": "dd5cd237-d053-4cd9-a122-829cd918a747", "comment": "Malware payload (LaplasClipper)", "value": "87e8df6bf70c6b610354157500cedfdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402627, "uuid": "33451a55-aa13-40df-a30c-bbd8d84b1579", "comment": "Malware payload (LaplasClipper)", "value": "c51d9a58dc0321246d9791da6c1e3777bd0b5287e03ec8b40ff11d64dcb49879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402627, "uuid": "adbe6b0a-0e6b-43c1-8495-c8d220322bc3", "comment": "Malware payload (LaplasClipper)", "value": "b0f130760044bcd3bc06abfb0dfe687436113c99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677402627, "uuid": "395be3cb-f74b-4115-8ea3-6a0e6d722e1e", "comment": "Malware payload (LaplasClipper)", "value": "fc2088b13d904b5cedf14c28ffaf25b1e479be3f9ac5f34f0a6499a1f7f602f4435db4e875d8190122a40957532d5b02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402627, "uuid": "c017e9fa-1f50-4e45-87db-518b198aab47", "value": "T149F1D5027FD94664CADE4B7868B302150731E656E537CA8F1C8C92281DA37D85B8A7EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402627, "uuid": "5e757dd0-5e6e-4b40-97f1-bc4cb346f744", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402627, "uuid": "3e21b126-b861-4de1-9867-b2db8171bd10", "value": "192:BHnxSqD610EcsYt4Y/dQpyOYJ3XAgkRm:FnveVYtRypyPJ3wzRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677402627, "uuid": "6707a832-d4f9-4e4f-ad05-916e4efd0143", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677402627, "uuid": "12f66e9c-27db-4922-a1e2-9aa10933f728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677402627, "uuid": "52b1a02c-cb70-4d16-b404-b5b70f481444", "value": "87e8df6bf70c6b610354157500cedfdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07646723-b60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677441118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441118, "uuid": "22a2fd26-1ddb-4c4d-b7a4-16ec43a9c43a", "comment": "Malware payload (Mirai)", "value": "0d04b45be9a2d9ed0aeaee78cfcdae47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441118, "uuid": "ed2fbc0f-a687-4f7e-b70d-53bad4293d02", "comment": "Malware payload (Mirai)", "value": "c86c099b9df0ae52f0788972ac76e6e9b901a25a57563a651393bfed902f2f5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441118, "uuid": "43c72508-ec96-44d3-9507-2f541fdd6063", "comment": "Malware payload (Mirai)", "value": "0a73a428b2caf219f9517b8b90927759a0149bef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677441118, "uuid": "4055e063-1569-481d-894b-554d6d4da859", "comment": "Malware payload (Mirai)", "value": "f80e8034b558207f1c2095a00c9e524dc47bcf12eb27df1ec911e7bb73a231842e2b4e8dbfe4fd07ae7a3365605f4b15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441118, "uuid": "71d1ba54-6d89-4aa4-9041-71baad3a753f", "value": "T1B8A2D01922CDAD32D1B0843AE23DC307AEDB43B662FE313A1E18079DE49491AD3BD945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441118, "uuid": "35a89180-3846-4064-9c3f-a71255efe406", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbwhymdGUop5hXJ:Ypoh/DxCvhdR4IjWVFbSss3UozJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677441118, "uuid": "bbc5dcb2-116a-4c23-8a77-f4a82b9ce8de", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677441118, "uuid": "81416565-9060-442c-a189-954159d46308", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677441118, "uuid": "e84c4876-34a5-4794-9e90-99c62ce691f9", "value": "0d04b45be9a2d9ed0aeaee78cfcdae47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f06bd4-b5c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677408606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "90f5b003-e0f8-4c31-959c-e739c91ce537", "comment": "Malware payload (Mirai)", "value": "aa0bf00d6218b744f3b551463d331596", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "f50aaaa5-ede4-40b2-b4fb-9eb97da694c4", "comment": "Malware payload (Mirai)", "value": "c90a035b9d8d371d287dd8a3a7443f39e37539c1f71ef29cb01b16b02f213d35", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "e829fbf6-5877-4469-9f3b-ade9b78ec950", "comment": "Malware payload (Mirai)", "value": "3b986abce45632ebbddd5f0edcc3b429916313cc", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "e15c9032-4312-449a-ac36-1d6a460598b3", "comment": "Malware payload (Mirai)", "value": "7ee52e5a9ac77f7cc667ce7e0edd41d0ae6a3901874b4722066aeb9053091366993ef1350dad1af58b519b3379895825", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "280c1863-0cac-4e0b-9580-545da1574271", "value": "T114833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "341b22a9-3a0a-4264-8f7a-f6546f50bec9", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LUWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Y42oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677408606, "uuid": "9fa13252-a1f0-485a-96df-d68a206e124d", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677408606, "uuid": "557c3d82-5029-4158-8cba-f340daf14f5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "5d018ec2-c172-4a7f-96bb-589f08374cf2", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c747c4a0-b5e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677423830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423830, "uuid": "1e1a882f-b7b2-4781-9350-f8b4f246732c", "comment": "Malware payload (Mirai)", "value": "8bb195369d5618d316805b930de62553", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423830, "uuid": "331c75e6-ad4e-41f8-95ac-90111ef3928d", "comment": "Malware payload (Mirai)", "value": "ca4290ab05115df3eeda333892210f752b56bfc1844f9838ffdd341a7b1d51b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423830, "uuid": "01f8d62e-d4f1-4767-ae60-377efdb821d8", "comment": "Malware payload (Mirai)", "value": "7d42212428bac1fa967fbc2ab2b3306e99107423", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423830, "uuid": "274574d1-fe7b-4a02-a792-719540537553", "comment": "Malware payload (Mirai)", "value": "d2d226be4afc1934e2cbd07d8338b4509bc4d416dc5e13e61c1457fd649d08a1b53f7e8ada80b10cc670811493d4a3d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423830, "uuid": "eb6afa00-3831-49dc-975c-b5c162a7fc85", "value": "T107832A5878110E9DE9DB5CF8513A8F1ECD115340AA530B1B6AB7FDD339A31A6BF0688C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423830, "uuid": "75eb98e5-3428-4048-96c8-60a588f5c97e", "value": "1536:Jye6EYIivNvTjmZD6H++QX4CQdilR2p87/DfQg1pcUpAyQF:EC6H++QICf2paDflpcgQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677423830, "uuid": "77f4d561-0c61-4664-84f8-dba3d1e1155d", "value": 84216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677423830, "uuid": "0a30c8b2-3d2f-40f7-b2ee-ea40083ec855", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423830, "uuid": "74f294dc-3ec6-4cfa-9867-a6554c425a4b", "value": "8bb195369d5618d316805b930de62553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5781dc0e-b5eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677425790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425790, "uuid": "20d8b80e-d0da-4ed1-8d91-a99fd524e419", "comment": "Malware payload (Mirai)", "value": "fd4faac2ad0597d7baea143f08fb0d76", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425790, "uuid": "aeb5693c-f91a-4270-be92-ee0db6ebae03", "comment": "Malware payload (Mirai)", "value": "ca4333986e1b313d86349e2ccd6f1573d6d73a33f4d3472bdae6d4492256cfba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425790, "uuid": "1176ad26-23b9-4255-bc63-a9a5894c9e67", "comment": "Malware payload (Mirai)", "value": "148d36e9b470e377c5789a834640ce3d83a064d2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425790, "uuid": "257fff25-414c-43a2-8bdf-25bfdc8a2de8", "comment": "Malware payload (Mirai)", "value": "e5b2a0b567dafa45e38cf63c03946a76ab385e9e726cdb4e752fe8e72066e682d84488a4e3d7420b4d1507f4ffbeebd1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425790, "uuid": "db889259-2c41-4984-a771-c3b4bbfa2333", "value": "T184632951BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425790, "uuid": "19973d08-e941-46e1-a943-0ca6f5041c91", "value": "1536:qNSlxYmii8N1U9uO//kWEjFgikg/QA83NRuxAvjWp:qNnK7kthgikg//29jY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677425790, "uuid": "60bdc518-c1ce-4a4b-8a09-0e08c82e1426", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677425790, "uuid": "5c41ea39-3369-4b35-b334-29a0ce9c4a83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425790, "uuid": "16cf47e1-18f6-4ac8-a78b-a1d2f3118a6e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9aa84f-b615-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677443974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443974, "uuid": "26ba1fc8-f957-4cb2-bdc5-65c0592466c2", "comment": "Malware payload (RedLineStealer)", "value": "d7fd8128461b5ed5d7e68b0021966e5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443974, "uuid": "fa8e7e27-c912-4080-a93f-d7f07381a6a2", "comment": "Malware payload (RedLineStealer)", "value": "ca8b5bffe3623e56e641b8af5d12066d86fbd831329083b7314e64127f83862f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443974, "uuid": "3e79dfca-f4f9-4a31-afc6-959c5d77d45a", "comment": "Malware payload (RedLineStealer)", "value": "9f79e2b51c3351144b0507f7a4edaef24303b746", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443974, "uuid": "a3b094a1-609c-4fa8-bd2c-a35af656ff56", "comment": "Malware payload (RedLineStealer)", "value": "fab8f9a30f35d772294176642ca035e225b3132910fc7afa6c3dd4150442cf37f63cae7616da2ca81da74ca5adcfdb60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443974, "uuid": "7c288bea-d4ee-4b58-a7e7-dfae21d033a0", "value": "T14A452307E6EC8071E4A84BB104F642D71B377EA06B35825B574AAA1E1C33731A67673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443974, "uuid": "1380b73b-8d02-4a6c-8dd9-0ad7310f486e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443974, "uuid": "f1f568e6-eb6b-4d8f-ba81-a3fae2a418ed", "value": "24576:4yrvK48fBCTNOFr0vtxTs4abTO14+iz5/E3F8w+b4iIIjFGVyNz:/rvK5ANQ0rspmlg+2MiZFGVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677443974, "uuid": "4d9ece16-0aaf-4a75-b23d-91ecfd2c43d4", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677443974, "uuid": "c1261363-f98d-43df-bfeb-663b8ee027ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443974, "uuid": "42a61b64-0e3c-4dba-91ce-c8737d2aac22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60a63dd-b569-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677370088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370088, "uuid": "782de935-fd2d-47aa-8fd0-a7dc4ec816b8", "comment": "Malware payload (Mirai)", "value": "b787f80c1e1541954a9d02cc4a3c6d80", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370088, "uuid": "d92fd8d3-3d25-44da-92c8-00d60bc32ecc", "comment": "Malware payload (Mirai)", "value": "cad4e129f0ad81c541196bd18ade4b6efaf0de5aa4979d0deb8ec1d10ad9fb0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370088, "uuid": "f90766f1-a291-43f0-b043-ddb49fc18108", "comment": "Malware payload (Mirai)", "value": "f1402f236c495e0242e74153a99d57ca900224db", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677370088, "uuid": "801f6c01-9455-44d2-8639-4458d7bccb7c", "comment": "Malware payload (Mirai)", "value": "fa1dfe3790fcfe70292bec6fba8962e61c555ebdb3f05772c46d81150899f2d386c754888dbf898d4c0edab32e21bccc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370088, "uuid": "eae27384-e281-48e2-9847-90a8f2de99d3", "value": "T167436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370088, "uuid": "f229b45b-b5c3-42c3-b60f-5fc9669874b3", "value": "1536:JeESt/basV2rcZhG6ySN7naqlSR9zWOIaEjrqMAs:JeESt/basVTgS7naqQRVtXESv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677370088, "uuid": "fc0e658e-2239-4f00-a754-8e651b905f22", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677370088, "uuid": "92960789-7c0a-41e4-866f-7075cf7608b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677370088, "uuid": "96e627ee-cdfb-414b-ab45-0af6bdfaaa04", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8610cdda-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "4d510cd8-4e20-4cef-ae38-a1ce788c1203", "comment": "Malware payload (Mirai)", "value": "86be64e0398ae5cb663d51227c0b4656", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "b19cf47c-a7ee-4a71-b5a3-caebea74f415", "comment": "Malware payload (Mirai)", "value": "cadef457af3e185fac56ac06b3a3669855f0cd974bce6f281e2629766d13ec2b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "c3f4dc83-b9c1-47a1-a13b-5265a0a13586", "comment": "Malware payload (Mirai)", "value": "e2bbf5bc1f9126b8effad7933d43f2e8377696a8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "7b76db0a-6b97-4102-9df6-79f2ac0c8f98", "comment": "Malware payload (Mirai)", "value": "0d300dffec938dc831f8496512947e16d39d2708f7b745dcdc3fd6f4944d85665732be5d71942337b633b15bd4d8cde9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "096361ad-2f60-4bec-aa30-542ea70b99e3", "value": "T1ACA2D01572632D66E3EC1C3DC96EC35BF9A60BFC90F5327669416620CD4D24A2E38A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "caa4181f-1f7c-44eb-a376-018b8a44e715", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjhEhymdGUop5hw:vvQn4j+ZO5fKAlxlEs3Uoze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372611, "uuid": "b3419f68-19bb-4d46-bd7e-6928c6fae49d", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372611, "uuid": "095c2124-be22-41b7-a20b-fb452d4a8c06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "43a4e642-8699-4352-ab40-2a22926bf134", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e7c3be-b603-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1677436342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436342, "uuid": "18ddced4-9148-4309-ab94-307b2fcdd27d", "comment": "Malware payload (CoinMiner)", "value": "37b41adc82a1bd8a94dbbdf9f839fa29", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436342, "uuid": "ab410f50-1dc8-4122-9f0a-dccecfd27a70", "comment": "Malware payload (CoinMiner)", "value": "cef5fabaaa65cbda71369cd13fe466bc669c0433078b003a334f9d6367601850", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436342, "uuid": "cf3d12b5-e014-46bb-8f3b-0c11b89d0cb3", "comment": "Malware payload (CoinMiner)", "value": "e47ff21b0a14d92294cfa57ee40e94bbaa73be69", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436342, "uuid": "ff2e6242-1187-42fa-993a-29cecdbb587d", "comment": "Malware payload (CoinMiner)", "value": "c3fd4cf30732f5e584eaab486d029b3389984b0d3ce8d044d1c3df133cbe122224b2154bd0d44122337fe61dfb4e2aa6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436342, "uuid": "0deec4d1-c9fb-4294-b839-0fa8cc6d11bb", "value": "T10854D041B940C472C85701709C24D9E97F7ABC765A59C9AB33283B2F3DF03D16AA735A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436342, "uuid": "b7409660-ec0d-4429-8887-4055f78b1967", "value": "61552f371d50dd7cc1d63f5028ea0b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436342, "uuid": "ce34f6e3-8cf5-4d77-abfb-b53d69a3472c", "value": "3072:sTchML8kaZBF57Hhjx7Hds9ikDTwpeD1ez0l+/NoxXx3eb4qC4r:AjL8LZhhtFUTt1ez0s/Noxu4qCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677436342, "uuid": "db379eb5-f09d-4621-bb93-4a305cff234e", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677436342, "uuid": "44faacb6-57da-4473-979a-c9fbafb4998f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436342, "uuid": "eeafd0fc-9b6c-45c1-b7ae-057805a0ba15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8669b158-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "7fe93e2c-1465-49a2-af4d-a93a29e18909", "comment": "Malware payload (Mirai)", "value": "c1b6d87469a178ad6332fa549e46394e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "f7633bbe-e2df-46cd-ad9a-d63c3f79cfbe", "comment": "Malware payload (Mirai)", "value": "d018ecadf7960704b0ab58366196027619da2b735be86085c08afcc09957289a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "789a7267-49dd-4510-958d-232a1012ce9c", "comment": "Malware payload (Mirai)", "value": "4f493588237d51df670fd36f326bf1a61bbb278d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "ef5342db-d4bd-42e6-9df5-b7929e527141", "comment": "Malware payload (Mirai)", "value": "1e3ce759ac3f859045654913fae54326983d7f3a3d717a3a01c483ad5fa64837aeb62bc7e4d46655b81ea59f75507d54", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "e328b4e9-43b3-47bd-bbd0-ab74532ebe01", "value": "T13F1302FEFD837033EF0D3B70450119A8B5C7AB25DF6BA266605839D0D82B619194DC9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "f7cfca3b-fb64-492a-9e77-9270530517a6", "value": "768:b/3vZMNnUBkoD/f/ujBEFoWn/+ndZy7cgXpU1JsgBTkO9uoL5dJXHKiFW60wdR6S:ry+Bkg/f/+BQqJfAO9/dLHKis60mR6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372611, "uuid": "768f792a-790b-4b05-a379-f2b6dea91b03", "value": 42244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372611, "uuid": "51a94799-a4b0-4f17-aeaa-8bf552295458", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "4b5c2b12-e3ed-4645-8c80-14d9fb4f0141", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49b68d6-b606-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677437650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437650, "uuid": "31df1bca-86b9-4785-bf13-cab437132ed3", "comment": "Malware payload (AgentTesla)", "value": "2479c7f2a1615a8d6ce3ba0ae522d80b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437650, "uuid": "97040925-f4a2-437a-83e6-623cacc9111d", "comment": "Malware payload (AgentTesla)", "value": "d0b503c6c62fdb71eccdf8d03737c99ca8b82dd582a8547add16b8f08811e9cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437650, "uuid": "fe74979e-f117-4986-8ae0-2414917c5280", "comment": "Malware payload (AgentTesla)", "value": "0ee7dd56615d0e4521563c17cd39f799ded8f08d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437650, "uuid": "7131bd7b-351a-43ca-85b5-7bd4340076d9", "comment": "Malware payload (AgentTesla)", "value": "71ebe6934d7b61a6dcedf7ad66a5c9a368811728f38423c6cc2a0ec29261ef9632d1b29e27f053788727145dc1c3c003", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437650, "uuid": "768026a3-a105-407a-8b47-fa4c68455026", "value": "T1F43423C208DA5D901DE7020ED0FA496AC21E1A5E65BF34FB87AC0CD3597D694B17A42F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437650, "uuid": "d4e3a224-c051-45b6-b024-57a2084068ef", "value": "3072:j4lcSRE9CApeFBtHNWcEH2EBuRWRezWdDo/JL3QzJHUBNvmH/eoCozmV0rD+lCUl:j4lctA3twiWAg8hgGUD0V0v+l2Wui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677437650, "uuid": "d881e9e9-221d-4354-8d83-ace50c759c6d", "value": 233979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677437650, "uuid": "20f84eca-bd3c-46cf-a1a4-92782f1deb25", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437650, "uuid": "76727106-52ba-47ba-8986-cb95d0e83311", "value": "INVOICE.r17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5553548f-b5eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677425787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425787, "uuid": "be4a4357-5fb8-4089-9bbe-bed60af90335", "comment": "Malware payload (Mirai)", "value": "c49915639606962a7d2e6e583b2cac08", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425787, "uuid": "75f81f1f-0834-402e-a3f5-02a6ace364e3", "comment": "Malware payload (Mirai)", "value": "d0ebc5d0d5f228728e8bc65bced8a105a5504fdba82ac77038e8d53825e35ee8", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425787, "uuid": "3cccd346-3fe3-4b90-aa56-de00f9f9b19c", "comment": "Malware payload (Mirai)", "value": "a7689046ee79e902650bec909f6587d99857ff55", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425787, "uuid": "0eb07f03-5d7a-4f1b-8a7f-89c824442c28", "comment": "Malware payload (Mirai)", "value": "223949dea4dc49729d4edff5a28bfdf758ac010b0cb36cfa65e271bb9267ed1a8531695a0c65fee8ccb4171e39f733b6", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425787, "uuid": "0f9accdf-b8a5-4e20-b445-c393633bb19f", "value": "T1C6534B17B54280FDC49AC1744B2BBA3AD93775FD0378B2A677D0EB222CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425787, "uuid": "c1aae9c8-7023-40cd-8608-0ad651414b61", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQpLiKimfFoktCe3fYRMi:WShU3q7cEDlCK/0DR9i8Fok06fYRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677425787, "uuid": "4774c11a-e464-4dda-85ad-4361b2c5fbab", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677425787, "uuid": "cb5ea5ad-9a53-4e43-baad-72ad8073d216", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425787, "uuid": "487b1a43-ce91-4d3b-9391-ad1f44507a33", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1da75ba-b607-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677438048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438048, "uuid": "3dc97d9d-c546-4c25-aec4-072d0c677b17", "comment": "Malware payload (SnakeKeylogger)", "value": "b0acbc46026b32d07f5c71e6cffc4a24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438048, "uuid": "acdd0785-3859-406e-901b-8aa12772c514", "comment": "Malware payload (SnakeKeylogger)", "value": "d10d4cd425dfc56bcf1234088ab4310960b104099961f3cf343c1f76acf54669", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438048, "uuid": "f9f5aa27-54bd-43e8-970d-72525495a561", "comment": "Malware payload (SnakeKeylogger)", "value": "79ad1d409b85d5e7cb41a67a91a1e5cd46b38852", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438048, "uuid": "c3026424-3fa5-430d-a35e-3ff83e5cdcc6", "comment": "Malware payload (SnakeKeylogger)", "value": "d344229d5c91d4e1b54440f977e024bba560baee0d1be40eb20ca92e7d85bf281c7a0ff0a224a42d29bfce4f49907249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438048, "uuid": "21b7b853-c4ca-48b8-9484-1f4f518f9239", "value": "T127155B7111437E9BA7A70DD9E50037324CA5A1C753568188FFCC0EA9E6EEA14DDB88BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438048, "uuid": "61617769-7f2f-45ac-b0a9-e50053c4a672", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438048, "uuid": "416f851a-a702-4245-9aa9-80a583b954bb", "value": "24576:9LEDJe6UKZsthfn/xQVtuHl/ppFvfa6dnyHyiiH8/WqQFeW+nf22L+EBADyvRBeT:JHXjOdja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677438048, "uuid": "bdcb97cd-21d0-4f80-b670-ccf08ea19f75", "value": 928256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677438048, "uuid": "843e1c6b-89d0-46c8-a3c7-733614ce24a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438048, "uuid": "1fe7444a-50bf-4f1c-81c9-8d0ba04301f5", "value": "b0acbc46026b32d07f5c71e6cffc4a24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9de664-b5ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677399041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399041, "uuid": "d6284ab2-cb8e-49aa-99f4-585226981eef", "comment": "Malware payload (AgentTesla)", "value": "f553747f51f12b1cc1dc8fb8bf6cb51d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399041, "uuid": "b7c4b792-0ff6-4d21-bff7-d664a7d0c570", "comment": "Malware payload (AgentTesla)", "value": "d12ca833ba98d43bd8d3ea7f406d03efd109867c45a2b1f70226d8373b9439f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399041, "uuid": "3e734735-764b-4b88-97be-3e3d4f7d4e46", "comment": "Malware payload (AgentTesla)", "value": "d27560629435c00f02b5fd980fcda23a3118eccf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677399041, "uuid": "15b3ca87-a77b-425b-8f19-c6f7c8765252", "comment": "Malware payload (AgentTesla)", "value": "de45c86e4b1b3f778da64bbbcc988b95a68033ec5255eaafee4672f5a3cc19800f1259517c5d1ffcc221ba7dc7e9ed55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399041, "uuid": "2d8213f3-7f52-4a1b-b769-29ed7cf15c68", "value": "T154E423475A29B20825AF8767187B40795683BACC1283462D36CC5397BF39DD0BEA3DE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399041, "uuid": "f89d4ffb-072e-44c6-b3eb-058648aedd0f", "value": "12288:TkQrrVi2+c/q7PMWYF2ECitcQqror9NDaWYoMbYnq1tah2vMj8:4QrQ2T/I1WhC2DxNwof4YDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677399041, "uuid": "567f5b48-4836-42b0-8606-8ecf221ef303", "value": 712477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677399041, "uuid": "4155c37f-3e35-4c84-a702-84e9055c647e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677399041, "uuid": "afafcf12-2a7b-468d-9f3c-8abd42a0b015", "value": "ScanDoc_Swift_USD71,450.exe.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28679a5c-b576-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677375460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677375460, "uuid": "6466ac5c-f3e6-4e29-8700-07478333e958", "comment": "Malware payload", "value": "1a4f7e545d1fc45428ee14915aceae69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677375460, "uuid": "26b21e42-9485-4eed-93dc-75ff65184c27", "comment": "Malware payload", "value": "d4282cef21e82f89a01c8840409c1408ba573094b24868cf2206eb99fdc620d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677375460, "uuid": "59e7cb1e-1864-4ef2-a476-87ff9c1178a4", "comment": "Malware payload", "value": "8eec6597fc7ffc5047c2c727d503df110c5fe505", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677375460, "uuid": "f54ae268-7019-437e-8b00-9970053c11fa", "comment": "Malware payload", "value": "543de0edd94ef4d497fa57936c8ec7c2c26ccbd492e52b72c513e8d1a3d3bea0831045998c895278ed8a5231aa685b1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677375460, "uuid": "fb4834fc-10ba-46df-a14a-bcba4b1b9ac3", "value": "T17903F1F2FF24D807DD99BDB345E90FC2F064A85941082A279089ACFE662419ABC4D1F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677375460, "uuid": "a42b8e24-a4d4-45ca-a4fa-3887c66842ad", "value": "768:JmE6Rl1bmLjLqxePVZRsKtHNMmbEVtjBhtGlhxE3uWfDkJWMKtAkV:EE+l1qfLqAHGKpN9bYjBhtG1E3DfAJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677375460, "uuid": "b6f0697f-9b55-4ebb-abbf-a742d6dc5059", "value": 40592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677375460, "uuid": "5f3febc0-3be5-45ca-b3af-356a7abec3b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677375460, "uuid": "32105577-c800-4bf5-ac4d-260622303dd4", "value": "1a4f7e545d1fc45428ee14915aceae69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55176c14-b5c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677408606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "49e8e8ed-507d-463b-ac74-09c5ed780c44", "comment": "Malware payload (Mirai)", "value": "e8644cb4a2e0283f0a83914277ba7f6e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "52681ff4-2fab-4f8b-a60c-cdfebcbefb12", "comment": "Malware payload (Mirai)", "value": "d45a75dffb897bb3322ebca6fb1f23944adbb00e81db3038261b8c9de079cbf7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "6edaf194-f9e8-4711-b37f-7aa2901f3114", "comment": "Malware payload (Mirai)", "value": "812fd67eabbcfbcfea71e695ac3081afe06db972", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "3e45d1ab-27dc-4a17-8e70-d87142596891", "comment": "Malware payload (Mirai)", "value": "64a09444214c56e3bea06fd7499ea0631ef95b63ff2f912867362fd99138b7fe34d475505e5deef10adadd4e1e5b4d25", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "64531ae9-bb5d-4fdf-837a-1e614312f881", "value": "T1AFB31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "9c229659-98e7-4e9d-a2e6-50a52d880ff2", "value": "3072:MSY+46m1qOzssSFPPKNy+AmkZrQAhPDCXFke:06mgOzJSFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677408606, "uuid": "44b8b4ce-1a14-41af-a147-934b0422a08c", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677408606, "uuid": "a3653f00-100a-4d8c-9461-767686ecebf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "9e62fc5a-cff6-4d3e-8bec-98bd56fbd865", "value": "a-r.m-4.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3c3998-b5cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677412804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412804, "uuid": "57f5e570-3d04-4a89-bd61-527191647113", "comment": "Malware payload (Mirai)", "value": "37d0e8320ae5e59fb083c79d8001495c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412804, "uuid": "5011e024-f50b-42f4-8964-f33d726b329e", "comment": "Malware payload (Mirai)", "value": "d4adbb3aea69ece365660addbc7887a4e5b50b3393ea9eed66be22e369590433", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412804, "uuid": "8025a3aa-89ed-4985-be90-98d3aa718d3c", "comment": "Malware payload (Mirai)", "value": "5125f5d6985e6b25eed1ece7f98e4f94bd186b56", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677412804, "uuid": "22df3288-7173-4df2-9493-5e2246424b84", "comment": "Malware payload (Mirai)", "value": "f98e89d2555c68c5ecf981fb20a5f9dd1683f98a59459cb10db0691c30c18b6831d62bd369fca89305793aa1cc611d07", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412804, "uuid": "5bbd4478-55f4-4877-b2c8-12e8d272c4b6", "value": "T15F536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412804, "uuid": "3bbcd5ce-f73a-4ffc-8487-7fcb678f91e6", "value": "1536:Z7qARubgzY/bEJy/Rcpk80LDHhklv4JQC9DSW:NP+eY/bEJB4XBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677412804, "uuid": "fcd69304-b239-41af-b0ac-22c6e728b768", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677412804, "uuid": "67e3c920-fd58-4325-8080-f3a5a161c14c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677412804, "uuid": "0d3aa2a0-9106-4165-beee-8e98c18bff6a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86633ad8-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "44ac1e25-663d-4386-9839-d39bbb533cb6", "comment": "Malware payload (Mirai)", "value": "fe803b1431784bdf257664887592ba73", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "2c2988f3-018a-4e87-8112-0e4af4252e98", "comment": "Malware payload (Mirai)", "value": "d7b600a545d3a8c09887b7148624f42fac83ad4e2d1fd883dbea520bd7993345", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "775b2a7d-7092-4191-9ed7-04f4fe0cc404", "comment": "Malware payload (Mirai)", "value": "a503c43456e7e71bc7c2438ef90d9d8079fd6daa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "5f9efc1d-d963-48e1-8907-8fb5a60f3dc8", "comment": "Malware payload (Mirai)", "value": "9d6f6896768bb79ddd64d2dd15f2dae98acad6227746ea2190384e6442f8f27963faee1e287e392d1a24c5f878784ddd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "682553d1-05fc-4148-9543-0f315aca8027", "value": "T1DF731982BC80E616C7C01777FA6F508E3315A7D9E1EA32429D255FA07B8AC1F0D6B746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "8703ed45-9fcb-4b00-9661-9d006a72d958", "value": "1536:0vn2uNgEPjgD7mUxdXDwmby6BPBqPB8t468Kz/KPJJmq:0vfNgfxdzwmo584bKYJJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372611, "uuid": "9aebfb8b-8118-4b34-a929-7f9f77f7624a", "value": 78860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372611, "uuid": "d5418464-8218-4a28-8b89-1cff30102746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "5cb2a163-76fb-4cf5-ac62-f08fff45d00a", "value": "KKveTTgaAAsecNNaaaa.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5639866d-b612-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1677442539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677442539, "uuid": "41538a88-9245-4cf2-bfd1-d4d564729c0c", "comment": "Malware payload (AsyncRAT)", "value": "243f4d7d56da6f9f03a0ad8953722a7b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677442539, "uuid": "d639b7fb-3ad0-4da0-87c5-d84d73697ffb", "comment": "Malware payload (AsyncRAT)", "value": "d8270b3ab372ed508c56f10846ee64a9d7e8040699e311eac38dba2069fb74a5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677442539, "uuid": "4e35027d-672f-4724-ba91-fe38efc48ed1", "comment": "Malware payload (AsyncRAT)", "value": "0acec5042e9a9fec184ee0dfb9fcd6067fd03f6e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677442539, "uuid": "e01f5c9a-d488-43f3-a9b8-3f0440660c37", "comment": "Malware payload (AsyncRAT)", "value": "7b49ab41fc248df8a087e91388a020a7bc0e42347d6fc315893a3a72695832f9f488299770c59340020d18eae066c470", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677442539, "uuid": "af4ab684-2c2a-48af-b326-51345233d6d1", "value": "T14D75F81C618924EED2941BF9BE4337D7E0C89019FA1F5E8F235E2D64D8F11A07658AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677442539, "uuid": "bed7f1f4-2082-4cb6-92ed-7d320a82d5ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677442539, "uuid": "403fadd1-e01a-478c-88e6-d8598576d2c5", "value": "12288:pfW2rQeoEBPLZHAWjqQ3xnhV16rT1tGdXC:pfRVfZgWzxnhLa1tSXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677442539, "uuid": "afedbdff-7e6a-41b6-8a92-e042bb04232a", "value": 1598976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677442539, "uuid": "9ffa8010-6590-4783-9687-844dab131890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677442539, "uuid": "47449756-b715-46e3-9170-b54cec43acd2", "value": "D8270B3AB372ED508C56F10846EE64A9D7E8040699E31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340c418f-b5aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677397814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677397814, "uuid": "1278c8c1-e376-4031-bb4c-0eefd26e6f93", "comment": "Malware payload (RedLineStealer)", "value": "7260ce2539aa0bc12628814f43c05df8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677397814, "uuid": "a4e9f66f-bc61-43db-b2de-523b9966b263", "comment": "Malware payload (RedLineStealer)", "value": "d9be2b5a42a1d6cfed20e17c1c178c5512f596467f7a64264ef02331bf51c5d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677397814, "uuid": "c5beba38-305d-43af-a001-ae31698f69d5", "comment": "Malware payload (RedLineStealer)", "value": "bd53999cfb10a89dd47e039f2beda141fdc48242", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677397814, "uuid": "4a3ff765-72e0-45da-abf9-114d94566c5f", "comment": "Malware payload (RedLineStealer)", "value": "0252389a55d11aae7cafc473ac2f464288263fca5704c84579ba852a278061374b69b029a72f4bad4bc27ecce0749627", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677397814, "uuid": "78a160c4-3571-4447-a572-d5b4cb04aa54", "value": "T1C694F10BF7EC8122E8B5577019F606C3063BBDA19B38836B178F69494C725B1A635B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677397814, "uuid": "a70f4818-2016-4426-bb97-c19b4fd3cd46", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677397814, "uuid": "dd476fe0-ff4c-4791-8566-385aa00a0c6b", "value": "12288:0MrZy904l59lXYjpn8cq2fn2xgbQDaUFj:1yRl59mtniOgBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677397814, "uuid": "4ad9c8e2-e403-4543-86ac-a4ded8556127", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677397814, "uuid": "173270d2-8e53-4a3d-bb55-04231af163d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677397814, "uuid": "2e852d24-8f34-4c91-8e6f-6de125073f61", "value": "7260ce2539aa0bc12628814f43c05df8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba3927d-b621-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677448856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677448856, "uuid": "10794bf3-a18a-4a7a-bfda-b79d3f6887b0", "comment": "Malware payload", "value": "a2a79848b7c22f7f35d9a5ff7b5021a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677448856, "uuid": "810f15c7-751b-42c8-8b8b-ff3099f15cbd", "comment": "Malware payload", "value": "da901e87ab2565be47bbb3ca0c1244adf197324b6f73b241d1bb0dca4dec5c01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677448856, "uuid": "365626b9-2f70-43bf-8671-ec968ffa2094", "comment": "Malware payload", "value": "bcda0117a7f302f7f43abd9923863a391ac47cb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677448856, "uuid": "448c7bf1-c074-4f68-9fc0-c01e420b3824", "comment": "Malware payload", "value": "78eeecf980f96c11271354ee3817085f6073750a157d174f97b0d80557ac14c429dc94d156de26e5e2965cb6c2fbb573", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677448856, "uuid": "96168e16-1c4a-4206-a32f-b1fc5259ba08", "value": "T18E45225BB7F88026E8B097781DF603E31A32BE617B39478B164B68450CA35B4B43577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677448856, "uuid": "457aaa67-1f50-4981-8af1-3c1092628a54", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677448856, "uuid": "6e1ea352-b9b0-43ca-bfa1-9090210e5751", "value": "24576:3yuJUVqyTt8tj1b/ARwPaaREDhIVX1wOtl:CN7TKt1k0iOX1ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677448856, "uuid": "c9974121-3b0e-4ada-afed-ae3eefcfc065", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677448856, "uuid": "147b840b-078e-4613-b2df-000f0786efb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677448856, "uuid": "934570f1-81b4-4ed7-b2e6-2128948a35cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8670bc15-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "de1e31a3-899f-4ab0-9160-459d7232a6fe", "comment": "Malware payload (Mirai)", "value": "e499666cc8c46ccf662ce7273a9a53ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "0344738e-23ff-46c0-97fc-2331096f9982", "comment": "Malware payload (Mirai)", "value": "da92e5d280eb2f6ed7de6f03eba6f7512cc791eaf7ddefa577968b263c7bb960", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "f8cd94a2-23c6-4079-87a5-49649b68bf5c", "comment": "Malware payload (Mirai)", "value": "ce99a0384207ed8f490b71aa25366fcc12333a05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "b46f827d-3d63-4f06-9bcb-bdb89526677b", "comment": "Malware payload (Mirai)", "value": "2b88ab9a45fbebea619ac44c2cbb06e78502909f9900c07e8ff3d8f00108fcba819d28a7ab8c562e55a7ccd9ad8c7a0b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "bf2527d9-0302-492f-a1b2-7ca0fe07bf86", "value": "T10A43E655B8C15A6BC1E423BBEA6E518D3331A3F8D1DE3217CC111B24B6C952F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "d89f4069-79f0-48a6-8bd6-7bcb9955f7a0", "value": "1536:jhZAFs6myVyXQPL5zcKQrrFRQ7VlG9Ww3fxH+d42+m:jhZbMrgKQr/Q7rG9r3JHKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372611, "uuid": "6cb515e6-d6a1-43fb-87d1-1296cd089b60", "value": 55564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372611, "uuid": "390d9c98-6a5b-4448-9edb-25b71fbc0380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "1c544f29-846f-4264-b793-836a92aee727", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1ade30-b5ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677434361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434361, "uuid": "96240367-8518-4be1-8e34-30a297161405", "comment": "Malware payload (Mirai)", "value": "f2bcdf46ba36d683ae0721eb3647fcd0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434361, "uuid": "c62202a9-07e2-4ca2-9f24-91408b3d3fb5", "comment": "Malware payload (Mirai)", "value": "daf0032b113b973d3298656dbff4926d03175d0cffccf0b32c146f1b4ac858c0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434361, "uuid": "cbda21b5-3150-47a6-ba82-643d09976d84", "comment": "Malware payload (Mirai)", "value": "e1e87243a4f5459b2398c99a6276b71653f9525c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434361, "uuid": "bb45800a-e0e2-43f2-8e98-92a119c68d14", "comment": "Malware payload (Mirai)", "value": "7c5a01c35c511a0ce3b218237e481552960f2f0a847958bb94057a4e0168cf621b5986298da1e4a759627f4bdc7bf552", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434361, "uuid": "c4d8e01f-4585-40ef-93a0-e87c1756f35f", "value": "T14D1318C4F553D8F0EC9A06703076EB365E35F1FA222DE553D3A5DA32BC82602E60699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434361, "uuid": "b1e13429-7fa2-410f-a5a2-359bd0184540", "value": "768:xMlB2zs8ssGfrRI6aQ2nEenz3q8uDOycM3U95VlVs:YYzs8ssGfrRI6aVnEeDWOrMErVla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677434361, "uuid": "aec157d3-3b1c-4da5-977c-89b639ddda82", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677434361, "uuid": "1074aa7e-7bc5-43e2-999d-61daf84e0f81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434361, "uuid": "9fe176f2-5fb8-42fa-92ad-8989c9e94713", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7036dff-b5fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677432930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677432930, "uuid": "80615eeb-009c-4038-82bb-0dc3a81cefe5", "comment": "Malware payload (RedLineStealer)", "value": "15e252ba8ed61b054cd4ea61a405ec61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677432930, "uuid": "c6f9855d-21a2-4c09-9594-d5b51a5a42ad", "comment": "Malware payload (RedLineStealer)", "value": "dbae912338b82c5ca945039308694c8886584c16b32c179d44d9cddeb3601e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677432930, "uuid": "d5bc7eb1-6378-4ed4-8f41-2501db3baebf", "comment": "Malware payload (RedLineStealer)", "value": "646ec1d881fee4c57a44c857a3a571f7b317e840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677432930, "uuid": "fa3a724b-5784-4254-90aa-8ecd00499dbf", "comment": "Malware payload (RedLineStealer)", "value": "35551628063a40bde21ebf22bcb2b115c027b1c2c8ab67c6c2d55e43997adcc27d076ae31944ddecc7a8b3c7b41d0e1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677432930, "uuid": "9834842e-0c97-4117-b195-2fdde864cdda", "value": "T1E7452307EBEC4172E5745B3045F202932736BC51CB784A6B238DBE5A09735A0B636B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677432930, "uuid": "73eaa397-e593-4bfe-9cdd-e29fb8a57221", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677432930, "uuid": "aa6a3b15-ef38-4458-bc87-cf1a917d1798", "value": "24576:kynwDtg1Y/CEMGNqzNv3YQG2Nm0YxqYNlwG2yRZEmj:znwD+6/zlgzBn1YoYAG2pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677432930, "uuid": "47d8aa82-0d18-4c0e-b401-4688b516b917", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677432930, "uuid": "bac775c1-f6d0-4681-9337-b7d8b1cce4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677432930, "uuid": "e0147af9-077b-4a4b-97ca-0d2b6e49da9c", "value": "15e252ba8ed61b054cd4ea61a405ec61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad42e3b-b5d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677417474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677417474, "uuid": "a806eb8d-3d5e-4a0c-9730-e09b7873fc76", "comment": "Malware payload (Mirai)", "value": "e943f6a911f05720d631cfa0e4a4df86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677417474, "uuid": "796880be-e68b-467d-aab2-91d74ead93db", "comment": "Malware payload (Mirai)", "value": "dc3e76b19556c0bce07184ac573a17dcc1dd9328d82229d3895fd77156ae10a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677417474, "uuid": "c01843d3-3ee9-4472-b996-7729980c855e", "comment": "Malware payload (Mirai)", "value": "bdd512a09fb975fee7b82aa66994fb23fd27c472", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677417474, "uuid": "7de02ab4-3428-432f-9c92-3428da813807", "comment": "Malware payload (Mirai)", "value": "cbffb93163565a9a8e7a5d21aac9db5869bbbf653eb5d0a5bd8ae43ebad23dc91afbef2e44ec88f74ea3f8c5f288402d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677417474, "uuid": "0863a9ee-82f1-4309-8a31-2bc5d1a8229e", "value": "T1E5B35B27B791C67AC08796B027CFAA919423F17D0B37322B77D42CA03B159C91D6DB82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677417474, "uuid": "60822802-9d6b-440b-9e95-158ee0ee8677", "value": "3072:hADBmLKlYZYZy8o7yzJOaGuiPIL5Fmn1VrX5hUZSE5:pUm7y18Pumn1VrX5hUZSE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677417474, "uuid": "d4421daf-fada-4824-9347-e4e67d38e190", "value": 113627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677417474, "uuid": "220f6e84-0dbd-4a6c-b3c2-24e8257fa47b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677417474, "uuid": "d48852b5-6f4c-40bf-9ba5-a00603ef8742", "value": "kray.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2c3f89-b57d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677378419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378419, "uuid": "19203245-24a1-4045-b79b-8c57bec2a2f6", "comment": "Malware payload (Mirai)", "value": "a5a5521df673363196c18d3934f76858", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378419, "uuid": "9ba0b639-dc1c-41e1-ada0-3687a769bd3f", "comment": "Malware payload (Mirai)", "value": "dca7d0e9e3234ef2813b1f1c21fa0edd9f27f4f49060758b3b65b51a6a876753", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378419, "uuid": "a0063bb6-9dc1-4665-af22-afeb15c7761c", "comment": "Malware payload (Mirai)", "value": "28f0c1be9aeea5e5939a90dd137a095b740d1997", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378419, "uuid": "08514bbe-d3db-4011-b031-6ef546f4482f", "comment": "Malware payload (Mirai)", "value": "f13d626aff873c841102fd4ad58eb397fd9de8d5d5f1786bc56388fa0980955f821ae8e17ce7f259cdbfe290dd902597", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378419, "uuid": "36848f20-c202-46c5-a621-c68a79a17f36", "value": "T16443E681FCA18A16CBC02375F95E2A9E3321A7E9C2DEB317DC115F207A8950F1D67E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378419, "uuid": "5610f5ac-b05c-40d2-b61b-c34c2e6e4707", "value": "768:WkOdHevTlMb4oFG5IYiXru+AfS/7To9DrEK8neKUnIKwtpdMVj8dkNzZt4zrRojL:6dH4ibpG5IYgruj6g/j5kzrTiX4gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677378419, "uuid": "e16c863c-c104-48d0-a21e-b4e341df7c58", "value": 58992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677378419, "uuid": "9bba4bd5-b9c8-4d41-89d9-d5e686658bdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378419, "uuid": "5a8fa497-e19f-4a5d-b8d7-a55cae745741", "value": "tamkjll.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f2265c-b5c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677408606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "24f951be-a9d9-4c11-9b09-8a9eec2de67d", "comment": "Malware payload (Mirai)", "value": "5b1bbf38bd3ade35a2557875319c0e7c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "39b34a83-9630-4438-9f48-b593d35c6464", "comment": "Malware payload (Mirai)", "value": "dd104e248ac21e06d6a5403419ae9862a48c8b1cea20ecab6efb8f4e5198601a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "b3b2d598-97cb-43cf-80b3-30b8ebf0d6f0", "comment": "Malware payload (Mirai)", "value": "4a0943bff8f9fdd2ee5890119a20e5917e8f8cb4", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677408606, "uuid": "7976cd52-c170-47c2-b3a1-2c64560edfd0", "comment": "Malware payload (Mirai)", "value": "c2a47e3331f275d1a20d040d873f2eaa8bfd0bcced88e796a057c9ccd45e0ab1b26dc041f15c8762266e59b1eff27ce4", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "b5a2cbaa-91b9-4c56-bfc8-ccd0f0000477", "value": "T169C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "531a7dfc-4662-42a7-b8d1-54c7764281fc", "value": "3072:ekYPUfsgnsb0J2ag/VfakDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0akDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677408606, "uuid": "5aecf707-cd5b-4a10-8fa3-7b0465b35c3c", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677408606, "uuid": "3def11e2-f400-4fe5-94e4-584ed56de041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677408606, "uuid": "a26f6fe7-e094-4b86-85df-912025fab391", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d242733-b5eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677425773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425773, "uuid": "1d6d6df1-e5cb-4ecc-9c5a-6678dc637512", "comment": "Malware payload (Mirai)", "value": "1b979099cc560113aa73ee3265b293f4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425773, "uuid": "b1a90903-58fb-4048-8a26-e74506d0d2f5", "comment": "Malware payload (Mirai)", "value": "ddec1aa556015ab192b003178a4c84bce58c387c5a54e61c3ade6a43888e24a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425773, "uuid": "8198786e-7c86-4743-9522-da7dc9770872", "comment": "Malware payload (Mirai)", "value": "54597cd364dae9854094c4b163ba12b05a22e5fe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677425773, "uuid": "a49c0629-6d4b-467b-92d6-65bb6843fff2", "comment": "Malware payload (Mirai)", "value": "8d4d73187629fb48e07d9463427df65f7bb0043b82aecb9e8c2925393a09ebd080bec5f0731cbe42766ca45218ebccaf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425773, "uuid": "440f23e6-9ef6-4ee7-a2c5-a40698963f31", "value": "T1BA730856B8814B12C5C5127AFA2E118E332317FCE3DFB2129E106B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425773, "uuid": "741110c9-3cec-40e5-a394-710fd608c37c", "value": "1536:mln25xPBXk1wnnkL7+KE007kAVkyazN0bIqvikNnsvHTGsV5GYIWk:rxpXCMkM/Pja4NnsvHqsVER9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677425773, "uuid": "fad9a4a6-50fc-4769-a048-6d83e6bbdf85", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677425773, "uuid": "600c4d72-1bea-497b-86b0-fbda030d595c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677425773, "uuid": "3b753f2d-55cf-4325-ad32-397c6561e749", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed73ab1-b5f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677430232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430232, "uuid": "dc57649d-7f66-4071-8748-872579816a38", "comment": "Malware payload (RedLineStealer)", "value": "b676e3348b142f00c303e83d5c675876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430232, "uuid": "16700245-0a1c-41ed-a795-9e9533b8b08a", "comment": "Malware payload (RedLineStealer)", "value": "deee735c89c612f3edf7c296805a6c06ef751937823bcd4d7a3ad0f3b1972f44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430232, "uuid": "e457c67e-528d-41f0-a362-f65c41ba532d", "comment": "Malware payload (RedLineStealer)", "value": "2b21b45bad0896957b1b42a9c1399701ad5f523a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430232, "uuid": "530bcfcd-5d1d-4f3f-bbd0-de22fa38e216", "comment": "Malware payload (RedLineStealer)", "value": "ae398296fc74436a864f2b8478b9b49918dae251ab7c4c6fe2ed5397d703cb5aadb2a830e3e3b9bdb7eb35a65e91f06b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430232, "uuid": "f8a1ce04-594f-4105-8268-b88029bdd01e", "value": "T1AD859CF0B5E0A636CE852E347327E7CD24B414A851585E2E5BCC4A5D902EDFBE43E932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430232, "uuid": "5c07c18a-3798-44c0-90e8-a957b9f05209", "value": "fe01f9f8334b2fe85e327d2dedbba869", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430232, "uuid": "c724f527-2087-4d69-a1df-16271b213661", "value": "24576:wQt1lMUTY9M7aFQ2PK3xdJkaxflU/YRuiei9ZTOavAXA0eNQkkk4WoB:wElMUTYiH2iNXuYteWTOavAw0eCk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677430232, "uuid": "46c33b39-e50e-46c7-8c7b-b3686d583c62", "value": 1729464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677430232, "uuid": "0086d86e-3ab1-4d5c-bce0-98c047462d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430232, "uuid": "3c9956fa-6978-49f7-b0b9-c9393c0886c3", "value": "b676e3348b142f00c303e83d5c675876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd38174-b5e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677423841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423841, "uuid": "bb59e73f-023d-4f89-ae6f-a0fcdab0696f", "comment": "Malware payload (Mirai)", "value": "37645bdf10f8d53e1cab8d510d3c884a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423841, "uuid": "85338ccf-727b-40ba-b2de-7308867f8611", "comment": "Malware payload (Mirai)", "value": "df66e8772ca90e84018d3de047f4bf8e8b0912c0a2c0544205e0430896a47090", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423841, "uuid": "e23b676e-5540-40db-9372-4a81364af952", "comment": "Malware payload (Mirai)", "value": "3e959f5a310dd6725cf8533e6b19f08f7182a450", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423841, "uuid": "595d818c-f7c0-4ead-8d22-5dacd5da3482", "comment": "Malware payload (Mirai)", "value": "111fb331e08abc0788df402f252598e3d9f2d2a6ea776fc9ac68741c56084a55d8d385f571133717b2f038aa58134ef6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423841, "uuid": "f08af5d5-693a-4328-b6d8-6cf77f1485bd", "value": "T1F4F2D0F708DBA970D5361830E6BD9141D9EA0A3CA643A1BE0316819CAFB644D1AB92D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423841, "uuid": "cfc31097-00d4-4a14-82c4-877c835bc701", "value": "768:MdSMlYcNplm6VP6+j600zfv6e6pB0ihoiYdM0tkFs3Uozw2:joNpkiC+A96pRo/Z/zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677423841, "uuid": "25497025-45e4-4c9c-93ba-7827731ed373", "value": 34804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677423841, "uuid": "99267d56-0f4d-416c-8228-1076a7a565e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423841, "uuid": "305f9c73-cac8-4e09-be07-2166ad4204ff", "value": "37645bdf10f8d53e1cab8d510d3c884a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a99f148-b5f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677428856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428856, "uuid": "fdebd076-0947-448a-9fd1-293b9919981e", "comment": "Malware payload (Rhadamanthys)", "value": "802d2ce8f23bbc7e722d65eb38620c7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428856, "uuid": "ec4852ad-a25a-4b87-9a03-fdef0ae93acf", "comment": "Malware payload (Rhadamanthys)", "value": "df66fe18ba387caa8cb295c5f35bb0a8d208ddadea7a05cef77090cc09a681b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428856, "uuid": "c68b6fea-de69-458f-96c1-e70622dc3c42", "comment": "Malware payload (Rhadamanthys)", "value": "6a930111965f902eaceac308b887118c6b11f026", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677428856, "uuid": "2fbd7701-b51d-40a8-9851-519cbf420bb6", "comment": "Malware payload (Rhadamanthys)", "value": "e5161fb8c1d2eafe8ff47c476e096c47adb19c09ae30c776beeca86f31ed67eae86e3d077569c82d93a4a13fc94b0ecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428856, "uuid": "f2962a32-e5db-417d-9527-14bbe1868b39", "value": "T1F504E118B2D1C0B5E99B023158BCCA7729FD3E5B8BB0DA47779C19C75D311B896292C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428856, "uuid": "d1738d78-6278-45cf-aade-b0e6b6b1bbb0", "value": "f214c5f744673db93dec4b219265fbc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428856, "uuid": "1429e401-f833-482f-8fce-f609efab5f8f", "value": "3072:bwevYpKTDMDUDfuuE46lC4PQyfHU6Ig4cjnjFRpbll/XbqefxlS3ETgmBN8vqI5L:sevY8muu3wB4HzlrzPOefxoEBK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677428856, "uuid": "4b7d0a82-b33b-4335-9a10-247101f9b213", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677428856, "uuid": "115260f2-0eaf-4f32-af6d-c65fd051cbb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677428856, "uuid": "7fdd045a-ae87-4871-aa8b-123ac4e8c1f2", "value": "SecuriteInfo.com.Variant.Zusy.448594.1276.26052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de40da8c-b574-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677374906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677374906, "uuid": "af98148f-6cbc-43fe-9409-7bdefa4425fa", "comment": "Malware payload (Mirai)", "value": "2f5955d1768833cba2761d9a09fccbe3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677374906, "uuid": "18d00743-1a7f-4fb5-a957-288f4ca2fff1", "comment": "Malware payload (Mirai)", "value": "df857f67dc47f38e6611ff915a53d6315f24f49e3b0b6c6c063ac251586f6995", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677374906, "uuid": "4209488f-02df-4e11-ac86-6d7eae16ed92", "comment": "Malware payload (Mirai)", "value": "0f8826c2996bfc097c8d7b6d58660769b0bb8c8b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677374906, "uuid": "decb5e3e-2781-4620-91c9-8bc8944be694", "comment": "Malware payload (Mirai)", "value": "57cea685674229f146bd6358dbc2d31fa7b0a5c01acd48adf83b23eddcfb7b98918338353c4a26f728810a26a563a08c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677374906, "uuid": "ed0afccc-bab0-4bc2-8d6e-f29d65b0f9bf", "value": "T1AC732B42B9C485ECC089E43802BFB535C415F1BD2339B2DB37D9BF27291DEA11A5D86A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677374906, "uuid": "636a9587-1622-43c7-8ff9-8f126e198924", "value": "1536:2zCTXktlQ4G1ROIN+aSUhWqe3hadiMG979u+Y18Hfts:+5u4GrOIN+aSfh3YdiMY79u+THfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677374906, "uuid": "d8b6b647-58ea-4d42-83b5-4b3447eaec00", "value": 75712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677374906, "uuid": "3e8545df-df14-45df-a75a-17cb91bdcf58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677374906, "uuid": "91312561-e521-4455-998e-c41ce00633f2", "value": "2f5955d1768833cba2761d9a09fccbe3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f3fcdf-b607-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677438047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438047, "uuid": "39d29a18-6e6b-4941-906d-02aab2c6769d", "comment": "Malware payload (SnakeKeylogger)", "value": "a8384f820885cb53243e2413abf22200", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438047, "uuid": "ad355b88-aa49-47c4-9a1e-901a52f8e82d", "comment": "Malware payload (SnakeKeylogger)", "value": "dfe752002f955e1facba9518dc6ac3854b9aa6ec196fcc22068f41e4f5c87cf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438047, "uuid": "95e1546e-9e13-4834-a3d7-57b862eb2baf", "comment": "Malware payload (SnakeKeylogger)", "value": "1314f2a95385822539ce1a12a0eb267be87363c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677438047, "uuid": "1303edd1-0c96-4fea-9bbf-67da94047a11", "comment": "Malware payload (SnakeKeylogger)", "value": "65dfc41f3b5039db3f8e6e35ce758084b10137ffcb858862cffae455f148319207ca3d99cc9a3689bd799983b62cb588", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438047, "uuid": "5d2f335c-a849-4f66-ae1b-9e0dd02fe24f", "value": "T19E24291A7BE49810E5FF593304B05521C73AFC521A2ACE1F57D1B52A1E7C690CE2AFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438047, "uuid": "318f07a3-8feb-48a6-9a78-1087c79b5a47", "value": "12115494f2c86ccfa8a7bf3471dfac33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438047, "uuid": "b05bb723-e0ea-438c-b6e0-644514a510e1", "value": "3072:CqqaM97eOTPiK3Druii9/XbKjPA18lVAgAEzoHj/LDdADnb8FH8taQwBj2WFbYQ:RCteODDyzKF+aWsbI2SbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677438047, "uuid": "b697b78f-655a-4d5c-92e6-a3168c9c0883", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677438047, "uuid": "cf66d839-6f6b-4f31-a914-167d2601be20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677438047, "uuid": "f334d5cd-cab6-4b49-840f-104d1da338d9", "value": "a8384f820885cb53243e2413abf22200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af0bed5-b5f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677430198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430198, "uuid": "6f57dd5b-51f2-4a06-a599-c5a3dd5057cf", "comment": "Malware payload (Mirai)", "value": "1fed49d385cc5142f418d09fee4379c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430198, "uuid": "f38c4356-e415-41c8-a755-8617a25348f5", "comment": "Malware payload (Mirai)", "value": "e0cee603da00ff6a250362be9746c3d27aca2c6681b08c24c6602f65ae0b8a01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430198, "uuid": "1d58bb25-08fa-42d1-8132-fc401e1bbfc8", "comment": "Malware payload (Mirai)", "value": "6a730b3b32eeea0c0144147e58bd597aafa63ba1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430198, "uuid": "7ff0a02a-e1d1-474c-ae04-a679c5ee776f", "comment": "Malware payload (Mirai)", "value": "8c520566e5e2d3367121d0c243cc4a6bf6b352e61eae5779466b75f60778712109cfe568d775526f69e3d786bb0b17fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430198, "uuid": "ccb49464-424b-4221-b2f1-e3425007a454", "value": "T1E0A2E019BF2C828BC836393955E9E6D61356FC71F29DDC093940C16BF0A33A92834E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430198, "uuid": "6723f962-c396-4f5d-bf36-1dddd66eadff", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTk:x98o08kxofBE+ZkXaITbp2F2TWul0c5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677430198, "uuid": "c8238151-89c6-4798-b9fa-7e63d8d3838f", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677430198, "uuid": "62f9000e-5050-41e5-aad9-151b32569b3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430198, "uuid": "0cbf99c3-0059-489a-be30-4cf65e868d29", "value": "1fed49d385cc5142f418d09fee4379c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027d3990-b5da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677418346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418346, "uuid": "b1d790eb-2751-4323-96d0-a97e655c413f", "comment": "Malware payload (Mirai)", "value": "fab09eeedd6c59c1d3a58162dafb834c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418346, "uuid": "0fa689f3-5e0e-410e-a730-62fd924455da", "comment": "Malware payload (Mirai)", "value": "e0f845b41117cf5dfd2281b1feab081d31d0464e5a5ba4737f7075ccec6d3f73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418346, "uuid": "83fd9588-fe25-466f-beab-a03ed8d69186", "comment": "Malware payload (Mirai)", "value": "e2948a7a64cddbc155ef56f626d360ea32a1f27f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677418346, "uuid": "53ab8001-4bd6-4b27-b3f4-4680550865e7", "comment": "Malware payload (Mirai)", "value": "d6a9f19e97a07dfeaf8fab8648df7b21ba37361472567017fac92641ba2048fd396921415783fb2f71194871d1f1d86c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418346, "uuid": "bc38ae53-7a23-42b2-90e1-a4662d211b98", "value": "T1C063961D7E218FEDFAAD823447B78E21AA5823D627D1D5C4E15CEA011E7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418346, "uuid": "e5e616f6-7824-4d52-b619-df8f91ebcb43", "value": "1536:i0y4avHfPTn/m9cf2jgqth7+0jRb+10WsS5:ihHrJqX7+oReL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677418346, "uuid": "4a8b018e-3446-49de-95e9-bef53ce7070e", "value": 73304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677418346, "uuid": "a7d63447-ff4b-4c57-a5b0-85b24311e2b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677418346, "uuid": "74718749-431d-4a0d-b8b1-780bd858a65c", "value": "fab09eeedd6c59c1d3a58162dafb834c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b7eb11-b5a1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677394159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394159, "uuid": "c2374cd2-1425-4438-ba9c-92584cceddb6", "comment": "Malware payload", "value": "dbefa57085427b3f1e72ce541b335aea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394159, "uuid": "0b251b63-b435-4d11-a9d6-8276feae55cf", "comment": "Malware payload", "value": "e1d946aaa6daf78016cb6f881680303d98745b8d073fff95a7e137342497604f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394159, "uuid": "f2decfb2-9215-4783-ab0f-601d45a55df4", "comment": "Malware payload", "value": "4b359fbb2923750c5f37e3c9e86175b080f8a3b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394159, "uuid": "e30fcf95-8e16-4912-b047-527576c50f4f", "comment": "Malware payload", "value": "3fcac90b6d3ad63d50b26b7f5697ab93c84b0d8cfefd47a5d4475472e7419740a3c52a676d61ab0d15bfe65714b785f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394159, "uuid": "7ac4e513-8bfd-49b3-9328-34672205e540", "value": "T102C4124BABDD4160EDB467701DF606C306317D616B78835B035BAD1E0CB1AA8B3363AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394159, "uuid": "622e6b30-f0dc-488c-b59d-b4cb4b5cec68", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394159, "uuid": "2124c3da-8c11-42fc-a850-9f15cd083aec", "value": "12288:CMr2y90cJulshW88iyO6fdzjEvEWCNdonLp:YyjU88iy7jVNaLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677394159, "uuid": "c58d3d5b-8ed8-4b73-8817-21a69ad78224", "value": 561554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677394159, "uuid": "1d6ed2f8-bd3d-4bd3-ab9b-07b37f05e917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394159, "uuid": "a1a53d0a-e2fc-41d9-92c6-dbc6fec786ae", "value": "dbefa57085427b3f1e72ce541b335aea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6060378-b5be-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677406675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406675, "uuid": "7d2d5fc3-0985-46f3-b18e-9b60c890f0b0", "comment": "Malware payload", "value": "9b4aadaae4dd93865e376830a48a2036", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406675, "uuid": "af00a70a-65d6-45e8-94ad-ac04da235914", "comment": "Malware payload", "value": "e207390f11dc95fc206625126e3eb96d52dee6e5e7ee01de5a32fef405c333d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406675, "uuid": "ea571d2a-7336-495d-8b10-e1f0f8a722b0", "comment": "Malware payload", "value": "2817f665ee33a3d4997a0fec19748c3d2fdcee7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406675, "uuid": "47bd1346-9cc3-4587-8a86-3f2b44b0c72c", "comment": "Malware payload", "value": "20100beb2b01d26e975fa82281fe901e316c8263c5d1c217c2ce357e34a7bf01342adf7ff2660ea8f0e0210c7052f70c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406675, "uuid": "038a81df-087c-4975-8d4c-340d83b7ed75", "value": "T1FE13F20AC4E85201E79CB27CD2930FF3F92606D8768F61C44A2CBD7FC918AF55651B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406675, "uuid": "711c8597-64a7-4ca9-9f97-d91f6c33f68d", "value": "768:P2AOp5XXZ1IFpmZkz9pV/RxtDLSEO0wzaEdG3ntOLPz/2ijbl8uI49xRiK6TM:P2AOp5XXZ1IF4krVk4EWtCbd9/i9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677406675, "uuid": "b7dd2d7a-8a8f-4e78-a87f-bd7d2b29610f", "value": 43852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677406675, "uuid": "4415fde6-226d-4ef7-b2ce-dc9d4c215d3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406675, "uuid": "536eaaf6-0b10-4db4-ac0f-7f89e1dc944e", "value": "9b4aadaae4dd93865e376830a48a2036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0ae691-b59d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677392401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392401, "uuid": "0b97da64-0929-4d63-9504-84609f7d0c83", "comment": "Malware payload (SnakeKeylogger)", "value": "2386721a30c6b37f4f5df890a341ca5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392401, "uuid": "6b535c93-6147-4e3c-8e9d-8473a1f99208", "comment": "Malware payload (SnakeKeylogger)", "value": "e2ded1a5f3b81f06c607bc47890ae1539a7511cc8bac2f31d13cf425a0dd8233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392401, "uuid": "1d5eb32c-bef0-47f9-a059-278d2352212e", "comment": "Malware payload (SnakeKeylogger)", "value": "237f4571422b03ce3ef3b8d9d3a821c5df7d8ece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392401, "uuid": "6a5d1c15-3018-4c4b-933a-96784fe5400b", "comment": "Malware payload (SnakeKeylogger)", "value": "d65d9c5875c1c0bef6138b762b9ce6b46189b5f23562145862dcad5be4348a97a03fcefb73a18499fd723268733dff1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392401, "uuid": "76382639-f741-4994-86f3-757e7f35e30c", "value": "T18AA4BED53164C4DFE9E22AB1AC0FD13026E1795C60D5A70E76E33B6EA8E3312052FB49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392401, "uuid": "199b2ac3-1bf9-4101-b6dc-112818badb20", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392401, "uuid": "55b142ca-2021-4042-bf34-ecbb80020c32", "value": "6144:5Ya6fk8r7GV4vY0uHPyHmjvro9suUa3VYcspDWnl+ZSMtq1VSRrBxMd7Wlactq:5YNLScYdqSvlaFY0l+pIiD0etq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677392401, "uuid": "8f6da3a5-8db3-4abb-bad0-95e2485295a5", "value": 449868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677392401, "uuid": "ad658972-6eb7-4562-96ef-ee7d152bed20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392401, "uuid": "6dd90c8d-c8c1-4d03-88d1-2f57eb8ffcdd", "value": "2386721a30c6b37f4f5df890a341ca5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41a0b4b-b5f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677429033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429033, "uuid": "65665f8a-3403-4f0d-8e4f-dbcd74d064c3", "comment": "Malware payload (RedLineStealer)", "value": "d315ea03f170f44217e53b2d4ef9f2a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429033, "uuid": "9673ade6-d281-4276-b494-4b5a749e2963", "comment": "Malware payload (RedLineStealer)", "value": "e38a00dfe2aae5c42dc81f3be9249e1b843c64b547a0e8ffc15af0cc48a7384e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429033, "uuid": "06752c49-c4f8-4ec0-ab2d-08ee4950cfb8", "comment": "Malware payload (RedLineStealer)", "value": "5bff1776a013710989a2f74abe25f149ff4a80d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429033, "uuid": "3ca415dd-717e-489c-b8c9-3bdf53160124", "comment": "Malware payload (RedLineStealer)", "value": "ec29ca2f7ca85822b863f3e0184585c800dd24b9735263557bfdd95b027d09af73dbcb242440b10cf0a63a5d83cca0bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429033, "uuid": "9bffd569-9c37-41e5-8555-37c3ba6c7de5", "value": "T16945234BEADC9416E5B49F301CE703D31B367C549F348A9B338E9C2A1CF1664AA35366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429033, "uuid": "87f6f4a8-5374-4895-b2e2-319a955e8a13", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429033, "uuid": "eb2a8af6-2e50-4409-b7ac-07165c1b90cc", "value": "24576:2yiAM8QjfO4pgVVY53Hhr4cP8Z+2ZpKR:Fiv7p9XhccNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677429033, "uuid": "c3b3932c-82f4-4e67-ac6c-fbdc8a2017a6", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677429033, "uuid": "6b7928cf-bf73-493e-9981-d76bdf3e7ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429033, "uuid": "b981282c-e86c-4845-a839-7265d9b77bff", "value": "d315ea03f170f44217e53b2d4ef9f2a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e237cb2d-b5e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677423876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423876, "uuid": "5cd2ffcc-7d95-47d5-8d02-b7acc85149d1", "comment": "Malware payload (Mirai)", "value": "1b122400ff226d80e66a6272b2c04606", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423876, "uuid": "0f4ea7a8-f967-436c-825a-98520e92ddce", "comment": "Malware payload (Mirai)", "value": "e38f7fbd16b13124fc9f5fdea1e8dd58d72e3e7e37cabea0cdaf509d6da17f23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423876, "uuid": "78289d8a-71d1-46ac-98c7-b9181744c0d7", "comment": "Malware payload (Mirai)", "value": "8ab47d406c7cf3f350a65e9374a188b0fdb8aae3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423876, "uuid": "862256c1-95ce-421d-b291-3e0aacfe9bd7", "comment": "Malware payload (Mirai)", "value": "7c8dfe29cddfc03950889aa08652d614ec40a070eb1134647526d8b993fb80fb9359eb1b5640a4f3e8add06ecde83c79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423876, "uuid": "2f10a7d3-3838-4674-ba15-9a5f6f8455c2", "value": "T11413E121A537A474CA141D7CAD22088E7F844BE6F47AAB2357A61A9C3BC06C1FF74547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423876, "uuid": "799d171c-fcde-4c38-b526-f071ebb00857", "value": "768:jiSsTL4AhOgizQzM5PJdtsH0aKLDpnZtqJsv0VT9q3UELXw:jbqL41zQzM9JsONqJVVSLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677423876, "uuid": "ade02f58-e426-4484-a4b8-fbb5a73e82d4", "value": 42820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677423876, "uuid": "e697d0f6-d7e8-4952-8120-15636829e11c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423876, "uuid": "263ad72f-1777-4ad7-9f71-52e53033849a", "value": "1b122400ff226d80e66a6272b2c04606", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8461eb4-b613-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677443240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443240, "uuid": "7a2300ed-35d4-4ab1-a461-90e4ac82fdfd", "comment": "Malware payload", "value": "b91cfdc1e9f7e264f97f30ae3eb7db7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443240, "uuid": "189f319e-6f35-48b0-8d4b-b017c8ac3f17", "comment": "Malware payload", "value": "e484a9fa1d2139bcb4a00617fe77b9d463b4288d97c7307c1e7c976b83c6e63e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443240, "uuid": "20e5f1ca-2fb3-439a-b413-1471436f14e3", "comment": "Malware payload", "value": "6284048c468a9dd10d5330f62820b7bb9d52a6ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677443240, "uuid": "ac643953-d5f5-4d39-8649-7b385d5d0ae2", "comment": "Malware payload", "value": "5889b6d4e13c4399acea9e032e44e689a5ae3c5e0195801c8da5c7c9d696f1550ad74dacc0b467194689eb3896f40bed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443240, "uuid": "028242fe-6af4-4868-88f6-62511eced36a", "value": "T144152A95F8419F61CAC0697AFB5E968833170BB9C3ED700A9D245A3477DB89B0E3F601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443240, "uuid": "b62f0f1e-25c2-423c-8d5f-adb432624c57", "value": "24576:XDigT5xdBmYzKxqCa3An8A1zhdavZFBrGzJM:XB5v0oZlAVPKZuzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677443240, "uuid": "a1a77265-db0c-4b56-9f00-eb172cbeb478", "value": 877144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677443240, "uuid": "ddf44744-ea7d-4844-9ae1-6eeef1ad49af", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677443240, "uuid": "7516cbef-3de9-4fac-8aad-2eb0a8f4ad89", "value": "SecuriteInfo.com.PUA.AndroidOS.Monitor.20500.10852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59da84a-b574-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677374919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677374919, "uuid": "0e1f95b9-c7c3-4f58-8e60-64d5c269ffe2", "comment": "Malware payload (Mirai)", "value": "1350097a2bbcbf24f27159f5184897df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677374919, "uuid": "e6bfaebb-ba13-4437-b6b3-0802ff89e154", "comment": "Malware payload (Mirai)", "value": "e5d9a09d24be79f1a72646919acf5082aaed1b0da7fea91588361d9b38bbbfee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677374919, "uuid": "f2b78253-bb8e-47d3-901b-419c33c5e0bd", "comment": "Malware payload (Mirai)", "value": "faf74f8a79eb30f66651823155a736fff04152df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677374919, "uuid": "4ca881b8-d963-41a8-a01a-e720c8a49f64", "comment": "Malware payload (Mirai)", "value": "c1d60381384378a39aeef0e5b331119a456964e2c5d74119b43093d8b951566ddb84cab556969a109b5c1e338a5dae87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677374919, "uuid": "3a454241-0861-433c-a6f8-aacd168f4895", "value": "T178733A99B4015EBCF99BE9FA41150E09F42163009F930F27B267FEE33DA20A59D47D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677374919, "uuid": "833363f4-71b4-4b06-9cb3-db1350431c1b", "value": "1536:BCVyHziiSIM+lTXPHNCpOW6N/1mWK1qtFhRe8VG:liiAkTPHEpCNNbZFHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677374919, "uuid": "1bf2bff5-13a7-4a99-aa69-eb0515f8df95", "value": 74052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677374919, "uuid": "cb9e82ee-60f2-4f26-a889-cf40dc5bbfbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677374919, "uuid": "b40edf43-6c69-441a-b48d-3a6bb5c92e1b", "value": "1350097a2bbcbf24f27159f5184897df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0346ad0-b59d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677392438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392438, "uuid": "ba9d0f81-6fea-4bf5-bfd6-2057d119cab9", "comment": "Malware payload (DCRat)", "value": "7862b63c418789257f399d079d011549", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392438, "uuid": "3997c47d-9d62-4ef7-8226-9ca808477f64", "comment": "Malware payload (DCRat)", "value": "e68a8a2f89159710896291473b1f51b16968d9066bb621a43a858ef4e0c7291a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392438, "uuid": "6c5256c5-8f78-4ab0-9db3-b04072ec7090", "comment": "Malware payload (DCRat)", "value": "ea2e7cf1f27e33dfaa5866653da398b3efaadea3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677392438, "uuid": "55d670cd-5d16-4afb-977f-1d2065b5a2d2", "comment": "Malware payload (DCRat)", "value": "06ce42337cc5eafcb29c584d1c6abb2258374dacaafc53d302eaf4b35a71b032ec70bc21d1310529b451459914295456", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392438, "uuid": "58e0ad56-9f55-4baa-a703-6c6b9df55832", "value": "T145C4020BE7E88022F4F567745DF303C31635BD515A3882AB2B8FAD5D18726B4A63136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392438, "uuid": "7da9cd63-858f-441b-a681-83a8fb2bbde6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392438, "uuid": "6af2ac42-6489-4625-acf6-82a8d811d550", "value": "12288:TMrJy90NBJ2f3wL+Da+8lKQ/4grkA2fqr+XmVX2FQ:eyWBJ23wLyajlzPrCCr+Xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677392438, "uuid": "b9f12d66-27cf-4ecc-8f7f-18fced7477da", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677392438, "uuid": "958dfcfd-a35d-4d5a-8a5d-4f2dc4be6c4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677392438, "uuid": "bc35215a-16a3-4638-8376-294543f0b30b", "value": "7862b63c418789257f399d079d011549.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d52e906-b5ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677434363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434363, "uuid": "6321e3bd-742b-45c5-b3a7-21ec55df6c3e", "comment": "Malware payload (Mirai)", "value": "35c59e5570086b0f4702cc958dcdfe03", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434363, "uuid": "98c8e143-cb1b-4da6-a72a-0e421f4ba9b3", "comment": "Malware payload (Mirai)", "value": "e7491e54a394eaa1eb0fbd164b048357d2abfc26534659556f3527e75f4683d9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434363, "uuid": "77fb4e65-d762-4176-b734-10be471cc047", "comment": "Malware payload (Mirai)", "value": "110b09dc7398751c34b251a2c99bf6fd9fd14cf8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677434363, "uuid": "a4c552ce-7e44-4f04-9ef8-109fc039f6e4", "comment": "Malware payload (Mirai)", "value": "a26ab6b1ee7370ddd7f0e91fb02c2d3da91dfce8d4de77993a596f42f80892a6f63025de62cc148f104d46ca0b2b122b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434363, "uuid": "287ee934-65d1-4e7b-bdd8-f6e1a4ce3575", "value": "T11323E807F54381FDC09AC274066BB93EAC2275FE1238F2B67BD4A7226CD5E225D19C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434363, "uuid": "edfe77f8-eaa8-413a-a714-b3592195cc42", "value": "768:vZCLNaOGW6bQHT9XmB3OIB/c1cV9KFf8D+wdYFmuqpjikP5jvI04Wx2fEj1sFKhN:oLYOGW6bq5XmB3OIB/c1cvK++JMBF9IT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677434363, "uuid": "e7418d2d-ee8e-4490-83c3-bee31bbf142f", "value": 46336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677434363, "uuid": "0b935e46-2ede-4e42-8bdc-1b613e937364", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677434363, "uuid": "8912708d-7b3d-4fd4-9a52-da9b35455fd0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6afa9d-b5e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677423009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423009, "uuid": "e1016b39-28d1-4a7e-afd3-e9f16136f123", "comment": "Malware payload (Mirai)", "value": "46d12bfd5efb9ca8fd695c59f13c2d25", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423009, "uuid": "8ca96ab7-ea07-4a51-954f-db5722b44b7f", "comment": "Malware payload (Mirai)", "value": "e7ceed9a2fce15b0d32905816f98e7e1657e6657abffd8f3b74eb619d2bc8c02", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423009, "uuid": "643fb82f-9832-4b9a-b171-1a92b62134d7", "comment": "Malware payload (Mirai)", "value": "8dffe9b830a438825fa7af0d2b75edb9c078fb19", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423009, "uuid": "3daf71e1-4131-422d-bb31-63d10e451392", "comment": "Malware payload (Mirai)", "value": "9cb242ee6dd0d7b91805a560c169fd2006c0da7578ac073d9338eac89f69e126593dbe4a7e95681f4bc8a572eb33a09f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423009, "uuid": "167931d5-2cf3-4b63-bdb7-3c8205dbb3db", "value": "T1B5E2F1B127F65070E5B018BFADBC429AA670477490EEBB4516458F1CBA50C1A3AFE34B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423009, "uuid": "50b81741-aace-4197-85c9-2153e97e83bf", "value": "768:jLZemcqkxSV+b9s42QG1AiQZp1gUiBZKAgxrQQsUIgydBs3Uoz18:JemcqZV+b9KQG1TOgFBZ1g5jsDg7ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677423009, "uuid": "927c65e7-bf4a-4201-9ccc-6102f18648a1", "value": 32692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677423009, "uuid": "12f1080f-d83d-4210-a13f-231dbb38df4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423009, "uuid": "57c3f53c-9349-4821-a84d-2de63fa61f1b", "value": "dark.arm-20230226-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86192934-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "a1803fe9-5576-4e2e-865f-b7b91288eceb", "comment": "Malware payload (Mirai)", "value": "bf56e74c95cf460fd722bed6e3ec6b73", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "43768937-7cbb-4596-9edc-ada024311ace", "comment": "Malware payload (Mirai)", "value": "e8b439b8e7af1d234fe69a0055aeccee1c60d1b3b4f7a4fadb1b642cbe34167d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "d6003c9c-2075-4b43-a1aa-f3bfb75d700b", "comment": "Malware payload (Mirai)", "value": "856844c0fd901bfa72422310a4c23c3291792bb5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "97f47446-4e8e-454a-8c2f-4a1758529bde", "comment": "Malware payload (Mirai)", "value": "052184890285e1a7dfc1fe635adb14a5bb19ee6084392455375841a19c9529bf1c5964bfac7b70b5ada0afc601633204", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "3adcfeda-cebe-455c-ab34-9b56dde30f6b", "value": "T177F2F17612891471D1B08A3EF835842736B703F4FAFA735711C881ADA7477233A7976A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "de9d2af9-8229-4711-b2ac-896052a1373d", "value": "768:fg1JWfsLzzmmn3n8K10y2HtiqqDpPh103pyJi77lKs3UozX:4Ofy3n8K11gtiqg51tJitHzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372611, "uuid": "728942dc-8b67-4dca-b462-0b3d40f53281", "value": 35884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372611, "uuid": "cd8fbeb2-59c1-4c68-88a6-f9da987d565c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "fac45121-0e0f-4c36-90c0-73676a1c83d4", "value": "hotnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29c9ed0-b5b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1677401006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677401006, "uuid": "009cb20a-6d64-4a82-937e-26151d180792", "comment": "Malware payload (QuasarRAT)", "value": "85c44c93c7ea09e8c5b980816990fe68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677401006, "uuid": "2243354c-37e7-4f90-9afb-166342693910", "comment": "Malware payload (QuasarRAT)", "value": "e9561022450d966160fb238b8b132dbda66266380c709f627db6dd1344b1e841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677401006, "uuid": "7b14063e-4132-40e4-9c70-05e1c4ed0518", "comment": "Malware payload (QuasarRAT)", "value": "74f9b7e2df56ac0cd036b03e1449c71041751443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677401006, "uuid": "8a521aaf-04fa-49c8-9153-605e25489a13", "comment": "Malware payload (QuasarRAT)", "value": "57377f9bd8605e9b60ea3894a9993dd68a6e52293618fb36c5754d999480829963f49b93536112b0857efe6bbb131608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677401006, "uuid": "e5d8e6e7-51b7-4d38-9258-0b9e2884d35e", "value": "T10905D0562BF4D313E0BA56B8366906E0C8ED4FB558526A70C3B5EF2467E0D0890C77B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677401006, "uuid": "85af46a0-7f03-4d91-8a64-4722d590cfd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677401006, "uuid": "0437c9d3-17cb-49f9-adad-5709ddbdda98", "value": "24576:8wicBiD2IVLgSFZv12Tklnb0qRS8JFU3wV:F3BA/NU2b0qRS8Jd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677401006, "uuid": "b929400c-1895-4312-954b-f46a365ed19c", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677401006, "uuid": "48d1d514-3f13-4f46-b893-c8891333e15a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677401006, "uuid": "9e18b388-6b51-4243-b533-50f5d9fce358", "value": "85c44c93c7ea09e8c5b980816990fe68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ce809b-b5f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677429834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429834, "uuid": "a9ac6a76-3c5a-40b4-83f0-fd82d077e141", "comment": "Malware payload (Mirai)", "value": "ff9f94f4a2a380a7b14347710bc25ce5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429834, "uuid": "23dfdcb9-5fde-4611-b0f4-365dbb4cbf48", "comment": "Malware payload (Mirai)", "value": "e988d09bcf03a92e0a84740baee2467c05984c12247f649d72b360e5e4753843", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429834, "uuid": "8318d899-e912-4314-aa7b-3507d26cfed3", "comment": "Malware payload (Mirai)", "value": "38875ba37ef7d44e7797b3f145eaf42480d3e40c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429834, "uuid": "2d554adf-82ee-45c6-806e-4dd200c8d510", "comment": "Malware payload (Mirai)", "value": "26e3047adbd1f163d315f41bf22420edaa9fdcd52e924fd4478e04ed0aa74d9118edcebd7d83d1c8f15500c51e7a6099", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429834, "uuid": "1fb8dbe2-d28b-4447-8732-a6fbf6ded24c", "value": "T128438D37E96E1E74C08641B074748EB56F23B5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429834, "uuid": "06c8601a-31e7-4341-8a37-7facb3302ed9", "value": "1536:Naa0brW/Od9hlCRbK6fZKwXQCcpvDCM12+Wl:Nv0brWGd9X96fgwapvDM+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677429834, "uuid": "badfb8b4-37fd-4c8b-bc0e-d4267db6081f", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677429834, "uuid": "fce1d11f-039f-498f-9df1-6302ba5cbaa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429834, "uuid": "9cd0a5a8-b373-4dcb-b2b9-c3244dc83f5b", "value": "ff9f94f4a2a380a7b14347710bc25ce5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6269a710-b602-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677435687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435687, "uuid": "9c62eb97-372b-4778-a110-037d11749ca1", "comment": "Malware payload (Smoke Loader)", "value": "a8630ef62cf10a9fb477716e03071487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435687, "uuid": "ba343df4-251d-417f-b4d7-d640db53912e", "comment": "Malware payload (Smoke Loader)", "value": "e99d0380aea60a18939b59f7286edab70817529f6736316401e9a2deb3355416", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435687, "uuid": "298c8eaa-95e9-4fb3-a862-b796c5f59da9", "comment": "Malware payload (Smoke Loader)", "value": "91d146ba7eccc4679b0c656f0a2fe7d39a212db4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677435687, "uuid": "080d4c00-6538-460b-b1c5-533f9e8cfb2d", "comment": "Malware payload (Smoke Loader)", "value": "cd92269593da2a29f4263326e23e44068d639d8510c42c0ac9a25b672df42169c9831b20caacbc3f540e16b71c57bc37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435687, "uuid": "ef82c0df-031a-4977-aab2-c42f78c28f56", "value": "T14D54DF10B591FC71C45607B09835C6F82E7A7C719A958ABB33283B6F2D3039176A637D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435687, "uuid": "43aa24f9-766f-48d2-a03e-b06e061e8e57", "value": "61552f371d50dd7cc1d63f5028ea0b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435687, "uuid": "8903eb70-8f8a-44a7-bcc9-3b8cbf4bf8a9", "value": "3072:qqjV8Lpa5BF53dn3BRXY43rc8vx/5IIdS539B4r:36Lg5fn3fXY0rc8J/H8ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677435687, "uuid": "b0b84260-5cc1-4e96-8dca-f24729a260df", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677435687, "uuid": "4a63adf1-86c3-4d9f-8043-e8e00b19cf9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677435687, "uuid": "d7f5dbc3-31a7-4cc3-846b-17fe95786777", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0953c654-b5be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677406332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406332, "uuid": "c91dc6e3-76f0-4f3b-90cb-c58ecd7ff3fc", "comment": "Malware payload (Mirai)", "value": "553e3be15361e5d9d063afa0f12dd95b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406332, "uuid": "b11d6eed-1c98-452b-92a9-d4c068ec6e2c", "comment": "Malware payload (Mirai)", "value": "e9c642d06ea0a6cce27b122fe7177ef4dab3f4fb525e76596f4973e627c5b15f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406332, "uuid": "983c5922-eef9-4b74-8ce9-fe0cbe59e1dc", "comment": "Malware payload (Mirai)", "value": "095fb94528a50badf4b923300e401550f9febc6e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677406332, "uuid": "6f55b68f-8bfb-49f7-b3b0-d12b1ced83e8", "comment": "Malware payload (Mirai)", "value": "a38c03fa8c2a300ede0c99012f28449e7bacaa6c24b1d2b3d63a85997bc18f6efeaeba364ba1c78b69dccca5f6124e19", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406332, "uuid": "20856558-4bfb-4cb9-9b1d-f187470b6856", "value": "T186130707B98384FDC06CC274562BBA36C467757D0235B6BA77D0FA23E89AD301E2E945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406332, "uuid": "5b6bc8a4-81be-4dbc-a32a-2be5a62a76b2", "value": "768:b4U9FiNjEB5NXpx19OlqxHgSWpi23UnyPo8BY/Bo8G9rC7CR:lojEB5Bpx19OsxH2iRD/ql+7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677406332, "uuid": "d3347fbb-ba0b-4286-9268-a63ca14d02ae", "value": 42784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677406332, "uuid": "f101408b-6036-4c7f-8708-fa6013a982e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677406332, "uuid": "da263133-fca1-4c22-ae53-f621bff2484f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a193793d-b5a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1677394132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394132, "uuid": "8f11f5cf-b180-4356-806a-b1ceed019ddf", "comment": "Malware payload (PrivateLoader)", "value": "a24f51890d3aebfa72b8170cd57ddbc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394132, "uuid": "8196a098-ccce-4bde-8960-40fbeefe3cd7", "comment": "Malware payload (PrivateLoader)", "value": "eaa834cea1c9ab48aed587744f5e7ce33639e8c4d194704ffa4fb6a2889e5e3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394132, "uuid": "02119f8e-b169-4c73-87f4-317f5383c715", "comment": "Malware payload (PrivateLoader)", "value": "d488be2e13569054c74f31bb597841ff01e44c2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677394132, "uuid": "95802de3-d8e7-4a05-89ce-39d5cc009611", "comment": "Malware payload (PrivateLoader)", "value": "21ab2502baf5dd230da7110486fa6c39b9ad2458f47e2aacf9af230685d09f89e91166734de0f078357d462ced23bc60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394132, "uuid": "e2c15a61-540c-4406-b531-5dd9fc76125e", "value": "T1B8753B22E350F469FCA240AAF27B09FB59241A30738514FBF7C29E916B926D2F535D13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394132, "uuid": "783b38e2-126c-4fea-98a5-d7dec8645ee7", "value": "49152:kHEP1Ytp7MnOYoH7NzvsfZHXlIZELxmuY88jIvnPy:GEPuBSONzvsfZ3eCxmQ8c6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677394132, "uuid": "fe4110b1-e12e-44f6-a8ef-8bbe2cd61895", "value": 1582482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677394132, "uuid": "dfcc0245-3967-4026-a7ad-75b6446da917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677394132, "uuid": "096d0c0a-7682-407b-8214-9f9097ea6d38", "value": "a24f51890d3aebfa72b8170cd57ddbc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f22385-b604-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677436532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436532, "uuid": "63564e19-2034-43b6-8aef-6f56b70189c5", "comment": "Malware payload (RedLineStealer)", "value": "7b6d15f2678a4725f66b577bb0d1a924", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436532, "uuid": "e8d3c1fa-a58e-43f3-bf50-b3d1182b4f4b", "comment": "Malware payload (RedLineStealer)", "value": "ed2c1471e9f953a6c4b898bdb7b8ad7272c0e1f57c0238766a3d76e69278693e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436532, "uuid": "09eef0e7-1c2b-4cce-8962-cba1d2dafa0b", "comment": "Malware payload (RedLineStealer)", "value": "a1a84af523cb6dcd077108c3a6828df0c11be91e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436532, "uuid": "a3b06072-3e5c-4cc7-95ec-1348b59686c2", "comment": "Malware payload (RedLineStealer)", "value": "98d06cae26aab16446aaf680650a835327330fc4732935faa4c5f12b206b6e55da2e5d74c902cc2b7afa0a3a2baf0157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436532, "uuid": "9a04e81e-d756-43ff-ba86-6c54c5678b84", "value": "T163A40207E6FC4022E96617704DF603C30A3A7C615E7853AB238A6C6A1C736B5B63177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436532, "uuid": "27bccf1d-6da6-48f8-97c0-93a4caa834c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436532, "uuid": "7f18d7d0-1a14-47e5-a9d3-1b8bdcfeff7f", "value": "12288:HMrly90dBBHfL6GAggHmDz8K14OP/7WVrBU:qyIBHzFcgzZF/7WJBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677436532, "uuid": "4f4a033e-8cd9-4895-b19d-17bea3becd01", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677436532, "uuid": "db194667-c91d-43f0-b502-1c61de064311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436532, "uuid": "dae3daae-a438-4570-ac22-83a12cefcef6", "value": "7b6d15f2678a4725f66b577bb0d1a924.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85c4848-b590-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677386842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677386842, "uuid": "855706ac-e38d-4c53-9957-a20b5684655d", "comment": "Malware payload (Mirai)", "value": "266526078e1e14a5f2c6e78aa4a1a420", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677386842, "uuid": "1dd530e7-ae2f-4e92-8699-7b0f888e6d86", "comment": "Malware payload (Mirai)", "value": "ed4260d4d6a9dcd18d108078989bbdf4560a54535983ced6547e157ccc765a3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677386842, "uuid": "47edf1ed-e426-40c4-8c7f-d84c9f41f5c6", "comment": "Malware payload (Mirai)", "value": "c99672c9bdaf2756fbacfea75d0e48b3c7d8d496", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677386842, "uuid": "d1e7d380-222f-4db0-9c93-4d5ee09d7df6", "comment": "Malware payload (Mirai)", "value": "790337340ffbfeec60d4339314da6f3395d0d74ecbd8f5417d1358ed5b3dcfb600840767e1cc1731e603eff7f06cbfa4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677386842, "uuid": "fbf8c7da-9d61-40fd-b643-8e235d664fa4", "value": "T1A6632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677386842, "uuid": "eeaae889-db7e-48b7-befc-cc066d569855", "value": "1536:mN6lxMmiioB1k5WO//kWYzKAioUbgo8DNRu9AvHW6:mNbODkReAioUb3ihHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677386842, "uuid": "245fbc46-298e-4139-b2ee-bc63f83b52dc", "value": 66912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677386842, "uuid": "2b4c433f-6cb8-4e22-b869-d96bd50a7ff4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677386842, "uuid": "2df50307-d1fb-4f8c-98c0-da3641293e57", "value": "266526078e1e14a5f2c6e78aa4a1a420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab1b0b9-b57d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677378417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378417, "uuid": "567efb4c-5112-4528-9770-39970c35cc7b", "comment": "Malware payload (Mirai)", "value": "8cc66795532d6dafe6df1b17845e45c9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378417, "uuid": "73bf7ee9-570f-4673-acf7-42b87a20e7f6", "comment": "Malware payload (Mirai)", "value": "ed442349400083b0fb417f0a82fd38a0c1eee2550a14c0771de38e1a053491c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378417, "uuid": "7543153c-af0d-402f-a499-283500e72842", "comment": "Malware payload (Mirai)", "value": "a077441a664d5c2cb50ef0313e3660971500c62f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677378417, "uuid": "d26c28c4-d761-48b6-ba2d-9646f7ef872c", "comment": "Malware payload (Mirai)", "value": "83bb7d503e22e8642d30c624b376f7c09ce15835c822f5ac677269711190d4e76c0fab2dffb2e52f4964cfabf8449a37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378417, "uuid": "0d61f5c0-275e-488f-84d7-60c742ff08f8", "value": "T1ED734CCDF683D4F5EC0609702076BF778BB6E2BD2225E647C7B86A319C42203D516A9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378417, "uuid": "4050f870-8924-413d-baf3-cf3148d1cea8", "value": "1536:/v2XrCtncZezX/Dp8CTNoM/ip1VQLihyuGTfhPQhZrFCj:n2XrCtnc8PD+q+M/izOLGGzdIzCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677378417, "uuid": "d5d68e79-c329-4daf-9d1c-2f5c8d9bf4d0", "value": 74832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677378417, "uuid": "d5dcc056-1528-4230-a151-d527f672d2b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677378417, "uuid": "f63cda60-7265-459b-9f7b-7e4f0ff23bd0", "value": "tamkjll.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debed2e5-b5e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677423870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423870, "uuid": "a61a5e46-c020-44ac-b581-d33c8d344f5a", "comment": "Malware payload (Mirai)", "value": "0be5c27b4d57d7a4cdd5b1c8c02060f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423870, "uuid": "049466b2-ae2c-4693-81b8-144ef5133e18", "comment": "Malware payload (Mirai)", "value": "f0fefbfa07e17f4c0806d9a29bcd461da38732f1d8e66a4ce14b0902684f099f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423870, "uuid": "f3db14b5-08db-48fb-9a7c-51381d67d042", "comment": "Malware payload (Mirai)", "value": "eb720839767304434d2a13d9fa6b3d68d3c818ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677423870, "uuid": "7f8453fc-df3c-4115-8315-8b6dec910554", "comment": "Malware payload (Mirai)", "value": "831ab46d40d0fa2c7edab2ec4a6a44da2ed77c6b712b6bb48098ff7e3304c5a5c86cbca2f2cb9ff141b7396fd85ac536", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423870, "uuid": "6ce8281a-fb8b-4d22-892a-3b57fe289a20", "value": "T1B403F2B0DB5943A3E3AC933299FDBA4E1570D76F50E592F9ACD050334812F393A192D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423870, "uuid": "1755c42a-d10f-4a74-b12a-5e9baca4074b", "value": "768:1vaSAUVbEwPFx0UU/fhzIyURkVYJM+kRsImPyUunbcuyD7UHQRjI:BaSAUVbfPH45zIXRyYP0bmJunouy8HyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677423870, "uuid": "907f523a-517d-48b7-9197-cbbbb4f952fb", "value": 38192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677423870, "uuid": "1adb6f51-5152-4fed-a74b-014413b2960f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677423870, "uuid": "2ac5e55b-1b72-48c3-b54d-028729d5994c", "value": "0be5c27b4d57d7a4cdd5b1c8c02060f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d55b50-b5f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677429218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429218, "uuid": "23d2dd3f-a420-464f-b47f-60a0f0448d9d", "comment": "Malware payload (Mirai)", "value": "548aa1bf0d088199cb31c89d232e061d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429218, "uuid": "31e5fee9-bbd6-49d6-91c3-ebe2d2aa3080", "comment": "Malware payload (Mirai)", "value": "f29f8ec633fe16283dfeffa24767843e821e5aa2cccc10843059350af96d4bcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429218, "uuid": "14e9459c-6d81-45a5-a546-3ee47a702e00", "comment": "Malware payload (Mirai)", "value": "36f77ffc4bca8e9dbc8e378d38572187117fa59a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677429218, "uuid": "ca3df8ae-591a-48bf-be94-e9f09008b104", "comment": "Malware payload (Mirai)", "value": "c6413d40122a899f7d1aee7560338634e5759fed02c654f716915f396b2e5019ed9d5272dc2a67a04301c062bf3b76ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429218, "uuid": "7cf57323-a4d1-48ff-86e2-78d5eae87cfb", "value": "T1BC336C36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429218, "uuid": "7c44bf66-3817-4a9a-8c48-04f0800390ac", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677429218, "uuid": "26c2ebc8-ff1a-4502-bdc8-f82e29c779ea", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677429218, "uuid": "96477edf-173b-4111-b010-2ae259cad368", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677429218, "uuid": "3ebe1d5f-7a45-46bd-99ca-b26471de8ab3", "value": "548aa1bf0d088199cb31c89d232e061d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a1bf19-b5ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1677427238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677427238, "uuid": "8a733b52-0390-4e0e-86ad-8e08fd71704f", "comment": "Malware payload (njrat)", "value": "b0ad225d4abb5c072c6e852759a2e004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677427238, "uuid": "9496c7af-5c47-4369-982a-a72274098f88", "comment": "Malware payload (njrat)", "value": "f471bd3372dafe383426fd565370558b9ee084683d26a21bc37b388f1149d24f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677427238, "uuid": "fb1ee1b2-ff84-4add-b7c9-ce555552c1b0", "comment": "Malware payload (njrat)", "value": "8b98504ed86705039f8d683c63c594ae0c4c8fdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677427238, "uuid": "e3561dda-92e3-40cd-9fd3-4e6d9112f5a2", "comment": "Malware payload (njrat)", "value": "0c6dab74912e7540b7d366ab0a365c54dc598a3395f02623fb667db6ba54f0ea0413915f2b33231d65dbcfedf46ba8f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677427238, "uuid": "4c7661ce-7195-4dfa-9477-7f3cd3630300", "value": "T14AD4F162BCC0D430E423087185AAB6B1E57EB92517371583FBC11F6E6A719F2E726683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677427238, "uuid": "7337013f-daa9-4396-8f98-2a9e0d2c9fe9", "value": "3eaa732d4dae53340f9646bdd85dac41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677427238, "uuid": "a1df833b-7d43-4c1c-a08b-429d1458086a", "value": "12288:hTaykrAZrZnDyfL1ClzvYdyvgcWKBBzfJ+IJ+mLpqD2Ps6PAM:8yDTIClzvYEYcX1+S+4GUaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677427238, "uuid": "d32ce624-e462-408f-9558-cf1b9bbcb268", "value": 611413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677427238, "uuid": "602478f8-667b-40b9-8115-3305327ba57b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677427238, "uuid": "28f3b626-b0d5-40ff-bfcf-f10a42ed00dd", "value": "b0ad225d4abb5c072c6e852759a2e004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cea4aa8-b5ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677426605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426605, "uuid": "fd3a62a6-6f72-40d4-b424-e2dcf1b641f1", "comment": "Malware payload (Mirai)", "value": "6e6b6b4c2a8a556722d61e62c4f31b4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426605, "uuid": "d30d406a-9ac2-471d-b690-83787370f627", "comment": "Malware payload (Mirai)", "value": "f610e1b9500d6c658e1dc12d943e69ce9a1ab7594ded8a89ee38f0ad20734289", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426605, "uuid": "30275b83-166b-4820-977f-fdde09a87e53", "comment": "Malware payload (Mirai)", "value": "ff8119662ed4c1c42a1ac95d8ddd8d48a6c5007c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677426605, "uuid": "e5a55ee2-4ce6-4dfd-96ff-85ee32727566", "comment": "Malware payload (Mirai)", "value": "e9a57a59d598f83e84d31ae8328c6788a6c43f714b7cf39a67d4f7833e57ca3a58c42f58ed7073377eab83083be9e866", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677426605, "uuid": "a1b2bfa8-1f1c-4cd8-811f-60705ef2ec8f", "value": "T1EFB2D025624C85FBCD46A1B1F17E0CEF887179E0C74A4AC31A4CA49982C336EED7F984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677426605, "uuid": "b1a11d5d-9b73-47b9-b095-7aa547e7d773", "value": "384:MV4jGDI8kZrvKfKLJvplUe2hXsqeVv90RepkcFnhtRALLv1RX8:UD0VSIvpO8qeL86kqnh4nX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677426605, "uuid": "446ba87f-71f3-4875-b349-7ecc4332797a", "value": 24400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677426605, "uuid": "6a05799b-03d4-46ba-8a51-9be8de018e43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677426605, "uuid": "c4a1e675-f9c0-4689-876e-1cde144e304d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76021fc0-b5ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677398354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398354, "uuid": "a07e2a5b-922d-4787-b7ec-70d40b5a6e42", "comment": "Malware payload (Mirai)", "value": "b992b20a95e36d7eada84acfdda3339c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398354, "uuid": "c037c652-fb11-4e25-8aa9-03dcd22b8a5e", "comment": "Malware payload (Mirai)", "value": "f6e0a9f8b8a5db37431e72403bee31e83983623304cff447661f55b407f271cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398354, "uuid": "d2dd24bc-9d69-4d45-97df-a2e24c95a27f", "comment": "Malware payload (Mirai)", "value": "675faec8c675b8316d352727a4c33893701ecd1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677398354, "uuid": "4348f523-1e2c-4ca7-a8ce-b5347e27a672", "comment": "Malware payload (Mirai)", "value": "c9b0baa56ea4cd10add156f68a67c61bb1139aaf106e3cfaf99c33a1ff525f20dc8159627b129970585891446689541d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398354, "uuid": "7be98483-9981-468a-916b-d95855375aeb", "value": "T1D8436C42721C0A47E5661EF1293F17E083BFEA9032F4B689694FDB568275E331186F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398354, "uuid": "adcdd406-4e36-46e7-a5ed-f62477341ef6", "value": "768:xNQhz93KOHGGRNdshrwFg/A5bHG05Nier7B0ZiJAqNbsc8SCKHF+ovcVdHYu:xuh3thqUYMaA97S6RNn/HEovcVdHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677398354, "uuid": "ac312be4-ebf4-4235-a982-4ebc82f68487", "value": 58488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677398354, "uuid": "e18d3758-42c7-48e1-9643-09d4a22c916c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677398354, "uuid": "fcfa5c22-70a6-410e-9275-3d017e1cc37d", "value": "b992b20a95e36d7eada84acfdda3339c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993934b7-b607-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677437927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437927, "uuid": "9ad8a12f-d7c1-4bea-ba48-ecce285eeae9", "comment": "Malware payload", "value": "97151dc7aadd8cebf0d7a697c7dc9e77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437927, "uuid": "cb25076e-8a3a-4679-9bb8-f1b1068e75dd", "comment": "Malware payload", "value": "f7181821d46759695ab9deac1467b8640185da88451bcfef5d07b608fca83eaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437927, "uuid": "7a0bb74a-4243-4ef7-b2d9-981b6cd1132f", "comment": "Malware payload", "value": "cbea68bbb959cba546f1ea851964361c432652e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677437927, "uuid": "ca5a2ad9-1b4c-4e92-97fc-7dd60532c347", "comment": "Malware payload", "value": "e9113531bbb9373ff7290fdd7c00ddef2d92d0f3164cd3a6dae53a92f17087d8896e97db5c669b8d42421e5772096407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437927, "uuid": "ed8a514d-a8fd-4438-a1bf-c1df60f68085", "value": "T16E957B47BCD060B6D9A9A23289B592D07731BC490B3163D33B05B7BE2E3A7D45E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437927, "uuid": "1135d7e6-31ea-4338-9a5e-f1e5e083964c", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437927, "uuid": "6902eade-c6b2-412b-afec-b7ebe818f287", "value": "24576:5ZsMeou6iExs3IiMgHxdhiY69xQxD1Jg6fpaCHhVcOzO5s60AacI:PfeouvEuAgHxjpxD1Jg6cCB6OzO5s9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677437927, "uuid": "a8dd3b4d-2359-4795-b257-584456543ae9", "value": 1953280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677437927, "uuid": "fadf970f-c021-4071-b92d-08b7b940df9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677437927, "uuid": "90ebd7f7-60a5-41e1-be7a-6e2d70364c9b", "value": "97151dc7aadd8cebf0d7a697c7dc9e77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c599fed-b591-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677387010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387010, "uuid": "6e86cd24-0f5a-4f1e-b7d0-d5115ef815ef", "comment": "Malware payload (Mirai)", "value": "222e0759b77842b536dad7a3f8a50e36", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387010, "uuid": "e1fc1152-38d9-445d-88c0-9a8f2402a308", "comment": "Malware payload (Mirai)", "value": "f90997e6ed5e529400c2bce425e5c70f242dd333a712bd195b2b88f741bfcc70", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387010, "uuid": "a9deca76-7081-49b2-975c-ec2ca1b8217b", "comment": "Malware payload (Mirai)", "value": "59f68cf9804f6ea5e74010c032199a3bdfe62230", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677387010, "uuid": "e05e9ba6-5662-4844-a272-fa853959f454", "comment": "Malware payload (Mirai)", "value": "66adc4bfb13ef7a4fb81b111ef88ebb4fbee196c5aaee0c93c0c3eab324c5f85cc08f021a967db2c566fdcc9ec0f3ef0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387010, "uuid": "a1a1bd21-bc2d-43e5-86bb-5803c92e6b83", "value": "T1AEC2D070A3AD2CB1C6100532E7F85AC5BA130FBDE6EE3890214057BA3D41D156AD99C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387010, "uuid": "690c0d98-7e12-404a-b812-c2addd20dfde", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEjzvzchymdGUop5h2:A8soTAZ3alkXLvFh8nNEPvzcs3UozM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677387010, "uuid": "8fd0294b-e98a-432b-abf6-6379a661ac09", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677387010, "uuid": "20100892-4d62-4585-8f46-8817d9826575", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677387010, "uuid": "011be0a5-21ab-434a-bdd8-530c5ea884a2", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f31ce32-b5f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677430206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430206, "uuid": "09d753ee-4966-4611-85e5-e90b6b4992fc", "comment": "Malware payload (Mirai)", "value": "71e129fdae75b819abd07fe2c6aa53c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430206, "uuid": "b8180d33-2e0e-485c-b9ea-e1ce33d02c95", "comment": "Malware payload (Mirai)", "value": "fa2e688bdcd916636afa5d8752df8bd9433c0d60f731bbfeb3cd71d51fd7165e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430206, "uuid": "de7a8475-ce3f-4695-8b12-66e3d0b17eac", "comment": "Malware payload (Mirai)", "value": "fb417b6a83b8cb735a118eb2ac5323cca37f9881", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677430206, "uuid": "76480737-e2d1-4768-9e94-d52f4f40f3f3", "comment": "Malware payload (Mirai)", "value": "5f5871c7e9e1afe8db83066d525a9de74f8ace94430069b1191c56f4014186e494395495102e1da2dbfd275545cda08b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430206, "uuid": "c93ab112-3b79-4126-ba81-3c475ae49305", "value": "T1C4333AC4958BE8F5ED150535707BAB338B76E43F1119EA8BD39CA933EC92A51D10728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430206, "uuid": "e984ae60-de89-4611-95a7-5794e81bf3b7", "value": "768:zNDthOoSinleu9qxwdKW/xgMp/STclyYh2uLvHQoNHy7cCmWgWvrx:5DthOoSinleuYqt/BSKyoMyHa5DgWvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677430206, "uuid": "a7e14f64-3bf2-4153-a38f-5a122d4e9e60", "value": 54492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677430206, "uuid": "f944cf8e-eab0-49c9-9b11-5db9102e0494", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677430206, "uuid": "673ee86c-4721-4c27-b6c7-a63061e36e1f", "value": "jklx86-20230226-1650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb733a10-b582-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677380861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380861, "uuid": "c8b8fd69-d10a-4ecc-ae94-4714da7dc497", "comment": "Malware payload (Mirai)", "value": "de0935f06f8268dd009cf85635035e9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380861, "uuid": "5a851e5c-5e38-4e75-afbe-b819ac732dc5", "comment": "Malware payload (Mirai)", "value": "fa2f537724af840e54cd55a795091345e3e80e03df7cbcae728f4c2826052e11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380861, "uuid": "8330bdbd-4817-43ff-90d0-62eba677e802", "comment": "Malware payload (Mirai)", "value": "45c282ba46436bd04c3dbba880228e681ab7477e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677380861, "uuid": "16294347-9afd-4942-b378-37ac75b6e0a3", "comment": "Malware payload (Mirai)", "value": "087566c72817ca2a179a3d8ddb9a30574a5a98a92efc970837f15b646e8f43d7d1bb011d5f2d6506ef009048def813ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380861, "uuid": "a4724f59-c01e-45e7-81f5-cc816e4287e9", "value": "T1DD13F16AC2E44EC6D2B3A5F40845E5D72BD45F9EB5A2CEF717C3BB92280807243099C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380861, "uuid": "21723248-ee0b-4b50-937f-65c2c6e2542e", "value": "768:IxVfdipo01MQSOoknnGYZFRY2cKjO9tX87U+h32BAZZRpB54ah3rjY4uVcqgw09c:IbffOMQEgGYrY2u967MwXeapk4u+qgwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677380861, "uuid": "83e732f6-1610-401f-87e4-7c8c89d120cb", "value": 43164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677380861, "uuid": "f4ea8675-13c4-4e7b-9cb2-6921472b8b0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677380861, "uuid": "9658bcbf-8893-4db4-a4d5-24c8a173f7da", "value": "de0935f06f8268dd009cf85635035e9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987cbdfb-b616-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677444368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677444368, "uuid": "28c98009-2fe4-4143-a76c-6cfe32a21c6a", "comment": "Malware payload", "value": "5e318bab9226195bcc85cfb1c15a1420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677444368, "uuid": "c02d30e9-c67e-4cd5-904d-d7fbbbf40106", "comment": "Malware payload", "value": "fb458da1b9dd47b713d2014fe052ed801c4c84a37f3c3daa0e9cf30ffbbb3e94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677444368, "uuid": "12d24cce-043f-43dd-a711-0a40cc4779f4", "comment": "Malware payload", "value": "fe9f9daa745893a74635af98cf9eb09b0f810e00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677444368, "uuid": "3641fb4e-2e7f-45de-93fc-60078791769d", "comment": "Malware payload", "value": "6d7aa3fa1a889ffe48c08ebd4b46c4ba0be4ad6de2f73e3c2bc701d0c5a547fee17daa5b844440b02abc7debb342ee83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677444368, "uuid": "eb0bec7d-421c-4376-9fd7-717493199879", "value": "T18C55BCEF7F7A95CAF228943387CCCC6047622CB3A9E4704761987AC90A34AC954BFD55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677444368, "uuid": "72f18482-212f-4c0f-9cce-15f4173c95dc", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677444368, "uuid": "1d617655-b6dc-429b-8dcc-939d77257af1", "value": "12288:Kk0axBz2lfj/hv0oglzecbH7UYURvJKwZsDqm5JU68QDnZGtFA05qfc4ljtUODvR:Kk0yBzWVGKcb6ZMqHuDktFAZk4hmss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677444368, "uuid": "d6d67753-c08e-4793-aa12-1ecd51488829", "value": 1322940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677444368, "uuid": "97ff916b-a3ff-4a7b-8f9f-d17802e90a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677444368, "uuid": "59c77a6b-6aaf-458c-b4b6-28a4971fb3e9", "value": "Sunlight_Checker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f9397a-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372398, "uuid": "0fb4cdf8-ebb2-4630-9929-90deddd2a908", "comment": "Malware payload (Mirai)", "value": "de7da6eb235f7b0d8235ce9f1c96ece0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372398, "uuid": "1ad57deb-ec62-4bdf-9440-9ea1d307b2b1", "comment": "Malware payload (Mirai)", "value": "fd85106c3284d56092cf8b095ac469e96bab370b2bf2c56a71a7b3d463b49079", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372398, "uuid": "738f0123-c3ca-40aa-9740-daff3ee1160e", "comment": "Malware payload (Mirai)", "value": "48b1513160d0e19f9ceea4cbd5d5ae04940dca1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372398, "uuid": "f3c67414-fa04-4737-a232-9ed6f742e7c3", "comment": "Malware payload (Mirai)", "value": "100f90f3d1a2e4db776da3a83938af89865de6b11c6943380bc34c589165fca1af23045ce6ca29425f32dffb04bfcf00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372398, "uuid": "25b52e75-06f8-43ce-8c17-b7b2e5b0ea20", "value": "T15B438D37E96E1E74C08641B074748EB56F23B5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372398, "uuid": "16d35ec5-fb27-4cfd-91ac-8bcc9a40b86b", "value": "1536:Vaa0brW/Od9hlCR3KEbKYXwKEpPDCMC2+Ws:Vv0brWGd9X5EeYypPDL+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372398, "uuid": "42604ee9-fb76-4922-83b8-28d2f9a5cbb9", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372398, "uuid": "4a83e402-be7b-4aa4-80c0-476425478181", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372398, "uuid": "ce5c9dd9-e4e7-4888-8825-064d7f910bb5", "value": "de7da6eb235f7b0d8235ce9f1c96ece0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7585076-b603-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677436232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436232, "uuid": "1c802159-2f49-4428-9bc3-dbd77c7466a1", "comment": "Malware payload (RedLineStealer)", "value": "9268c1bf3e3a6b0909ce12b1093501a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436232, "uuid": "0f31ee0f-a551-4b3c-8d97-8c52fe9ba447", "comment": "Malware payload (RedLineStealer)", "value": "fecc43069ba9b98d01330cbe0196e0d0dc8d0cdafca4f05b59164d9fd0a79410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436232, "uuid": "f15b6608-5013-4ab1-bcf0-2503eeed5312", "comment": "Malware payload (RedLineStealer)", "value": "793a3d69a741bf2343a12b591e16f94517412e4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677436232, "uuid": "9e2ac567-200a-4020-a3d4-936fafa0a8cf", "comment": "Malware payload (RedLineStealer)", "value": "84979fb0752e668bb67a0fb55de7c0c9ba22998d7c2b6d11eb5b2d6056fb76ad34d7121a307a22f82d7fd7a824b9077c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436232, "uuid": "b9d8be75-f780-40f1-ad34-67f01c838867", "value": "T1E5A40207E6FC4122E96517704DFA07C30A3ABC615E7843AB638A6C5A1C736B5B63173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436232, "uuid": "bf1fa546-9e26-4612-8b01-988b38157827", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436232, "uuid": "fcce45b8-1323-4c68-8244-d6dc6a0cd2d1", "value": "12288:pMrpy90oBBHfL6GAggHmDz8K14OP/7WVrBqk:4yNBHzFcgzZF/7WJBqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677436232, "uuid": "bc804692-826f-4268-b5d6-ac711b857418", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677436232, "uuid": "98225fc2-77b3-4843-9ba2-2f7ee4a7d437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677436232, "uuid": "d81e55eb-8a04-4388-84f6-2bd7f85104ed", "value": "9268c1bf3e3a6b0909ce12b1093501a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86675345-b56f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677372611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "dd657c24-23b8-439a-acae-40113b80a112", "comment": "Malware payload (Mirai)", "value": "7ec37fc165f657ffa2c48be1fdfc5b10", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "417bde42-cdfc-4cfb-a775-86a70e4c7adc", "comment": "Malware payload (Mirai)", "value": "ffff114c2f6093ff7156dad2559948f4bed1fa1cd9199d2cc51af72a029daacb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "266febee-edb9-43fd-b502-09581877daea", "comment": "Malware payload (Mirai)", "value": "fb90b08733a74324903a77c64c794ef3219fd535", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677372611, "uuid": "b1622d24-4f40-45a4-ae69-9e3dc4ded5ab", "comment": "Malware payload (Mirai)", "value": "15288689e507c1a32c55153cdf206a278785e3c7c9a264eb75d557bb5f58bd1836c974af4b935886e07f416b0e78b07b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "1bd3f889-bddc-460a-bd1a-596a1d886974", "value": "T16A431995B8818A17C6E022BBFB2E419D332223ECD1DF7207DD216F15778A91F0EA7654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "ce225d44-d121-4e9d-a519-b744428e5807", "value": "1536:R909akWiRZWWKmkiZScOmRdPwt55B6Q8sF+YdhFdHg:49akXkjF4Ib6sFV5dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677372611, "uuid": "301a9cac-c667-4d80-9a96-23cd79d0aa8c", "value": 60056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677372611, "uuid": "e55a0c5f-164e-4322-9a49-761564beaf18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677372611, "uuid": "df774a54-47e3-416c-86e9-d4760c579625", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }