{ "Event": { "published": true, "date": "2026-02-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-12", "timestamp": 1770940981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "938463c0-f115-4ef2-8b14-0dc8ee373ea1", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96614d55-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (DDoSAgent)", "timestamp": 1770877942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877942, "uuid": "a4d13e72-f829-4af2-95a3-18b4cd631d04", "comment": "Malware payload (DDoSAgent)", "value": "ce71b5139198000c53378fa16e7d2a18", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877942, "uuid": "e0cf0dbf-8198-4aea-9960-8457708583cf", "comment": "Malware payload (DDoSAgent)", "value": "0015c29f66488f8d4c814bdf98da00e72131b089bb24492fb077a3bf239c2bf7", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877942, "uuid": "644b5c0d-be40-4334-9cbd-47b6f725b0d7", "comment": "Malware payload (DDoSAgent)", "value": "fea44514f9d26696488215ab888c5d528d02e5ae", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877942, "uuid": "564ff5bf-4bc9-4c73-9642-6ea7dc4fe487", "comment": "Malware payload (DDoSAgent)", "value": "4fd772159892c75cb2c8408590a6add7e9b57d80fd184e00d63fcbb1928b259bddbb3032b415498b708bb61c6734fb99", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877942, "uuid": "0d9936ea-3384-4650-9c60-5aa21ba044e4", "value": "T1D7F3F956BD428F12C2C726FABB9E424D37176B78D3FA3103DD246F51278A89A0E36251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877942, "uuid": "8c236c28-bd62-45f3-80f2-3923d22db111", "value": "3072:erfkLJSB9nZtA2GYH13YjS7Msxmz2wsVcsIXr0CSn:eQlQ9nZa63YjS7Msxu2wvnXYCSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877942, "uuid": "4877bf6b-8bb7-40c5-82ac-b427efab08c9", "value": 166260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877942, "uuid": "4bdfc65f-050a-48e6-900d-0860fd12179f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877942, "uuid": "05001e4c-5774-43b9-be2d-3defacb373da", "value": "furry.arm4xc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7452fd-07c7-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770868934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770868934, "uuid": "368593d6-7290-48d6-a1dc-f949fccecf4b", "comment": "Malware payload (Gh0stRAT)", "value": "edc2659fa344a270e8cd6cfee9782e49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770868934, "uuid": "3b7bca8e-6a1d-41ec-8691-f876830d886e", "comment": "Malware payload (Gh0stRAT)", "value": "003734348d05ac8087c497c214bd871355b168e41c9ee8d5aa5fcfcdbe6c8a89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770868934, "uuid": "28062a1f-7148-4f25-bda6-b4d3bd75b655", "comment": "Malware payload (Gh0stRAT)", "value": "6e9016472c82fb65ce9bd2162557ec3aff529df5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770868934, "uuid": "2fe93271-d68d-4564-8248-355c5d6f123f", "comment": "Malware payload (Gh0stRAT)", "value": "9f8f08c5ec548df2d1d0d19585e2bd95265f83a16f9b2fc6f935f1e1969ef43041123bff0f3f46cc2df1b14443eb03f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770868934, "uuid": "53d0db45-0223-4f4a-a76d-041686da18e4", "value": "T1B6283303F38180B4C5EB50709680A2E79D7A6C7EB7ECAAC367E2AF443C644E51B7651D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770868934, "uuid": "6416f0b8-811d-4f4b-8dbc-8727400053b8", "value": "1ff847646487d56f85778df99ff3728a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770868934, "uuid": "de19ae71-1618-49bc-ad39-2330c961a1dc", "value": "1572864:dqETJ2OakNMbbQZ0A3BmGO6Uh9+6OA4cQI2DXU5efni95OZioBFhdvMGgjfE33p3:1TJSkIQH8g6OXc56acnqwZ/PnLpAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770868934, "uuid": "0a5e6700-9e41-436a-b386-1b1a78871e33", "value": 96709174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770868934, "uuid": "f57cec19-1eb2-4e40-b4cb-6a8fc4a29823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770868934, "uuid": "cf406880-9923-4491-ac96-0148814932a1", "value": "88888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb2098f-080d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770898761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898761, "uuid": "0eea8b74-7bec-4ebb-90e6-019b2d427f8e", "comment": "Malware payload", "value": "30b68f73a3411c985faec3f737e8e43b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898761, "uuid": "e7ed8a4d-d0bc-4048-a379-7a615d2e7d50", "comment": "Malware payload", "value": "016b884942a1856158d140a7c4f0f1be43d0cdf980dd88783c4138fffe0be966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898761, "uuid": "f0f7370e-e7b1-42b2-9975-61cfdcc4274d", "comment": "Malware payload", "value": "7364222361320b581fbfd0216ee4d88980e077ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898761, "uuid": "1766d0fa-3fa9-404b-bd6e-c63167edecc5", "comment": "Malware payload", "value": "e4bdbf89a75b9e6a1243ab3c9b6b9fbf2df9eee7c66290859f5ec7c85e363c7c71629d3599a3079a7c61019b96800f11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898761, "uuid": "be2ddb67-e70c-43f6-af3b-b592c6b37cda", "value": "T130364903F6D181E9C06EC579839BA333EA32BC894534B65E5BD48F212E16F606F4E359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898761, "uuid": "3350ac73-1755-478b-8bbd-b87f310e67c8", "value": "b422de70c78da90f4ba99e69af4263e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898761, "uuid": "0d6eba1d-9536-47da-8c52-42a5e423a315", "value": "49152:4xo1P9RUMrncRBWx0OYbCqmsZxjnQqOO7Gy40U10uJyNmJ+x8i/vugeUvfUAZ+ZA:d1laMwO6gRfoj3UAZXVNmbgCr38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770898761, "uuid": "83754126-f39f-454c-8f73-b001c797b6ea", "value": 4866048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770898761, "uuid": "dd7de976-3ee8-41fb-9b8a-d007ac2de1b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898761, "uuid": "331383ac-88fd-4da7-b356-f124c8e86bfd", "value": "unknown_windows_pe_36.133.126.84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f38c7ce-07e6-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770882225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882225, "uuid": "250fadcc-77a0-4145-a337-487cf05725cf", "comment": "Malware payload (Mirai)", "value": "5fb3614f813e0b3624eecb822f53355f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882225, "uuid": "8deb7470-8874-4967-9ace-886d2800c964", "comment": "Malware payload (Mirai)", "value": "02bc826e5bd2812124e601f2377d1dd5ffb9cc10de7f678f0aa12532d340b327", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882225, "uuid": "fd7b27c5-bd40-473a-b646-99134b839b9c", "comment": "Malware payload (Mirai)", "value": "4abf6a204dce1aed19a3d96d70259a01fb96221e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882225, "uuid": "41f54b72-86b2-45bc-81fe-ff8e29ee6ee2", "comment": "Malware payload (Mirai)", "value": "6cde1b72a9707f49cc5abe0f64a07d9cb01dd124b94beecd808528fec075141fd8f50faebd2e3c67c57a605d55ec7b9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882225, "uuid": "dc4ef0a9-63a4-4b52-be54-f22f55f57cd6", "value": "T1CAB30899BC819B11D5D536BAFF0E518933138B78E3FA7113CE185F2A538A86B0B3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882225, "uuid": "7405d8e9-d172-4720-a78a-a440524b7922", "value": "3072:c9W/CIC7nu3PEuofs48AsS1yv+emq87aVXc3phW3akIeup74X:Our6hsS1yvm17aVXc3nW3akTup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770882225, "uuid": "51a54dcd-f2d1-426d-85e1-4b5fa6dfab1e", "value": 116256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770882225, "uuid": "168c9393-9d76-4c2f-8d43-388dd3f91e1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882225, "uuid": "6aeb7466-15e1-453a-8cc1-a30948eb93de", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e462c27f-084e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927035, "uuid": "3eb4d2be-7552-43b0-b065-531bab8bfc7d", "comment": "Malware payload (Mirai)", "value": "26966f7a7fa52e09ecb0b85118f57824", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927035, "uuid": "ab04b681-57db-4ac3-a199-165d99f24bcf", "comment": "Malware payload (Mirai)", "value": "041aa50362a938102f6bee44ed853d2acc12204103f83a2e311d43f1d197b8a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927035, "uuid": "6a379bc2-15b5-4381-a6e2-8d939c822c2e", "comment": "Malware payload (Mirai)", "value": "9cc3fdfa302a471429d83d178e9accd72883b688", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927035, "uuid": "ffb937b4-fde4-4cd4-ae94-64b73e52ea0e", "comment": "Malware payload (Mirai)", "value": "ec567b4466a2a4ac59edbafa4ebea78dc398bac616c66bd78d3ee4b932a1312b2d506a9fbae0e9fd6104ebab780ca8be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927035, "uuid": "7c2471fb-3003-4913-ae69-c73c93df5575", "value": "T1D1736B32B9751D27C4D4A87A61F30721F2F2479A25AC8A1E3DB10D4EBF35A5032537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927035, "uuid": "7ebfd0ac-dba7-4376-8d10-4bade0c5da87", "value": "1536:/kjnSCObFJmCGSJRNm60TQPtkYiNM5GTzgnsvt78/XI:s2c6jcuCzN8caI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927035, "uuid": "882106db-37af-45f5-8ff2-0cde91f01278", "value": 75720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927035, "uuid": "7ade04e7-ed69-48ad-a1db-165ba17476e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927035, "uuid": "d609290f-97a7-4ca4-be81-8ad8881397f0", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdaa913e-0848-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770924501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770924501, "uuid": "b59c9e27-e34a-4e00-b5fb-9f412cce3cbc", "comment": "Malware payload (Mirai)", "value": "9dc62628955b11bd31fde600f809d3b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770924501, "uuid": "5bcec7c5-cfc1-4ea3-89af-05b59e245bb3", "comment": "Malware payload (Mirai)", "value": "051deba820eb6da7240f8c1fe23b97910caa12abf38a1e2dd7059371e3240faf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770924501, "uuid": "1e38dc57-0051-40cb-b970-c6dfb4bd8178", "comment": "Malware payload (Mirai)", "value": "f0fcc3525e7f27df0485f6847adc207b546f1647", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770924501, "uuid": "02e8e71a-f2fd-48a0-8b8e-4cfbd16affb9", "comment": "Malware payload (Mirai)", "value": "894305d6a7aefff1cd232075d8e6bf88de2084f021674151abb41557e367037cc8e5f3c7959a51d03c663bdb2491de0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770924501, "uuid": "33127734-48b3-4760-b736-740209ea004f", "value": "T130D2E1AA99E0596BDD68257C45887B396DC8FBC0115E93CF2310A8C8F77E94B348F01C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770924501, "uuid": "910a0ae6-bec5-47c4-a9af-248996488010", "value": "768:rdbCtPh/9igL6GwJz7TzICs6WwhXQn3cw6J8WWBQN:rdbIvupzQ6pJWcwvQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770924501, "uuid": "efadd403-5c2b-4eff-a402-bd689615b592", "value": 30572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770924501, "uuid": "01cab570-7498-4636-bc49-dc2a8f3d180e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770924501, "uuid": "55660b00-d77d-4909-a2a8-e8ea317ff8af", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274e0c75-07d0-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770872601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872601, "uuid": "9e83a76c-bc93-4600-9584-b903c4e4edce", "comment": "Malware payload (Gafgyt)", "value": "484fd0b59115b33cdbf41b9e595a71a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872601, "uuid": "50705e98-01d3-4368-b4ab-db19bf2b92f0", "comment": "Malware payload (Gafgyt)", "value": "05a9d291f5b177b6a20db163a02578144b771f8099c1e992a2e426d7454bda9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872601, "uuid": "e3e7e653-1bc1-4208-85fa-93b287e91b26", "comment": "Malware payload (Gafgyt)", "value": "72adb021b4b68e5c0b52c0e5e78990470f207f42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872601, "uuid": "958f67b2-c154-4e5d-a2f9-b41f6b1d934e", "comment": "Malware payload (Gafgyt)", "value": "12d5d84491241b3342f4e4cb7c9e672638dfcd87e90f4c7329e2169de1d243534a836f4371ad5ab1b7ec039b21c84459", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872601, "uuid": "0aa1c792-6d88-4325-90e1-a5923955ffc5", "value": "T16CB32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872601, "uuid": "3584f22f-762c-402e-ac9c-be006226c8d0", "value": "3072:b6an17WtsWhdgYJd0D6mbPbmTQOWsXAOn:Wan17WPJd0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770872601, "uuid": "aecd6559-936e-435c-8071-4d83a0d05038", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770872601, "uuid": "f0841572-e1ae-48f1-bc3b-e093d42c9931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872601, "uuid": "deb66fc6-109a-4a17-81ef-7e7adb780ffa", "value": "a-r.m-6.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7d478e-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877818, "uuid": "b439ebce-2a69-41cf-98de-72f7b704f14b", "comment": "Malware payload (Mirai)", "value": "50a77e1cde2ef9c6545be528b7ea500d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877818, "uuid": "a2d63e92-780e-4e87-8d3b-76a2657466cd", "comment": "Malware payload (Mirai)", "value": "07e5ddab4f8f4aa4c80c0e5aa275269e2394a91436d052e1f2e576d2297c9570", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877818, "uuid": "762abc44-a057-49b8-8289-131cf9a9a23e", "comment": "Malware payload (Mirai)", "value": "738346fbc8939dd2c17c763b7593da4e9eb4e9a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877818, "uuid": "c3a13dfb-8842-4ebf-930d-b481298c3b94", "comment": "Malware payload (Mirai)", "value": "7820c4fe3398e2fafd5cb3fab005d1f0a740ee1599fefca06baa383f272443921210d197e01acbb6faed3af528142e29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877818, "uuid": "57646a3e-5609-411c-b960-ee0e39900185", "value": "T10AE3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877818, "uuid": "3caa9c4c-1c26-44c8-8281-7402b2b02c58", "value": "3072:lxjJw1Cc/0s6YAPwenUr48pzfR+Jonay:lxlw1xAop0YfRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877818, "uuid": "130bbd1d-3dd7-43a9-8b26-37e1c8794783", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877818, "uuid": "fea397c1-6072-415f-ad7f-208661f64a66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877818, "uuid": "58d7fbbc-762c-43de-a77a-923e5f97d453", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbe40a0-0800-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770893334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770893334, "uuid": "d4bdbab8-0a2a-47ab-ad82-96cbb1c04410", "comment": "Malware payload (Formbook)", "value": "e44d6826e5994d8b4865891608a19dcf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770893334, "uuid": "48d6342e-1223-44fd-8f6c-8e00d61faf90", "comment": "Malware payload (Formbook)", "value": "08da77013d9edade53f14caecd449b40a9ab48233691e7f4672d577cf670f838", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770893334, "uuid": "5c0ddaf5-3c1f-41cb-bc26-abb172453e34", "comment": "Malware payload (Formbook)", "value": "b7f6dcdfb58694df347656535db5346e60b87fc7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770893334, "uuid": "0a30aa45-673b-4a9a-bcfb-0d4b63f01d5c", "comment": "Malware payload (Formbook)", "value": "94de4efc06ee4ef8f1651871b417940a6e08a7474cce1744976b6fa3db6b341e53735004018ea1a1a3fe1d130543c659", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770893334, "uuid": "ac1f644a-6337-410d-b636-cc182e305157", "value": "T10F42C07953E3AE57F903A738BAA1BD71D6925C31068C959740EEC702686069C276704C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770893334, "uuid": "3ffa99b4-82f9-469b-8988-60b25e4e918b", "value": "192:rbNDYavCzQIhKD9D9mejADPCgCd+rKa1fuZG0oywhX2DrOrbXBAHbQ+uzC9qrDWX:maassKB5KPTrKa1fuzol1qCAHb5uYqr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770893334, "uuid": "c0bd6d8c-1ed8-4ba7-a80d-203a869f9818", "value": 12160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770893334, "uuid": "794af971-5cf7-4686-aa20-a59430cac7cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770893334, "uuid": "48867287-3fba-4de2-be95-9c9fcf8726ad", "value": "Docusign3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6c6965-084f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927107, "uuid": "26b2404a-a89b-4462-8689-b125e9f19fdd", "comment": "Malware payload (Mirai)", "value": "5d9c4eab17d7987efd5a5328cf79140a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927107, "uuid": "c27fb08a-1925-489c-9afb-5733a57302da", "comment": "Malware payload (Mirai)", "value": "09055f614c3ce011ec49e2295235e16dd34cbb777e43f09a12abcabbb1fef242", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927107, "uuid": "17be6085-7647-41d6-8cfa-2f56d6b00efc", "comment": "Malware payload (Mirai)", "value": "6b85da5375b0df9995bd3e0bda4cda52cab65974", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927107, "uuid": "e324fd72-1fd0-421a-9a79-73c0c6508be7", "comment": "Malware payload (Mirai)", "value": "286d8d152e5637219f2ca0163947d7dcd6e3d60e38615df99d0dc05c1b76285ae83408c5aeebcda6a9951b3021f56361", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927107, "uuid": "5d3cfc4b-3bd7-410d-b0e8-d55f90ffeec9", "value": "T1E703F781B9924A6BC1E013BAAA7E618D332173A8D2CF7757DC255B047BCD81F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927107, "uuid": "aa87f0b7-bbe5-4d39-8429-c8670718dbc3", "value": "768:VOwgSuFzX54uRq3GfFVKKLUo2ThBpSXawNRI6MjDs/1bkU:VMXfRmGx2Th7T1s/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927107, "uuid": "42c60cec-ba59-4011-a95d-3ab2e518e832", "value": 38556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927107, "uuid": "be57d41c-f163-4669-bf24-114cbd9f388d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927107, "uuid": "c8c8d430-a4b2-476e-bc71-8d74abed8b29", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae9c704-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877815, "uuid": "b74df230-bef8-4253-929f-888c6383a615", "comment": "Malware payload (Mirai)", "value": "d3adcf8750b2996bb3fda63e7165eeb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877815, "uuid": "eb2ef06f-0936-4a2d-96df-3448e8cf537e", "comment": "Malware payload (Mirai)", "value": "096a6b15204ce9ced41f97e4dae2c6837a1907e8ccddfbe80e914de49f08bf9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877815, "uuid": "8de2cd7d-675f-474f-90de-70b09f3653ef", "comment": "Malware payload (Mirai)", "value": "a7614de6450a0161123200a474ff4256d84ac34b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877815, "uuid": "6a676cf1-3ebd-4a94-89dc-5698a87df6db", "comment": "Malware payload (Mirai)", "value": "6989c204cfeb2bc8c7e5d2cfc1f7734dd6b7c103acba113f3cad24fee792a9c2b0e4a0103e2cecc68bf8e330a79e6659", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877815, "uuid": "b2d8b284-3955-453e-880d-747c9cd6a9cc", "value": "T1CFC32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877815, "uuid": "f9e321a9-07f2-4444-ad9d-49bf12542689", "value": "1536:6RB72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3d2J:6TB4exMF7oZKJnCNYaMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877815, "uuid": "0be092bb-1bbf-4bbe-8d70-5bbcf85a5cb6", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877815, "uuid": "35359fe1-b5e0-4901-b547-671e04bd8c46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877815, "uuid": "df467456-a445-49fd-8e00-79d123e14155", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff93ae8-0819-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770904184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904184, "uuid": "c4526ccd-8703-40bd-afbc-322e3d44f03a", "comment": "Malware payload", "value": "a6900b7393dde662349644eeeabc40aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904184, "uuid": "8ee3e6d2-3777-43a4-81e4-d33e4350c277", "comment": "Malware payload", "value": "0a3bcd8feacf1d1775b5274d0ca1a8a3c7971c6edd33b6304da4dd32cd97bafc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904184, "uuid": "b6739039-ee8f-4674-9801-57be4234892b", "comment": "Malware payload", "value": "b42fe47b430c4ed7b962cbf73dc2885d5e4b063b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904184, "uuid": "8a8338aa-d6d8-41df-9ec3-cfdf32db66df", "comment": "Malware payload", "value": "04727968a78d4bbc96e0928fe2de35560914962bbe8ce80e1976c07084e11c536d2370301cffc99293476da2ab33512d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904184, "uuid": "8bda6220-8606-4b8f-8e87-c86bca71b472", "value": "T185A5F847E89550E8C0EED174C72AA213BEA13499073437D76FA197F11B26FE4AABC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904184, "uuid": "3c430db9-a9ce-47e6-a084-b6e6f793a49e", "value": "49152:wCe/ydXZSrb/TJvO90dL3BmAFd4A64nsfJvaWi9sglz/KbwLjFfiawr1ex:3eidO9suPFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770904184, "uuid": "24a4c99c-c040-41f6-af08-1a92bd3b49f1", "value": 2065524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770904184, "uuid": "8b0b1a63-275b-4102-b294-11d04ff25666", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904184, "uuid": "df94f1ca-23c3-4b8d-b5db-49678eff4294", "value": "kinsing", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a99efc0-07ae-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770858192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858192, "uuid": "0cf95f93-1a3c-456b-96f3-ecc4017f205b", "comment": "Malware payload (Mirai)", "value": "e837b6a9ccc7cf21c6935da92ee4767a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858192, "uuid": "52fd3bfc-7909-457c-b2ce-cc0c13f3283c", "comment": "Malware payload (Mirai)", "value": "0ab7aa603ba8ec7a854148a0c4e4cad38827fcd6204b726599df60afcf1bbed3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858192, "uuid": "ce63e4c2-33de-4ac4-af31-65759bb6430c", "comment": "Malware payload (Mirai)", "value": "c8b26c1ccad450ed97d516f849d44248e3a5e7db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858192, "uuid": "5a7d19be-3dd6-4199-98b4-e9cbadeade85", "comment": "Malware payload (Mirai)", "value": "7a906bc27c2cc0fa6aab5dbe08752a8b6b4e738d03032284328fbb09d375109e1cec74768f8d34d4652904a81ae17513", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858192, "uuid": "98c63cc7-a33a-4f01-aa36-bad9731dff75", "value": "T14C03F19CD6AA24C4DF8C5D3D60A801D0AE01D6D0455B979F33029C5DEE77B33784BA89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858192, "uuid": "3d7f3e45-f297-42c0-a8b0-8fcde6f0fa17", "value": "768:J/YhJHo51jeSy7CFAqAZ3x73wlrP5ZWc7250dmk/B6/KbtHWWBQw:1konht673+r372mdB6/Kb7Qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770858192, "uuid": "7b5d38aa-635b-455e-b082-a999a409e77e", "value": 41164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770858192, "uuid": "f36bb6da-4e40-41c8-90e7-1c40d114012b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858192, "uuid": "14e9c499-8d26-4260-8c4e-0ae8802652c4", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8de48f6-0839-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770917996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917996, "uuid": "f0cb24c9-f6f7-4ea1-bfd5-599188c634c8", "comment": "Malware payload", "value": "706d3d924c8432fc7ff71609e1974996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917996, "uuid": "a5aeace6-d82d-4636-89fb-f91f40b8be8d", "comment": "Malware payload", "value": "0ae22eb63a314e34620e9a8864500ab7dd4681f55d4b8f30706d6e01d8a4f558", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917996, "uuid": "ff21c7a2-952f-416c-877d-f6d10882e625", "comment": "Malware payload", "value": "f45e26243c927a1645f9ea03f223a2a22f99dc1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917996, "uuid": "097e080f-5c33-4eae-8741-2b867c951b3f", "comment": "Malware payload", "value": "5714be008f4619673e503f3b36557739061fcd1de51cd4e3b2a3c917bd6b6b2f7f2af458699450f642d3d439013e3911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917996, "uuid": "8afce6aa-f853-4d54-8b66-978dbff3d422", "value": "T15546632539EB505DF3E2AAAA4FD4F9AF9D1AF633270F30B9107103468712D819E92735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917996, "uuid": "6ee75f4f-8c1e-4c2c-984b-db7a86131d10", "value": "bb3ac2c21e02c68abcad237dc3fa6d00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917996, "uuid": "db97cc2b-cffc-481f-8c63-f197a30fc629", "value": "49152:HuUhOm82zOy4YgmIh7dl7uoGK/S2JU7Rd9XK9sMRgB7Ai4UQVPSyCN8WtBTG16AB:Hut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770917996, "uuid": "8e63f9a0-5566-4b7d-8718-5e607462c8dc", "value": 5566044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770917996, "uuid": "a696d834-08af-4a56-ac64-6414b5b5666c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917996, "uuid": "1a020371-dd26-44f1-acc6-4e95693e7720", "value": "exodus type shit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a697b3e-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877922, "uuid": "c6eb5254-dbbd-4c20-a731-3617cd16a9f2", "comment": "Malware payload (Mirai)", "value": "78cf8a9c03a5ad15b59a835dc4c0329e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877922, "uuid": "3c6def67-e15b-471e-9613-025f86ff7f7c", "comment": "Malware payload (Mirai)", "value": "0b86883c6e07f93c2fc256aae323340bffc6cc0b9cb753f361831b01d2c3183b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877922, "uuid": "cc78fa44-5571-4f8c-8c8b-d75e4b7a1bca", "comment": "Malware payload (Mirai)", "value": "55e3b4713e1da8e8d11abd80e8246ca9d12bb6d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877922, "uuid": "585eed02-dddb-49cc-92e1-138c71a48e5e", "comment": "Malware payload (Mirai)", "value": "dc7358f3cb92ce786c8f41855735355b2f20282c95b8ff749bdbbfea9d475bdd2c9448717e7c2f2a8cfcea574458518a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877922, "uuid": "4d7f71ea-12cd-4bdd-8212-9cf5ab2367ca", "value": "T1C42301F2A7AFD2E8D4918A79825955F0FEDB7F0262460F5F40553039E43B9613AE1E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877922, "uuid": "ac736ccb-a038-486c-a442-5d79bf92f9be", "value": "768:KBC4G55cpyNliAOWsX6JcNeozOb3y4SUz5uf8Q1BEY9Y4OYmLVuuGKcZJCgzhjst:AU55cyliA9TsOZSi5O2V/YAnC5hIgeff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877922, "uuid": "38bc3aba-cf8d-4515-90b9-87ef43b04548", "value": 47784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877922, "uuid": "e56a785e-c5a9-4200-b9ad-9a82b01e3f2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877922, "uuid": "06065147-91af-42f3-83e7-9eeb0489af15", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33cf1d3-082b-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770911894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911894, "uuid": "4718cedf-664d-444f-a5d7-b392b20b2f64", "comment": "Malware payload (SalatStealer)", "value": "6ca4ff521769bb248042eacf3d03fbdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911894, "uuid": "b8464088-6718-47a8-8e4b-f5220e07adfe", "comment": "Malware payload (SalatStealer)", "value": "0c29cce2264f5bf04ff732bb6035279cb32d23c4b7fa2b935b8386de29f91a37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911894, "uuid": "409aab29-b611-4e2c-886b-9c63abc7780d", "comment": "Malware payload (SalatStealer)", "value": "888b83fda65c55d8b560d60220acd62e96ebf389", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911894, "uuid": "20243b75-bd6b-4cfd-82bb-7bbfc9e1ea8e", "comment": "Malware payload (SalatStealer)", "value": "98709afd93dcbd027313dc3e678ae8c8b4da74a8d4ff294a10b20e2ad88add4bd254303e31fdaf65dcb56b8baaad69fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911894, "uuid": "12832b62-691e-4ea9-b173-6a18a113cc16", "value": "T134871256E2F900E8D9BBC0B8C6575517E7B1344917309BEB56A48A692F33FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911894, "uuid": "50c912e5-da7f-4a70-9155-85c7399554f2", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911894, "uuid": "c4771994-b0de-4249-9dc8-0c8878f0bc94", "value": "786432:muKomJk6+3JmL7ybJMEJtKPiadZ/yDkt4J8vGezOL01oWIVP:Gn2dmnS/wPiaRt4JH7L01oWIVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770911894, "uuid": "e2602d24-4418-4fdf-b132-efba1262946e", "value": 38438988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770911894, "uuid": "3a783ed4-ff4e-42e6-8958-6787fa825eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911894, "uuid": "93d4ae21-d647-4947-91d9-ee7173a0ac0b", "value": "0c29cce2264f5bf04ff732bb6035279cb32d23c4b7fa2b935b8386de29f91a37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e91242d-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877929, "uuid": "d53e8f3c-b2b6-4f78-8a3e-a6e90d0623d0", "comment": "Malware payload (Mirai)", "value": "c3a67be94674698311132c20976b3d94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877929, "uuid": "30e8d260-0b7f-4581-9248-f0f0aa6a5adf", "comment": "Malware payload (Mirai)", "value": "0db9e0726acda34286d13681bb001092655dd8df462c3c7121c24e4b48bfe66f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877929, "uuid": "c500ce22-6e97-419b-9541-006d15e76d3f", "comment": "Malware payload (Mirai)", "value": "234f5c7dec0de6a488652e6298c3721619ebf244", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877929, "uuid": "3d495ffd-1813-4842-a5ee-c66843223cf8", "comment": "Malware payload (Mirai)", "value": "1a2c824492dda0ed65472d04e23196e37fd7ebdea9c00c935680d29094111d2d1834c68de2fd7f80a804d56b49a571c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877929, "uuid": "d9c7ecb7-da57-4d7b-8f16-ae876458f3a3", "value": "T1A4735D0277289F1BE5A669F128FB1BB047AAFD5059E2B144E50EFF840232FA21C5DF54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877929, "uuid": "b256078a-acc0-49c0-a8b1-411455bbf52b", "value": "1536:JV/Nf6CnZ/Z0MR7IGIxn8rAc/Xd5eLJTDYX836nK+:/NfbNPIxneRXKTeA6K+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877929, "uuid": "b12969fa-ca9d-4993-886d-43bd5bdf523e", "value": 76574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877929, "uuid": "f170ab62-8dd3-4bde-bb7f-0858b7ef75f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877929, "uuid": "c89ce8a0-cb94-4b70-8d42-18547834fae1", "value": "xd.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724554c5-07dd-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770878311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770878311, "uuid": "48c14613-ae61-4220-b1e8-5529ca239a38", "comment": "Malware payload (DarkTortilla)", "value": "3a26c5ac7df731b398cea506dfd0c25f", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770878311, "uuid": "488ca11b-9793-4fa6-908a-40d547120fa4", "comment": "Malware payload (DarkTortilla)", "value": "0e6ce191196d561a11d2e38053bf411d6da991bf45dc5840df3a8832bbd0f253", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770878311, "uuid": "9aef23ae-3038-4194-a791-84285d55db72", "comment": "Malware payload (DarkTortilla)", "value": "1f2fcb21713e39f0037326e8bedce790af13cd69", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770878311, "uuid": "3e22db57-3d39-4ff4-935a-b07482e5ad63", "comment": "Malware payload (DarkTortilla)", "value": "fccf11f00f3a4e5bcc57abce4f26b2594eda98242f076344b4c7b932ea02ca8f9a8164047185d43c7a2e2b96af2e5926", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770878311, "uuid": "1ce910cc-3bca-4543-a56a-964ca5c885b3", "value": "T11555E10A27C54AA4F4BFDB38B778406843F0B91F8611E77E2F0952E69D21B4E91527B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770878311, "uuid": "ee0ab4bc-7e60-402f-82eb-25661e82629b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770878311, "uuid": "03ece1e2-2c1a-4664-92cd-9495737bee9d", "value": "24576:O/kfd1HK6/XZfSz/MbBMIlN+22QuwwoAGZ:5fd1H7Jo/MbBM6M2pfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770878311, "uuid": "2c434b4b-5592-4022-92c4-9889a94fa9ab", "value": 1312256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770878311, "uuid": "cc77d99e-439f-4201-ad2a-36dd1acbda59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770878311, "uuid": "50daaae6-e6da-40fe-afe0-def055548cf8", "value": "10. 2026_Purchase Order_PARS_4500002330.pdf (49 KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a592086-084d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770926267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926267, "uuid": "f0db0a91-23a3-49fa-8b16-952ba7cd471d", "comment": "Malware payload", "value": "fc40656a997a0b67104dfd31a4fefcb5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926267, "uuid": "dadd95a2-7c2a-415c-bc5a-72c2a207d47d", "comment": "Malware payload", "value": "0f78f9262aec2ce51cf8824f254b197d75cb73df03da4e3f5c5441379a1ba491", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926267, "uuid": "ad580479-f9eb-4396-854d-16694b5ec605", "comment": "Malware payload", "value": "2ab339f4c60eec293bb119c661d5a087bf2f1883", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926267, "uuid": "7d15cc45-b248-4a2c-9010-444ed10c78f9", "comment": "Malware payload", "value": "4c6cf16fda4f58273be0000a255c5463d443f7ad81ad79f1907a726da358fa4469f7a67f3b0d0750ed244d1e15ad03df", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926267, "uuid": "1dc044be-81bd-41b0-b03b-e2e8af0564eb", "value": "T15E664A03ECA554E9C0ADE13589629252BB717C485F3623D72BA0F7382F76BE06E79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926267, "uuid": "6124dd1d-e34b-40f1-97dd-5839309a752c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926267, "uuid": "ffafba5f-17f8-4c57-af5b-90e17999ea03", "value": "98304:M9LdcjOw8IJddN90wXfFtt7lSOwTMdh9lE:MAuITdN+qFz7YOyW9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770926267, "uuid": "1ff4f70e-ef30-42e1-84b9-f3d3f35048f3", "value": 6777856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770926267, "uuid": "e9425acf-87c9-4a52-80fb-cb726e534f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926267, "uuid": "4b5d9aa2-231b-4116-82fb-6bf9ea19cc32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88aace1d-07fd-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770892092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892092, "uuid": "0810ff42-0de1-41cb-af9f-73966b6d1f47", "comment": "Malware payload (AsyncRAT)", "value": "e9f7746b1c449431bae94bb7689877a2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892092, "uuid": "74444785-faf2-4e91-b788-6c322fe04f1b", "comment": "Malware payload (AsyncRAT)", "value": "10f04ab796863777f48facebb67e965c10e9a322f9c0373cbc11d7e509337062", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892092, "uuid": "1196bdea-1a95-4e89-a5eb-1239b09a6371", "comment": "Malware payload (AsyncRAT)", "value": "82243fc51b82fbb753264196644139dc09c5da32", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892092, "uuid": "f8c30cde-64b8-4223-bd4d-d799da955aa2", "comment": "Malware payload (AsyncRAT)", "value": "89ed62ca6efe4decca6e7355e3f56a9f95435025a1994acbe58cb0416fb2581aa577bd836b244222cca300a901978e58", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892092, "uuid": "b94a85cf-3284-43dd-9441-1e22bac6875c", "value": "T109D23A08B3D48561E1FD57B94C7293048775EA5BA973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892092, "uuid": "1a9382b1-c661-43e1-b416-22c42e4a4b90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892092, "uuid": "77b157bc-bc7d-46c7-ad5d-5b9c6e107133", "value": "768:9AMRXpZrm+iUg/cIRGqom/Rb7fB/dTv/+:qMRXHrm+iF1i4RbN/1/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770892092, "uuid": "97d13937-af0f-4f50-9b1e-e81309a4e6b0", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770892092, "uuid": "feb18cee-9987-44fe-91b3-fc47dcb129dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892092, "uuid": "1e0df033-afd3-4419-998a-10f0f499556c", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb2938c-082e-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770913200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913200, "uuid": "267eed6e-4570-4993-8df4-57b87b98cb90", "comment": "Malware payload (ConnectWise)", "value": "752641eedf999e74bd48d86d12054e6e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913200, "uuid": "2f7b5fce-96e7-44c4-8b90-e37a6f1a1035", "comment": "Malware payload (ConnectWise)", "value": "12e08d55af20a444d56a70576846f6e6ca5372df40e3260d34ca5139c22b004e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913200, "uuid": "648694a4-3bc7-4a1e-a366-8f9b3e67a910", "comment": "Malware payload (ConnectWise)", "value": "d2d6199779e0e1b5b7a97bc088fa3e9fdf451efd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913200, "uuid": "a5e884c5-9c72-45d9-8b07-68661a95f6e3", "comment": "Malware payload (ConnectWise)", "value": "c46e84d1d21fed938d7d78d2ad3f11cae205bf6a2f408e77349b3c2f19c84fe90bfe16ac624a6c3dad9efdc957007616", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913200, "uuid": "f979a1e8-6742-4b5e-9eea-20c01cc44749", "value": "T189C623627BE4842AE6B70A39F93991B199767D55CE27C10F1374790D1BB2E809A33333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913200, "uuid": "3d70cde8-9fbf-459d-8d0d-ced732c73e87", "value": "196608:IT0cEhi5owS/wFFV2eOhJgy8T0cEhi5owS/aT0cEhi5owS/AT0cEhi5owS/oT0cU:IT0UR9FFVogy8T0URrT0URlT0UR3T0UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770913200, "uuid": "d3576e1b-2f3d-4369-bfaa-dacf50cf23bb", "value": 12189696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770913200, "uuid": "e9566efb-0b37-4893-8d04-a12574dc98df", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913200, "uuid": "7a6bcfae-1183-4243-beb7-125ecfd0404f", "value": "12e08d55af20a444d56a70576846f6e6ca5372df40e3260d34ca5139c22b004e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6995332-081b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770905161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770905161, "uuid": "d30326a1-9333-46ca-bf3e-7d31416bd492", "comment": "Malware payload", "value": "7dc84387dfbda5cf9ac24887bd6c061f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770905161, "uuid": "9405ca4c-5fd2-4612-a1b6-886606eea6ec", "comment": "Malware payload", "value": "14401fe15a5decf328d03a2126821592a3e77c48b86489f2db01a3f1352eaf26", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770905161, "uuid": "0e1561c2-41ae-4e3c-8fb4-05a1e40d49c5", "comment": "Malware payload", "value": "290f658f19f038ed30a13941c880f372133566c8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770905161, "uuid": "b2de6e17-1f27-4228-9311-7fcd5ddcc64f", "comment": "Malware payload", "value": "e1006b26c9c80fda0538450e5b4d7b439ab74819cdd46ec3c6b9c9b21499fe74758cd6f0d6c92e89c37b26111e9a0455", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770905161, "uuid": "564e9790-7c08-4fe0-ac6a-09881b0333be", "value": "T170F2C5CDF0C3B0744657BDA2393FF69AEA6F8F0066898050D2565DA8FC2D71DC826DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770905161, "uuid": "89c09742-eafd-4d4a-8c81-90db0cd3ea5f", "value": "384:nEHVCObkQ2FmRNlT2VzrF8ul8Cddst+mzEWg8R1Jw1eGowtgWeyV7WyVgsYw3kkV:nEVSUXlTGt8FCd2+pT1HmH4kDcKrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770905161, "uuid": "74726c8e-29f8-4dbd-95da-4435c14d9973", "value": 34945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770905161, "uuid": "a472a798-ee5e-4c7d-8ef8-bbe9d00b4ede", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770905161, "uuid": "2ec3d114-647b-4c4d-887e-07abe2c86258", "value": "QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0f9c17-07cf-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770872500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872500, "uuid": "179b9d33-9547-49a9-94ff-d63f7e42793b", "comment": "Malware payload (Gafgyt)", "value": "11290a8e5b51bc16233ea8da7afcadfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872500, "uuid": "ee2d2c4c-91d0-4ecc-91e3-886f4bbd2f16", "comment": "Malware payload (Gafgyt)", "value": "175bc3046c43f18dd9cae2b139c98880a7255fbac49bad6f70d1664c4963ff3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872500, "uuid": "db7b3c3b-bb31-4716-b4a0-594e6328620a", "comment": "Malware payload (Gafgyt)", "value": "d585715676b4357e6f8c21fb1fc374ac9c11275b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872500, "uuid": "215ec920-de99-447c-a7ab-1a8e77382e8c", "comment": "Malware payload (Gafgyt)", "value": "757fba399741201168a5734ed518cabc08ff42f4815049922f82f2f5dd81411293fe9fc9f8f663d604faa76e1bbb0f63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872500, "uuid": "ff391ba6-e629-4bfe-9a9a-6c84f06e30d5", "value": "T1F0931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872500, "uuid": "0f04c85a-83bd-470f-a61b-7d63398af5d5", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcv3NPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFG3NPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770872500, "uuid": "53e13ec6-1051-41b3-bdb3-67e1e5aae53a", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770872500, "uuid": "a9153fd4-0082-4679-b124-dbf6f45071ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872500, "uuid": "fe6471c1-5e32-4459-9b18-b04997a8e358", "value": "a-r.m-4.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0378a118-0842-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770921504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921504, "uuid": "1eb732e2-9ac4-4a72-be91-ab8db57c3ae8", "comment": "Malware payload (Mirai)", "value": "a212a846d7b3427eeae4d4cd8b88bd37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921504, "uuid": "3d29e6ab-3f38-4a38-979b-b0ac744dfae6", "comment": "Malware payload (Mirai)", "value": "17857034121721903f42b09e4c9f4745787a36aa393c3b23543f09e251eb9e3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921504, "uuid": "c022f1de-f38d-4c68-b4e4-e9a39223abfb", "comment": "Malware payload (Mirai)", "value": "5b4ecad1fa2090a9ed08d5716bccd1dc71048267", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921504, "uuid": "20f3e90b-0cc7-4513-9a26-520e7bca15d6", "comment": "Malware payload (Mirai)", "value": "481d41e7e3952c69b5a0c08abdf9c4a399dd61e17997680e48e859bfaff206bcac15b0f740196bb09a3b5ce15b21df35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921504, "uuid": "655ed2f8-1c52-452b-8a06-c267a26ab2fd", "value": "T1A263C81E3E218FBDF7ACC63847B78A21965837CA36F1D1C4D15CE9016E7024E645BBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921504, "uuid": "129a674a-ba5a-42c0-9ffd-d66c60b3b2e8", "value": "1536:WkvDSnAd6mYoPdd8QVs1o0vB1tA0iLuYw2+O/8Q:WkLSA3vbko0pTAmYw2+OEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770921504, "uuid": "029d0b0c-929c-4646-9eb7-ded8afb88db9", "value": 71764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770921504, "uuid": "718bc122-7312-4637-9019-91101a151b88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921504, "uuid": "5221fb89-98f8-4e87-a3d6-74c8bfdde29a", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd2b36e-07cf-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770872502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872502, "uuid": "8210d70f-e179-47be-9691-cc862ed5e206", "comment": "Malware payload (Gafgyt)", "value": "a2f90feb9a68246cf713c4d654ce0f74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872502, "uuid": "30b12322-33f1-438c-9964-acce2714191b", "comment": "Malware payload (Gafgyt)", "value": "1902dc2fd462294a9b7d27333255005e73517dddeeb3585f075d17bfd72cfeb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872502, "uuid": "27b3b2d8-0e21-441c-bee3-3e0eec692be6", "comment": "Malware payload (Gafgyt)", "value": "3799c5e08c9d7b2c9334b23e3935d43b3120f4a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872502, "uuid": "72040655-04ea-42fe-9ccd-2e1ff9ca512c", "comment": "Malware payload (Gafgyt)", "value": "1574cebdb90e195884be1550264b28cd69e9d2923bb05ae90f7340bf33fd135d1d1eb276fe817d399f93b2ae17d46e86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872502, "uuid": "40785b47-1cb4-465f-8632-988fb306f364", "value": "T156734B47AD628FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872502, "uuid": "0ff007e9-740e-4e5d-968d-0e49741b8b78", "value": "1536:kAmbedEfIKy1BABWWNxiEVN/CT3yzTN7mj9VqYLe8f26e:v+eefvyoWWF/k3Mhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770872502, "uuid": "ad02f79f-3e6e-483c-a319-5b9883bcc54c", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770872502, "uuid": "b2cdf69c-48ba-4e73-bb31-e2748acafae2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872502, "uuid": "4d3e2e1a-9df0-4b29-96b2-cb08406c89d7", "value": "s-h.4-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94498789-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877938, "uuid": "e5d1a8b6-a4ec-4701-b60e-8c117a457a4f", "comment": "Malware payload (Mirai)", "value": "cd39787bfdfb651ca60529c957dfdc8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877938, "uuid": "474b940e-2ccd-4ef5-b6db-a65e7e636e6b", "comment": "Malware payload (Mirai)", "value": "1996e88ccbdd56e93babfdab3cc2ffdbee2acb9bf295116b9ba93e6dd35daf72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877938, "uuid": "7dc15d56-2aed-49f0-af3f-ddbcfacfa0cc", "comment": "Malware payload (Mirai)", "value": "b7cac9880307a9a35096e76a403592beaa181c21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877938, "uuid": "80a00730-6041-427b-a980-efcfb38deea8", "comment": "Malware payload (Mirai)", "value": "874d88f5b1c0f53b448d31bb493b528d306e8217bcf9a3ec221cfbf1dae0e0959bbb4b7aa02201bf6590682b1ed7d24d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877938, "uuid": "5c460098-3459-4fed-b840-d50ade556cea", "value": "T12F24841E6F228F7DF269837487B39F30969C76A616E1C581E1BCE1051E2028D685FF78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877938, "uuid": "a6d18fd9-8de2-4ac4-819b-821826e7bf43", "value": "6144:UqKbV4PxgIFCpX7ZCXCbPRkfPVPZMrzqWCbNOR:UqKbV4PxgIFCpFCxZXbNOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877938, "uuid": "f4569ece-6d12-43ee-9c99-1fe3e9099103", "value": 218884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877938, "uuid": "b4461264-014f-4466-a928-6c066d26cba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877938, "uuid": "6ee942ec-db92-4855-a5af-25cbc54e9e36", "value": "furry.mipsxc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fd0d86-083c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770919096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919096, "uuid": "02384676-b466-4585-8449-96488be4b11a", "comment": "Malware payload", "value": "c32222b2babfec163accc6ede749d779", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919096, "uuid": "10785f85-1ffe-4447-9112-4129f5451cb5", "comment": "Malware payload", "value": "1a284fff0a9bdb989fd24cc4e24f1017f64425bdb5c6a89f2976b843a37cb5dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919096, "uuid": "1def2e37-6b3c-4ecf-9654-3c04afcf9f4e", "comment": "Malware payload", "value": "8b363bbfb7f2644beb83b8b257a83f5659907134", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919096, "uuid": "378eb99e-934c-4382-a0bf-d4ca22754630", "comment": "Malware payload", "value": "67e8690340248ef389d46eb6b9ec3ac86603f1f08d3a940aeb47eae6b534fb72813605bfed6603390a49a742b57ca2ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919096, "uuid": "ecbde6c2-9cdf-4042-9d43-bbb81942bee6", "value": "T1F6A3299ABC85C202C5F061B6FB1F91CE375643A8E3E6B107CD19AF29674B8670E3B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919096, "uuid": "f9423cb6-5d07-4575-8e6d-4cb1a4d84234", "value": "3072:2YsUJu3MP6A1OZbXL53w45yew5o/huQuX:1zJu8P314dDnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770919096, "uuid": "7ce5468d-a1ac-478f-92e7-cb8d3137d0d0", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770919096, "uuid": "e87d38ea-854a-4b08-8b27-ec8e228a7ea3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919096, "uuid": "5f538918-5696-4707-8209-2d87392909ea", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1bef0a6-084e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927031, "uuid": "6894c11b-fafe-4a00-80f5-92563c642ac2", "comment": "Malware payload (Mirai)", "value": "fd74ea43ea8d2d9a5ac8038b319ca24e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927031, "uuid": "3af485db-9fea-4aa2-a808-5d38545d9fb8", "comment": "Malware payload (Mirai)", "value": "1ab3a8b8e17e642089e7813aeac59be1d2720bfa598a3c4e3a17b89f853d58c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927031, "uuid": "e1e6e2e0-9fc6-4e7d-819f-241098f4c7e4", "comment": "Malware payload (Mirai)", "value": "ebbc1a38f552e5a5506c8f4d3142e20e595ae486", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927031, "uuid": "8d8d5bf7-8692-4695-951e-4584a8144fcb", "comment": "Malware payload (Mirai)", "value": "d20f6e3ea3859e22b9d9178f7630a71c11ffe59add560b81b34bc0842bb8090438bc120953147fa444cc10b08e809e0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927031, "uuid": "0b4c4086-15c2-4739-9b74-9732f9259f62", "value": "T15682D115C3495EF2CAF24C76CDB981C327520AADD16A31063E2526B4A2CC99B4FF53B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927031, "uuid": "de6dd195-cd6c-49c5-bf87-d744efe0e0ba", "value": "384:aU8ucP4fqbh8HqMq6c/gcDKaFL/W1clneaKfhymdGUop5hTw1:UryqkqMkDKaBkBs3Uozy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927031, "uuid": "d588afff-1c98-4c25-968b-c52ddbe940ea", "value": 18616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927031, "uuid": "39b2eb8d-02f0-4fe3-bdb2-6232ee4ab8b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927031, "uuid": "440cf04e-55d9-4e76-ad42-8124dd8a8051", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6980c43-084b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770925777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770925777, "uuid": "22d77270-5493-4e5c-95f2-823fcaa3b6fa", "comment": "Malware payload (Mirai)", "value": "72a70d48af70c75aaec4db3130968fea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770925777, "uuid": "8bdaa811-17ac-49f7-b36a-fbc0337f1096", "comment": "Malware payload (Mirai)", "value": "1ad572c08af6bc4eeeb620922555f2f9269c3e11e6c300b41abc8ec773a0a5a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770925777, "uuid": "fcc436b0-d860-42b3-b608-71385521ce2e", "comment": "Malware payload (Mirai)", "value": "cc65b89007c11806a6e32e674da39553809f3457", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770925777, "uuid": "3d0c0c2a-af6b-46ec-8d03-0da5836e5d97", "comment": "Malware payload (Mirai)", "value": "d4d474a5e6c35eb372f38ee446f3a88dc274a5ad5a0b5a406670c4c2a2f4d1ede52c53e8f959e91411afcac1c3198c2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770925777, "uuid": "476d2f50-e0ae-4ce4-ac51-05b344bd24d9", "value": "T1F9E2E1422231AB60F8524C36FA38C719564A2779C67A78F3761083ABF1B1993777ED43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770925777, "uuid": "034bb77e-d0f3-4708-9ed0-e15e1fa65bd6", "value": "768:B44BHaZ6Wl8cTi0IkQUEm/n23U03wfeiB:jxa/l8nkm2/f/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770925777, "uuid": "12c1af3a-b283-4ac4-8a26-4d93c8b39c66", "value": 32016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770925777, "uuid": "d4594781-d759-4f4c-8792-1741ba075fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770925777, "uuid": "84916ec2-f745-40d7-ba24-6f4cd1f5d9e1", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a2c945-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877808, "uuid": "33b35b9a-6034-45df-9134-93264f510483", "comment": "Malware payload (Mirai)", "value": "6a00e421d43028dab3cc8d99f3751d1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877808, "uuid": "5d50650c-a751-44c1-956e-d0d3c7367c32", "comment": "Malware payload (Mirai)", "value": "1b57bf68acb8e5df5f80c2783d83988489f76a7768d4ffb5a7b649c2e8b4fed5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877808, "uuid": "2bddc600-dba3-49de-a4d3-51b2c2e3e064", "comment": "Malware payload (Mirai)", "value": "a96c888d8153d2333c93da7c4afbfc80aef9ac59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877808, "uuid": "ebc1d581-6b9b-4def-86ab-6ce41d98c49a", "comment": "Malware payload (Mirai)", "value": "ab183e52cca7dd7d38814ae4df234c1a40c69506ebc50e3eee5d5f4cee91c3b9760fb24a703aac744bdf49b29bc28d16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877808, "uuid": "02374c28-f81b-4eb5-93ea-fe8a5bc367e5", "value": "T100043A1AA952CF11C5C316FAFE5E814D33132BB8D3FE3212DD246F50678A49B0EBA552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877808, "uuid": "2f3466dc-20f9-4fa1-ad36-2d4e81bf567d", "value": "3072:FBNzP4srTvLFevLhnTlulXakwq8A2fPQeCSXJ4S4z7reoZD:FBxwKjLFevLhnBu9a7qp2gSXJ4Sy7KSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877808, "uuid": "f8fa8950-54d3-4c82-bbf1-1be821e08b21", "value": 174304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877808, "uuid": "236312dd-f666-4f5d-af4d-b3d116154b04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877808, "uuid": "b5bc9646-3f91-4685-9899-aad808f806d9", "value": "furry.arm6xc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c6b0ab-0843-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770922233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922233, "uuid": "beb6e98b-9e66-40c2-9125-7ba195b72a10", "comment": "Malware payload (Mirai)", "value": "bbc791be3dd0e350ebf39c21d5671314", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922233, "uuid": "289a1619-23f2-429d-8473-df594cb02761", "comment": "Malware payload (Mirai)", "value": "1d4307746731e9045152afdcb5c0be7f3d58e1cafbf8b5d1fba1cb9fa2a19aa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922233, "uuid": "463374e0-5c50-4aec-8d02-aa375f5e19c5", "comment": "Malware payload (Mirai)", "value": "dcb70e37f30d62839c2a2c51199d42d1b96c07cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922233, "uuid": "abf063f1-f5aa-489e-880a-be6313f1c811", "comment": "Malware payload (Mirai)", "value": "945c4c1815977bc134ba73bcd26e74b3210d46eb097b35cfcc2bbec999636a308c98c793f4ace8afaf8d3ac0d0b5cb6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922233, "uuid": "856c3848-d20c-4c91-bab6-c3bf6fd6dec7", "value": "T1FC731947B88195FCC089C130176F7A3AC826B5AE123DB2E777C4FF172D49E604A2E959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922233, "uuid": "1c68d04d-e0b5-4cd4-9fa7-091e00e7b7d5", "value": "1536:nGXnxDzdASmcTAionZM9f7r7pFPzXBoMT0FiEfbpBjGyExEjGAPA8H+a:GXxDzdASmcTA7nZM9f7TPzuMT00E1oyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922233, "uuid": "d461662f-3860-49d9-a7bf-1414f6fcc542", "value": 79104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922233, "uuid": "414f9c66-7726-4d96-9be1-38e8c24d97c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922233, "uuid": "1c78db3e-db40-4bc0-9151-62360b4c7f64", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a411f74b-07fe-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770892568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892568, "uuid": "d422a941-8daf-4c8b-a9d6-91e350b8d058", "comment": "Malware payload (Formbook)", "value": "396172f6de30c40adc2d08e1de3a3ab2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892568, "uuid": "cd1d8632-76b1-471f-8dd6-6636ca8cb742", "comment": "Malware payload (Formbook)", "value": "1e13f20a223bd67e1e603d73a48b3ce589b24edfcf32d2ac4bc5bc341cd3ce99", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892568, "uuid": "18e1ae02-79e2-4d61-aaa7-5841eda30dce", "comment": "Malware payload (Formbook)", "value": "80eaef689a00800703053a811ee928dc5486031f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892568, "uuid": "63ccf207-3f11-4fc7-8570-b00b69d84e93", "comment": "Malware payload (Formbook)", "value": "3471d3515818237f1c75cab40f8fe96bb14b241c06a4e68d8edccaf39f0b7cd7000f0a0ff9c120c39df83902941fc122", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892568, "uuid": "f9046af5-2b1e-4c3f-a6fe-9a145a3b7ac8", "value": "T1C155BF027391C062FFAB91334B5AF6115ABC7D260123A61F13983DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892568, "uuid": "1afd8346-a160-4ed1-9117-206ee6f2c31f", "value": "24576:bEB5EmXFtKaL4/oFe5T9yyXYfP1ijXdaTMyvuaW6nEQgDXbfeS:bEBPVt/LZeJbInQRaTMguaW6Arf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770892568, "uuid": "b8cbc5a7-cc56-461e-8b89-38ba2c9f0822", "value": 1323008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770892568, "uuid": "490f619e-4f25-4818-b868-1bd9d76ca9c6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892568, "uuid": "29923167-08b7-415f-b740-25c5d1143c8a", "value": "3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3802978-084e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927007, "uuid": "8935d80d-6bcc-4653-8789-d4fa2c19983b", "comment": "Malware payload (Mirai)", "value": "3530df74cd9f22a2a6ea912c1e8681f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927007, "uuid": "1adcfc6a-d2e3-426c-b6d0-59709a7630f9", "comment": "Malware payload (Mirai)", "value": "1e1b81b52962d3594db6f023a96a29b4b42ec4d6f2c82f59cde7f58155d265b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927007, "uuid": "73d56a76-674e-47b3-88a9-5e191a9bed28", "comment": "Malware payload (Mirai)", "value": "2324e8a81e8bf8e04c52f67baf1c8ffc49404cce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927007, "uuid": "56ad3912-ccdc-42c6-acf3-f18f482ea552", "comment": "Malware payload (Mirai)", "value": "27f5a4b7fe29518f650d2aa7174b0dd331e20bafae67ca4eed823531693cbfaab3db56763f164f27d85d28913f510f72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927007, "uuid": "9055f648-ec35-43b8-9316-45c4a13ffbff", "value": "T1BCE2E1BFD2C9653AE18E03F5432DB86AA5BF54E62E5A4240D3015934AF773B3D760224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927007, "uuid": "c7343152-8ea9-4492-837c-c4dac402d23b", "value": "768:SJhFGtH+pcWnPuP5zgSg13Cl+o4BDuYqVsBatxIkKKTtoAGDOS:SJhFyH+p0J23CK1aQkLTmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927007, "uuid": "0b1c1cbb-e956-45b3-a9c4-aa3aa22d2a39", "value": 32636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927007, "uuid": "61d6a5f0-ec52-4cb1-9441-09e6d284c567", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927007, "uuid": "a96abee4-ca2a-4fe3-8663-69f3d4fae704", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58389514-07d0-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770872683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872683, "uuid": "cb4cd59d-0c1b-4671-a28a-fbb3c27828ba", "comment": "Malware payload (Gafgyt)", "value": "220658a7b402d580ee04ccf3d46a796b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872683, "uuid": "f3d9957f-56db-4979-b60f-09c7df40dbf5", "comment": "Malware payload (Gafgyt)", "value": "1e9f28a7a7f05ad776184ddb356e7fb2d48d37c165ad892c1914bd8d2b754489", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872683, "uuid": "17d6ee4c-3fd8-44f0-8046-26c25be2d15e", "comment": "Malware payload (Gafgyt)", "value": "eb63ff32da59b6d3e5fb2d59050185809334fa6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872683, "uuid": "901340d7-2f6c-4457-8f06-733b221159bf", "comment": "Malware payload (Gafgyt)", "value": "c5a38dbd32dd282793ed93479d67428f2dc5f70d1b3af06a56617587d4c6a89e6ad228c7584397e7072a075ae406d9f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872683, "uuid": "7f185ad7-0eae-425f-b9b6-ee7267d1c70d", "value": "T1C9B3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872683, "uuid": "c3af1a0a-cacc-4b96-bbf6-d3b5475a7f6e", "value": "3072:R/4tNF9U4vvLKw6J73x8UmkiSFxfKxbXe:BUNFK+L8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770872683, "uuid": "51fccf52-041d-4902-8f70-061e3fe1ecd8", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770872683, "uuid": "47f7103f-ac0e-4288-bb01-ac23ba2ffd63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872683, "uuid": "b58826b9-d1c2-48ce-8fd5-ae093abd14c5", "value": "m-i.p-s.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf82bb3-07c7-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770869066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770869066, "uuid": "9150cfbc-150b-4f85-ac5a-977b8f71baa1", "comment": "Malware payload (AsyncRAT)", "value": "4d53eb7bbce78e9c19381bded9db938a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770869066, "uuid": "af6f374e-3ade-40d2-a828-8180d199ea6a", "comment": "Malware payload (AsyncRAT)", "value": "1f46ae013f551c57e26c04f1dda6387d171880b4495fd74171ce952be8f2eaa2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770869066, "uuid": "b41ece4e-2c7d-4118-8302-5e306960967b", "comment": "Malware payload (AsyncRAT)", "value": "473072ab97e384ef2fd8b271f5a6b3b301e824ad", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770869066, "uuid": "09aec55d-1744-43e3-8eaa-509fab0c3814", "comment": "Malware payload (AsyncRAT)", "value": "e9123eff9fae5bb71007b96899d64dd12d4a43066a1ef634c583fc60afb0c92640aa10bc273062bad837660264499eab", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770869066, "uuid": "c0b5a374-5c29-4322-b0a5-2cc9b3dae9d7", "value": "T1DED23A08B3D48561E1FD57B94D7292048775EE4BA963DB9E2FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770869066, "uuid": "1fd05f51-4188-40e5-a762-b8f140d189f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770869066, "uuid": "36a56c14-881c-416b-8d06-b15f804341a7", "value": "768:zzCiRXbBJYMgsg/cIRGqo+/Rb7fB/dTM/+:z+iRXFJYMgN1iwRbN/q/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770869066, "uuid": "a9b628f4-e904-46c2-aaeb-8f8bcad3722c", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770869066, "uuid": "3000b97a-0ad6-4e34-9fc9-586ac2f8b1dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770869066, "uuid": "a0154e34-aacf-4a6d-bc9a-a674d284f14e", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c86cfe0-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877925, "uuid": "a6e32849-7f51-4238-9b9e-a588de093771", "comment": "Malware payload (Mirai)", "value": "041dcc505562f01324167827bac0c98c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877925, "uuid": "70028861-0834-426e-8a6f-22956ffb0bd7", "comment": "Malware payload (Mirai)", "value": "1f56a8681d7b8988ebbeabfa540914a5be54b36a035ac2f5ba5abdd895d96345", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877925, "uuid": "2827224d-a9fb-4169-b073-0246e85fddfe", "comment": "Malware payload (Mirai)", "value": "4f895df559f6b76720884840276e94325b64d7f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877925, "uuid": "a610ee51-69bb-4fa3-b354-e4cbd57b1981", "comment": "Malware payload (Mirai)", "value": "a8489ec7331f3dff7e3ae6a9835112b94b55dfe472561cd4054420d7a5898206ab770d5b566e780755493598ea7debbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877925, "uuid": "2514a6ee-505c-4089-a7fc-5c16eebcad8c", "value": "T1A08318817C819A27C6C11BBBFADF414D3720A798E7DB33429D186FF43E8694E0D1A619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877925, "uuid": "f5e0559c-52d9-4227-9baa-7d310de58397", "value": "1536:iJP5Z09E/8KFRqGS07dzxgweZWU02wAdPC+VgiTHFsNtTDzu+O0q:qxe9E/k0JzCwwqpWfqiTlgtTDC+1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877925, "uuid": "42ee149d-4d3b-4f61-aa56-3d559b2f01ba", "value": 87471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877925, "uuid": "4bc4d3c4-e799-493f-88be-d567e645cde6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877925, "uuid": "c836f208-108f-426c-85df-d41331542765", "value": "xd.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0194dbd4-07fb-11f1-a129-42010a9c0007", "comment": "Malware payload (STRRAT)", "timestamp": 1770891006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770891006, "uuid": "68ca0fe5-4e52-4593-a29b-69e49fa30166", "comment": "Malware payload (STRRAT)", "value": "85b5b42578e91f7cec8970cbc0723a84", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770891006, "uuid": "fd7832aa-ec0c-44b6-bff6-d1f3bb8bbf7f", "comment": "Malware payload (STRRAT)", "value": "20172c67c112e4ac1b793722d78dcbefc47e106ea5367c11e808967d1c5bbf2b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770891006, "uuid": "1d58768e-5a25-421e-a6de-7c3602c10e1d", "comment": "Malware payload (STRRAT)", "value": "a41ab5fcf9d73b1c56eb78601a5526da758ec3f0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770891006, "uuid": "ae1aeebd-b843-4c68-acc0-81dc2d87bf16", "comment": "Malware payload (STRRAT)", "value": "0d04d489b2b875ffb67feb212aa90a405be588983b58e48e315931570adf6981a336d9f8b59372af51977f7685776dab", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770891006, "uuid": "e8b3c540-5b2c-4ac6-8dcb-66961d62672f", "value": "T147A309587B48D0B6D763B0F30A5C930AA974F5EFA65461CB1EF0AC9DDCA98400F6278D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770891006, "uuid": "4890608f-0f4a-4fe4-8d65-8acdde827ac3", "value": "1536:dBGy3fI8QJzkjKFR6eq7OZJJsKvGQTWXqqUoymWn:dcWIfV7ch7uJpT2TvymWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770891006, "uuid": "24882bd9-cc3a-4a19-a0ff-5119b705039f", "value": 98442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770891006, "uuid": "e1628cb1-c524-4f04-b380-31d8627cc4af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770891006, "uuid": "fecb5900-ac57-480d-8168-80d001ee4324", "value": "Angebotsanfrage.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dde4fde-0843-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770922166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922166, "uuid": "c4baae0a-5edd-4ae2-a8db-8b6f3203bc39", "comment": "Malware payload", "value": "5a795e9e7bd5c2905e5845b9ce2e77d0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922166, "uuid": "d0793411-445c-44b6-a2fb-99b6e8f98a5e", "comment": "Malware payload", "value": "21262bfa0505c909dd87d3572c10fcbd18212089cd503b6f9bdc4a37a17352dd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922166, "uuid": "b23b2161-169e-4298-a023-2e047555bfbf", "comment": "Malware payload", "value": "f1482ddf7a28558e9897b2b0698ef44a1e76da95", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922166, "uuid": "33b89202-02f6-4a00-9544-691a28c94624", "comment": "Malware payload", "value": "f0453a3da7a74d6d2c804776d89bdc6431f3f8bdb50eba8de181e10a4847769a117a8ff9565191d236b1d8c483996041", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922166, "uuid": "c75f91bb-7e11-4826-b39b-de63691f979a", "value": "T1C0B38D6EE34F0925DF55A7BB434A4E4A09FCB33DB28540A179AC573437ADC2E462287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922166, "uuid": "e70407d9-b131-4473-8c13-0ca114fe5771", "value": "3072:0EDmrWBnmlOyuHsLBkYY2Z7isglFO+VRM9VkvAbaBDxok2B46vpTEDdbtsqm:7DmpOynNY2diDE9VeIars46vpgDdbtsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922166, "uuid": "04b5d8fc-de02-4053-ab8b-bb4105b0a017", "value": 114143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922166, "uuid": "99c25677-831e-4219-afa3-779a9cb5335d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922166, "uuid": "10a62744-c2cd-47ed-a436-a46f4a7c187c", "value": "0.0.0.0.0.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ee56ae-0862-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770935603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935603, "uuid": "af3546ef-a34f-4b55-b6b1-83cfaf2fcbf2", "comment": "Malware payload (Mirai)", "value": "841ee485ad9bb56c52046240a4faf26e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935603, "uuid": "9cf3229f-ef9e-4074-bdc5-2f1f22e9daac", "comment": "Malware payload (Mirai)", "value": "21e45b355aecc3db2a7d92cd4b6c4c571da8fdd6a336a756e812b11c269dea7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935603, "uuid": "35e6e4e3-3eb1-4d72-ab2b-54935b9ca480", "comment": "Malware payload (Mirai)", "value": "5ee056940f6ab3cd0e6cfafbe0bf4fe22ab892f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935603, "uuid": "8defb108-018f-47b5-bcc8-803eff9cac90", "comment": "Malware payload (Mirai)", "value": "5e1f11334018fda1f1984a2da8a6632e6e76a5f79595449f7941bc9cac99585d8db6787f8d093799c6db5cc3c0282fe3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935603, "uuid": "054f5308-38da-458d-b626-4b0becb90faf", "value": "T198D3970B6E228F7EF269877443B78E30A75837DB1AE1D684E16CD5501F602CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935603, "uuid": "cd7d391d-f1ab-488f-bb8a-38d7d7f466b9", "value": "3072:6mg/Iwt3SylBr4GDl4YAG4DP4DqYbxtsrptc:6mg/IwtiylBr4Ml4YAlkO68rU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770935603, "uuid": "6f601e91-aaf7-4b2c-8707-8acc2b2f1fd7", "value": 141448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770935603, "uuid": "cd4ca303-12ba-4e79-848d-f13440623c52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935603, "uuid": "5ed8d35a-9671-4069-9573-06abef9b3518", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f51d7dd-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877930, "uuid": "b8238f30-5f3d-4eb3-893b-596bdf253282", "comment": "Malware payload (Mirai)", "value": "b49d11038e9624bdd41251b3ca94b5f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877930, "uuid": "7b4dc7bf-0a70-4a84-9848-4233c8a384b3", "comment": "Malware payload (Mirai)", "value": "21ff453e9ccccde761ea72c8d8df756e1bad5127beafd1bd5ce13a83b748e3cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877930, "uuid": "7d6e3dfa-cb9b-45ed-bb4d-cc1d5478ecdf", "comment": "Malware payload (Mirai)", "value": "657a05afed2d0e20ca1f403fa401702f935abbd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877930, "uuid": "666b86f9-3ccb-4ac4-b848-d3025b3ca969", "comment": "Malware payload (Mirai)", "value": "de267f568018d552c917686d670c94983d315b7b408009d954666db7c03eefc4568c4de2d2ac10aeb78ad35bab23b6e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877930, "uuid": "93531bf3-1302-451e-a3d9-e9700506071e", "value": "T10F830A07A98086FEC1C5D6B813FB6536C423F87D173B7296B3D8BE5A2E05E901E1D249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877930, "uuid": "8d3cf1de-0c7c-4f24-82d9-5088fe877960", "value": "1536:2WIPlSxqJtlAkkFk2OedjTKnhvpUA7CRK4dMraIn9X:xIPNJnrkFkJedPovr+RKAM+MX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877930, "uuid": "edbf12ab-a987-4441-8b68-a8febec2dcfc", "value": 83255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877930, "uuid": "ba525de5-d275-4191-bb71-2a2ee6095434", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877930, "uuid": "a60e38e8-8432-4d4c-bbe7-f089baa8d583", "value": "xd.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e112625-0842-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770921575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921575, "uuid": "01f100c2-e6e3-4381-b762-d30645238a1d", "comment": "Malware payload", "value": "ea05a6b311b7066e8550b8f4156159ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921575, "uuid": "55a9d34f-a0dc-46ea-968e-83d86d2eca72", "comment": "Malware payload", "value": "2202021d271eea5c2cd82b7c06299da17a51bcaf6e977ebb4bac3cb4ab38a999", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921575, "uuid": "e8f08dc5-f04b-477e-9749-d35537635760", "comment": "Malware payload", "value": "19732a5968d94862211fcf2c1784a77ac8d1cb23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921575, "uuid": "fcdefde3-ad1b-4801-8fd7-8e73323d3add", "comment": "Malware payload", "value": "a75320b4a462dd0dc194b30f5a3667a65381ccaa494d2c80cf8f1ed1d8132416f9f349e09fb5d931f90dec9729b14153", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921575, "uuid": "3b869b80-5d38-43d4-98d4-6a739464a7d3", "value": "T1B593080AAFB11EBBE4AFDD3309A50749399D5A0621B53F3A3674DC1CF60A64B16D3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921575, "uuid": "dbe992f6-3053-42d4-aa11-1fed00e0ba62", "value": "1536:N06MhCmxuwgCv5/++oTLsptH3uL0MFqFYC1Rb988160HRmLTt1HWZfqFX39wu7rv:NtYkLspCHHdUG4XCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770921575, "uuid": "4f52a7a6-cc2e-41be-b92b-4d4e23e33a62", "value": 89808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770921575, "uuid": "8b955fe3-cac3-4c58-acea-df2109b11da1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921575, "uuid": "0e063cf6-abc3-48d5-b00c-47657a7c5e62", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c2abf2-0816-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770902769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770902769, "uuid": "39d31e43-5bf3-47b5-b95f-934676487526", "comment": "Malware payload (Mirai)", "value": "b8096d06f401d63a4af932cc4360845d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770902769, "uuid": "d8a06a54-78f6-4883-901a-55182ca27090", "comment": "Malware payload (Mirai)", "value": "226e50be26433d5547aa78fe9fea0f44834be2f1d7ecbfc74727f08a005c9ad6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770902769, "uuid": "6376e243-9799-48b7-865d-31dec07d24f9", "comment": "Malware payload (Mirai)", "value": "11871a6222bc3cca49886e499f42aa9c1621896d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770902769, "uuid": "16c6cb50-030d-4f10-bd1e-6aa6d7ac118f", "comment": "Malware payload (Mirai)", "value": "3bdfbf0b54d69ae85883c67f9d4498c164674bb76c05e4cb404d5d1fda5e6a059f556d7d804d5f4b4aa93a7ad24386ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770902769, "uuid": "a868250c-3a1e-4be5-b4d8-3da8357544b7", "value": "T1ACA3299ABCC5C602C5E071B2FB1F918E371643A8E3E6B107CD196F29674B8970E3B255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770902769, "uuid": "65d3c778-f80e-4310-aad9-ccfb6a237402", "value": "1536:HHuYGhfYO6dEdNmQLp4n1yHdOUat62ADj20okDe5rBC1qvsX:HH5GhwdGNm/1y9Olt6vDjEki5rA4sX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770902769, "uuid": "1139b929-03fd-4463-802e-91d739f226a7", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770902769, "uuid": "d3bfcf7b-5e85-4cad-89e3-3c405e0e9307", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770902769, "uuid": "9f4e3814-29f4-46e5-b9e0-da787e0146f5", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84500db8-07e1-11f1-a129-42010a9c0007", "comment": "Malware payload (QuirkyLoader)", "timestamp": 1770880059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770880059, "uuid": "2719b8be-cd9c-4ffe-a8f0-a1a055c7ca2b", "comment": "Malware payload (QuirkyLoader)", "value": "2fcc13fc8c3837b0f69a274f59431693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770880059, "uuid": "6f180944-9ba1-4bea-bf93-05e7d538c5d4", "comment": "Malware payload (QuirkyLoader)", "value": "24a0dc847510d0bca39adbf95a9d543f149af04cd5bcaab7f3f69696d0a028da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770880059, "uuid": "281900b7-d06b-4044-9f42-4a8e719e72f6", "comment": "Malware payload (QuirkyLoader)", "value": "661406f41a0e9b7364deb0807caeb8010432945b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770880059, "uuid": "390c7174-23cb-41fb-9854-5bdf0e35a3f1", "comment": "Malware payload (QuirkyLoader)", "value": "18efa9f97ea0fe98a05417abee65bd4d9d1d8ad6b6a3aa8076bd839c1990585ed94b1a34740e76984316b15e4e6ba928", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770880059, "uuid": "885b1765-4712-42be-8ef7-417aca25dc89", "value": "T155B5BE65F3D82199E43BDA788B41E323D5B2B8221732A4CF0696134A1F77ED19B7B311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770880059, "uuid": "4b5b0797-29d5-4bac-921b-34f766ef5ab6", "value": "919cc231eb5ff2389c4ee51ddd70b90a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770880059, "uuid": "59b92ed6-328c-47b0-bd97-77a640271d8f", "value": "49152:1IiBhOPCAox7QHCnWrgiYdtCoRzLzVsOWVMkqKPaGKIIUY:zWK7QMXCoRzLzVsOWVMkqKPaGKIIUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770880059, "uuid": "8a777b1b-a886-4443-a8ee-737daf96ebed", "value": 2304000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770880059, "uuid": "dc35fb02-f648-4194-a023-9232d8558b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770880059, "uuid": "0c940552-a84e-4e94-9ecc-2137cb0bf098", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf4c133-083e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770919800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919800, "uuid": "bba9f62c-e8a0-4c6b-ad2c-38689a7aaf04", "comment": "Malware payload (Mirai)", "value": "59e37279b5da209c98a1d1942fd60bf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919800, "uuid": "90813e46-8b32-47eb-a14d-1ca9b15bac7e", "comment": "Malware payload (Mirai)", "value": "24d04d42ebbc0fc0d0c2218975ff628104f5bbdefc1a1deda9b53b9451c0d8af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919800, "uuid": "aac0a916-dd6d-4d22-b116-e3dae041afe7", "comment": "Malware payload (Mirai)", "value": "2d66cdfaf619204b3aff5f5782478bd022c7e821", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919800, "uuid": "1f325e3e-2654-4db7-93cd-6c753c2f9885", "comment": "Malware payload (Mirai)", "value": "9fb1fe1abbe1d9ac60ac29025faf43416153fb8b78ae5a3a82817b404c1de7eeee2d9f350d4017357795d9a14b3fc9d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919800, "uuid": "deec7ee3-2ed1-499b-9bc8-ab7e90d21dc6", "value": "T1B1B2DF0EC19E6D34F9D725795D49F2816BA09BAF3A71CDC01BC05A111A22B285FD8ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919800, "uuid": "118c594d-52da-4fe1-86d7-3f6e7828aca3", "value": "384:SOA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIodbM4uVcqgw0OqeM:SAApCdvwJr69VJoA8FZtxCo8GI4uVcqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770919800, "uuid": "cacb1c80-4ed4-4eaa-96d7-38b6f827e7ae", "value": 24444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770919800, "uuid": "2551eafc-35fe-4225-9228-a1569c4e1052", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919800, "uuid": "05a9d24b-6192-4a17-9ea8-c1997b1365ee", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8344ba4-0817-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770903446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770903446, "uuid": "08f8a30c-7ff6-4d7a-8799-6ff14f2efbcc", "comment": "Malware payload (Mirai)", "value": "73c732bf28077a6e2334ddf3f2c53151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770903446, "uuid": "fb3681ee-a81a-4d72-9010-ed9dbd6f3b1b", "comment": "Malware payload (Mirai)", "value": "258b80360c64a279df97f23375de8c24f2fa5d6aefe37108be6dc6d5d3e9bf5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770903446, "uuid": "84d0dfc6-7c59-4a2e-9385-6092fe5550f1", "comment": "Malware payload (Mirai)", "value": "f41d6bbb034def067e9d1aa6b1cc3e82d64d869d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770903446, "uuid": "39999b94-107a-472b-a1b5-cf61c711afd0", "comment": "Malware payload (Mirai)", "value": "a3ca8597c3285cfb0017a52c65ae28a7aea05740e0619863ffba81e49a74435389d660bafff54c39a3d427b3ae94f5f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770903446, "uuid": "efbf53ae-63f8-4978-aa53-7ea0205c0d01", "value": "T104B30899BC819B11D5D536BAFF0E518933138B78E3FA7113CE185F2A538A86B0B3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770903446, "uuid": "0f1c77b0-de18-4ffa-861b-889bc6a0ef1c", "value": "3072:c9W/CIC7nu3PEuofs48AsS1yv+e8q87aVXc3phW3akIeup74X:Our6hsS1yv817aVXc3nW3akTup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770903446, "uuid": "5364c384-56a3-4d4a-af4d-95f815d2b797", "value": 116256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770903446, "uuid": "f04000b2-6cb2-4734-b930-0976f1ea39e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770903446, "uuid": "9d90d8ac-af00-4222-8186-cff715ec5519", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5cb179-07e0-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770879621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879621, "uuid": "79177732-699d-40ee-aaac-b2cc50636907", "comment": "Malware payload (AgentTesla)", "value": "d245f89fda65f4ea8a85a4b73a49f249", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879621, "uuid": "79da2c14-1d02-4a63-8085-3abe47327efc", "comment": "Malware payload (AgentTesla)", "value": "25c8a578ba1572be7dae728d13ceb4937d0ba0108160801d5fc0f95f5b806edd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879621, "uuid": "905df5be-3eff-4870-a2c5-b4fb8e322f97", "comment": "Malware payload (AgentTesla)", "value": "d8dc1cf0fa13c6c2deb3df9efdd764fffaafc3e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879621, "uuid": "02df1b08-f653-41e6-b48e-128f87aa78e3", "comment": "Malware payload (AgentTesla)", "value": "6fde6f05aa67c0fa6f5edcd034b7b7a44b37af35ae3782efe83a38b52f38fdd61ae6d31baa5440eddb48a12a6c694578", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879621, "uuid": "12d06881-3602-4ac9-bb66-003fd1d626b1", "value": "T1F145BF0273C1C062FFAB92734F5AF6115ABC79260123A62F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879621, "uuid": "ee621ab2-96b3-4508-a0b8-b7654707e3d4", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879621, "uuid": "798e42ca-8ffa-4668-ad43-d9a4047330e4", "value": "24576:W5EmXFtKaL4/oFe5T9yyXYfP1ijXdad3RuIfpg72Yg:WPVt/LZeJbInQRad3gIhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770879621, "uuid": "cd797bdf-a4eb-46df-9208-d98610decb01", "value": 1269248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770879621, "uuid": "45166794-773c-4772-9bf6-4faaa05e35f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879621, "uuid": "92ec60d0-d489-48e8-8dd4-5913acbc12db", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ffb440-0850-11f1-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1770927848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927848, "uuid": "679e0c9c-dfa4-4b85-ad6c-a9a26fc0143e", "comment": "Malware payload (RustyStealer)", "value": "9319c2f41e9ec22cfd53afdd6693cf81", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927848, "uuid": "c9a5587c-899f-4ac8-93c2-11e1a19507d2", "comment": "Malware payload (RustyStealer)", "value": "27f9183b9694b9ea1e71283dd084570f5e57bac1a3b64988f7667a76617a8a7a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927848, "uuid": "bb545f08-2c61-4be0-a908-c23b86ef8c04", "comment": "Malware payload (RustyStealer)", "value": "0810b4be454682ac5511783bb26cdda11dd96a1c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927848, "uuid": "93e718e4-7965-4b86-a533-dc3465098efe", "comment": "Malware payload (RustyStealer)", "value": "497df307712a40fe1349150d5c093b6db6bd753116c117cdbf182b8636b7b0881c6e30c6c48beb45bdf39010f0d3d25b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927848, "uuid": "d486fb24-4101-4042-b927-464d1e2b696e", "value": "T1020622E6B89155E8CA058238EF5BCFE2D96739CC0756B9B316BC72543E848D81E4FE04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927848, "uuid": "b05bc116-03f5-40b9-9f86-34eae1d2b416", "value": "b25557f316c563f336766cfbc5e9ece4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927848, "uuid": "1c960ca5-e2d9-4292-bf46-acc222a8c788", "value": "98304:Q2c00IOXcXiubGJLHZd7LM8Hv2w6o2W8KWAiJBAeA:70LXcXiTDn1v8zW8KrWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927848, "uuid": "3dd576e6-dc4b-40b3-ab9a-24a4bdb09546", "value": 3721728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927848, "uuid": "11a6397a-2ff6-48c3-bc9a-8fe71fb0172c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927848, "uuid": "1106188e-5fb3-450e-a9bb-04d640386e18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5af4825-085a-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770932138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770932138, "uuid": "5224f999-dd9b-4e2a-af23-374ee95454d2", "comment": "Malware payload (ConnectWise)", "value": "545fad7b00c2fdf8d484b42ce9213e05", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770932138, "uuid": "7df20ea2-886f-4468-83bd-35358e11eef9", "comment": "Malware payload (ConnectWise)", "value": "29065f6b2ad4d908eacc6dec0b82549a469e13068012b990bcb3f8ed19c94aa5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770932138, "uuid": "bb0ba7ec-8ccb-4509-873f-1e571a10a364", "comment": "Malware payload (ConnectWise)", "value": "b870e3d7a465bb03905243dbafdcdeaf00fc8cc3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770932138, "uuid": "83856286-ee2c-4993-b27a-c66b01fc32e2", "comment": "Malware payload (ConnectWise)", "value": "c3de99cd50f8a4433e4e704e69127b4f08aecf6560ef6ce69117bd1108ac32a5db81d287f1f5462cd167a9f812adde5b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770932138, "uuid": "c04acd62-62d2-45fa-b98e-b3b3874b23c8", "value": "T131C61211B3E585B5E0BF0A38D87A86562A34BC049716C6BF57A4BD292D32FC09E31377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770932138, "uuid": "962cc758-e66d-446d-9602-e85a1c699200", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770932138, "uuid": "60cd8781-df22-4385-bcd5-17b22dbe9c57", "value": "196608:T1EfefPkMKaLNkbgDi4QlKaLNkbgRKaLNkbgBKaLNkbgU:T9WgDiHZWg1WglWgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770932138, "uuid": "232d6dd8-0f89-443e-a69e-6489b6b21473", "value": 12580920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770932138, "uuid": "a8e72a5d-b746-4d17-b8dd-e6201ce88e92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770932138, "uuid": "efd924f6-7c0c-4edc-9e80-b5a87cce2457", "value": "importantfriends.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3094e2-085a-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770932154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770932154, "uuid": "4c6478e2-5846-4b59-afc4-54baae0d7093", "comment": "Malware payload (ConnectWise)", "value": "d5817ec95ccbaa43e7d9837dc6a91d33", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770932154, "uuid": "aadb2498-ac91-4115-ab7e-a58d5ef9465b", "comment": "Malware payload (ConnectWise)", "value": "2b719e4d0d591e8903c8a5956a36a3b77202cae8807714d19b56cb635ab43357", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770932154, "uuid": "a2181fff-1939-4392-8619-1fee0797495c", "comment": "Malware payload (ConnectWise)", "value": "083f841f129d24efb383083924fbb091f777b390", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770932154, "uuid": "b033bdc8-1d01-45a7-a24f-66327b37f569", "comment": "Malware payload (ConnectWise)", "value": "6bac50b920ced7bdbc0a2fa83b53be89a90d55455ee6bfd1b8c2080b7141e80e29e0259bd7b5dc8a0dab610de84bd7ce", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770932154, "uuid": "3f826860-1602-47d4-bb16-8e05f04e3299", "value": "T120A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770932154, "uuid": "4aa00171-695a-4cbd-8cf6-fb19e987656a", "value": "196608:7KaLNkbgDi4Q8KaLNkbgRKaLNkbgvKaLNkbg:zWgDiHSWg1WgHWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770932154, "uuid": "e6ca47a6-6ba2-40a4-8aa8-97b51e5f3254", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770932154, "uuid": "bf7a53cc-edb4-464a-954c-1a1ba6722d77", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770932154, "uuid": "84266977-2fdd-46d2-8321-4ce4a1b23592", "value": "jjnpm.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3edde3f0-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877795, "uuid": "68741c85-794c-485c-b284-0bd02f5dd1c3", "comment": "Malware payload (Mirai)", "value": "1b21e51f04083d07cb2a09f28c8ee0bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877795, "uuid": "d88fb96c-f604-4af1-afc1-1c56ed28f184", "comment": "Malware payload (Mirai)", "value": "2b80891fd478d829fdd9e64bb012bad663379cf01f15c0afb422dde8dce58e57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877795, "uuid": "9bef7e4d-0185-46e2-8c86-a913309ba7f0", "comment": "Malware payload (Mirai)", "value": "558fdb0b788fc9f2aae6463b655acd72316f3cd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877795, "uuid": "cc14f088-b6b3-44a4-949f-5f3d94a436f8", "comment": "Malware payload (Mirai)", "value": "77d14f813da177c27451a47e319d2910827ea0c57b86cac35436eb8d9201304ce0339ff437685d2d54727a812b1947ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877795, "uuid": "65e4009a-d3d3-40db-a05b-637a1e8bd2ab", "value": "T18BC45D59F8809FA1CAD529BAF65D529C33130775C3EE720799245B343BCB8AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877795, "uuid": "4f5f93e3-792d-460d-b094-ce20f11bd8e8", "value": "12288:uu0Gco9Wu43/Y69qQwkxtUTxOgpEorrg:uu0Gx4vY6PUTxd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877795, "uuid": "487c0acc-034b-41d7-9c57-409076f8ebea", "value": 575388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877795, "uuid": "81fe4b26-4361-4517-a7ea-ee7c4ccde065", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877795, "uuid": "bd126edb-fccb-4259-8a44-3ce2c4662339", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfba367-07cb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770870410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870410, "uuid": "f3879dbe-573a-4114-bd51-d080dfb9df70", "comment": "Malware payload", "value": "6892ff98bf0ea47396cedbe9a272f427", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870410, "uuid": "084d7dd0-b2a1-420d-aa14-7a01457fc288", "comment": "Malware payload", "value": "2c13de78854b6c71ed6702c6a91a2348e061f0ec80e36219fd21fbc96af88c66", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870410, "uuid": "b2d025a7-d54d-422e-bd7c-36c46dab4ac6", "comment": "Malware payload", "value": "ee5be342b722c311e222cb8d870c1ee7cf031b1e", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870410, "uuid": "5f6f00a9-ec5c-406b-ba87-5a0247e0ab5b", "comment": "Malware payload", "value": "ef9e83b9bc4e2b67e4f052d4ea5673d818f0ec186bdeb6454e7de839d0311669710ad23cc9ce92d6c780590ce04404c5", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870410, "uuid": "22fab9f0-e6f5-447e-bb76-7925a4168c9f", "value": "T174F533E435D844D7CE8D7295AA36ECD1EC28CE8B6B4C527808722B9AF394B7354C15CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870410, "uuid": "56333b39-fc4d-4f32-bb67-9b5172ffb94f", "value": "49152:iKWQcYHVUi54KjgvRXXNTNfZYrc09CK7SeW+q8MwHu7wly8M6ywC8bMzAmbYzsP3:iuSIuRX9xZYrcdK6+O0hfbUbvYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770870410, "uuid": "ad99b38b-0347-45d5-ae89-1aa66cb03899", "value": 3347921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770870410, "uuid": "8e7f8c93-f391-4e70-8c58-1802a3404658", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870410, "uuid": "b9dfc10f-b5e1-4952-8363-869883971cb8", "value": "2c13de78854b6c71ed6702c6a91a2348e061f0ec80e36219fd21fbc96af88c66.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac0f002-081b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770904954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904954, "uuid": "9fe6ebfe-6ce8-44c4-9d2c-e8a96e1d2e52", "comment": "Malware payload", "value": "4d6bbe29b014670391d1545b20b2b8a2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904954, "uuid": "5f52e10e-2be3-468e-ae20-c531fc23fe1d", "comment": "Malware payload", "value": "2c2571ef28369514b8fe7dc2f8b76c2e7a35777c36dc42a1e0abe62e884f68a7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904954, "uuid": "1af6cdee-d78b-4cd6-91a7-e674977f8b3a", "comment": "Malware payload", "value": "9abc1c212ab31693ecde725e1efb6123031bea65", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904954, "uuid": "16de1f82-3bf8-4185-8c24-b08f43d711e6", "comment": "Malware payload", "value": "e7052d2f792b63ac70c02dd5247cbf3859ca52a78cb1ef418a8e22f1e7ee5d839ca7b1902cfa22e1a4b005919490f331", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904954, "uuid": "165f83d4-1a6d-440d-abdc-f527fc9e4b72", "value": "T17D635B53A9E0CC72E5704F7C8D28EA50A57FB9763D244216BF7C960D0F1A5C284A8FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904954, "uuid": "d32650ae-8a1c-459b-adb9-2120f27f38eb", "value": "c4831ccf6e98eede3bbbee112609ba11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904954, "uuid": "ffeaf242-7ec9-449d-b622-a2770e0f586f", "value": "768:Uv3mq1oJQpwvZlXhVkcDsaoi9P9TJKvaoStYARRQwfwiTys4BtIl82+hE8x:YmqMQoXhVN4aooJhDCSZyzel82WNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770904954, "uuid": "6aebdfd7-98d9-4d78-b168-f186a3768907", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770904954, "uuid": "24cee82f-8b70-445f-963c-c75975b59b60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904954, "uuid": "27304ae5-3576-400a-9e47-4a63c79897df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbf0892-07e1-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1770879993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879993, "uuid": "418589aa-a834-4eda-be5e-f254d8b62d0a", "comment": "Malware payload (VIPKeylogger)", "value": "2cbb319868220d4b28b27aa7f7876391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879993, "uuid": "ca85de6e-79b2-4f65-a010-063874091040", "comment": "Malware payload (VIPKeylogger)", "value": "2d3ca4aca6913755b07b879e5649a35564bf22c01e72f6e16b9b0fad6c1ce70c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879993, "uuid": "7d718f49-0f32-435d-a15b-033225fc04d3", "comment": "Malware payload (VIPKeylogger)", "value": "1a5df771a235d46f0e2b0b00e8bcee9c29a540d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879993, "uuid": "13c1c7e3-d2c8-4903-9caa-06c12750b9f7", "comment": "Malware payload (VIPKeylogger)", "value": "6ca4283ed8c31a8744ce1cd5fdd18aa1210492156a4608d0def49ca7603ad2d05358280563726014e2ba60eb4ac72794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879993, "uuid": "d446cb7b-78a9-40cb-bafa-ba4ab8664fb8", "value": "T186551218314CCE63C49E23FA5AB2E37553F44E6EE020D3668EEBBCDB7855B514948683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879993, "uuid": "afcd2f9e-8caa-4ae4-98b3-0ee7ca6a8884", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879993, "uuid": "7e692e98-5f83-48f0-bc84-995c0a5ca9e6", "value": "24576:NguQW76vmqiB6o/az+Xcdl0h6rR+e/v7KDlTDHKZXUUhJhfacVict/:6uXmS6oCzT0h6JIlCUUhJhnQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770879993, "uuid": "ba8e281a-cef8-4f4e-847b-84d45d8cec57", "value": 1299456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770879993, "uuid": "af93eeca-ce00-4356-b083-1b3e0651ce98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879993, "uuid": "5650e6fa-c04c-4ca5-8d26-d8f8534a3747", "value": "SWIFT_COPY_MT103_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2a731f-07f4-11f1-a129-42010a9c0007", "comment": "Malware payload (OrcusRAT)", "timestamp": 1770888070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888070, "uuid": "603f1cf7-38b0-4086-a31d-d0961423cf84", "comment": "Malware payload (OrcusRAT)", "value": "e4f4add9863ec1915b74d4d9aa499f0c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888070, "uuid": "dbc0085f-4057-481e-81f0-2d5424602826", "comment": "Malware payload (OrcusRAT)", "value": "2dc1310a2a0eb9b773d07ff527972aea4b150c3beae2a9cfa3e938cf122b1343", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888070, "uuid": "65426df0-60d5-4a3b-8aeb-447b7ac2e96b", "comment": "Malware payload (OrcusRAT)", "value": "c0cf838c24d8319d212d13d457ce5e4935f34093", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888070, "uuid": "9a096931-eab7-4cd7-93a1-aa8937ee83f4", "comment": "Malware payload (OrcusRAT)", "value": "70ce872a729ceaf1666f7e4bd88cbb04b0f64780d96b49aee48e2ab2975ca7494892d53a0e42b1abf08d3d1bada9cf12", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888070, "uuid": "96140862-188f-4a0b-a975-90715ad1a340", "value": "T1EB359D1DADA900BAD077D039CA930546FBB278222720AEDF13D1035D9E67BF57A39319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888070, "uuid": "731ead12-2ac6-4df1-9784-fa0347c51ae7", "value": "c65ed3a99850b1c3dea70f50ea322588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888070, "uuid": "6fe5efb6-8e1a-4723-8bf3-651b544dc085", "value": "24576:8yyjT7g4FwxPPATyiq7hJzxNOTMRyqUn9CiQ7:wT1+aTS7zTIqUn9Xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770888070, "uuid": "9803e679-ce36-4f4b-b31d-c6c94f655781", "value": 1129592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770888070, "uuid": "470abe15-3a45-4d6c-9fad-1d36acafa18d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888070, "uuid": "52639ea6-d281-4c0a-bf44-06561c296550", "value": "task.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b31b581-07f4-11f1-a129-42010a9c0007", "comment": "Malware payload (OrcusRAT)", "timestamp": 1770888043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888043, "uuid": "19501940-6fcd-42fb-bcc6-d91f546367f4", "comment": "Malware payload (OrcusRAT)", "value": "8746bc1866357510a772271a91175794", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888043, "uuid": "13a0910c-e282-44f4-99d7-ecb9faefc294", "comment": "Malware payload (OrcusRAT)", "value": "2ed1e219132beb9f057dfa6c27c83d094a886331d224215ce597bbb3e3b6f84a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888043, "uuid": "88dc92ad-1beb-4e06-a985-abffc47011b9", "comment": "Malware payload (OrcusRAT)", "value": "9a2d414ad44b97f38a8935a90c29255943a71f63", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888043, "uuid": "06bda990-e9e7-44be-836e-28be5e44b545", "comment": "Malware payload (OrcusRAT)", "value": "fcd669378b1e8799abfbc840766664abd9d74108ba1699a5d6add6870d395b4f7fb60d0fe56e19448ca56c49cd7f908e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888043, "uuid": "32c87564-0031-4de9-bbb9-c14f18a71f98", "value": "T1DF359E1DADA900BAD077D039CA930547FBB278222720AEDF13D1035D9E67BF56A39319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888043, "uuid": "d31d2637-34c6-4f8e-82e4-da4d2084aa78", "value": "c65ed3a99850b1c3dea70f50ea322588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888043, "uuid": "424e0f2a-7700-4ea5-add0-8f539b7f2410", "value": "24576:8yCbT7g4FwxPPATyiq7h+FxNOTMRyqUn9Ciz:AT1+aTSkFTIqUn9Xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770888043, "uuid": "3affccef-ef3d-4c08-a29d-c233c4c9019b", "value": 1129592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770888043, "uuid": "23d84ce3-d3b7-4451-917c-f735350682ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888043, "uuid": "fa6b1ece-6cbd-4630-bddb-be9248613899", "value": "task.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d072fd-084e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927014, "uuid": "4f99bb81-4bcd-4892-a407-76139f333c65", "comment": "Malware payload (Mirai)", "value": "7d5bae6724d59093a529dd97b3c75675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927014, "uuid": "0e103d20-d081-4096-9cac-0bde57ad3a90", "comment": "Malware payload (Mirai)", "value": "2f62a6e01b12ff9045caaec15c3c0a6f5a4e405c7995c07c59ac2e6e95ebf4b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927014, "uuid": "7897826d-d621-4b7f-b43c-d1e016d44e88", "comment": "Malware payload (Mirai)", "value": "c58b59b5767222b3a855795821c4e21c6e25d4a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927014, "uuid": "dfa1d530-e8b7-49f7-aaa5-4cf784a9e01e", "comment": "Malware payload (Mirai)", "value": "fa3702bd355eba0cf476c4733b8d4bbbdd40fda6b61829a82819fc7d105f99b8b9917ec4ee5f7b3054fabb10e3e3fe52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927014, "uuid": "cb68a5cd-97c0-492c-baf2-e1b908d0f9ce", "value": "T191538C7BC9796E44D25881B1B8B08E742B63F080914B1FFF1A99C67A9087DACF6053F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927014, "uuid": "f902f3f2-6bb3-47c2-ada6-9b54376ee25a", "value": "1536:XlaMwtZivFfWRKmvCK03BjpdVGa5NiC+eiyKgBs/F:VPXv5WRfvl07JNisHTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927014, "uuid": "7d1d7fe0-ef45-45f2-a1df-7abf114070da", "value": 63100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927014, "uuid": "cfef420b-bbbe-47f2-b506-ff90daa1166d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927014, "uuid": "5e447b33-b518-42b0-b858-091ad8798033", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52682e9-0844-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770922688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922688, "uuid": "2a413504-40a5-4a7d-9b1c-67aef561ac23", "comment": "Malware payload (PureLogsStealer)", "value": "73c9e7a4dd78119ce0fd72562a72a23c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922688, "uuid": "b09b8b59-b8c5-439e-a961-2fef1be3c770", "comment": "Malware payload (PureLogsStealer)", "value": "2f80cc0fa8d8814e979d7910ddee88e84ece46c1110b7c9f564437bd41bea85f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922688, "uuid": "cce1b961-414e-4e49-806f-0eaa4dc18c36", "comment": "Malware payload (PureLogsStealer)", "value": "c708d644c21ccc56f6051460b8635ab723d74886", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922688, "uuid": "bd47719e-18ff-4a3a-ace6-4cd4cf342dec", "comment": "Malware payload (PureLogsStealer)", "value": "512939f3a6109199b9253112cf7f23b970707e67337837454a964f8d00e025aa456080d97170bb4f9b96fc2b00c41c9d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922688, "uuid": "0451797f-41fb-4f90-b27f-37f4a9b5b707", "value": "T10013B86D495A7311ACF31CEE54FEBCE594A8C0F070397067FD1A2623D39053E6AAA58C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922688, "uuid": "7fc46ca5-f207-461a-9844-adb57a606687", "value": "384:ixVw8IvVnaQMboGUZCb7DL0PhVy8EVWV4i:ixVHIvVNMboGUZCbfL0PhVy8EVWV4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922688, "uuid": "8c8eab6a-7dd4-4db5-ab4c-7b37a1cf0c6f", "value": 43702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922688, "uuid": "a7e82455-7db8-49a3-adef-ec52cf5353fc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922688, "uuid": "4e697fc0-7e7a-4d4a-b94d-e871f9eef1a4", "value": "mm.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27358139-07f4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770888063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888063, "uuid": "e9c64088-dd08-4451-9c3c-aa53ccf9d2b7", "comment": "Malware payload", "value": "f96bda23bce10e92e1982c14ad53293f", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888063, "uuid": "e1177598-ab30-48c6-9088-dc9927d49f5c", "comment": "Malware payload", "value": "2ff69274741ab3042614c9cd329646744cd9a5573bc82a677bfa1db5e5581b69", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888063, "uuid": "2b3cd5ba-aa9d-4c5c-8218-34487196cc65", "comment": "Malware payload", "value": "d42e5d0588d9050de17c8cfe6369bf6ee22b0918", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888063, "uuid": "9f8e3e3e-91d3-45e3-93ad-dcd26bf88af0", "comment": "Malware payload", "value": "77202c87fd0c1d286664f306522d574e7fdc6e8bdf56274a97bd51d31fb1da2a7b36b9f6fd8aa076ed24eceaaedd9fd1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888063, "uuid": "aa799645-07be-43b4-a6ea-e8da58d6b423", "value": "T104161120CA26CD94062C921524A60E8B26800EB75C14777A3F8F9F8E5F4F95F94797FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888063, "uuid": "b7b29ccd-4dfd-42b0-b89e-df07ab3fe964", "value": "49152:ixgBOQB+irqyUaEcUcwDiNRjCr6wHl57htp5D2wJPr4bvK45n7322:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770888063, "uuid": "33771157-0e44-4af4-bbb0-d77a4e3228e8", "value": 4245856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770888063, "uuid": "64dbeb73-cdab-48d0-9965-78a91c3d57fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888063, "uuid": "7caa55fb-c294-4075-9aa0-53c67d34db82", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de3ba6c-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877927, "uuid": "637ca806-4708-4226-967a-7f899466f203", "comment": "Malware payload (Mirai)", "value": "3c582e406ebd11a7ca450536e26d514a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877927, "uuid": "3016c22e-d54f-4be0-922a-b935adaf496a", "comment": "Malware payload (Mirai)", "value": "3235b88f5d366b326673c8bf0c1cf41400f073bf4410631834d89daece023cbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877927, "uuid": "4bb42a6a-dae3-49f8-b0e8-52c7afb7063b", "comment": "Malware payload (Mirai)", "value": "038823081e97e6c1e2311355d221d741ca5dd814", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877927, "uuid": "c532ddab-7b70-4c7b-a850-40c010588e80", "comment": "Malware payload (Mirai)", "value": "4e75bf117ce7ac918e6cd16a25901c71c945ea4b7e595fc5c30be37aac15ad5cb428acbda8a642ad6177f7b1aa0a8830", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877927, "uuid": "faef8a5f-7fc4-43b6-9933-0bae6487bf0e", "value": "T1DEA33C4168518A53C1C21777BBAF415D3722AB68D3DB7302CE146FF42F87A8E0E3A656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877927, "uuid": "c223c5e1-0569-4062-8ec0-443708a856f2", "value": "3072:dysAW7tH2oLmpMguHcUjVUHalw7W5uH0AsfCimMhL1iuzIDPIWAWRjXPuafY9VF:dysAW7J2oLmpMguHcUjVUHalw7W5uH0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877927, "uuid": "b56c8e39-25cc-4303-89cf-ae7cd213754c", "value": 103396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877927, "uuid": "d4eddc2d-34fa-4de8-9018-f664ffff75bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877927, "uuid": "5512b933-3d25-4cdd-8b5a-f2485192f97a", "value": "xd.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32334197-082b-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770911704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911704, "uuid": "1ce89880-b30b-48f4-9ab1-18d4d2336822", "comment": "Malware payload (njrat)", "value": "706969ed938c0bc0a96f5ac94fd6ea46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911704, "uuid": "a215c2f5-c4df-4040-a7f9-2fa9aeaa1997", "comment": "Malware payload (njrat)", "value": "32cc6624192e6882d959793c887ef9e116aedc68ceef1ec8d4dbf11609d00d02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911704, "uuid": "2a95c6a7-9873-44b2-b4eb-f001bf1cd550", "comment": "Malware payload (njrat)", "value": "d1f5949b27a32455c360de935651c31d30bb12d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911704, "uuid": "06d75973-373f-46df-9112-766bd0d3a1a2", "comment": "Malware payload (njrat)", "value": "915098da00d1b27d42869b3dad27deea2acc16849d72b8a84fa3142128591663190555d51d2840d4f7741f656cbe7bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911704, "uuid": "60ce0301-cae7-4864-988a-b0b3b20e7107", "value": "T11CE23B4877954312D6FEAFB52DF362061270D517D923EFAE0CE485E62B67AC087803E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911704, "uuid": "70e8a2d0-3b5b-46a2-bd89-324d24efb7ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911704, "uuid": "b2641e8c-aec9-48de-b3c7-20183c4c7596", "value": "384:RcmKc71F3BUaMbGf/JLbFt3Tm2eaFOYKdRApkFTBLTsOZwpGd2v99IkuisVVFxOJ:Ka1LxMC1Jt3Tw4xKdVFE9jKOjhaxb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770911704, "uuid": "22832a75-d388-4894-962a-d1a6eafd1aef", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770911704, "uuid": "796b531c-3ce1-444f-8be0-3cd1226bf539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911704, "uuid": "f3a1b73f-6ec6-45a4-9b2a-3d5091cec900", "value": "32cc6624192e6882d959793c887ef9e116aedc68ceef1ec8d4dbf11609d00d02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98eb6de-080a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770897784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897784, "uuid": "f9fd0b50-e206-4c6c-a2c3-274245901a31", "comment": "Malware payload", "value": "8ad19acbc6fed05122935c9c6812c4ec", "object_relation": "md5", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897784, "uuid": "8267dd60-2906-4d48-a2e5-e46e95b14b5d", "comment": "Malware payload", "value": "3477260209c72d9fcf1bffd50268b1abe96493a61543dc4d4e266a85b5151818", "object_relation": "sha256", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897784, "uuid": "98250e05-112a-4d45-9ecc-002d566a434c", "comment": "Malware payload", "value": "88c9bf4632f7446d9a4f745ed168f22363059c39", "object_relation": "sha1", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897784, "uuid": "3091aa7d-210a-4569-86d1-d39f60a32ea0", "comment": "Malware payload", "value": "a087a3ff74b7335da92edb5966f365547098f0a3d16efc0bca6b428db9f1b92a8dc3bbf73fb0cfe903da9c1b4cc5ef7a", "object_relation": "sha3-384", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897784, "uuid": "56516b52-10ff-4fb8-8ea7-e5267772420a", "value": "T15A548D16F66928FDE977C47DC9424905FA72BC4247B0E6DB03A04BA61E236D09E3FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897784, "uuid": "6affecb9-d2d1-45e3-a2e2-d04e56b377e9", "value": "3c91f4b5b3c9206a4b159adde10dd572", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897784, "uuid": "69aa8338-5083-423b-bc63-e3a0266d58aa", "value": "6144:W6QKVRXSNsikPp7j6r5dH+mwoCno5PD+VIa:NvRXSNZspir5demwoOoF4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770897784, "uuid": "ae8c8dd0-dea2-4d6c-9c25-2bde068cde2a", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770897784, "uuid": "6452f38d-7b9b-4f9f-919d-2da62a52f1d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897784, "uuid": "80100e7c-003b-4c82-88d8-d1abe97eff4f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49716f6-0835-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770916191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916191, "uuid": "5ff01c00-274d-49f1-8020-d2b563a6c589", "comment": "Malware payload", "value": "d8639344f3a604df748dd7459b49f0eb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916191, "uuid": "781d2b4b-9a23-4766-8bc5-38b9130af610", "comment": "Malware payload", "value": "3529b005e9e461139af037e3a42c5abb35edc5f159ea5c8c08fb5bbec49203a7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916191, "uuid": "163cb64b-7bec-459c-b5ab-d13a24de27f3", "comment": "Malware payload", "value": "49096b44b648f7dbebeb29abf81134d2bfd3ad92", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916191, "uuid": "b83dc6d2-5f03-4191-bd7e-ff386f1c7efc", "comment": "Malware payload", "value": "12b1d3f941c46da8376e363555e844aa21100460ec22949ccf6cbf3419bc3b0a6bf5d1dc939bbe2ee6f710c771d78846", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916191, "uuid": "e841f061-96cc-4790-937d-42c725ba0a76", "value": "T194D182127A82E199E6B5C3F5ECC3B141FD7990AF5866320C77D882412FB6B274B8A04D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916191, "uuid": "485142af-7527-497a-9dce-c64699e457d1", "value": "192:ru04kKiMcB0kJOEBF4aG7S5H/0csLqA9nM:rlrT0kJOEBFU8H/6qSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770916191, "uuid": "78611ff9-5172-4fe3-b9e8-870a39b18ffb", "value": 6594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770916191, "uuid": "c6900d11-57e9-46d9-9467-4ae278b5b1de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916191, "uuid": "6215feef-80c2-4f4e-9a8d-98ab87bef439", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5debd90-0862-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770935601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935601, "uuid": "0e9ab0d1-59d3-44c3-aa9f-3bea8aa53da2", "comment": "Malware payload (Mirai)", "value": "dbaf8c7e44505603b1af9fde3643c86c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935601, "uuid": "8b05372c-845d-4099-8302-0ac05ff04fde", "comment": "Malware payload (Mirai)", "value": "38722f0758758187c7310e3e7675e3b4795eeb488ccee5b4e0816b582b05ea6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935601, "uuid": "c58d68dd-319d-4144-a3b8-918a31a9082e", "comment": "Malware payload (Mirai)", "value": "75fa02f8e6be8fe4360778c1a60b60f678dca277", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935601, "uuid": "9180e438-e1c1-4902-acbe-5372fc3ff302", "comment": "Malware payload (Mirai)", "value": "60523a18803f44c99036d2f2b61f5836fc6d5e4a51728ccad2eaa228a6c494f10093339d0e7af3e07396c7bae8c317fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935601, "uuid": "0dec076e-5c09-4109-9507-2c5f10262e43", "value": "T12B143D13BB324F90D351D6724BB38F5959EB02421EE258D5936CCB103B207AA689BFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935601, "uuid": "f429b4cd-a389-4845-8b87-2e030ca84829", "value": "3072:pemsGDRxzu0vFd02fdk2NXN42maSHwaa8THiG+mGIyJuVmqO+ppk:p5DRxjvX02flmaSQaaQRHGHutO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770935601, "uuid": "cfc67510-5be5-48f1-a1cc-f73c722efa82", "value": 193092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770935601, "uuid": "774be5d6-3473-4203-b61b-853d9b80ec22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935601, "uuid": "7a962cd2-a196-43f9-9140-f1f1c26cbd68", "value": "data.mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead64f4a-0862-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770935636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935636, "uuid": "e1fdfcf5-3d5d-417b-8b42-8c6aa611cace", "comment": "Malware payload", "value": "48119b5a32fed0fc7a9a7e9e07287179", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935636, "uuid": "41b7e864-e910-4a66-9306-629558bdb4d2", "comment": "Malware payload", "value": "3a0655a9973e8d7600f228240e1c3494b0acc55f46f218f42c12138d8ab73014", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935636, "uuid": "fecb7396-a4b5-4c65-a7e3-318f61b33f4b", "comment": "Malware payload", "value": "f53668f06991e2e15a8bdf4cd899ec4520b8e31f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935636, "uuid": "083aab6d-3cc4-4b9e-b488-e94f9c6e1d1c", "comment": "Malware payload", "value": "2ae5d14861b3b3932c31b8f10ac30113c7d8577f134d6385e117770d771b53a2b817824cd6dc01a4ead5e1a7cfb18660", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935636, "uuid": "1b371e53-8866-4a7f-a676-605dee763436", "value": "T13735D04633E44A68F8BC8B79856554E543FFFB06AB36DB0DAD0940EB0C26B51DF41B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935636, "uuid": "e7b2fe91-eed2-4886-82f0-d45e1bdbf05f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935636, "uuid": "15475fc8-9ff6-42b6-b325-95ad56573c0f", "value": "24576:DgfZNC8ZHKJCX0fI8mVS7UsjF3leaMgOk2:SZWWgI8mcwCcIOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770935636, "uuid": "ffa28507-7aa5-42a2-a4e0-b0192e1d14e0", "value": 1122304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770935636, "uuid": "0f258763-8076-43ed-b879-caaf96cb9c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935636, "uuid": "57759dc8-dba8-4ddb-b545-8dd73bbd3cfb", "value": "Teklif Talebi 226200263 xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c362f99b-080a-11f1-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1770897774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897774, "uuid": "693f26f3-5fc7-487e-9d28-ea30eac5bbc9", "comment": "Malware payload (Amadey)", "value": "4c6c68cf1389ae4692ea240c010a596d", "object_relation": "md5", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897774, "uuid": "49156095-178f-468b-bebd-e1429ba26e83", "comment": "Malware payload (Amadey)", "value": "3a4438a7241d8f75f723a4252c5ee308ea6ef11db7df4a00d6b3b446f509e138", "object_relation": "sha256", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897774, "uuid": "1915cfaf-43f8-4e53-865e-dda3efa72bc9", "comment": "Malware payload (Amadey)", "value": "09ae39a8462d485d22eb65dd5919ff3f3f7e6c71", "object_relation": "sha1", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897774, "uuid": "81520b99-5f19-4f69-ae7d-a14f11080168", "comment": "Malware payload (Amadey)", "value": "2e4d1cd2e54c472be0ae4ffa79eac8f6dc2693fcc689349f1dc153365b22fada977989d43c4e36c18d683697386efa77", "object_relation": "sha3-384", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897774, "uuid": "a063acd2-216b-4447-bd90-6881d34ac10d", "value": "T1BE557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897774, "uuid": "e244127f-1bf7-4682-bd75-707f01b78a18", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897774, "uuid": "387f6a47-89f2-4ee9-a28a-3ea320f493f5", "value": "24576:nrR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRFEOnW:nkHmiyCkhh2Bamituw+UDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770897774, "uuid": "85189659-8082-4e1f-91fb-c6481878b939", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770897774, "uuid": "fbba0c1f-d291-433d-9511-c646de77d397", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897774, "uuid": "cb6c9e2e-a97c-48c0-9939-2a62aa14cd38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99cf713-081d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770906026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770906026, "uuid": "2ea35497-b013-445b-9d31-f6c3a4e9420f", "comment": "Malware payload", "value": "e8d2974f4e1bbed7889e17bb75106e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770906026, "uuid": "8ea27487-c00b-4cda-8992-7cefac27be24", "comment": "Malware payload", "value": "3b071c7438a14fff3e93c462d896552fb637b0e3f8a494aa25e57cbc4b2f78d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770906026, "uuid": "01de2b78-83ce-41ec-b9cd-1383ea7e87ad", "comment": "Malware payload", "value": "b820ab6aa2ab98b5274b16a74c7074d8bcf1a747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770906026, "uuid": "3b6be0f7-0173-445b-abfa-aa59bbe3a74d", "comment": "Malware payload", "value": "29d4bde59430b9401f5eae235c04fff8e91a05702df8369e8640fbb5b51db58b0c4908df65f6e490a4b25350990a686f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770906026, "uuid": "39a523f9-ac09-48e8-9eae-8e27c4a27c15", "value": "T1C472D62B99159BF00A7E3260A59B6C1AB6500322B930795C3C4FC9AD3F36A14CFF54ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770906026, "uuid": "2974f840-0221-4727-bbf2-003e3cefa91a", "value": "384:KHDPrT4UcwkIp351NLxsaS48dVr2rwPb2Ct/PgsV:KjYXIp3rSh13v/PZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770906026, "uuid": "33a3e5d0-8e50-4219-8760-f6d7a3e3c561", "value": 16243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770906026, "uuid": "3a5f5682-2bc3-4d1b-b6df-c86f69388e8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770906026, "uuid": "7e523159-5a30-4ecd-976b-e154ba06695e", "value": "Sars Letter.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e8ab96-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877803, "uuid": "f3081759-2a7e-49c3-bb63-f76aac4d3771", "comment": "Malware payload (Mirai)", "value": "cf42ca6037e9a2366c3e90de395efd1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877803, "uuid": "ed8b15a1-872d-4b87-9e9d-f361ffe97e04", "comment": "Malware payload (Mirai)", "value": "3b394165aefbaf8f7b3a0acbb253581259359f4fc68fb60283ede12edea3b273", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877803, "uuid": "fd3442a4-e2e7-4c14-9b73-1c9bf9b36306", "comment": "Malware payload (Mirai)", "value": "811658a3cec5ab0fe2a3644ebdfe7596e191373e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877803, "uuid": "01bcddf9-47b5-4592-b214-04247e088275", "comment": "Malware payload (Mirai)", "value": "964ad9b56ce72c12903867e09f1175660343c0a8ee589f8db9562c99d1f519d8ad72f5b1ea9280571247feb2a77b1bf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877803, "uuid": "0f2fd4e9-03aa-4d27-ab71-071d9b893ab5", "value": "T1ADF31856BD428F12C2D726F6B7AE424D37176B78D3FA3103DD24AF51278A8DA0E36640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877803, "uuid": "f95314df-f54b-4f66-b539-00460a020c04", "value": "3072:5JABn9wQbqmiNJqLZclqTMO99lvYyPc1qP2F4rEjnp:5SR9nbzqMNMO99lv1PLP2F4Ijn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877803, "uuid": "a37fc015-78c7-4b80-a48a-c2e62706f156", "value": 166060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877803, "uuid": "75bcdbfc-bda6-42ac-883d-5831f5889c33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877803, "uuid": "1c7fdde4-b702-4fe8-b400-02ee598e0f61", "value": "furry.arm5xc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3e536a-0836-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770916658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916658, "uuid": "53dbbfe8-88fd-440e-a82d-169a5ecdebc7", "comment": "Malware payload (PhantomStealer)", "value": "8008e1891eef1c9051cf4e0654ebb32d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916658, "uuid": "c5d4c320-11e8-482b-9d7e-726fed1fdec2", "comment": "Malware payload (PhantomStealer)", "value": "3c23073583bd33a068be551134983e7958884cb7656a4da03d9cc737b262f1ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916658, "uuid": "107c5c12-abfd-418e-9f44-24c1b4749b4d", "comment": "Malware payload (PhantomStealer)", "value": "8fd2981d6f4fd1cced66ad4b5be0c5e4c2b77c64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916658, "uuid": "37c8109f-bb27-4312-a374-1d65c9458ca1", "comment": "Malware payload (PhantomStealer)", "value": "2ff53ce6177b7d0837dd45003b2dcb6404ffa44d887b54101dac5b9dccac99a0248842882f591abee0f4e114ff0ff9eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916658, "uuid": "890498f9-f3d3-4331-baab-02c7015b7be8", "value": "T165752220239DCC62C5AA0BFA24B5D33053BA5D5AF113E306DEDE7ECB3926B924D14653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916658, "uuid": "56249269-0db8-4179-ad66-3b7f943647a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916658, "uuid": "87f506e4-9602-4d27-92ab-2bf3447d163c", "value": "49152:szHIu6sN+qLGvq/+RtbWUQpJ3fuStQ24jl4kHqeQoQcw:U6sN+AGTiDfuUkdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770916658, "uuid": "e70d2697-6a06-41dc-b952-3e5d16791c93", "value": 1608704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770916658, "uuid": "a948f4b7-3d1c-47f2-9059-4afc4a9c50f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916658, "uuid": "86d8366a-28f6-4149-84ea-3e950a0b59e0", "value": "Vessel Particulars_Invoice and Packing listpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e6dcb9-081a-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770904592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904592, "uuid": "7c745078-203b-4fa9-bf67-3b6a2390e111", "comment": "Malware payload (Formbook)", "value": "1f8715d769b879769fa4c65a2c9a9467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904592, "uuid": "3c50a67e-9d5f-48f9-95ba-54cd33573a5e", "comment": "Malware payload (Formbook)", "value": "3c97c9c3fd33f0deafc90dac2192ca8a44a44732368e02fdafbf35da539091aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904592, "uuid": "5d8fff8a-9af5-47c5-a943-1981bfc01750", "comment": "Malware payload (Formbook)", "value": "3a76adca3539964ce581e3f969cb17e446a8a09b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904592, "uuid": "5dfb0f9e-9969-4e76-98a2-7eea5c3520ba", "comment": "Malware payload (Formbook)", "value": "82f4431e7381326c41d1c35ac5597ee326c78cf2fab379875df5c6999e3580f8eb18654e19056208512fc29cffaf8995", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904592, "uuid": "fb22774b-c237-4f66-9fb4-7ae303896ccd", "value": "T19135120DB76ABE20CB684B77C413120C51F68597E633F3AA5AD61CE50D79B49C80EAC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904592, "uuid": "48a60f69-93a4-4666-82a2-d8fb1de1036b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904592, "uuid": "c340efaf-b213-49c6-8377-e2d21fe2a353", "value": "24576:XCZal6DRKKSeuqFp8ilnpdgny6acGW07lVSKQ:JodKKV7lyZmlVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770904592, "uuid": "c7314358-7e33-46d2-ac62-90b6b005d7ed", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770904592, "uuid": "c2e55e49-d450-485e-aff7-11a030889a38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904592, "uuid": "14db2d46-d7ee-4d98-bd95-ae96ca0015b6", "value": "Wonjin_P_Shipping_Documents_Feb2026.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92da1881-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877936, "uuid": "dee51af7-6abe-4cd8-8a5e-3a8df59ba07a", "comment": "Malware payload (Mirai)", "value": "ec2fb9224d3eb9d1258d50da40243108", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877936, "uuid": "49a95a69-95ed-428b-97fe-96264e76381b", "comment": "Malware payload (Mirai)", "value": "3d07705fe19d70dfcc6a8bb35ce2139ac62cdf11b3b6d70b6d1f22ddf27a059e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877936, "uuid": "aacabb3a-39ff-493c-8a6b-79c52749dfab", "comment": "Malware payload (Mirai)", "value": "17f048c45902efba620779c44640707260c21782", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877936, "uuid": "ac6c1fc4-6ba3-485b-8687-f55a8c1a47b3", "comment": "Malware payload (Mirai)", "value": "40ca8633feb4186555a1a9904d9e56303eda76948ae3565225a3ba6b11a934f479845919457a4d150d6a1ddab3ab287d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877936, "uuid": "5ff76a77-d9ee-487f-afd5-22aeb459d5da", "value": "T1B3D35C46FA408A13C4D61776FAEF41493322DB58E3DB730689185FF43F86A9E4E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877936, "uuid": "777a5d67-c98e-4951-8ea2-2a40ccf1ee8d", "value": "3072:UHDKAIo07ooLmpMguHcU3VUHalw7WbuH0gsfCpnhLI/U9xtTOghnsCjyj7+c6kMR:UHDKAIoEooLmpMguHcU3VUHalw7WbuHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877936, "uuid": "861e0c3a-684a-4890-b2e1-f879c6dc5390", "value": 140665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877936, "uuid": "f0c01b32-8c42-4971-80cf-d02a5d2e65c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877936, "uuid": "104db6c2-77a4-496f-a8fa-8bcaf0ff8506", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fd83cd-07b0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770858855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858855, "uuid": "627c4bde-9b6b-4c5b-9302-27db689b936e", "comment": "Malware payload (Mirai)", "value": "0014f50b4c52bded352e8d18fd957546", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858855, "uuid": "b2549b8c-10ce-4045-be8e-2b9072109d45", "comment": "Malware payload (Mirai)", "value": "3d1672c424effbd0b52f2c68431aba1e99dfd9522bdb531cfec2117355d4593c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858855, "uuid": "1dddcc65-046e-4fc2-839c-4149af4aabff", "comment": "Malware payload (Mirai)", "value": "ec88444f2ebd9b3613d6345121ba11bf73939df4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858855, "uuid": "a115b6a3-d450-4ea7-827b-03a12ba6a5ef", "comment": "Malware payload (Mirai)", "value": "f4c520a6ca9010f77c4d777f2a72c8ac12d3413c04c737ad77bbaa0fa134fd21a8daaa5700d9e847db843f55031f3f96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858855, "uuid": "85a7c249-40b3-4ebf-8153-cec0a2965388", "value": "T1CCA31886B881AB11C5C5177BFE1F118E33134B6CE2DEB3528D18AF6477CA91B0E3A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858855, "uuid": "9d46ea5e-e671-4fde-bb53-4cbc8f4d708d", "value": "3072:T5fHq/EUroLmpMguHcULVUHalw7WLuH07sfC/maGsUsiwsnCaIiw4azgsXPER:T5fHq/toLmpMguHcULVUHalw7WLuH07Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770858855, "uuid": "e847c711-43ae-4fa7-8829-8a22bbcae392", "value": 99632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770858855, "uuid": "d5d50e63-9cf4-4282-8bf0-13cb137e034f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858855, "uuid": "683bbdf4-62d9-49b6-89cd-87ff56834348", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31633579-0858-11f1-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1770931030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770931030, "uuid": "1dd71156-32e9-4eb7-b28a-0cdaa1499009", "comment": "Malware payload (GoProxy)", "value": "09334d1bbe3b29de0549644c7b40e4a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770931030, "uuid": "c38357a9-ef18-47f5-9581-0d2bfcb4081d", "comment": "Malware payload (GoProxy)", "value": "3d4c930095db4acb818fce8a928d3f1e9add6bed17169ac0f48d02a0eb901b05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770931030, "uuid": "7eaa7fd6-fafa-4d25-95d6-b6da3e49bfa0", "comment": "Malware payload (GoProxy)", "value": "cad2c65915a9ac285b7145f8519a858efad7fa72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770931030, "uuid": "0471aabb-d3de-4fa5-8e68-16dadbcc5f52", "comment": "Malware payload (GoProxy)", "value": "1b8d22fbd208f4c9b84d1809692825f19dee3e8860b4d1843f930ded4ab0b43cd2d4ee5fe407481f7042550b566d8e44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770931030, "uuid": "73c1c4da-9a34-4928-9aa8-7a12f3a0759d", "value": "T12E664A03ECA545E9C0AAE2358A639253BB71BC485B3133D32B90F7292F76BD06E75750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770931030, "uuid": "ff421df1-4481-4e0c-873f-e7d29e9beeab", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770931030, "uuid": "63447074-f050-4d3a-bffb-4f20efc80186", "value": "49152:BFz3To+0cUUGMh74DfH3JTR/5PZPg25mY3EZr0c6UCGezDS3dI5jZQ9XU1lfKiK2:BdVKzX5ZF593YrKhadP9mbrENM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770931030, "uuid": "4c315e5e-bb0c-48cc-be05-84efb8a73e1c", "value": 6673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770931030, "uuid": "f79f03bc-65e2-4224-bad8-9f85f3d0d9a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770931030, "uuid": "3571b72e-dd76-4439-8310-c2571b65b3d3", "value": "f12BhQB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f896f9d-082f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770913552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913552, "uuid": "6608c3cd-15fa-409a-b14b-5ff2394f9cc8", "comment": "Malware payload", "value": "d0c8ef56873fd775e887f8615ca537d5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913552, "uuid": "baad70f9-8989-4b4b-a1ec-363671304bae", "comment": "Malware payload", "value": "3da7acd6e7924ada32fb1de1608874e7df58fd1cb460608a45dbdb2caf544603", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913552, "uuid": "ccb47575-686d-42fa-ab96-f9b20fc662fd", "comment": "Malware payload", "value": "c6f150f81a253e5f5e6d00d2d3b0108f181d885b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913552, "uuid": "e051470f-bd8b-44ef-a763-f10af333ac75", "comment": "Malware payload", "value": "5218f75fa1a990b762667758854c38ad8a31ce71d51fa1b0d2848477a74fe3c1d8313a66110bbb0e3fdb2f7a7e62c43c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913552, "uuid": "af54be99-beac-4213-91cc-8aec02da3d42", "value": "T1049002224B1F08728A484DA4952A5275687A348930494143C5D428D584401055B79F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913552, "uuid": "fd5c15b6-b9bf-458b-b05a-8e04cc99be08", "value": "3:2vJcWtvnkdCWYeegcfB:aL5yqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770913552, "uuid": "8d268636-e5fc-4353-b3ac-6b1857241847", "value": 56, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770913552, "uuid": "f0763d3a-fe49-4d02-9214-8c62b5a954c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913552, "uuid": "0e8a97a3-3b06-4f01-b156-b9218960952d", "value": "3da7acd6e7924ada32fb1de1608874e7df58fd1cb460608a45dbdb2caf544603.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2a6da9-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877923, "uuid": "70c8152e-29ef-432c-941e-53f02c64616a", "comment": "Malware payload (Mirai)", "value": "e3af7b6594f9ff3b4f19cc82b082dfc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877923, "uuid": "9e205922-fed0-4ab6-9ffb-e498e1807642", "comment": "Malware payload (Mirai)", "value": "3ef5dc26fadfa838504642499dd426525c699ce5588ec67d67d6ea1b8b979ad2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877923, "uuid": "ca02c868-e47d-4439-a776-91a2979972bc", "comment": "Malware payload (Mirai)", "value": "306f7686db2babcafa43304ceb1a4c3fd653a326", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877923, "uuid": "bb997df5-7e2d-4310-81f1-d5c0a800a8c9", "comment": "Malware payload (Mirai)", "value": "e505a793b929ab1ed56da8b4ca6154461dac25a5cb99521cdd4793657d54c3c20ea9547133a5df295faaaafe654903bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877923, "uuid": "7d59e39a-5842-47ec-89b8-09b79d2e8989", "value": "T13C735CA6B5019F7EE48BDAF980E24F05BE20751198630713A667FDD36E322D4BC16F09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877923, "uuid": "2871c037-24f6-4074-a7c8-58c128c2d4f5", "value": "1536:FGwtfgNh6aGKynuw8d+7Gc5jg1plwBiQC0YyihQC9Kj8S49ZvfjRJBq:FIyudDWmp+YhBQCMj49ZvLRXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877923, "uuid": "a39e2d1d-1207-4e75-b241-36c9a05c0bcf", "value": 78610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877923, "uuid": "e041c8e3-05f1-4c92-9ab6-d16338af61f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877923, "uuid": "2ec16ad9-5ae6-4baa-be9f-07aaecc8fd20", "value": "xd.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45654a3-0847-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770924029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770924029, "uuid": "e09d4530-afef-44d7-88be-1e664b6ca0e5", "comment": "Malware payload (Mirai)", "value": "f528b6a9864751f03517cda9e5c5b4c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770924029, "uuid": "09bf7ff5-77e1-47c1-b48f-10961f6dc002", "comment": "Malware payload (Mirai)", "value": "40c890c41aa54fe7cbf55ea1bc51f37039a2a05cf6dbba5e838b4c75d17779c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770924029, "uuid": "fb6ef828-57ff-4c34-8aa1-7c3509e35a9b", "comment": "Malware payload (Mirai)", "value": "d274c96926a58df1bb551680c659b4f4a8a4541e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770924029, "uuid": "6b265451-38ba-484a-8308-f50b170ce865", "comment": "Malware payload (Mirai)", "value": "ae2e3137c2483fd063a2f0c067dd712b2cb534c1952dd95fe5b50b44bab15036cde76f4dec0b8cdaeb94b384dd7e445f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770924029, "uuid": "a64de53f-d50c-47bd-b710-904b8b5a3f9e", "value": "T119F33C45EA818A53C4D517BAB6AF01893332A754E3DB730689185FB43FC6B6F0E77602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770924029, "uuid": "da5b4068-4c67-42b3-822e-9d84b4751472", "value": "3072:48vYs1CFhq8Ii/sHx4J2OUMnQ12EXu48XzUQLhnIH7FiXHf2M/9lCOn:TvYs1CFhq8N/sRkxb48XzUQLhIHgXH+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770924029, "uuid": "2266ac4d-8595-4ef8-b8c9-af4d25b4fdf4", "value": 162505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770924029, "uuid": "d167e06f-c201-4112-a4ea-12c9a0b757b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770924029, "uuid": "fed6dc6e-a58e-4660-9b53-c52bebeca337", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14b9bf0-07e0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770879678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879678, "uuid": "747cae30-8d94-48ab-b78e-d465d46fa4ea", "comment": "Malware payload", "value": "ab3daf600719552869607a1ee9c92443", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879678, "uuid": "7e0ac241-22a1-448e-988e-4865d1a2d253", "comment": "Malware payload", "value": "44f426825b5f891900bda97d82487381f44a3564ad63841c7476279d519cca33", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879678, "uuid": "a3b958d7-fc55-4582-ba7d-7b68e20f4f59", "comment": "Malware payload", "value": "cfef2a4eac4edfc3a368e48e6e80cb3b870e2c12", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879678, "uuid": "e2ddee57-fed4-4bea-9cc6-4d3a4de65be7", "comment": "Malware payload", "value": "9a1720a4d92a98a461bf20a514a66ff8081eea524f39633a99aec7807bf13c4ebd67d1dea3951140363ee35900b6d1f2", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879678, "uuid": "8733cd3e-2db0-4bff-9c50-cf59b04f3aeb", "value": "T12AD412B70AC23E7EE99E04F30583B0F0B3904C128979B0652D679BDD8D0989D2A559FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879678, "uuid": "ea6a3e47-a733-4b89-b1dc-3cccffd8c8e2", "value": "12288:uSktl/NXlQBkUK1DvgdePJUK2vhxIHOvotDCjM/P0yQcWM4TTVLL4DckSS8qM+9:uJx6k71D4GU7vjOOnyVWM4TRL0DcuJ59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770879678, "uuid": "a4492a81-aa38-46bf-b98f-55cd98d43b65", "value": 633987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770879678, "uuid": "c90ac9e1-dec6-433a-a99f-0f22e38fd747", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879678, "uuid": "9f36a0f4-e1a4-4193-ac77-dda262f8a99a", "value": "purchase_Orderfeb2026.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5d071f-082f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770913548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913548, "uuid": "0c090a44-2265-430f-9387-3dd4ed7ac0f3", "comment": "Malware payload", "value": "e1a05ebf72d01af7d3900ee1a65964ba", "object_relation": "md5", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913548, "uuid": "ca786c76-8a23-46cc-b0ae-cf9696d99eb2", "comment": "Malware payload", "value": "45aaa5b97bad98ea0b13cd54338f042028778623772a89d82c5a87536e8e1af8", "object_relation": "sha256", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913548, "uuid": "c5441de6-988c-4e20-8aa7-e10c16764267", "comment": "Malware payload", "value": "c35b8ca25641b698f4bb8ec73bc19c37d6c1d3b1", "object_relation": "sha1", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913548, "uuid": "e3853eaf-1919-44c8-981e-b9b835ec29ff", "comment": "Malware payload", "value": "3fca5f4fef3219ae2277b687f68eb211ff59aa62004865b11b58216f80a0c0be5f6f9820a8f6c0882b414cd127d5d305", "object_relation": "sha3-384", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913548, "uuid": "7c80314c-bbdb-415c-aa42-28570b9f72d6", "value": "T1F2F63355E0BDF243A0CFB0B946605AD43AE9DFCCB66A3C2C43155949A91CFE721C2CB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913548, "uuid": "c0777d44-e08b-42c2-aa0a-13d61a5483d9", "value": "393216:8hlQHXBUpCQDqgO7l6WqO7xZRtbQNjftoscJHkDe:OlQip/qgO7n77xxb2jftyk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770913548, "uuid": "a8b2c78e-aa58-40de-9798-5f617fa75470", "value": 16268795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770913548, "uuid": "c8fec5a5-ac3f-44ae-8070-7439e7b6c468", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913548, "uuid": "545f111e-60df-4663-889b-9e03069583a5", "value": "6461d8f680b84ff68634e993ed3c2c7f2c0cdc9cebb07ea8458c20462f8495aa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f15c38a-07f4-11f1-a129-42010a9c0007", "comment": "Malware payload (OrcusRAT)", "timestamp": 1770888050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888050, "uuid": "fcbdddf4-4812-47e0-a83e-6112affaa8c3", "comment": "Malware payload (OrcusRAT)", "value": "c9bd519f927e52af32103ce576867987", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888050, "uuid": "cb86d86e-0ab1-4ca5-99f6-754cdbfcd8d0", "comment": "Malware payload (OrcusRAT)", "value": "46ac2ac73b0d42cacb46b0bdc9f2c359973d3dc2e20afe37576f611ce54550e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888050, "uuid": "e3eeaf45-ec27-4845-a455-4b07cffd07dc", "comment": "Malware payload (OrcusRAT)", "value": "188af680ed4311ead325c06cbeb82bd618206cfe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888050, "uuid": "e35b1629-72d1-4e02-9b76-b16c56020193", "comment": "Malware payload (OrcusRAT)", "value": "840b70c6dc9340c1129f033293cea2d92d6c887e5df725cb5f7fad8e57bdab8dbd0a86a6bafc9209266c5c35c1a9e8ad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888050, "uuid": "f16f8293-01c0-477a-9f8e-f45fdffc04d2", "value": "T153359E1DADA900BAE077D039CA930546FBB278222720AEDF13D1035D5E67BF57A39319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888050, "uuid": "3b511215-b582-45bd-b919-c0c412353963", "value": "c65ed3a99850b1c3dea70f50ea322588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888050, "uuid": "505a7449-b808-40f4-adb0-0c982ac2fac9", "value": "24576:8yKBT7g4FwxPPATyiq7h0RxNOTMRyqUn9CiI2V:iT1+aTS+RTIqUn9XIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770888050, "uuid": "55a98fe7-0d55-4333-add6-5fa889e6ebe5", "value": 1129592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770888050, "uuid": "e38a5aa0-fccd-43f5-951a-4a744b5ebb94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888050, "uuid": "09bc5acd-7bdc-4846-b8ee-c83e73875c3c", "value": "task.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3aaff7d-07fd-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770892218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892218, "uuid": "80c2dad1-a9bf-46a6-9380-0524f690e007", "comment": "Malware payload (Stealc)", "value": "a619be1e2c1936d372e94dbc946d23f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892218, "uuid": "0c3cf598-bcc8-42dc-aea0-85daed2d4afd", "comment": "Malware payload (Stealc)", "value": "46f605598488ded49527e9e6a3ea045c817833aecfb527c8f213ee0e0527a130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892218, "uuid": "1fe9adee-cb90-4aaa-b344-72d97b22d2f7", "comment": "Malware payload (Stealc)", "value": "97a36aa533587627b8f0222cae1a72057063d22c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892218, "uuid": "05d7f447-d718-4164-9743-b6c19e505ab4", "comment": "Malware payload (Stealc)", "value": "7632c0e0fae42e7b873ac26615e070713dabe9acd410ccc568857ba06e9e997eef4c5b7a911362f0ef488157bf862f05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892218, "uuid": "8275734c-6a08-49a7-9530-dce873886a72", "value": "T15486028BD38A2316E49137352D1AB154B33BF07442C6A91294ADE46C7E57CA83A3F7F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892218, "uuid": "957b633a-1110-4fd0-b25b-c5d98b0c2664", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892218, "uuid": "9f9f4a96-349c-40bd-a766-659f09317255", "value": "98304:nrRil0+nj3Rs61cgLoZXcG39SVkxsmlA8/Ufj2s3Fv4XHdDKYnZqqLrzMyydM:rRQe61nLo2wykx5N/Mj2CARTUmyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770892218, "uuid": "cbf23c12-db70-432a-9e2b-467637997e53", "value": 8518193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770892218, "uuid": "92c2c654-c4d3-422f-bed1-744bf4837609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892218, "uuid": "d99a5594-0dcd-41ee-b262-257053ca0025", "value": "A619BE1E2C1936D372E94DBC946D23F8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cddafa7a-0810-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770900369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770900369, "uuid": "344214fe-1e77-4c5c-ae61-743faeab52ee", "comment": "Malware payload (ValleyRAT)", "value": "7ea7e702c6dd97a9aaede1734932a769", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770900369, "uuid": "9179e86d-411c-4b82-a6fb-b289ae6ba274", "comment": "Malware payload (ValleyRAT)", "value": "475634d646d360e4c12dc87e83626dad2998f982f8f6156bec92db6da9cc7687", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770900369, "uuid": "284b4cb2-8eeb-4910-995a-da05647ddad4", "comment": "Malware payload (ValleyRAT)", "value": "a233f9e4cb5add870a7c80652775b71342c6fd71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770900369, "uuid": "76bfbfac-5f9d-4c06-9a6d-0b508ce986a7", "comment": "Malware payload (ValleyRAT)", "value": "a05b4c4d6ea79bcfab463de6e95fbeaa3f09300fbc3b18bae0e3d7fc9d1be62a91de609e3b019da1067a3af89944893a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770900369, "uuid": "0e5a25a5-083d-4768-814c-7b4576b88f55", "value": "T1C7A58C43B29651ACC55AC9F5830AB732BD25F88B07207D7F02A69E303E65E505F9CB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770900369, "uuid": "d0651894-5728-4738-8c80-bb273d0ee63a", "value": "66692790c6de4312480e145740eada62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770900369, "uuid": "f4adec0d-9250-4742-a8ce-6480f01e356e", "value": "49152:rGDOjHwe0nHSTwDb4Iu7Hfwp7ZPSn1ri8D:9HweUH4z/wNQ1rN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770900369, "uuid": "ef1bb6ac-e247-4ab9-88b0-8e1f2f010ee1", "value": 2219008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770900369, "uuid": "96d14945-45f1-486c-bbb3-48a5cf989fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770900369, "uuid": "3e9f1c3a-0650-4c57-ac40-7f9745c2d5f6", "value": "DeFi_HNWI_Quantitative_Investment_Proposal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68160a6-084e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927039, "uuid": "2ef8b399-3437-4bf9-b8a0-769a38ad3b2d", "comment": "Malware payload (Mirai)", "value": "6d6a80940c43ccf3f2e3db1b0d5638b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927039, "uuid": "a1ff2be9-c98d-4d3c-ab7b-458b7a093341", "comment": "Malware payload (Mirai)", "value": "475e92759d6fa5b8c1234bf83e8bd7cfbde455dc3a1aa8db762fd10ca936d5a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927039, "uuid": "61739f99-99b6-4aa5-8db8-11ab086b5e93", "comment": "Malware payload (Mirai)", "value": "e41c8683273c707ded43fbc72838acf2ef3474a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927039, "uuid": "089489c2-f0f1-4be2-9d98-7f19a156c639", "comment": "Malware payload (Mirai)", "value": "c741b959c019845f13401cbac4d7b56870858d8623ed6662b7ddc0fbb81b83fb526849478309d51d89e3005c70b52bcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927039, "uuid": "142088f1-7575-4233-9cd2-275faa47773b", "value": "T1C9F2F152F132F9B6C134A938F1850E43FF993AB5A1F620E729815D810BCE5677BF1482", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927039, "uuid": "582b78c3-e35d-4759-a9ce-21e7d29969be", "value": "768:kY7xc2Wi26uRlirTc/2ZDXTDHrhOk2v1XjZTDHCM9q3UELIL:17xa6Sk4/2Zz/Yv1XjNyLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927039, "uuid": "f87cbb42-6ae2-4df0-a571-d239187ce948", "value": 37052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927039, "uuid": "d7a267c1-9f22-4a7b-8a6b-44bbac5ffce5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927039, "uuid": "fbd73774-ccbe-42a0-8aa2-37f75db66098", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d614b29-0842-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770921574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921574, "uuid": "3fd85156-9955-4749-afe9-ac1365a08396", "comment": "Malware payload", "value": "861de6907d1b3cc6af07842d394e71fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921574, "uuid": "148b9a65-2d0c-46db-81ad-ab8fb66776f3", "comment": "Malware payload", "value": "482916ce9204e91ada29ff4bfb0f099cbb38b0c183b39444650569396286bf18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921574, "uuid": "b4aa6309-2178-4ccd-9092-3e16df3d3b07", "comment": "Malware payload", "value": "a98c21ad01d2979d5fe0788c33816ba56a7ca73a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921574, "uuid": "912cc6a1-cb49-41f4-b3de-a3d45edfa36f", "comment": "Malware payload", "value": "662bc29a1242ea1a3a9e64abc21082f1c5cb516b7ef43b2478dc6eac19fe8c5df9a71602b98dfee4dc31c7490bc2dca4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921574, "uuid": "535b78bb-2334-4fb8-985a-1690a7750d29", "value": "T1E893F8CABC858B10D5D525BAFE0E218933138B78E3FA7113DE185B2E638AC5B0B37551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921574, "uuid": "51c4bd5c-9e8d-4d6d-a773-727325c70da9", "value": "1536:zgn+Coal+NS+YRHMwep2EsTYf8YMnLscWfAEbjrJnMQn2lHzimCAIQ9:BalkaRHnep2Es8f8YMnL7GAEbjrJni84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770921574, "uuid": "6bcbdef6-dfc8-4dc7-b31e-9084d83a14aa", "value": 89744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770921574, "uuid": "9b19aa36-1e50-4d70-965a-27ca6603d0db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921574, "uuid": "1d3b161d-b215-4bc9-876e-1034c0d9975e", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1842ab1-07b2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770860002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770860002, "uuid": "52f81b57-f764-41eb-ae2d-ec9ae09dc508", "comment": "Malware payload (Mirai)", "value": "1e888611ba6b21c11d7afb89f3213f10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770860002, "uuid": "017f0999-7911-45ff-aa80-4a7907582f62", "comment": "Malware payload (Mirai)", "value": "48b7258a9addbd13d2ab829402db292c214af089fdc4f987a66df429ef1bd90f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770860002, "uuid": "0070c685-e86d-4597-9637-23b21ceebb97", "comment": "Malware payload (Mirai)", "value": "af304221004e0609680399a05521764b4c4d9510", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770860002, "uuid": "c5aafd14-2c09-46d1-8a65-e42deaa55768", "comment": "Malware payload (Mirai)", "value": "f503aaf6179ecfa94511aec214d6070a296833d4381cd5c7dc30ed22ce46636d0ea683625a9d3eec24170c94311b4669", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770860002, "uuid": "b78a4760-fa92-4fdf-9ae4-77e50a62098a", "value": "T17903F162E0AD6CFCC074D5B5939C8FC8FA7328A1D7270AAB04CA357AAC1EE71D614547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770860002, "uuid": "04815c81-27df-4a35-92c3-6209f422ab7b", "value": "768:T8B2EcNrTKdIK1H7LhN1Rn+e46TuFQ8ieW3eanS8kDAbm2:g0EWnKiKd3hNH+8TuFdiVuaSR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770860002, "uuid": "0a0bdc8a-891d-4830-90a7-ee906be15590", "value": 40004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770860002, "uuid": "318554e1-1daa-48da-a8e3-a2f54e419051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770860002, "uuid": "915aed50-9552-4add-8ba1-f4fb529d3d72", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01599c8e-07f4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770888000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888000, "uuid": "e3ef4dec-51f5-469e-a97b-65dde8583175", "comment": "Malware payload", "value": "f5f25f7a1f1688c857977ec4dee467ed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888000, "uuid": "0ec5791d-d0bc-4c56-b77f-602d3b2214f5", "comment": "Malware payload", "value": "4a68c6d4b5fb83e9241e81ec9decd050dd3f4a4f430ef517a72910c5c383087f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888000, "uuid": "305e69aa-c498-4975-9bbb-4b701ecdb50a", "comment": "Malware payload", "value": "bc6558c0dca71117ec97fc122bb21340f33c8b49", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888000, "uuid": "c14b972b-cafd-42ce-a300-6755c6831212", "comment": "Malware payload", "value": "f0cbc4248dde6b3d53939c56e2bc305a8cdcd4a6694a1b10f4b6ed94aff228fea43017888f68b6390d8b803718c61634", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888000, "uuid": "10bcd651-a68d-4501-b5ed-003a182e65c5", "value": "T1B096017B0AB58781280DD14F53B0BA51AF9750F7BC5A8E04B924CED7C294AED8530FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888000, "uuid": "93f2c08c-2857-4898-a6a2-0bd48facf7b1", "value": "48:uH4h7MrlhILI/3ZrMtXKLQbysyy2E2bM1wbykN+6b037yyyDTV51WQ5lKbwGRRr+:unAytxMiy+UGTCN49dMiAW9wmqsMw0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770888000, "uuid": "985f2ecc-109d-4904-8cf8-ca9881eec640", "value": 8666105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770888000, "uuid": "335050a8-d70b-40b2-8bb3-e35eb9f64b25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888000, "uuid": "0e183dea-eb40-4e78-9a04-e56e373b4087", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc96d63d-07f3-11f1-a129-42010a9c0007", "comment": "Malware payload (OrcusRAT)", "timestamp": 1770887992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887992, "uuid": "98c6fcf3-2ab9-4964-961a-9a686bfcb700", "comment": "Malware payload (OrcusRAT)", "value": "95357cf738a5d40e9388c8a2166816b1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887992, "uuid": "4cd0e8cf-7410-482c-9863-9f6e1c6d00b6", "comment": "Malware payload (OrcusRAT)", "value": "4ad9bf9e3c39e377636a2391510f41f562122fad82aebfb18ae7923cfb932c9b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887992, "uuid": "9560e809-8150-42ec-9c26-025428b24280", "comment": "Malware payload (OrcusRAT)", "value": "08be8af3cc21bcbce993e8a79cb97edac14eb15c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887992, "uuid": "ef89ec2f-c3dc-4d17-8d42-12805a411151", "comment": "Malware payload (OrcusRAT)", "value": "909b01e2e1e80b65d63a60aa5d00e940abdab8f62aa54afaf8023db4db0f29a8c5951715e78812dafe9d98a22a86d3f3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887992, "uuid": "eb15c970-36c2-46e7-bc2b-0b288066b1c8", "value": "T164359E2DADA900BAD077D039CA930547FBB278222720AEDF1391035D5E67BF57A39319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887992, "uuid": "d1e2c176-033d-42af-83fc-bb373b1eeff1", "value": "c65ed3a99850b1c3dea70f50ea322588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887992, "uuid": "65dc7ec2-21a6-4f8f-ad17-358d20d2a70c", "value": "24576:8ySDT7g4FwxPPATyiq7hd7xNOTMRyqUn9Ci1:wT1+aTS/7TIqUn9X1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770887992, "uuid": "b854bf5f-410a-41c2-985a-ecdad5c73b15", "value": 1129592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770887992, "uuid": "d2f876e2-ffbc-454f-9b6c-98a2a7a16e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887992, "uuid": "166bf1de-e71e-49e0-842a-6ed598e43163", "value": "task.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa48fb6c-07b7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770862218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770862218, "uuid": "0fc72cff-a61b-450e-b966-5a58e527c0f5", "comment": "Malware payload", "value": "85e374cc45a08ff81d4016bf2e88987a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770862218, "uuid": "5ad22288-30bd-4ccc-b6cf-231bc9df8aad", "comment": "Malware payload", "value": "4b94331c45d7f23e240f09008d2605884ef37ad8dd4613b0fe6b5811d614da37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770862218, "uuid": "d707c45f-d4f1-475a-9289-78d661bf14e2", "comment": "Malware payload", "value": "e3ffb9a92f7b48ed02373d793d145702c30ec487", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770862218, "uuid": "49058e22-5ddb-4f23-aa92-88328f9a6993", "comment": "Malware payload", "value": "44a2bfc604ac0a4ee27d4ac58d8aee1d5022cde7b6bbe6e20c1529c7c5e22ac64c31a34dd702d777f9255ed7fc123b75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770862218, "uuid": "8ff14e52-6b7b-4a93-8b57-85dcd46dd953", "value": "T16775337A221349FAAD306F76389DDC50DBEA023A357836C6C85478A0F67F9ABD7105C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770862218, "uuid": "b430b9d0-411d-4ac3-ba43-f05a3078cd1b", "value": "49152:FNfel2wifAGbiHGdCeDJnzenYFPkFeQ8T:7ml2lfAJGdDpenYFoeJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770862218, "uuid": "4e67db67-8c5a-4d2f-bd20-8934c88f5143", "value": 1622383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770862218, "uuid": "874f13c4-d2c0-4fb5-a07a-dfac8fe0d99e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770862218, "uuid": "2fb98882-5001-4cd7-8c66-e959093cc9a9", "value": "bizy.mpsls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f2ddea-0844-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770922689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922689, "uuid": "9ae1b443-0fcc-4b8c-a13a-81e4784e1271", "comment": "Malware payload (Mirai)", "value": "d21db8fe5314748553be0023595e1ff9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922689, "uuid": "f7e77410-353a-43d0-a55d-2504f283eb30", "comment": "Malware payload (Mirai)", "value": "4cca20c0f20c5cbfc36d5f967b7f7563d5398cedaae60754eb0481098dad54fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922689, "uuid": "83d879a1-dbaa-4d75-9074-5fa49984b211", "comment": "Malware payload (Mirai)", "value": "3adbdfc444099886785cac3814c73e8af40884c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922689, "uuid": "26c3f928-1426-4062-84a9-03605101371c", "comment": "Malware payload (Mirai)", "value": "91d3df552e31ce38dc7a6cb0e62a1891c2ed5c3cb98b3f0db78803b9e9b9ad604d7b9c7ff23b1243464a79d47b488eb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922689, "uuid": "5449e4ce-356f-4f1a-8bdc-f1d37054cc62", "value": "T168C2D07EE5999561FDBEE5B2AC668BD236A21A153023CFD15748FF080E1372DE180DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922689, "uuid": "29e19e6a-ee2b-4eb3-b9f5-0517f5516a57", "value": "768:i5DiXf5lwIWqHE3nCSIjU4CFXVZ4uVcqgw0retm:iJiP5GZvnjIjMZ4u+qgw0rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922689, "uuid": "6b901dbb-d7cc-49d2-9060-912220014500", "value": 27104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922689, "uuid": "8a6c370b-2c20-484c-a9cd-9b63ea795b38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922689, "uuid": "b545ccaa-ffc1-4315-9884-ddf9296e70a0", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165a30fa-0830-11f1-a129-42010a9c0007", "comment": "Malware payload (Sality)", "timestamp": 1770913805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913805, "uuid": "f5ca48ca-db48-4230-afb9-1b3218cbb30e", "comment": "Malware payload (Sality)", "value": "64ec62478301ee6dcc7b893a2114f077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913805, "uuid": "0cbf458b-66e5-46d6-b1fa-a8339376517c", "comment": "Malware payload (Sality)", "value": "4d4cda3ce66f376dab5fada530035829151e41fe5fc6bb9f5d3c0e6fb8215e8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913805, "uuid": "bf72961e-a275-4799-8c4d-7cd2a548aee9", "comment": "Malware payload (Sality)", "value": "5097be35a6ad801d40321ecfd93e3a8d6d31c886", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913805, "uuid": "dafe67ea-8a1e-49f4-9872-b4be2fc5f3bd", "comment": "Malware payload (Sality)", "value": "b47b833352f568f8ce4893a61b0449dde2be816ce124374ddf09913bae078be8b3c654750c4a1e403dd9a17bd07e03f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913805, "uuid": "fe8bf25d-4cc8-4da3-89b8-4e12308aa636", "value": "T149A312D2A64E9A13C71BD2795A5F75545ACCD563C3E8C6FC1B525080829B90BF0A0F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913805, "uuid": "c44c054b-a933-4a7f-9108-2dae27fc4aa3", "value": "14610dd0ebbc796a9a3a2ba2cdd24e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913805, "uuid": "53a47a17-a8d0-4a59-9036-01aa27370b32", "value": "3072:PAo+sctawEbcuNPpqzXhDA2yOg+yWnBz26nMRgSS:PT+irlpqzXh1yo26n6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770913805, "uuid": "c72e0711-6cbd-48e4-ab36-da95008a13b6", "value": 103140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770913805, "uuid": "7f580a9b-e517-4712-b50b-9392821ff13d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913805, "uuid": "e0c20437-154a-4703-84e8-3fe1663511c7", "value": "ynxe.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a1732e-0838-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770917595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917595, "uuid": "621b17eb-52ed-46e4-8fcc-aada5b04609f", "comment": "Malware payload (Vidar)", "value": "9aa518c8f33fbabb7a86695265b4b842", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917595, "uuid": "c71ca4c8-4d01-491a-8f31-a1ebf57e876c", "comment": "Malware payload (Vidar)", "value": "4d6e5a3253f431db90bf1046ad17381d27ede91fac98d48b445da2e484c53cf5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917595, "uuid": "0ca61020-88e4-42ba-8497-8303f96b8b40", "comment": "Malware payload (Vidar)", "value": "46538a5c152db2371aba700111de21c32845bc23", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917595, "uuid": "15f916de-8a9e-42d6-9851-c4db9295eba1", "comment": "Malware payload (Vidar)", "value": "fd2417b946c6b05486318cf314de9b502b8b8426fc37890dc5ffbb74b1563441d445ea8cb49ba1b577c8d621033580c8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917595, "uuid": "fb053fd3-f723-4a66-9834-2fd833320828", "value": "T1D3A185B1873102D873A201D9096DD25110E0C26BAC5DF68DB74DE9C19F95B83833EBF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917595, "uuid": "7040c38f-5780-4df8-b23b-d33b587fbe0e", "value": "96:NDEE/6K1EXuLot7KAYlKU0ZWh8aAHy5BW08F0vL+fKo3mMCJU5LorW:6E/HHLzAYlKM8a55Bh8F0vLZxMCJUNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770917595, "uuid": "cdf4758b-c45b-43f7-b186-0b1b912ce3d7", "value": 4752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770917595, "uuid": "2c8d3c89-baa2-4054-8d1f-f1740130b275", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917595, "uuid": "abd91f13-e410-4b83-8ad4-e9a124178f8b", "value": "app.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1667f2-0843-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770922164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922164, "uuid": "01afd0a1-1eea-4c68-abce-957e53d372f0", "comment": "Malware payload", "value": "bca5c4b1481d36e1a8e0f87b7a35b195", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922164, "uuid": "e4875c8f-96ef-4d5c-aeb2-6a092bbff7a2", "comment": "Malware payload", "value": "4df6230fd8d63d2364866be92ad8cffc07ef6b1c37b9373bf57e0924a319ab53", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922164, "uuid": "ad65d86e-0821-429d-83dd-484226e01d23", "comment": "Malware payload", "value": "dcdd263321354593cdd16df2f56b85ae035a4966", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922164, "uuid": "1cc8be4e-28bc-4808-b694-b1a5e42f0690", "comment": "Malware payload", "value": "d5849f7630ae49f722b4ae1ec040601e5e9a1508365e84677ec2d1c0a147c0c259a9a356b0bfb1b90b8d9362ac94526c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922164, "uuid": "ef85bbf8-a544-4872-8ac8-0ca2ca9d9de7", "value": "T14782577FB76B4E689B56D3A6061A3E8A467DF529528144C0FFBCE73039289078F70634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922164, "uuid": "abf11768-32cf-4727-8014-9c54a5ecb120", "value": "384:Nl8bZcnfKTKsowJGn/1oiaAFKFolKYQglNowTbC2XVYpubPPicn93aBfNEKA:NloCKTKspJGn/FaAFKFolKYHlNpa2XVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922164, "uuid": "0f5aacb9-9c02-4e9d-8f67-359fe5c00574", "value": 19207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922164, "uuid": "050fc7a1-5135-4bef-84cb-52f0b02c4742", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922164, "uuid": "8a1875bb-f6e8-4545-a331-c686b27bb69d", "value": "cj.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6e4f5c-07b0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770859000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770859000, "uuid": "bd87fc7a-adcf-4f1c-88b8-6e5a44fed10e", "comment": "Malware payload", "value": "243963e3019f679b685ea757b3d07142", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770859000, "uuid": "e520682b-010b-4e28-a529-863ed4d62b38", "comment": "Malware payload", "value": "50ea860716aca388657dea1cdfcc1a141c4b76aacd71e77bcd8a36705b7f6b93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770859000, "uuid": "45aed108-7100-4725-a906-2a7879d37406", "comment": "Malware payload", "value": "1d9ff73c68b112f2a8733c026429d5347e7cd4b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770859000, "uuid": "fcaede1f-02ee-4295-ab26-61f34fbca710", "comment": "Malware payload", "value": "b5856ef3ff08d78ded891b123d83654a8da6a7b293b53d617f0267f46e23b197e815560fe39bc84bd8aa9b689c5a0e6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770859000, "uuid": "734c384c-8b60-4e77-98b8-3387f49262f0", "value": "T111139211FF4967B4CC630930A79A2A5A6E3B104A7EFB59216E1B823DCD13C109B35F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770859000, "uuid": "1edeb62b-5ea3-43a5-9895-b30706ef4b35", "value": "768:tyJO54ezfTy5AD51dc49ZIZYXw3/NYGp1KQ1inTSdrxkUbwYGopb:IJ7ezLD51dcCzgNYGpF9xkib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770859000, "uuid": "e25f2891-a42b-4c5f-8bb1-a58d9679fd03", "value": 43175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770859000, "uuid": "9606c879-77bc-42f1-9d32-fb52f045be9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770859000, "uuid": "766fd2bf-8701-4374-bed3-fa42ff0f890f", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62be74e-07e1-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770880196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770880196, "uuid": "212df907-4aec-454d-93f6-4ae94c7f43bc", "comment": "Malware payload (Vidar)", "value": "5d03573c944300f14705f9cdd284a1f7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770880196, "uuid": "5e55f1b3-4cfc-4218-8a09-b54fa22289e1", "comment": "Malware payload (Vidar)", "value": "511d87ae2b7c08b7c611fec70b9ed7c6e96c51c189bb35e7e539b6d5f261f83d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770880196, "uuid": "0813b4c5-dfa7-4358-88a7-8458141b813d", "comment": "Malware payload (Vidar)", "value": "fcb2f5cf8f5a36797a459684dbec619284202648", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770880196, "uuid": "1c07df71-bc5a-4d97-acbe-dbc3d1c6316a", "comment": "Malware payload (Vidar)", "value": "83a4af879cf7eda7c815ca93d5ea845f46156dee547d422e78668054efb58d82349fa790ce1828a620bd52a10e543310", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770880196, "uuid": "a50a91b6-fe80-4585-88ea-a2395e260ea6", "value": "T196B523923AC9D636C6AB153385AF47792E31BCA55B20D0CFB7A07D1C1D31AD2AD39342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770880196, "uuid": "bde8908d-72ea-4d30-ba5e-54c21482b34f", "value": "49152:ApxxBAixYljwGFanK1ur8zV+Umj+mJKuW+8102j3WXI7Crsm:ApaiY9wG8nGkUsBq8Iurs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770880196, "uuid": "3f04afa5-a40f-4dba-bc92-386aef448ce0", "value": 2392064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770880196, "uuid": "075d7647-05a5-4825-83f6-5670eb019763", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770880196, "uuid": "29cde24e-ae7e-4df0-8a6c-1b040ada54bb", "value": "X5P2hQO.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6390683b-081b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770904915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904915, "uuid": "b4f5630d-1e65-4c6e-946c-6b4c1fa976aa", "comment": "Malware payload", "value": "04889313b4cf71e67cfff5c294a355a3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904915, "uuid": "32668de2-2fe6-40c3-a363-11e752329ef3", "comment": "Malware payload", "value": "51a61c2001879862ef227d2eaf7b111a4cc937b21b3de3a0dbb986bcea9ee8c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904915, "uuid": "11e9b3b0-df02-47ae-a5cb-925142b338d1", "comment": "Malware payload", "value": "3a63d83b54c2a7a6eddfdc97be52b5f930c08e28", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904915, "uuid": "0bf0269d-8634-422d-98e6-698616c27de8", "comment": "Malware payload", "value": "a667c79e7946801e19f1675a2141ae0bd75b1bab305299b22dc6ead4cf2732de9bab8113d0d60e99f3c3d00752eef861", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904915, "uuid": "ac6ff337-3bd3-4350-ac92-767d8a9fa75a", "value": "T1B5C4C7DD2EC1F1AD0F82A933F20AF06DE8F598F0936A4C69A0DC6C48E8516D4FD55639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904915, "uuid": "a6e18d06-8901-4aa4-b7a3-30275368ebf5", "value": "6144:X1TJcPeqEQho26RVtwi3QJWHEokROQ5fkMevJONYmcBOe5b5YcA:UhhORVtNQz7sMehQmL5b5ZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770904915, "uuid": "c1af7a5e-7028-4fb8-a212-772dd2682715", "value": 555156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770904915, "uuid": "9a4e8c0b-509b-4e77-b634-dc29c393eea5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904915, "uuid": "13390501-8014-4717-86af-56193c42baa0", "value": "02516 QUOTE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fddb3d0f-07ca-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770870384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870384, "uuid": "43dc3ebb-b723-4098-a199-e7a9f1d574ca", "comment": "Malware payload", "value": "275261b351d57b8d272b28b1291a87d2", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870384, "uuid": "6930f97b-fab7-4900-a033-137b9fb2ff9a", "comment": "Malware payload", "value": "5294335645605429e30ebe5cecc144387ec5e424aa0661e8e615edc358afde14", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870384, "uuid": "472883db-4076-4e3a-8da4-e7dd2affa536", "comment": "Malware payload", "value": "b17858ab90ce2a3af723101abbf3a135da78ad81", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870384, "uuid": "2f46cc66-6d75-41c2-a352-18942c6ea796", "comment": "Malware payload", "value": "51c6770a63f0b7957f3e203828cd36d05515a5f9a22031027347aebdd95d2faf87b194aeaca7192df126306683b01db3", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870384, "uuid": "2427255d-926b-4bae-bf87-a5736b2fd23f", "value": "T1447533EA1A9901DBCB4D62F4B727CCC0ED15AD8B0F2D5A76043227AB6344B6358DC6CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870384, "uuid": "a013ad56-f533-4e09-8d59-7124966ffd96", "value": "49152:Ty4X+KsEHbIkw0uSiNZEz7Xv+fqFq9fofKOQ9X:TySvwNA77FqOSfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770870384, "uuid": "f166d2f2-d528-4f85-8d30-fbb7301c640b", "value": 1679049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770870384, "uuid": "0b9a9dca-3f66-4c0a-8f03-4f4840f4dc48", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870384, "uuid": "5d40796b-f00f-4cf6-a4a3-dab68dd6b2c4", "value": "5294335645605429e30ebe5cecc144387ec5e424aa0661e8e615edc358afde14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f578bc9-07f4-11f1-a129-42010a9c0007", "comment": "Malware payload (NirCmd)", "timestamp": 1770888023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888023, "uuid": "e9763204-c45f-46a9-91bc-66c654c11b01", "comment": "Malware payload (NirCmd)", "value": "07055309df80f2ac020a2849f4364adb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888023, "uuid": "a56473de-181f-4ec1-b4f1-a59a4be614a2", "comment": "Malware payload (NirCmd)", "value": "52ce6e673b4580aeb94d376868d031dd5f501c001717d1e3665173f19af899af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888023, "uuid": "0efcd0ff-7980-4708-92db-91fa0e331494", "comment": "Malware payload (NirCmd)", "value": "bab6254f8677dd8d4a62a145e7d574c0208f334c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888023, "uuid": "13f3a075-72f3-4436-b2a0-a7bd85edb4a2", "comment": "Malware payload (NirCmd)", "value": "fec95a261680d2b659831d21b13679b3bb49c0342bf95cc419162da64ff1422a02ee13d015365f0d1ef3e917edc6cafd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888023, "uuid": "81f1ac0a-86c1-4c58-ae16-902e32907f52", "value": "T1D9A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888023, "uuid": "8b0cd91e-9b4b-45d7-88cf-505d1b3af797", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888023, "uuid": "11c0d37e-51f2-4b3e-829c-42855f4d17f4", "value": "49152:ABRqTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aMTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770888023, "uuid": "f841248a-b88c-4a52-8ee8-1046799578f6", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770888023, "uuid": "c819add8-ab31-47c1-a257-cd1e20bae03b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888023, "uuid": "d9d143a3-2eea-4012-8b69-ad0afca16ca2", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302081c9-07f4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770888078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888078, "uuid": "0f640374-71ae-4827-95c9-25e40e791882", "comment": "Malware payload", "value": "2aa8f5a49abfb93f12b92654f735a0b0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888078, "uuid": "8db8ab9d-8140-4631-9e0a-e170f27538e3", "comment": "Malware payload", "value": "546067a07f5372ca6dda273b24ea19460ae1dde6cebda1dfeed0db529b6c0124", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888078, "uuid": "9092b950-4df3-48fb-bd34-3d9d6518b95d", "comment": "Malware payload", "value": "39ccc73730ab00db4d693f253383a4dc9adfce2b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888078, "uuid": "bea9184d-e6a2-4387-b7a1-4fd48356ac38", "comment": "Malware payload", "value": "9b3c639d5017b43fc284b1f50b7482d0b0ac71cd46febf2746a7388a9d960570ec6b688c40122edff6b09bc449586797", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888078, "uuid": "b685d073-b075-4346-a82d-40dbe0c6621e", "value": "T173911975B386742D9BE115EA943BAB18B23B8215340B4032E7ADF8D13C70A5F4086F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888078, "uuid": "24faa796-e99b-40a7-950e-c0cb24811ab0", "value": "96:nItDJYtoAJS8ffKH1NPIX4rDIcQ0ucq4o5nZg5ovTtPDEI7BmaL:IVJYtoA1ffqzr/IcQ0ybg5ovTt7/oaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770888078, "uuid": "88d237fb-f1e9-4ea8-8730-cd6c23aa27e5", "value": 4560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770888078, "uuid": "da8062c8-b87e-4cd8-bb50-620db2364b26", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888078, "uuid": "ec1d1c48-418e-4750-b8cc-4e70c53a9539", "value": "0000015545452222214774124_97324031.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ff8319-082b-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770911927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911927, "uuid": "ddb99fe0-1ee6-49fe-8c3e-2a65d742f7f8", "comment": "Malware payload (QuasarRAT)", "value": "869d06bb9c468658a3399c9cd05cfe14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911927, "uuid": "6fd9a540-1c38-4dff-8142-c8b61551be79", "comment": "Malware payload (QuasarRAT)", "value": "557bf0b973d4e3cdaa8244adc667e1b3088d0bb57fc01a56a90fa42e4b258957", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911927, "uuid": "ef2e7c2b-b872-4197-ac14-496d4e6b739f", "comment": "Malware payload (QuasarRAT)", "value": "d5b928fada8c1c1177fcd2c7ec49fccddc8b6672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911927, "uuid": "c31eb3b0-8805-4845-94ce-71552138ed62", "comment": "Malware payload (QuasarRAT)", "value": "c456b850ac10d568213fec7fb853d3ce12a3ae4857b5624b4dd80f75f93f14c389b64eceb2ee23ad32571d85710a7470", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911927, "uuid": "76b07310-d8f5-407c-9a80-7000936c6ee0", "value": "T1D8E54A1437F85E23E1BBE273D5B0041267F1EC2AB3A3FB5B6181677A1C53B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911927, "uuid": "054138da-f709-44ee-8b34-a13663bf1c44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911927, "uuid": "b8b53b22-d627-4eb8-9bfe-2b8597accef0", "value": "49152:3v3I22SsaNYfdPBldt698dBcjHJCE1JLLoGdpTTHHB72eh2NT:3v422SsaNYfdPBldt6+dBcjHJC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770911927, "uuid": "de06d8e7-5139-49ee-82ef-b903382d688c", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770911927, "uuid": "a4b286c8-d172-48b2-b398-561606fdd8e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911927, "uuid": "2b7f8bff-354a-4751-be46-afc10d9e2578", "value": "557bf0b973d4e3cdaa8244adc667e1b3088d0bb57fc01a56a90fa42e4b258957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888bff9f-07e6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770882213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882213, "uuid": "2ee8a1c5-b127-415f-9795-b4da040b1280", "comment": "Malware payload", "value": "b6d6e71bff9df5a99ba08258d2d53d31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882213, "uuid": "084245cb-b48c-4efa-bcee-3c8dac613670", "comment": "Malware payload", "value": "576692df4bf1c7d8927d3a183f5219a81c3bff3dd22971691f8af6889f80c5a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882213, "uuid": "80f2413e-ba6b-4dfa-9900-65c575a7b2cd", "comment": "Malware payload", "value": "288de2395643496da7fded6f92343f734528149c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882213, "uuid": "0a0395dc-14a1-4cae-8e89-20f496902392", "comment": "Malware payload", "value": "f2c364a6fd5d991c728deca96e01e42db154062d9ba3990f321d7d9aa36fc4b46cfcaf5261af5389d976eb0691dd7f28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882213, "uuid": "11a0ea0a-36e4-4049-9b2b-e5e979d8b479", "value": "T1AD07334043A009B3FDB14D3DA8B4A969C166BDE72BB0C54FD7B803626D637D22D2D267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882213, "uuid": "70a9790e-7ce7-4b56-b9f5-13aa158d21eb", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882213, "uuid": "8c5bd434-f7b6-4ede-a5a0-a7689e1cdce4", "value": "393216:oo/cZBQ1lwGaa5wEMiuHClSXMCHWUjrrRQ7XbFsn6h6eRGP3gWBjVN:sqgaGziuilSXMb8rrRQ766AtP3gWB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770882213, "uuid": "b4d834f6-2c5a-4b62-b418-8bea0593043c", "value": 16957010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770882213, "uuid": "13e2a0a0-d86f-433d-9313-2f495a262c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882213, "uuid": "6045ef82-3a73-4397-8584-501db5a69acc", "value": "b6d6e71bff9df5a99ba08258d2d53d31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fbdf99-0846-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770923278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923278, "uuid": "dbf1a657-2124-4b57-868d-75d4e531121c", "comment": "Malware payload (CoinMiner)", "value": "20f26a980149598b2a7f6d3935822c62", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923278, "uuid": "88a8f03c-8cce-4972-b73a-454b797589a5", "comment": "Malware payload (CoinMiner)", "value": "587ea69283a5e2863add67c8d8ad0382910bdb57d1fd52882ad6df7531dc6a5e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923278, "uuid": "ac8cd05a-e3df-4d64-8469-f9abc873fd7b", "comment": "Malware payload (CoinMiner)", "value": "9c6817c9269a596b51d35474f6d02293d9301cee", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923278, "uuid": "826da85d-43cf-4085-ad47-d9e1e0f5ebf5", "comment": "Malware payload (CoinMiner)", "value": "1808b2afe9f84f04cbd48871a5e762f3b9cb149aee659b27dd1626545148d40359250edcd9ed0969e2ab49b54a03afe9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770923278, "uuid": "3b95f0b3-d74e-41c7-84a6-48e004027a0b", "value": "T16AE523189FD77BC6E41508BCAA6AD7A54B59DF98F4E10AD528FAAE3C32D14B0C700F50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770923278, "uuid": "8e7cd650-ed9a-4fbe-ad9c-91c78da8e772", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770923278, "uuid": "707f728f-a33b-4311-8831-e4aaafc74fb4", "value": "49152:HVc5DC7FeBs1pM/hF/eOsoMkMSx8xHOL9TuvCm5IkdbyWfmT9wlc961UnQHWWzE:HKskApKeoMkaO0v9oT6KdQZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770923278, "uuid": "87145626-6000-4dd9-ab71-7176a663dcd8", "value": 3093504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770923278, "uuid": "ee5fc1ef-4a44-4940-b7a5-5a2905544a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770923278, "uuid": "9ba6ffa5-4686-4c27-baf2-ffafa84ead47", "value": "SecuriteInfo.com.Trojan.MulDropNET.78.17371.1355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fb6e6e-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877939, "uuid": "83c5ad1c-468d-4660-b15d-da02af45665e", "comment": "Malware payload (Mirai)", "value": "283d4c4d9009d33536cd4cb522fb4c5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877939, "uuid": "abf85e7d-d013-4bb0-bcb9-fa037fae7980", "comment": "Malware payload (Mirai)", "value": "597d8bc2e54eeed35c57970686e1b96a83814e6937d4c05da0cdd3f3c3139815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877939, "uuid": "8c8adf0e-2f8c-4f75-a63c-ba6b4f35c84b", "comment": "Malware payload (Mirai)", "value": "804be9300bfbad260d5b7c3752cd7c7ae354436d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877939, "uuid": "ca6a1318-3942-4454-87f1-e466bc11337c", "comment": "Malware payload (Mirai)", "value": "b5db06b49b20639785c478cb067625a1480dd7fe5daa3a5618a3dac1eb84f7a8ab05c7305b28c85c32f34d51973a06d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877939, "uuid": "9c29e46a-a496-478f-85f8-9a285eb8fe76", "value": "T128D308C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877939, "uuid": "f62a839f-145a-4220-b251-f8987d50d3fd", "value": "3072:pXbul4MGHJvkrybLutTK/OwpiZdDoOPVO6V1jbiALNHFIPx:4rybytG/Oyi42VOgLNkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877939, "uuid": "54a22765-d09d-4e22-b969-a69529392e0b", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877939, "uuid": "a9f1e256-7bc0-47ff-8286-075ff34da98d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877939, "uuid": "e87e9b22-83a2-42f1-b876-f7362f369c92", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d33132b-07f4-11f1-a129-42010a9c0007", "comment": "Malware payload (NirCmd)", "timestamp": 1770888073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888073, "uuid": "64199082-4c6f-45de-9359-c5910d432759", "comment": "Malware payload (NirCmd)", "value": "dd3412e6ea63b1c890df2ca6e5c32b04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888073, "uuid": "e1d742c5-5a5f-475a-97bc-4af05937ac23", "comment": "Malware payload (NirCmd)", "value": "5a13bd97a93e5c3a5c98ed12b2210c5f26356347188b63f71101ffb4f37eb3e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888073, "uuid": "43a297b2-0dd2-48f3-bb01-e942e0695a7b", "comment": "Malware payload (NirCmd)", "value": "5410fd246121a26c5b66b4866c117668eb914c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888073, "uuid": "8e0172da-6a12-4465-ba2a-1f704e4b6277", "comment": "Malware payload (NirCmd)", "value": "86a36e47c299978a22d1bcc32ab29c42608231e32dbbc2da22b778a268ededdf028f6bd218160d8fd6dab75391f95d1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888073, "uuid": "0b709b3e-9f1a-4ce1-90b4-dfef8368def0", "value": "T1BEA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888073, "uuid": "40643ae0-0c06-46b0-b96e-81dc524b8409", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888073, "uuid": "6c9b4207-e02b-4498-81d0-95b9b42d0200", "value": "49152:ABRDTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:axTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770888073, "uuid": "8dd43d76-81d2-48b6-8184-be02271d12bf", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770888073, "uuid": "97dbfd35-18e6-48a4-901e-fb32647cd5f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888073, "uuid": "104d9389-c0d5-46c5-822a-a56ff0521a08", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f90882c-07e3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770880776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770880776, "uuid": "d69b06ba-3d07-45e1-b1ea-513e8bca5c28", "comment": "Malware payload", "value": "b0856e8a911b6c2e6972912fc146743e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770880776, "uuid": "c5b3fa62-db1a-40d8-a603-bdc05a96b167", "comment": "Malware payload", "value": "5a44e5b17566cb4f3f5e3b494953536388eb61f2aab0bad1f0e0be3974ff3cd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770880776, "uuid": "72be21d3-e91c-466e-873a-9da4498a039a", "comment": "Malware payload", "value": "a326977a428b7c948dbaf6e365cfef7e8ec97e06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770880776, "uuid": "101427af-f5f8-49dd-9efb-00ab7012294f", "comment": "Malware payload", "value": "8e79e676d790091d5c35d5d132c63eda0762be159221d78fcd43f6c1d8c9bcd2f4681b3850aa711a5eacb579397e0698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770880776, "uuid": "dc118b59-b91e-4dee-ae7d-082ca3102c77", "value": "T1DD735C1033FD5126E7AF8B3D99B460004F36BA636E72DA4D5C4690CC09B6B81A960FF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770880776, "uuid": "eb949fba-bc62-472d-8a40-53a2f5a2e9ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770880776, "uuid": "ef9e1755-c6e7-4c71-b5d0-81be49894d96", "value": "1536:+Y1wIAk6pAlNXiFIBdTsqa4tsi5yz+aqsc61wbFgC3aq1wr3og:+3TKdAX4tntaC61wbF73aqmcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770880776, "uuid": "85826cd4-6aaf-453f-9d1a-f52b8b531fa0", "value": 79360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770880776, "uuid": "5cda18b0-7f64-4cda-9418-c86712f68eec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770880776, "uuid": "eece4b4f-afe0-4b8f-be0b-47b1619b143e", "value": "ratonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b71a7f7-07fc-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770891614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770891614, "uuid": "d8166328-15e8-4c90-b8db-a166416d9542", "comment": "Malware payload (njrat)", "value": "a43e1cc1354136673a33a8d6c13e7fa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770891614, "uuid": "74594b84-c07d-462f-85f5-01e51801a979", "comment": "Malware payload (njrat)", "value": "5c98eeea38290c34f2e0c88068a34a0e48d991dcd32f01e8237bf2263c870d51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770891614, "uuid": "6e108fac-b946-41e0-9bd9-bd6cd617aa3d", "comment": "Malware payload (njrat)", "value": "02b8d79a31de61951055e3310a81267867472da3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770891614, "uuid": "4d998e09-66e1-42af-b37d-be3ac0e92211", "comment": "Malware payload (njrat)", "value": "f04d7e5ee47730552235ec4883821d67f1a714c3e18509c504d294cb6a8dcef257b391c9d32aba50507e13b6fb68fad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770891614, "uuid": "e67a9a89-5c3f-4642-b063-f8ff24885997", "value": "T1F7B2090E3FA98866C57C1B74C6B5965003B491470423EE2FCDC564DBABB3AD91D8CAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770891614, "uuid": "19478132-5229-4be2-a9c1-b0531993db94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770891614, "uuid": "0b751fab-d731-4296-86f0-07b1d9e2369c", "value": "384:LQ+ILgIbOprgPsUOSU0kB1kd6dg7GYh/JomRvR6JZlbw8hqIusZzZpE:WLL6MVU0NRpcnux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770891614, "uuid": "329f1e9f-21c1-47d5-9aed-983f680e7d59", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770891614, "uuid": "f722e3a9-8c9d-4828-8b0d-515e7d49990b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770891614, "uuid": "c81a0f50-0acb-40a3-be76-9a456db06be3", "value": "A43E1CC1354136673A33A8D6C13E7FA3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df742bc-0839-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770917898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917898, "uuid": "800e321f-960d-4344-8b34-c0ba8a7a4215", "comment": "Malware payload (Mirai)", "value": "aa01208799cd94d800727afc2bbdd3c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917898, "uuid": "32fe1d26-44fa-4663-afe6-636bc506ffae", "comment": "Malware payload (Mirai)", "value": "5f2697fa26bf736ac18a3fc7dd349a81e047bfa5d7c479cfa5ae93dfdd14a7f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917898, "uuid": "fb482410-6cf0-4ba0-96b7-25b41de6974f", "comment": "Malware payload (Mirai)", "value": "bf9d5ba1fac1026b3b1743670d14655edae6c8b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917898, "uuid": "8b63f935-b668-450c-a780-b6ba384ad437", "comment": "Malware payload (Mirai)", "value": "91c7a6f1bc62d5a4e314921a7acd515cea9a37b79514efb596cdf756fd3280d4a3724a888abf9340249a5a12eabe627c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917898, "uuid": "7c161954-9244-42bc-a541-27c01e5a82ad", "value": "T1F883F846B9829F11C4C622BEFF5E418D3313BBA8E3EE7112DD209F5427CA59B0A77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917898, "uuid": "3a6c8c05-7e15-4d29-9ea1-0732afcafa06", "value": "1536:NanWlI3IAcMCQjZnZvr7YbmTPFtfrRUIp+htp+ebmlVyxli/QX+Ewc32UA:blFAtCSZGbmbFlr+Ip+htpZMQXX0UA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770917898, "uuid": "ade0eb65-18f0-42dd-a57e-eb1cd1db7505", "value": 83136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770917898, "uuid": "6f3142c4-b5b0-4a82-a5bd-681796594cfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917898, "uuid": "7f4628bd-9759-4572-a1ec-8f031cac96af", "value": "Hilix.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91693fb4-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877933, "uuid": "0a2afc5b-6f7b-4ef8-95db-ed5ca00eba16", "comment": "Malware payload (Mirai)", "value": "b2c215f2bbc218892bebc02c2e620793", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877933, "uuid": "f31b36d8-7d91-4285-8722-d7c00ad05fae", "comment": "Malware payload (Mirai)", "value": "611c42af54f6370ad772e9e7055134dc79c3fc03bee8af50e3e6ae3b461ff0a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877933, "uuid": "9e75bb33-968a-4a21-b20f-df19b1750946", "comment": "Malware payload (Mirai)", "value": "4af4e69347767aae5f40a2d2347f524a9a156a61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877933, "uuid": "10187c18-97aa-48ed-8b7c-d98821c69955", "comment": "Malware payload (Mirai)", "value": "cc02193e35e32c76ad680c5edb06579b1e10a404b6beea07c79138e2e880746d8ef5bdde7255057796f5d424c65332d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877933, "uuid": "967411ee-f50f-46f3-8327-e47e890ad149", "value": "T1B7735BC5A5D3D9F7CC411A7C21B7AB715933F43F7A3A89C6E3AD78768602A80B106358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877933, "uuid": "a62cf8e4-daa7-41bb-a457-e22caf0083d8", "value": "1536:7iB/GGFEt0ut6G0GW0iT+ySWt/xx/NkZMPbY8ciNv2Pn1U:GfFY0ut6EDiTTSWt/xxlq+c8Ps1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877933, "uuid": "d7708866-6e35-4100-9b77-b496de6b45e8", "value": 76204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877933, "uuid": "499474a6-a71d-4914-b1bc-6aa3fd35d118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877933, "uuid": "23be1f12-1f39-46d0-9ed5-ae0c9230981c", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea48ea43-07cf-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770872499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872499, "uuid": "e19c8aa5-d915-4682-be9b-2313a50d6323", "comment": "Malware payload (Gafgyt)", "value": "5fb969b95eb91c6ee1c37e6a9fc57a1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872499, "uuid": "e441b2cf-dba8-4288-9abe-793241027ac6", "comment": "Malware payload (Gafgyt)", "value": "61d8249c583169e97ef49d4b8d16f24d0db62ef6f54f6f31bd9a2395c3d905c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872499, "uuid": "bb2da79e-1323-4464-b182-134ca8298c8f", "comment": "Malware payload (Gafgyt)", "value": "2d092bb3cf4c88cee0803d64d0087b8b0f4e093e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872499, "uuid": "195489f2-edbf-497e-8243-da72414f7afa", "comment": "Malware payload (Gafgyt)", "value": "0230b0a7038958843802172730e5e98f03c65db4425a6617705d0aaa44dbaf91b83e3ca3a690eaa9e219a0b19025bcd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872499, "uuid": "abc1dbfa-1344-4462-8d96-10701bbed8d1", "value": "T15C831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872499, "uuid": "0c52a8e1-93d4-4fd8-b17b-8920572e0ee5", "value": "1536:BQOc40ozMPjej5qckA39ikRFafnrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3BmrWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770872499, "uuid": "3ca23fd8-3115-49e8-9d28-e4356edbcd04", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770872499, "uuid": "abd7900d-c3f5-4380-b8e2-e867b0e411dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872499, "uuid": "349e8133-80fa-4972-871a-b05b621e2eb7", "value": "p-p.c-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747fe3a2-081a-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770904514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904514, "uuid": "1e2782c6-e08a-406c-837b-14b49a7bdd07", "comment": "Malware payload (ValleyRAT)", "value": "01fb67072bf23f6eca8b97efce7fd7b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904514, "uuid": "2411a9f9-8c04-49c3-8f73-2152d180c023", "comment": "Malware payload (ValleyRAT)", "value": "6318fc904ce497c6469ed747e35203101f9030d36fe8e39b09d2d0806e137b9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904514, "uuid": "af849483-2d44-4831-a610-dc883e10879c", "comment": "Malware payload (ValleyRAT)", "value": "64bf823bd2c6af5581add28fd4617a98297e5b5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904514, "uuid": "98288c72-ea69-445d-bb50-e4516936801c", "comment": "Malware payload (ValleyRAT)", "value": "64a0f6f161b562034b96de4be5b0b8f970f33c8ea955e16106f29b9aa4cffc1cda897927db9b9f4c4417fca54486ae8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904514, "uuid": "9078286b-e7a9-4be5-a91b-b757fb7b6fb4", "value": "T1FF96E09532A0C797C906FF7DCC919A5A5F7BEC332E868A0E2040B196ED3375C6C06DA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904514, "uuid": "0ae86bc3-ef12-4785-9470-c1bd171afd49", "value": "96ad788580be640858fdbac91a357aa3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904514, "uuid": "6466739d-8df0-4e0e-882c-6ee26ca88c54", "value": "196608:Q0+SBCnV60E8CCssjwDD1m1cv5RznV60E8CCssjwDD1m1cvZ:MUvvF1m1Q5RzUvvF1m1QZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770904514, "uuid": "bdd767e1-fe6c-4b4a-8b5a-3e5a90f9bc27", "value": 9064440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770904514, "uuid": "08db33e9-8be6-44c7-a73b-0a3d07f736b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904514, "uuid": "b5aab43b-2c1e-423b-ab5b-b77cfaacb035", "value": "Flash.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca53857-07cf-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770872503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872503, "uuid": "24345719-c8b0-4cbf-ad1a-549ded0ea01f", "comment": "Malware payload (Gafgyt)", "value": "62f1cd1a581d3d7023635bb50e6c57b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872503, "uuid": "428b8506-36c8-467e-be74-0c091b97b871", "comment": "Malware payload (Gafgyt)", "value": "637a147af100d6cb5ae28d8fe133b1fd6837d5cf7b213da5dbc9a6fce9036a0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872503, "uuid": "43644b60-fe30-48e0-b6a4-007a5a0e1317", "comment": "Malware payload (Gafgyt)", "value": "98dfb8fcd04b24349c16fdf9f2fc1728f76d1a03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872503, "uuid": "d3a8a458-9ede-4fff-8df9-f78aec978655", "comment": "Malware payload (Gafgyt)", "value": "0669701ebc9388c09d118a97d54ab8941a8e4d1761a8ae8f1e12ed571942af4473c1ecf4d3aae745fed828f105682b56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872503, "uuid": "83010877-687b-4eb5-b1ec-07503570bfe2", "value": "T1F8B3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872503, "uuid": "68a4d16c-27cd-4be9-ae5e-a96b33d3f511", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2OZN2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUreoNTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770872503, "uuid": "8c3ed0fa-e091-4e99-a7cf-003b82c50ff9", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770872503, "uuid": "3b5ef9f5-b2c5-42cb-b032-c681a8357667", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872503, "uuid": "7175ae99-84f2-4481-b610-0f1d6f505d6b", "value": "m-p.s-l.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98579996-085f-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770934209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770934209, "uuid": "26b8d542-e954-4bc7-9452-b360d55877db", "comment": "Malware payload (njrat)", "value": "2505178fbd21ff1f32bcba353c4563cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770934209, "uuid": "13f7b463-ebca-4870-9fa6-8068b590ea38", "comment": "Malware payload (njrat)", "value": "642814a99cb7c8afa90d4058da672a3bbb908dd75d5cdedbd13b760fb07cdbeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770934209, "uuid": "ebe0b236-7d18-4ed8-95dd-2e02447d997e", "comment": "Malware payload (njrat)", "value": "f634000e0a25d3bb94466f43013365f0814fda05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770934209, "uuid": "2f0af919-7a67-44f3-b496-816117e371aa", "comment": "Malware payload (njrat)", "value": "daa6eb7813bb89206b2d5b4ad703c32b0e8b2cb4b5f2e8f9130d712fe4bbef8a9ea3c0af38632f51115e37fd3e4ad27a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770934209, "uuid": "e524dded-31af-4b5d-bfd4-1469a2b90513", "value": "T113032A4D7FE1816CC5FD097B06B2D01207BBE04B6A23D91E8EE5649A37636C58B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770934209, "uuid": "29bb2a78-1c60-4821-a456-904660fe23fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770934209, "uuid": "35767b7d-ab0f-4420-9481-005525134c3d", "value": "384:tinsiDjT95hL5YyUvZ7vLOw4qYddlrAF+rMRTyN/0L+EcoinblneHQM3epzXuPNw:8vv5zUvZ7blYrlrM+rMRa8Nu8+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770934209, "uuid": "baf42d19-7183-4cf2-9152-9f22e8f2582b", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770934209, "uuid": "d61e6497-ab5f-448d-9c2e-653dc104f3b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770934209, "uuid": "a71262cf-c3f0-4398-8551-3c65274a8364", "value": "2505178fbd21ff1f32bcba353c4563cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59023c32-07d0-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770872685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872685, "uuid": "5bee8607-ebbd-4b0b-8a5d-a1735acd6912", "comment": "Malware payload (Gafgyt)", "value": "c14ebb5cdb226006465ba1017fc663f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872685, "uuid": "c28090e2-e14b-41d0-a0de-789c254367eb", "comment": "Malware payload (Gafgyt)", "value": "64e0e6150b7c6eff27ecf171bee4cac3db489772110dbab34aac63fded65a802", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872685, "uuid": "5adacae5-1ade-4b92-b9aa-53377043320b", "comment": "Malware payload (Gafgyt)", "value": "153cfe984aa9f0265bcd5cc2eac1d575cb9c08ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872685, "uuid": "c388ae0a-3090-47e3-8d4a-68836b6a4cde", "comment": "Malware payload (Gafgyt)", "value": "b1a801ea752125fed965f43d1f867fdfe10a40477364c05d4a294fa631e6098f8e81a522796b434aa5c1807782f78f06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872685, "uuid": "13154f71-d8fb-4d69-ac0e-f834b5a11ea0", "value": "T19C733A02E652CAB3C8930BB602AB9B6A4631FD2A1E2B9F55F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872685, "uuid": "99dbf546-8853-4a50-b5b3-28275c157151", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzMQMmLI2VOCjXUfJRk:45omr0xKFn6J+OHMmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770872685, "uuid": "e18be67f-efc6-408f-af0f-a88ab158c9f2", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770872685, "uuid": "e65b39aa-35a6-4371-bd30-3670f14fe720", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872685, "uuid": "21379450-709f-44dc-8edf-df17401faf82", "value": "x-3.2-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be86d78-07fd-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770892017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892017, "uuid": "53b5e4ab-3d5b-4b17-8e0f-37520158f813", "comment": "Malware payload (AsyncRAT)", "value": "4914c10720240f54365d7c0f9f798cd7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892017, "uuid": "552604ad-a98a-487e-aac1-f3bc75d2514f", "comment": "Malware payload (AsyncRAT)", "value": "654df769865ae25d8725113164d0aef17b1a342674380266c20576061b4eba22", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892017, "uuid": "b8000bb9-d1ba-4ff0-ad82-b7c74f392e83", "comment": "Malware payload (AsyncRAT)", "value": "b7060a54b881d7e61c675a3267b4f2a6b812be07", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770892017, "uuid": "79d777c6-8dc5-4546-b42f-cdbb2a044f9b", "comment": "Malware payload (AsyncRAT)", "value": "52b1da83facde756847ab012ea7d97866fa66ea3cfe0641f22810036aacb9a59dfb789c6dc889212677a93d2b7addcc0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892017, "uuid": "206b42b3-3777-4d26-83a8-274b89365bfe", "value": "T149D24B08B3D88561E1FD57B94D7293048371EA5B9973DB9E1FC450AE2623B88CF14BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892017, "uuid": "465a67a2-e0fc-42d5-a06d-e06604b7ee84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892017, "uuid": "ae64ac19-4bed-49da-a64c-e640f74f97d4", "value": "768:ZMARXV643iqBkgg/cIRGqom/Rb7fB/dTI/+:6ARXT3iqBk51i4RbN/+/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770892017, "uuid": "525f3cdb-672f-49d5-92d7-e590bd0e38b4", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770892017, "uuid": "5ac2dc6f-d5ae-4aaa-8eb7-f06451c6b70b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770892017, "uuid": "4b3e2f48-f52b-45cb-89ff-775ba7e03744", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488d286d-081b-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1770904869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904869, "uuid": "7d5db406-499b-4f47-ac17-716289ac0858", "comment": "Malware payload (VIPKeylogger)", "value": "f275254311c9aafa06d30421170252fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904869, "uuid": "b83c9aa5-4c0d-4c92-b111-b83ee47fa6bb", "comment": "Malware payload (VIPKeylogger)", "value": "658f84fa8ac86bbfafad15a692165ef768e3db869038810a079fd5d0d430f29d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904869, "uuid": "aae73261-c84d-48dd-a5a6-a13d817b2a13", "comment": "Malware payload (VIPKeylogger)", "value": "511f807ee8d2319568d0b46364b0a527bd2507e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904869, "uuid": "86790e89-5bae-45d0-a2fe-0d9bcbb2df4a", "comment": "Malware payload (VIPKeylogger)", "value": "67bb221caff70e83e71fcf68a066ae792667ae8864f82197e60a110fe2dc88f467d6c8da7a373552f5cf1176d375e280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904869, "uuid": "af2058b4-7341-4389-aceb-4598d0337395", "value": "T122942201F7D0A027DAF44E32053B5B375E969D6226F0835BAB847FE8B832682DD1657C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904869, "uuid": "00168013-ac39-4b6a-a425-8859c9ae6286", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904869, "uuid": "dddcad9c-6c38-4ad5-85f4-e951dd8f9e14", "value": "6144:RbfopLxrlvtdY6XLTjo/YzHODhoZHZ7Slz1ZtPcq7+WScOJbTjgfKEo7t0b5FYaE:Rb6xrT1Lc8HL5m11ZFl6BSo7ub79E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770904869, "uuid": "061b815b-9e43-4e01-9a3c-a19d24bee946", "value": 412936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770904869, "uuid": "8de905d7-f5c1-4fc2-ba44-cffa1ef798ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904869, "uuid": "f7c68a02-b24b-4e9e-bc90-54d479b3f2a4", "value": "MOD 130-2T2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4278f86f-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877801, "uuid": "ac6f9d09-2e8b-4061-b809-5e1997c944d5", "comment": "Malware payload (Mirai)", "value": "71ffbc16dba83f8ed5cb68f2dbf78c78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877801, "uuid": "3870478f-2301-45d2-b999-557777555373", "comment": "Malware payload (Mirai)", "value": "659a0bff891c385f87965e94700bce2cb5adf29dd2d5d52ac9db8d081535d250", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877801, "uuid": "30d77ac9-ed02-4086-92bf-4e8e76ab8962", "comment": "Malware payload (Mirai)", "value": "458edfdd586f7b469945921b357c19b081be7d04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877801, "uuid": "c3620bf4-a0f6-4f95-92c1-3d860945cd7e", "comment": "Malware payload (Mirai)", "value": "124d0089af5d8efd1d7173328488945d6eb95156f8f2a6587c49a5e83374a14a153d3cc587e9e3fd0ef13b8e19f45bad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877801, "uuid": "91f25dd5-f9b2-42cf-a251-f2a3d9c41c61", "value": "T102C30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877801, "uuid": "4ecb7e91-2897-4ee6-8573-9ee1fb4dc4b8", "value": "3072:fZD7YhjFMX+maR8TcDeRqQV3tNQYciYTG1X:fZD76aX9aKTcRQVnoiYq1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877801, "uuid": "55f86845-1cbf-4005-a874-53bd33b7d6e0", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877801, "uuid": "985b8cca-7b18-4450-bf92-4311027219b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877801, "uuid": "b705fb86-e932-4dcf-89cf-12dd7b1c404a", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9fd2f1-0840-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770920684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920684, "uuid": "db32d2a8-2eee-4b3e-9605-c0b4dddafd5e", "comment": "Malware payload (Mirai)", "value": "0ce9691a7c95db9f7b6107f843792014", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920684, "uuid": "ac7c0a1d-a9d7-481b-a284-9873af900d6f", "comment": "Malware payload (Mirai)", "value": "65ae47b0ea140622cc1de44862176667d12bfd4e4751aa101606d58c30d8db57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920684, "uuid": "664dd72b-4ad7-42ad-9e10-4e420bb67cd5", "comment": "Malware payload (Mirai)", "value": "80d37ca7bbd2f91c83df7e5f07fe900217a2ffe7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920684, "uuid": "0233457d-786d-488c-a7de-f2ba151d80e4", "comment": "Malware payload (Mirai)", "value": "cb5f26e98501a3ef07e27eeb7ff96b9db97fb65e2a0d94d26414fe0b4d81c58efcc76da84e8ec629e606befc1a45314e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920684, "uuid": "2f352c87-5db3-4cc3-9ab5-6eada9e29669", "value": "T1F3C2C0D7D1FB4B4AD12C40743C4FAF99C921A38CA2546229FD9C16BF53B6F90222D572", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920684, "uuid": "7e2bfbd9-f7a5-49f4-9226-857c739db4f1", "value": "768:vsgqchq534ulYqsSvspHbXdwYLCGnbcuyD7UM7CU1:hqciqJDHbXdwYL7nouy8tU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770920684, "uuid": "01c8839d-1f26-4266-bc5b-c5253773da1e", "value": 25760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770920684, "uuid": "6a2d38b3-a763-42bf-be66-ce004a3b7ad5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920684, "uuid": "7ff88c24-3225-4e06-83ae-df6266c961e1", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a1bc0b-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877940, "uuid": "e6de8af1-72b9-448b-9b07-fb8b888a5549", "comment": "Malware payload (Mirai)", "value": "e8f61e164b29114103093f23a41aa95e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877940, "uuid": "cb81aa0d-8c52-4f9d-966b-de07ae339d26", "comment": "Malware payload (Mirai)", "value": "692d565c13e6fc343860452caa828b402168d6f8dc4efbb81e289f469f5c6b02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877940, "uuid": "99c4991d-1780-4cab-94a5-a8e3713675b2", "comment": "Malware payload (Mirai)", "value": "88418293eee477fb99e99aa3c71a0928846e7b6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877940, "uuid": "af88685d-c832-4774-8452-9fd4b4244bf5", "comment": "Malware payload (Mirai)", "value": "fa26789d00adfcef8a44994407f21f9ab77f3cad778cd8734f571cced43d9cf5241ef0417331ebca588db3f2a82ea313", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877940, "uuid": "d5bcd54f-8f93-497a-8ff1-b8a6ca715b42", "value": "T18C333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE66AE32A02711B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877940, "uuid": "8c242447-4b5f-45da-a579-676a6f8e4925", "value": "768:uw5A3X1eCZWUJ2SNpRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98wN+s:uwkt3NpOzwLMU431ANA0BLBC0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877940, "uuid": "47f3e85c-ef73-477e-9161-88661baed11f", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877940, "uuid": "901ee71c-7059-4fff-a459-f06cd77adb27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877940, "uuid": "ddb252e5-f3cb-4c63-a62a-debf18a741c9", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56102b97-0810-11f1-a129-42010a9c0007", "comment": "Malware payload (LCRYX)", "timestamp": 1770900168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770900168, "uuid": "d3366fda-a82b-4895-810f-4ad3850cedd7", "comment": "Malware payload (LCRYX)", "value": "2e59e1f52370a3a7d7a383f732b5b548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lcrypt0rX", "colour": "#E87C8D", "exportable": true, "hide_tag": false }, { "name": "LCRYPTX", "colour": "#3D06F4", "exportable": true, "hide_tag": false }, { "name": "LCRYX", "colour": "#ABF47A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770900168, "uuid": "b5029a99-6797-4bae-883f-79ec258c4281", "comment": "Malware payload (LCRYX)", "value": "69d049fed65b114aa75024d2f2fe5b59444d77abe87c82c72cb1346e4b0696cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lcrypt0rX", "colour": "#E87C8D", "exportable": true, "hide_tag": false }, { "name": "LCRYPTX", "colour": "#3D06F4", "exportable": true, "hide_tag": false }, { "name": "LCRYX", "colour": "#ABF47A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770900168, "uuid": "53792b9b-c34a-4de8-af1a-c258bd3e86ee", "comment": "Malware payload (LCRYX)", "value": "cc5859d3456a46c05bdee2eb6dcc4d1f52535f8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lcrypt0rX", "colour": "#E87C8D", "exportable": true, "hide_tag": false }, { "name": "LCRYPTX", "colour": "#3D06F4", "exportable": true, "hide_tag": false }, { "name": "LCRYX", "colour": "#ABF47A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770900168, "uuid": "9ee2ab9f-eba9-409d-bc22-e21662bf8a88", "comment": "Malware payload (LCRYX)", "value": "f1181a5891da80142df749a4e2d9b2e7abf958ceeada14e36b9fd733fabf10a549c2a2330a2b1fc3da0cb66c21addafe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lcrypt0rX", "colour": "#E87C8D", "exportable": true, "hide_tag": false }, { "name": "LCRYPTX", "colour": "#3D06F4", "exportable": true, "hide_tag": false }, { "name": "LCRYX", "colour": "#ABF47A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770900168, "uuid": "17801aac-3f37-4bd8-866a-f3cefc651d41", "value": "T1F996338512D005E6F5E3E13D5AA2D1A2D272BC102B31C99F0BA487AB3F573F25E36B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770900168, "uuid": "cb2d4348-236e-4e27-89ab-46144f449792", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770900168, "uuid": "b7cf4b82-d654-443e-be3d-8a44d04d8b43", "value": "196608:2lS9QtbW897GDr/x7eovq5XMP6PzFcsUHsoqrPbRjMFV:vi1yNdq1B7LUHsoqjbpiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770900168, "uuid": "94dd4991-e54b-4dc0-a150-c7a64a75a887", "value": 9025678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770900168, "uuid": "7060f16f-e51e-4903-9cb4-2b7d183fbfaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770900168, "uuid": "2910c18c-4f9b-4fd3-9571-47b51fc55d4e", "value": "LCrypt0rX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0050074e-07cf-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770872107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872107, "uuid": "877a6df1-7f39-42d7-b173-bbda10f6d332", "comment": "Malware payload (RemcosRAT)", "value": "4ac5cd3be403bfe8e6c0af71425e9cb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872107, "uuid": "2de46c83-9e6e-410f-b666-894c46285357", "comment": "Malware payload (RemcosRAT)", "value": "6ac7d044c280196e619571271b51b3a37280a347405f6362ad239cb62eabf4c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872107, "uuid": "c803940f-14d8-44ea-819f-60741e4af258", "comment": "Malware payload (RemcosRAT)", "value": "218a371006ae1b6e741e00f390d9fb61e35938b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872107, "uuid": "ca19f680-c941-40c5-81e3-9152354caefc", "comment": "Malware payload (RemcosRAT)", "value": "87e8009980fdae0105bef752130b1c351b37fd220fd6807b48d0ed8ffb7ce466e81ebedbbc65e1dfeb87f7ece6bd2661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872107, "uuid": "559ce476-1551-4459-a047-365a3dcc1d58", "value": "T1336733202152F539F9813970AB07B2965B4A4C5BBBB1D44EA47CB716F2B08776632CF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872107, "uuid": "1f00ad1c-104a-49b7-a0f3-8ddf20b3fddd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872107, "uuid": "1c13a9c2-185b-4e04-a337-f985da3909bd", "value": "786432:+xrNziUG4eBUtrRPI/e/rIMcYAjGATjU7SScrUwaKCXD4q:+h2+rRP+eztcJGWjUSB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770872107, "uuid": "4ba0770e-7771-4756-9fd3-f67fdc5c50b4", "value": 31817216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770872107, "uuid": "b5cefa75-c6cf-4576-ad8a-fe71c338d064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872107, "uuid": "58572aeb-1121-468d-895d-79c5507f700d", "value": "4AC5CD3BE403BFE8E6C0AF71425E9CB3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280e8910-07d0-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770872603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872603, "uuid": "55489571-d92f-422e-b509-3b5b2313b636", "comment": "Malware payload (Gafgyt)", "value": "818d3de859712258cf54d6afbfbfeea4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872603, "uuid": "255e5995-d6f3-4756-a0fe-aa092ecdad63", "comment": "Malware payload (Gafgyt)", "value": "6d77cddf95d74a7cac9eef11b99ab1d2eb66f7792ec042a3c7f7ccdcdb4d1bdf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872603, "uuid": "63a23fb3-351d-4839-a24f-348403b1cb03", "comment": "Malware payload (Gafgyt)", "value": "a27bc47b78905e638457a6b1124a54f9c016a064", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872603, "uuid": "d45ba47c-ba36-4d23-9e3c-1d6edaf034c1", "comment": "Malware payload (Gafgyt)", "value": "ec222c97255b1e86f5612b7cda787bf959e5ea52eef4259577704dea27dcb6d57b65e6d58dd77c15d420c175b9d96244", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872603, "uuid": "ffe36a18-ea30-4cbf-933c-ed94fd75ca87", "value": "T1B5E32A09EA808B57C1E2277AF7CB424933339B64A7DB33095528ABF43FC279D5E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872603, "uuid": "9c35f2d0-2402-4f77-80b9-06f72511b6d3", "value": "3072:fuNaNpF4uVN++dkhnxwQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnSQennCM/9ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770872603, "uuid": "63b9b08a-cead-4199-b0d9-277f0f3c2a98", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770872603, "uuid": "78406aeb-2596-4b3a-a4f4-63bcfdf4a7f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872603, "uuid": "52942c71-d015-4aa7-a621-f5cd22465c40", "value": "a-r.m-7.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9390261e-0843-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770922175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922175, "uuid": "c396e0d5-19b6-43b6-bf42-bace7a735529", "comment": "Malware payload", "value": "3686117b5689bf6a08117f5494789345", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922175, "uuid": "51c4f7ed-fa21-4135-9b44-9b9b1ac6d6c7", "comment": "Malware payload", "value": "6d7e1e9d797fa68a5928d1d9b392166f8206d3965107777b67bcbe4c555147ea", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922175, "uuid": "e96056c5-1dc8-4644-bf06-54cbb7e77346", "comment": "Malware payload", "value": "542daeba9d5defc87083ead64d32239c12de984b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922175, "uuid": "2e204c5d-7609-4e61-86de-3ab5f945bfaf", "comment": "Malware payload", "value": "fd4a71ea69ac51a166624a4e367f0022779ecb20d187c159514b4a6bbdce9382788828ffebf9c4f35e562bbb22404540", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922175, "uuid": "ad499196-d722-4654-8c50-137cd9e702cf", "value": "T15DB38D6EE30F0955DF55A67B034A4A4909FCB33DB38140B179AC977837ADC2E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922175, "uuid": "b287a789-3185-4d66-8561-90175d16960a", "value": "3072:+O3aPMiyxOCqIvXpx5kVaMrMXshmsY1ZZQl6Q6CYT:+O3aPMiy7XpxS8XshFY1ZZU6jCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922175, "uuid": "31d93772-6ee3-40ff-9778-00ef01b8b6aa", "value": 111224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922175, "uuid": "bfab4337-6803-4d0d-92ea-dc4c2ee256a4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922175, "uuid": "fa2e927e-b6fe-4968-9584-6e9e746fcc0e", "value": "0.0.0.0.0.0.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05703e8f-084f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927091, "uuid": "6eb198c8-b2e3-4ee2-adfe-05a6af2cca09", "comment": "Malware payload (Mirai)", "value": "33de8327504a90dffd1cf34aa6e62028", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927091, "uuid": "7a331718-7779-460d-968c-e49b3526ef43", "comment": "Malware payload (Mirai)", "value": "6f8562a3df7c7096519c361ac8f7e6ff78692f2a3e3d1a947cb8677052f36edb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927091, "uuid": "aefea3f7-5891-471e-a863-ba30f14d4407", "comment": "Malware payload (Mirai)", "value": "e2e23973d458e76d45d6095ecdca41bae7dca5fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927091, "uuid": "63b72e66-1a6c-4015-a509-9cb77de823ef", "comment": "Malware payload (Mirai)", "value": "e72f1c34c33f01750868be8ed1ec725909b55698965b4a89aa79de284151c9b81f8ce0c8e2068e9df447ad68be7ea708", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927091, "uuid": "e3efc291-556b-40f3-9190-f4098f12f0fd", "value": "T1FF633A91BD819713C6D112BBFB6E028D372613A8D2EE7207DD266F21378786B0E77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927091, "uuid": "d04bea16-c0fc-4359-b87d-e1db76251333", "value": "1536:jLbWzyoQU0SP8LEb9BEp2vk7XrnCHAvMs/Fx:jLbloNBEwWxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927091, "uuid": "35f981d4-39d9-43f9-b8a7-8b9f35bbc7e1", "value": 72688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927091, "uuid": "496d968d-4aa0-428d-8fd5-3f64a38c7a35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927091, "uuid": "99cb55a1-a1c9-46f6-90de-318df5908b3a", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90442492-0843-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770922170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922170, "uuid": "b993f563-414a-4d12-ad03-f2837ba72f38", "comment": "Malware payload", "value": "e517cb57f7252934641076a6f74b9701", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922170, "uuid": "38cee8a7-7d3f-4324-a993-8c19059047cb", "comment": "Malware payload", "value": "70535e402e399e2743de32189aa712eeb0f8fdb4c2b8daafd01d5fbdaf438ad4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922170, "uuid": "9c9e09cd-d2ed-4569-8808-c0b2113c56ea", "comment": "Malware payload", "value": "b3b77df778150e74769459d3bc1acf13ff6fd65d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922170, "uuid": "0e0249c7-4a98-47bd-a347-8850182a68e6", "comment": "Malware payload", "value": "fe43b187b2b77c6d2ba742925349055e701d979b4886f366c427def8c17fca560455dae4aa66f33833168f40c745aa4c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922170, "uuid": "7c661406-d6c8-416b-9307-e3194d8096db", "value": "T1B5C2BE7EB76F8E699B56969A461A3A8A467CF53E538140C0BFBCB33075388078F30134", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922170, "uuid": "b8b7a1cc-bcbf-4397-a54b-a04d02402a65", "value": "768:U5awhyQ30WmsKPHM6yKr1Ig7uKVZF5OdhIZ4REjkbFB+JTT/OuK9:U5nyQ30WmsKPHM6yKpIg7uK7F5kjRekP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922170, "uuid": "e1be3237-f920-4763-ae36-6a7fd6bb614d", "value": 27138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922170, "uuid": "cf3b33f4-654f-41f9-b4cc-a5187352887a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922170, "uuid": "a65fa843-d958-411e-9787-ee4d6cfde7e2", "value": "2h328ds7f87sdf87823jhjdhjfjahfjkhksajf987fd798sd9f89.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f06f7e3-082d-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770912719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770912719, "uuid": "ced85782-79e5-485a-8305-2f35fb50f06f", "comment": "Malware payload (Formbook)", "value": "868d2de0a6f8164cddf803f50fee0fb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770912719, "uuid": "a883f562-5ade-41f7-9576-0beb1b5ec3d9", "comment": "Malware payload (Formbook)", "value": "706bd04b5489a253c4e35239df8e08b74f873dbfe8e5dfb3cfdd4a43491f9c62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770912719, "uuid": "33f1cd79-29a1-42d3-9c5e-a6c3236f4a0b", "comment": "Malware payload (Formbook)", "value": "0be41de62c4659386d5d68e4b63fded28d161b14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770912719, "uuid": "f1715537-53af-41ae-abb7-f490707f4a9c", "comment": "Malware payload (Formbook)", "value": "f428dace91dbaeb8f4a4ee059ac8995cc08326648bb66e0afac2949404dd949377d6d40a0e10392b860b98b527c15152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770912719, "uuid": "c8d7e4e7-d6bc-4505-aafc-5ca871a65fb9", "value": "T14B351230229DCD26C5ED17BA4470D33113B5AD2EA113D39B4EDA7DCBBE96B824854723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770912719, "uuid": "296d47bf-4634-4250-9c63-f68fc2e71406", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770912719, "uuid": "fa911433-c234-4b33-91c1-ba437c6d9ca4", "value": "24576:IzH/guQEo+cIx88bFEvyCID1Wy36x1f6iBu6Y3VictTJw:IzH4uWDAEkDV3OAiS3Qc9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770912719, "uuid": "cbac5507-0737-405e-9c02-2178a69d2cb7", "value": 1116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770912719, "uuid": "296a9a70-41c4-4f43-9e07-ffe2abfcf529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770912719, "uuid": "e5441f4d-8074-4024-860f-df568be28a7b", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b24e9c3-081c-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770905223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770905223, "uuid": "a9619976-422e-49ad-a882-2a2f0e90df7e", "comment": "Malware payload (RemcosRAT)", "value": "f3097d1709050ae1c3d4b7716604bd5c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770905223, "uuid": "d7e02fb0-f148-4091-9ab0-275c2768e204", "comment": "Malware payload (RemcosRAT)", "value": "7076a44c8d80ecd4bc34950a1b99607d3a6013a6b6770ffcb1d10595416ceb7a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770905223, "uuid": "a197de5e-5146-49d5-bb0c-fe6d53ab0262", "comment": "Malware payload (RemcosRAT)", "value": "0a07715c5a02eb4a88abe7e356dd488e666f069e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770905223, "uuid": "b8b7f7a5-7ab0-4a8f-b128-eeb5e4626ce2", "comment": "Malware payload (RemcosRAT)", "value": "b0ae41ea1be6966e291326b760f8e48ef27823dd1276d2c8ddc677d07ad81f4745add972bf42e3723ba4836eb381d59f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770905223, "uuid": "224473af-5931-49e6-a3e6-b2e95493542a", "value": "T117A302389A0B5D64C06FE37301AF4D30EFA4594AD921091F982FD27C4EB11B9C57BEA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770905223, "uuid": "11e659b8-0ccc-4a52-aaf2-bd840bb7908d", "value": "3072:zNHHHHHl377z+Vc5hPJs1iRJT2KfiNMNmNmdZPp+nQzMaUAg:5HHHHHl3j+2H2Gx2KHymz9dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770905223, "uuid": "ff2d0de5-c8c6-478e-9966-02953f491cfd", "value": 104335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770905223, "uuid": "eac4afa6-55ac-4850-9708-9e46b41c5b5f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770905223, "uuid": "253fd50a-c590-40d9-a83f-4bc1aaab124b", "value": "BL EGE-1410B0 2026.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5029907e-07e1-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770879971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879971, "uuid": "b1b74068-1638-4ed4-b4e4-110ed77db2c2", "comment": "Malware payload (ConnectWise)", "value": "da6ac7f285d24551219667ff80bce0ed", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879971, "uuid": "b98bc373-abb0-4fbb-836e-5e17f18afed2", "comment": "Malware payload (ConnectWise)", "value": "715806dd201a2d9676743e3f425c426ef28e6807a5510caa060fd551da5a3d6c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879971, "uuid": "fed4b075-0da4-47d3-9dc8-abd7f3ced58d", "comment": "Malware payload (ConnectWise)", "value": "8584486f4f26390806f214e72390a3117ef25ca2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879971, "uuid": "ad0f42b1-fc1b-487f-a940-f4f2fc15c358", "comment": "Malware payload (ConnectWise)", "value": "37765724147bf407aa1b6b8bd80f9390b27c16d62213a6dce6aab866b03bf9617a720c4dd76aa50e34d62ddcbd4a6fa0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879971, "uuid": "54a4e978-784e-4ec9-aba7-d1f3027455df", "value": "T193A623227BE4842AF6F30A39F93991B1597A7D55CE27C10F1374790D1AB2E809A72337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879971, "uuid": "6544c334-1fe1-402e-baa2-803e511b8bab", "value": "196608:xT0cEhi5owS/9FFV2eOhJgyqT0cEhi5owS/uT0cEhi5owS/nT0cEhi5owS/:xT0URoFFVogyqT0URLT0URgT0UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770879971, "uuid": "7ebdee42-dca6-48d4-b82b-1cffdc01e209", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770879971, "uuid": "3af7d3f2-75d7-4b25-b214-bf4bd8b677a6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879971, "uuid": "6dc7b17e-72a7-4d40-8278-e0c9619ede63", "value": "PreApprovalLetter.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920226f1-0843-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770922173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922173, "uuid": "0cacec56-5767-4e51-9b71-da9e71184483", "comment": "Malware payload", "value": "0305fe742b24876da5378b053dd4e861", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922173, "uuid": "df67faa8-fdc6-4cdb-8d22-eca37f775856", "comment": "Malware payload", "value": "73ec208dca54b5b0a5221b6d2373fa8369f8ed59296b65e6a130a9899067f506", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922173, "uuid": "1853c831-d249-4ccb-8b01-a2a817ba21a1", "comment": "Malware payload", "value": "e527d2c1ef2f102969ecf1754cbd6f685471c5e6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922173, "uuid": "6a28285f-8e8b-44cd-a3d3-733a648eaa3b", "comment": "Malware payload", "value": "b4ddae782bb9862e9acd1524f79f04b19fd612fe4752437525034e26390dcaec5d4a046827b38c200657734733024ebe", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922173, "uuid": "e3b71565-94c4-4411-b420-7816414880ae", "value": "T129B3AE6EE34F0959DF55977B034A4A4A06FCB33EB38140B139AC577437AD82E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922173, "uuid": "b183e7a8-5fb3-4049-8680-91cb07577d62", "value": "3072:YVrAHlMct8pBpzP3UhKdK4bvLfhXbtwLTkBb/6Bd:YJAHeqqPNdK4TlbtgABb/Md", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922173, "uuid": "4e7bdf35-e271-43b5-baa4-7d4ab819c795", "value": 117852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922173, "uuid": "e1f15a51-0976-4d2a-ba3b-6ab2d49bc3d9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922173, "uuid": "47a88ffb-6d0a-4482-8665-053718ab2626", "value": "ce.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4641adba-0839-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770917751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917751, "uuid": "c231e4f9-12ae-4c6d-b2bc-526371f5f5e8", "comment": "Malware payload", "value": "b72c367e07f795624496bab49bc966ab", "object_relation": "md5", "Tag": [ { "name": "bambooware", "colour": "#8B1214", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917751, "uuid": "6cb3ba88-ef2c-4a2d-8b6c-bdc195dd20aa", "comment": "Malware payload", "value": "74f171cbe2fa053263d9a56854f875d16c650908b61dfa485e473731a6563e5d", "object_relation": "sha256", "Tag": [ { "name": "bambooware", "colour": "#8B1214", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917751, "uuid": "13c6d81f-c730-423c-8971-73e0d0707b0e", "comment": "Malware payload", "value": "b223012d4c082e0d3585debb754144b53588c455", "object_relation": "sha1", "Tag": [ { "name": "bambooware", "colour": "#8B1214", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917751, "uuid": "85d15988-14ae-418f-8330-38455d40015a", "comment": "Malware payload", "value": "b5478d2bea2190357b009349c9987d2cc1f540b1e5527309d0bcd162a2b495a6e8b7d4bd2732f3220a25d60ad43f083f", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware", "colour": "#8B1214", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917751, "uuid": "e9ec2e00-3d1d-4b9c-9ce4-3f901e82628f", "value": "T1696423679B3C58B6EC56D27DDB46FA0EA47170064ACFB2CF33820D26946F29B150878D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917751, "uuid": "0ab3a9eb-6ef6-487a-9b0e-1cade6443885", "value": "6144:EYlP/5cSLNemlB471mrOE9Tmt0jAAIhD4mYK188Iy+yi:zlP2GIIB47fE9Tmt0k5Bcy+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770917751, "uuid": "f746c3b6-9ca1-4d99-b137-ce1a6fabb4d7", "value": 307714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770917751, "uuid": "d55fa83a-d353-49a3-958a-8e2720a86646", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917751, "uuid": "c2fd6d87-a7f9-4c76-a839-1803b26d5b0b", "value": "donutdupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad0e54b-0841-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770921489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921489, "uuid": "c43347d4-a659-4698-a8ae-213535b33ae3", "comment": "Malware payload (Mirai)", "value": "de1606472ce36cf100dea8457e805906", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921489, "uuid": "1e40e54e-fed9-4ca9-90f5-cf1725940c31", "comment": "Malware payload (Mirai)", "value": "75320b569967693cba04260f49e84dd9bd01b9f8fc37e9ddfe50aa37cc0fb051", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921489, "uuid": "c6cad85f-8892-41ee-a040-21dc6221bafd", "comment": "Malware payload (Mirai)", "value": "78e682d411983b229f528a0071a41f9d80d56770", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921489, "uuid": "b577f2f0-2a14-4c25-a5d5-7f4735d5d4b7", "comment": "Malware payload (Mirai)", "value": "19f72d0615d887b1368cf964a3291ee1401fb22edb2b8da34081a77ce421615e2ac44aec5979ae0e2d5f9e1b820abb46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921489, "uuid": "b4ddef82-d2c2-4c40-9301-b817f97807c0", "value": "T15AC2E0486B4D2DD6C2F68138036817A90DB80B6AF81ADCC579F9F6A1CD4A9753077ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921489, "uuid": "bb8e325b-2051-43e7-9520-ccee3da2e390", "value": "768:N2G214DFyosXqgvV9o1ndB08rWMiJgGlzDpjcJ:N2GdDgosaaO1ndxWxV1cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770921489, "uuid": "ff5b14d6-92fe-4068-a284-dd7928f563f7", "value": 26448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770921489, "uuid": "946c3b97-38e6-4ee1-828e-5c18a2953926", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921489, "uuid": "edabc85a-643e-4507-9fb8-dd9443aac3b9", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9172af2e-084d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770926467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926467, "uuid": "ae572689-dd0f-40cc-a6f6-bd0a83f54d9e", "comment": "Malware payload (Mirai)", "value": "9a739d1698e4152ca954947a1e804172", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926467, "uuid": "7a5b3af1-e5b4-4726-b8cd-ff3196c830bd", "comment": "Malware payload (Mirai)", "value": "760338a60eeb0e10681d101beebb567c2e380eb3afcf8bc58ecf8a9fe2d838f8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926467, "uuid": "33c82f64-705c-4024-955a-49c7f20c995e", "comment": "Malware payload (Mirai)", "value": "f9e4b4fe58d9078b2cbdb2d7d33ec7a5a0196a98", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926467, "uuid": "4832dfe5-3973-4d6f-9b71-e36f250e31de", "comment": "Malware payload (Mirai)", "value": "9fdf64ef4233d8b2804450f1c81d3a915ae70bf7840bf467bf157423bee564a70d5d1b65b8bcf6efae1c5b9c8856f925", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926467, "uuid": "955c37a8-8c62-4b0e-87a5-5ce5fb3427e8", "value": "T10BB66C67F1A710ECC66BC174835BA772BA31B81801347E7F2A64DB712F21E505B6EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926467, "uuid": "67b38120-6e4b-4d06-b812-6a1e23582858", "value": "ec87abbb634355963c5e06116c3e7637", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926467, "uuid": "04c05c63-48f4-4e69-93a5-3ee35eff226c", "value": "98304:nwKnd9USCjEBhW65BfABFrOyxGTCIYBPTWWcMo6GHhL55Dkh2s99DjU0Q1MLiL9d:frdhbDW3zK96Rqwst/ha2fR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770926467, "uuid": "9b9a4504-a51f-4a56-9813-aa8c7f3bb5d2", "value": 11203072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770926467, "uuid": "2a29e7f9-e7f1-4dcf-9171-f45ac81c6852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926467, "uuid": "36e7d069-c948-4918-8d52-58744288780e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bda3945-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877924, "uuid": "0efc5362-8697-46a2-8462-977b2d938d44", "comment": "Malware payload (Mirai)", "value": "c1c0605028c18dae2cfaeba7101dee11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877924, "uuid": "8e464459-337f-47b7-be41-98a2a6b6ffc0", "comment": "Malware payload (Mirai)", "value": "77703e6804040db524890e31738dcba53f286cb23aed9c29cbc2cf0c57e57569", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877924, "uuid": "25c67d58-af46-4afe-b1f0-c5228c17fcb3", "comment": "Malware payload (Mirai)", "value": "ef8365b05d1a2bcc718628e0c72f897b0fa6e9f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877924, "uuid": "c22a8e32-de1c-497a-8104-15cbf1e68fee", "comment": "Malware payload (Mirai)", "value": "ae3495df1e33eed3e6b03ac5c0075bed28c7709727e02ead8c1146bac3c6ec707c264eaae33acd810dab13fcd8a091fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877924, "uuid": "463f112d-25bb-4162-926c-b6468c492b34", "value": "T185835B20B9792F27C0C8A57A52F7C331B7E1760E29B1561CBD761F8EBB116C0680A376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877924, "uuid": "7427accb-62bd-40d1-a53b-b78f451fa114", "value": "1536:5olPymJnNSvmO8WT9J0USMcMkhjEaWJF6vp7jWpkFxgFx9Fl:6YQc1zJBSMcMkYJMvpOC6xHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877924, "uuid": "00177bdd-fcc3-4cd4-8b62-8d46d671e20d", "value": 85194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877924, "uuid": "0d60101b-a4b9-458a-931a-9b634985b125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877924, "uuid": "c1e5aeba-e631-4b85-a641-b4f35f0961ba", "value": "xd.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bf6412-084e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927043, "uuid": "e7eb1f8a-c7b5-4fae-bf24-66a8fc7ce7ee", "comment": "Malware payload (Mirai)", "value": "d4efdcdbc45734748a468a8a95cacc48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927043, "uuid": "7e20ee31-9fc1-479b-8f1c-54130afae83b", "comment": "Malware payload (Mirai)", "value": "7b1fb40609ccbb721b4daf65e62666d046f80e13aff7854b37358541264fc2d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927043, "uuid": "2953af49-7c81-4b26-acbf-0f8da2d89340", "comment": "Malware payload (Mirai)", "value": "de2913dae57068ab967eac098578e8a86b4b9573", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927043, "uuid": "48d6b865-3a1f-490b-b6cb-0f499292361e", "comment": "Malware payload (Mirai)", "value": "0dbdaa496bcacb135f037c8fa5dc3c1f836501d645be58265665dc20b8e4bbb75ac0898eb0d477aa24a331d7ec87f411", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927043, "uuid": "98e7557d-b107-480a-96c7-b46096bb0415", "value": "T1C693C81E6E218FBDF769833147B78A21A35C33D627E1D685E26CD6001F6124E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927043, "uuid": "bc7abd52-cbd9-40ad-a8b3-cf8a75f82b0a", "value": "1536:xvVx6jjfTLDuqVh7uUMeXNCS3e+uzSOJs/Fm:Lx6jbTLKE7uPeXYeOMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927043, "uuid": "cbcb3be9-4a3e-45e6-9aad-898f1354f75a", "value": 93496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927043, "uuid": "2f74ca4e-897f-4e3d-8f68-815270995354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927043, "uuid": "c7a557c9-3458-404f-91e6-a7324f3239b0", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b16037-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877932, "uuid": "e0e9f880-3cb1-44ff-b8fd-2a4920e7f963", "comment": "Malware payload (Mirai)", "value": "c7a2e996a4de744e9705be0d38f83d3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877932, "uuid": "fb5d97ea-5fe6-4782-8a0d-1b02c2119f18", "comment": "Malware payload (Mirai)", "value": "7c55dbff386241d09734458d43a08d821a7e9535cb3609079b4f455126b05947", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877932, "uuid": "d5f69647-111b-4e44-8ea2-3e776866e2d7", "comment": "Malware payload (Mirai)", "value": "4917de2e648518e5d8f854be0460b81369005bc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877932, "uuid": "551d34ee-9827-4a14-a68f-589001d2460a", "comment": "Malware payload (Mirai)", "value": "895dead3b4638c568335b32e3e24b9c6bf823ef3671444b7d337226bd451990b713f4a5bc67212c3b5b7b10f877b1198", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877932, "uuid": "d30ef2ee-80b5-4ded-a4f5-6445cc23c569", "value": "T195A3F9067F614FF7E89FDD3749EA1705249DA42B25993B36B934D828F21B24F18E3920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877932, "uuid": "9aea84a3-ae7e-46f4-b22d-0c1a08d2e8d9", "value": "1536:cJS73cXws1ulXAws6doPkv3s5SbDPQ2BhLDQAncv:WSjcwlXzPTQqzncv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877932, "uuid": "32c6f49c-52db-463e-9a9f-8500607e8cd2", "value": 98786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877932, "uuid": "3f14ca88-6b05-4a6e-99d7-721f8248d37a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877932, "uuid": "c5bc9a2d-6629-4c2a-b4b0-0c1a7a1f0f8b", "value": "xd.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff2c4c0-084e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927028, "uuid": "8bae4228-d817-4aba-bb83-b5abf3421e4f", "comment": "Malware payload (Mirai)", "value": "a3e236bad2543879baba4c060acd89d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927028, "uuid": "7e2c361e-85be-47d6-9f20-65ef1979b44f", "comment": "Malware payload (Mirai)", "value": "7c5caa6b2c87a661244c45d8ef3e51e3655bc0e58176f642b5e9e2ac40726a01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927028, "uuid": "775e9215-1457-4088-a23c-8f8c8bfccb4c", "comment": "Malware payload (Mirai)", "value": "9e5c02b560e14b86f0c8105294bdefc83e91291d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927028, "uuid": "544f427a-cbc8-4a72-a16a-d5ea21eab798", "comment": "Malware payload (Mirai)", "value": "1bf160f0bb91402e5b96e1d03786e5a59d67f8932559b316b2adca77483c60142b42d9b426911a850c87a671e0519165", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927028, "uuid": "6cce6019-f861-4891-b811-0ebe1e67ccd6", "value": "T1FF43F2DABE85A4534230ACB78858458BFFAA0FBCBC5163372A0E875076415C356ED493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927028, "uuid": "6b086772-f139-481f-9f45-156b06b0fb2c", "value": "1536:etrP365yN8WFx6k52cLA46uf+o4vCrL+QrEJz:eg58hx6kIck7zSL4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927028, "uuid": "077878eb-05f7-4a56-b1ce-1a2895c41fba", "value": 58844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927028, "uuid": "e0114522-9e34-4e1d-b6af-2762c3452972", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927028, "uuid": "b4fe7f96-6dec-4662-861e-8e622d648490", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5c6122-0844-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770922780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922780, "uuid": "8d24f952-b9fe-4877-a1c9-de2709adb43c", "comment": "Malware payload", "value": "79ffd3fdc0302fd23c7536967a1d2bb2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922780, "uuid": "90bd5908-55c9-4c64-b939-e42a1bc35149", "comment": "Malware payload", "value": "7cf91d9ab60d9c5caed19d3b54753fde579dc91941ecbc26a86f94a1c1733130", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922780, "uuid": "ca42c78f-7a3b-4186-ad12-e48dcd90e126", "comment": "Malware payload", "value": "af11bab63b1d1da8b49255d0baf5353d0c3de9c8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922780, "uuid": "3466b798-db0b-4d17-9b21-ba342287efdc", "comment": "Malware payload", "value": "b811e2083943e5530babb11c1005d306b01e77955b8d1dbdc1cbcc81b39cffc49993f9dffa6ba5c4738888b1f10d6f38", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922780, "uuid": "f51020c4-1a09-47ba-8eb6-0b02b9c56928", "value": "T121B39E6AE74F0854DF94A67B434B4A4945FCB73AF38540A139AC973437EDC2E4A2287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922780, "uuid": "9770f123-080c-4914-942e-d62f9cbb73f4", "value": "1536:M6tAuM+PPrjNCbL0DrBvJ3q7FszG0An5b8ycOqmlERTQPMb:MCAuMyP/NCbL0pvJ3q7YG0Ant8FOKTQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922780, "uuid": "c12b4e8a-94b1-447d-9072-7ecd2381c24e", "value": 112878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922780, "uuid": "12b253c3-48b9-4c58-adcd-13c4c79759c4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922780, "uuid": "86139cee-de34-4c59-9eaf-bd571153e28b", "value": "cs.doC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a723de35-0857-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770930798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770930798, "uuid": "710ebf91-4c37-4099-8eb6-5091c7ec97c6", "comment": "Malware payload", "value": "9626093d0e29b2cd84ebcd645f6c269a", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770930798, "uuid": "2e5d59a7-0b18-4bec-8f71-9ae6d62cff30", "comment": "Malware payload", "value": "7ddb5dec07a76371efa20e58eb84adf4bf4b81509f3c89fb81a64eaf36138c21", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770930798, "uuid": "6b2a9e72-7281-4e1e-b22c-d71026938280", "comment": "Malware payload", "value": "7bf2b9394cb102fb1d397d0b5322dc1ca0067526", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770930798, "uuid": "5f1f1ed9-304d-4a28-968a-581fe2a6e80a", "comment": "Malware payload", "value": "2b11a311ed01e1908957b1cb14baf607454a1d3e062fbd2498783069edd6d8619b3ca3e92e5d1d0bf54994a7cfcf0b79", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770930798, "uuid": "d9a4be07-0422-487b-bbeb-c30368e80ad4", "value": "T1B99533BE24F9934D06AF66C2B972828DE1F1A981389A5E841C17473F9C14EC0D365FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770930798, "uuid": "e096db27-3b70-4fa3-8132-ff80b78ee9f1", "value": "24576:xGG8DYM6YtO+qWKI2/+YKYHxsqKoLPQoHLe69BLbVsPTDkxTXXFEpAiOGr:xKoWK7+4D5ooHLesnunkZFAAt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770930798, "uuid": "45bff9ed-25b7-44a0-b3d7-f84defb2dec1", "value": 1878597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770930798, "uuid": "7f2c573d-e88f-41bd-8464-5cd3042093dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770930798, "uuid": "d52e8975-c208-4c0d-a40a-84b5a713482a", "value": "53__Full_Appointment_Letterpdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5481c8b-080e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770899522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899522, "uuid": "e2c7cf93-760b-4e2d-b226-9a5f06e64cfa", "comment": "Malware payload", "value": "182e932f7a73792cc33a67e861a45697", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899522, "uuid": "caf27a67-e420-4d0c-b9e2-cd6a8aadbf53", "comment": "Malware payload", "value": "7e217c57cfca7f26cdb6cc6fee4cb8ada8ac6d008605c6a7396b203842f7ab38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899522, "uuid": "4886cbd1-9739-407a-b2d3-7ef0a20ef5ef", "comment": "Malware payload", "value": "7d9c61cddea246f40e4ae1f4f8860dd7a69321c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899522, "uuid": "ffbfa847-e16c-4f73-87a8-c6d19da89584", "comment": "Malware payload", "value": "d5dc53136a82549ea23118e6dcb3a0c9dc84fe9cc0a2e398d993cb182b16acd8a663b94d14e758aac00252593f0197c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899522, "uuid": "55ce5c46-e161-4e18-97b9-97fcd42f5570", "value": "T1EEE53367186F34C5AA54C8FC76AC66518F2412FA17C718B6078EE17B61BC2E80793EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899522, "uuid": "b1572160-e0b4-48b4-a7e2-1eb29e7c6cbc", "value": "49152:wGygn8OVWuNx5sps3FuBbbxl44hs8D9G+MWl0JI4iOS0k2muJWKU7mq0ZfP0LfC0:w5gHWsZ1sN+8U9JI4U0xmu66pZE+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770899522, "uuid": "971e4d20-e11a-4104-b0c8-1d389a27a547", "value": 3062740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770899522, "uuid": "73161579-a671-453a-ab48-098714be62c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899522, "uuid": "8f94ab81-b617-47da-ad9d-d3d796b32d5c", "value": "omicron_linux_truncated_36.133.126.84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba37f4c-0841-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770921491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921491, "uuid": "0579a065-3557-4345-b4aa-dab7a2296da1", "comment": "Malware payload", "value": "74f1b46b8b55b7ba9443c79b890429a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921491, "uuid": "25c529ef-cb8e-4703-8da8-e87a4d8007dd", "comment": "Malware payload", "value": "7e3768836da5f98128132b1e30874f5d78a2ce5c1903d09dbd3721300a49f2bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921491, "uuid": "91520515-8f90-44fb-9013-ad20217a6247", "comment": "Malware payload", "value": "d0fdb1c43700e455ed152d77895d29bb67f25269", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921491, "uuid": "73e1b2e8-176e-4861-becb-a8f04307ce92", "comment": "Malware payload", "value": "2957cc71bac403b889e797e7dbcd90184a1788d2963a52f1cc32b12948e0ed67ad4b684520f6048289d75c7dd98185d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921491, "uuid": "4713be59-8768-41cf-9138-e737a00e41b6", "value": "T166F3124C356240BFFB2CD23CC2990351AD571D3035AEF8BED87E666FCD569A0630A662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921491, "uuid": "02a5bf20-7b99-4c03-bd0a-f9c67d58d43b", "value": "3072:ot5n3oDuPoiLxyd7RIQqiI3ysFkgIVokkvPdn2/jks6XFSjA0y5x9:anTPRxyd7RIliI3yfg+QPdnqks6IjA0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770921491, "uuid": "5a597440-0598-4138-81ee-7922bdc51e90", "value": 169079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770921491, "uuid": "83b9a31d-16c5-444a-b917-a2fe1efdeefc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921491, "uuid": "73b65989-193e-46a6-a02e-9f25b65357d7", "value": "bizy.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48460ec8-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (N-W0rm)", "timestamp": 1770877811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877811, "uuid": "ce897ce5-5876-4ec5-b633-ba1e21b79390", "comment": "Malware payload (N-W0rm)", "value": "6522b86e000e91e0f9404c4e3616b49d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877811, "uuid": "87be118f-55b0-4389-9c5f-dee4dc7f36c5", "comment": "Malware payload (N-W0rm)", "value": "7fd025c534c0d310a207c80cd12cdafffb2c10821a7686b25512157cd6adcf98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877811, "uuid": "3a8b12d6-1b13-4429-b4cf-3aa1a75c6661", "comment": "Malware payload (N-W0rm)", "value": "6a58bc764c093246c032ed2e99aab4591536071b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877811, "uuid": "f8f0c4b3-43b5-4681-b1fa-52d6f6a67807", "comment": "Malware payload (N-W0rm)", "value": "cf189484b053081e502912be007fbbc5b900bfa1c5c2630e56fc473ceff074f9da2bcacaac6c8bef31797adf64825a5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877811, "uuid": "4bb462a9-e6ad-4787-a84d-4de71c189dd9", "value": "T10D6423DFB77C5921C54D5BBAE1C1E910477D998BC313B3BAB86E134E298371E1A85230", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877811, "uuid": "51925a7d-51bc-469a-b81d-669adf994ac0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877811, "uuid": "9e034e9f-e73c-4a44-8516-25f5ab9ebe0d", "value": "6144:/myDMNM176WMtI6soT7Fhj8hMXZZF3JrfXTrachV7pX8R:rOM1mFIv6FZ8hMBtbraoV7SR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877811, "uuid": "552d799d-4dcb-41d6-9580-8fcbcfc0601f", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877811, "uuid": "f77b7f04-326f-4fd7-930a-7bdf5f11c3cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877811, "uuid": "afb4d88d-adec-4f17-a7d3-9a9c3958f7ca", "value": "6522B86E000E91E0F9404C4E3616B49D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0302bb5-082f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770913660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913660, "uuid": "01da258c-08be-4254-af24-ee58eea86a78", "comment": "Malware payload", "value": "6e9f4e913879cce24a1a55ae8794f693", "object_relation": "md5", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913660, "uuid": "69b2dd60-e0ba-4cf9-add3-27cdf9722443", "comment": "Malware payload", "value": "80584e37cf9c4a75437f91140c595529f300cdc0c2e8aa782318c535a413bebb", "object_relation": "sha256", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913660, "uuid": "35f75d8e-a98a-40fe-a5b9-ca95cd3484c9", "comment": "Malware payload", "value": "928bea3dd76c9095d2b21014a884aa6cde69d715", "object_relation": "sha1", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913660, "uuid": "51e246ac-ee70-4c4c-87b5-c4cdeb71db50", "comment": "Malware payload", "value": "9d11cf8346b4359402c5ec73edee030210f3530f6deb7c551f8b3f7d51262d313984752c18e21db6e8779a05bfb443d1", "object_relation": "sha3-384", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913660, "uuid": "6a41376e-c1e2-45ac-af74-ae9d43df3bd0", "value": "T19E712800A7EB0508F1B72F4C197A59684A2B7A655D39D99D829C5C4E0FF3F84E970F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913660, "uuid": "41502762-3855-421a-b513-6c0274b4d9fe", "value": "48:ukyF8u/hK7UWxufGI7902XVt9hVup6+pud8Ib0y4lf7GzzACM5Lqf1zA6M5L3:ukyFfcxun76GQpzQ+s+lezbM1qdzLM13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770913660, "uuid": "e892da75-cf6b-44d3-999b-88c95f52f255", "value": 3716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770913660, "uuid": "7453a40e-76a5-4864-9c86-2c4c02f53ada", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913660, "uuid": "f51dd059-fb97-4cbc-8cab-7402ef5e1b5f", "value": "80584e37cf9c4a75437f91140c595529f300cdc0c2e8aa782318c535a413bebb.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0383f902-07b0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770858797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858797, "uuid": "a9dfe218-1aff-4de2-b229-ab32e209e0ad", "comment": "Malware payload (Mirai)", "value": "dc58fa2bdc5671fa7d173e12e2eb0029", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858797, "uuid": "d0dfa249-4591-4198-8834-058935839388", "comment": "Malware payload (Mirai)", "value": "8151f4c91bf133a67132163c176f586a34437c7f6ef61c93505e71e4aa278bab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858797, "uuid": "8c67bc8e-5c89-4138-b3e4-8402bb9b8a2c", "comment": "Malware payload (Mirai)", "value": "9b5e66be8327c3319d703bb9a57d7a86eed02971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858797, "uuid": "3a155d4b-d796-46d1-9c24-9f6fc64de77e", "comment": "Malware payload (Mirai)", "value": "a8b500e01a27582bd702e9a4d9002d74fd93112727250237d6ba956df3ec5b65c5df2def1755ab8218c78d7a27b392c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858797, "uuid": "0022b57e-c72c-4bd6-97c2-3fa1ee926b09", "value": "T1AC13F158828C47B0CB9429B2D43C88C263DB75B9327734568C834ED5AA38D8B7777F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858797, "uuid": "99d8e528-562e-4b9f-8c26-8a0a40c1f3de", "value": "768:VZNdl/fR3nvTGkNh+dAXAea8k3qIO5Hopq/G1s3CPcpkwp42KZPu3U03wf3N:rlh/f/kqAP8kiIUGAjCwpatfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770858797, "uuid": "e162fd9b-cae8-4ad0-8774-54c561be752a", "value": 43528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770858797, "uuid": "c68f5c6a-02ff-449e-ab13-61bf7f94bd72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858797, "uuid": "804caec3-4450-4eaa-a4ac-4dbda621d2d2", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3297d0fb-07f4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770888082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888082, "uuid": "62ceabba-1b4e-42bd-bc3d-b8b7b30154ed", "comment": "Malware payload", "value": "0f184764358cfb87819ccfb2c07f80ad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888082, "uuid": "fb8788d9-884e-4bfe-ab37-8bc3f2eb4d60", "comment": "Malware payload", "value": "81e10dac1b8f1249a633244daa512e2a16026cdd78c6ff58f65f3ffe5908f788", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888082, "uuid": "e1d91809-9c04-4268-85f7-0cba5b53b7cf", "comment": "Malware payload", "value": "803a1740af83a7b8fdc112c563f0277df71a060b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888082, "uuid": "e3ba7363-5ad9-4f45-8a0a-c3c210d17ace", "comment": "Malware payload", "value": "ae97d5f123592379c0553927fdc7b0ca560a3ced31f6ed8bb0b66c05b6419184371948b04b5c95c55f0690edc535c4e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888082, "uuid": "d71c4c35-d9cf-4737-912f-f190681c9424", "value": "T17E91F877BB863429DBE110AB953BF754723BB21534874022E7A9F8D13C20B5F4086E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888082, "uuid": "64f66fe9-ad8a-4c66-b3d9-22d2ea15ed82", "value": "96:nItDJYtoAJS8ffKH1NPIX4rDIcQ0ucq4o5nZPt/0wI7BmaL:IVJYtoA1ffqzr/IcQ0ybPtMroaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770888082, "uuid": "fb5337f6-1a63-4188-80f9-646e2cb923b8", "value": 4587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770888082, "uuid": "2bc1baea-8dec-4a2b-bfd2-bcc5f55689e8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888082, "uuid": "82ad1fab-a1a6-46be-88f4-3ccb056a608f", "value": "000000000000000000000000000000000000000000123.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a122bee-0815-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770902376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770902376, "uuid": "5e74b6b2-22d5-4fa8-a7fa-b88dbbaa90f9", "comment": "Malware payload (Formbook)", "value": "ee0f2c5958ae0d11bbb679515e89ad40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770902376, "uuid": "abf57170-5c07-4af6-a6d8-a662a40b4cc4", "comment": "Malware payload (Formbook)", "value": "8208a48fde271dee0d0ae10327a054970153139845cb52ac3d3f8b3282a0ebc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770902376, "uuid": "3e7a4f57-42f0-4c8f-9eb1-49aabcbab755", "comment": "Malware payload (Formbook)", "value": "636391563273b4c5363f2e1c82119511ad65b8f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770902376, "uuid": "374dc5f2-2173-4ed4-aa3e-c3785a3a8cf9", "comment": "Malware payload (Formbook)", "value": "c8fbcef15b472c53a5bd4ce9a1b6819b7b5fcf1c545a998505792687094a55fc92fca90b29469ee09692ffe92ee57621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770902376, "uuid": "5f5f0e64-f933-4a72-a874-e903397ad22d", "value": "T1D845BF027381C062FFAB95334F5AF6115BBC6A260123E61F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770902376, "uuid": "432ffef0-c7e1-42b1-ab6a-dd75a6eb474a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770902376, "uuid": "f3bcaa11-b735-4457-b7a4-68f34b7c0ff0", "value": "24576:j5EmXFtKaL4/oFe5T9yyXYfP1ijXdaaU6FZocxSqn+lh9tTv6L:jPVt/LZeJbInQRaaUVSMbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770902376, "uuid": "3d38b1b2-041b-49fc-8158-2430c19ef7c5", "value": 1223168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770902376, "uuid": "8d197a24-8dfb-449e-8973-9913d0242975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770902376, "uuid": "c1b88f96-54aa-4b21-b1b5-15406192d3e0", "value": "Payment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2857cf75-07e1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770879905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879905, "uuid": "b7b59706-98bf-43ec-ad1e-6bb40a4e5bfc", "comment": "Malware payload", "value": "4ef0a4460e6e83e571ee4ea4ab13f463", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879905, "uuid": "f473a870-ef63-4acd-b3a4-2b41c7d58b3d", "comment": "Malware payload", "value": "82da5db58ebc35abdf0ec3b9085ea46aa860f91f5fa11c6f52a56bce7cdf9919", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879905, "uuid": "865ded23-3b97-4354-a297-b0cb58cfd0ba", "comment": "Malware payload", "value": "ebc1983aa71deb22df061fa415891ac126acafe8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879905, "uuid": "82f34c51-ed9d-4896-8021-66d0fa06b54e", "comment": "Malware payload", "value": "3e5f267af44b32240295f306101437c6a06211141c41d63b99b9b42dbd6c710b78f136ec39548fe049a8d7d5f4ff6040", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879905, "uuid": "64bdee74-1a59-46cb-8bad-d2a06f541720", "value": "T1BFB4EDED2EC1F16D0F81A923F61AF06DE4F598F0536A5C29A0DC2C08F8A16D5FD69235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879905, "uuid": "5ecd6cca-ea33-4795-bf93-d7dd8b6e2bf3", "value": "6144:CTH8/jDDNEDj7/e3X5rhnrnlr/GLN5iTPneVx15wio6:6H8bHKn7SrhzcnUw159V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770879905, "uuid": "d4a87fa9-fe76-4395-8765-9c2c8d3beb9e", "value": 539145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770879905, "uuid": "417c1241-4f16-4a71-b9ca-da616e6615bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879905, "uuid": "9352b5ec-ce18-41e8-873c-4b42e456ce91", "value": "QUOTE_B2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8298c91-080b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770898212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898212, "uuid": "c0d1cdf2-a15a-4fd3-9832-36e158b9a14a", "comment": "Malware payload", "value": "905bfcfa7c2d87fea765e02f278fe1f0", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898212, "uuid": "c090a697-c4bf-45f8-80b7-bb89693da3c4", "comment": "Malware payload", "value": "83b234bd5f4cac5a67baf1359dc9f759f4fdafd71a7a85e5b76008ddb5dd3510", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898212, "uuid": "bded17b7-566a-4b5d-acbb-4f3918cb103c", "comment": "Malware payload", "value": "4870b12fa9817c2cb926e691769891af7044fc03", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898212, "uuid": "1554a3e0-ffe2-48ee-820b-b8a29d2a9695", "comment": "Malware payload", "value": "1680f852b16c449556e19cbdc2a792c54efe5fd158fc57141c4b1f97e8ea064460f845c566876f5e43e284179b26d019", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898212, "uuid": "8e2e3c50-2a1c-40f7-9874-0b660863421b", "value": "T14B08024AD50CC936E9CAF17C9F7A0763F1363C5842A4C19A7829B209FEF76E04671B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898212, "uuid": "e54be653-bb07-49fd-bfe4-b28f42439a44", "value": "1572864:vMHZMH7VFGxN11H1VVKlvO7jn31Yx8ERq:vUQVFGXjVfKI1Y5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770898212, "uuid": "ccd62a49-f9a5-403c-95a8-ccbd504803d0", "value": 82736218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770898212, "uuid": "d73a5dc4-fb27-4acb-a35f-deb71c1355a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898212, "uuid": "fab6331d-7944-4ab0-a716-9431653b27c9", "value": "com.svtv.djshort_1.3.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8290182-07ca-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770870375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870375, "uuid": "74e951b0-1d6d-4f5d-a84e-b7a6a9de868e", "comment": "Malware payload", "value": "1f7f9fdb6aa92545b36f81988fd4ed31", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870375, "uuid": "a3fa3bf7-e80b-4514-ba7f-f1e4870dfe1b", "comment": "Malware payload", "value": "851b97f5419f3735f872eb59a12ca7ef2f50ae1d8386ac38f2706bb49f25777c", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870375, "uuid": "3a5ad42e-ec91-4f80-92b3-01eb79b7fb29", "comment": "Malware payload", "value": "5bb42c799bb6be830ba8c401a6ea20e0d6a1c627", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870375, "uuid": "896e11ba-3452-4c25-9fd8-0888d425b548", "comment": "Malware payload", "value": "c5f3c24b986247ac5fade1d8c791bb34998b2c0549f5a63c6b85a522c76b02bf73f330c589d7c882c7ec9673d4baced7", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870375, "uuid": "7d014019-8d64-4109-9950-91cea94c68b2", "value": "T17B6523AF2A6B80FCC01181F5DB2826DD089B9337B71DB507C52B1BD572B5E92B6C3066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870375, "uuid": "36999fca-d2bd-4025-a21f-4371a0e78b11", "value": "24576:xnI05vynI05vi7uA4YTZQzSCSX1QwzG7QonI05vx7uA4YTZQzSCSX1QwwA4YT/QJ:F5va5vi9T6zQ1QwzGt5vx9T6zQ1QwjTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770870375, "uuid": "ac0d6489-77d8-4650-af0c-303a59005985", "value": 1433035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770870375, "uuid": "3537511d-5dc8-404e-841b-de58c9d0d88f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870375, "uuid": "935f968e-e9b8-411b-b679-3b22ffe03244", "value": "851b97f5419f3735f872eb59a12ca7ef2f50ae1d8386ac38f2706bb49f25777c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e4701d-083a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770918260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770918260, "uuid": "4b6db33c-e167-4357-b914-8181e02a9122", "comment": "Malware payload", "value": "bafd06fb7430f64a5c1cdaa1594db653", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770918260, "uuid": "9a226e82-63b1-42a4-b243-4761b4b315c5", "comment": "Malware payload", "value": "85e53c4a2fd42048aaa8bf76766cffed0569a06f6a3eef6d26b692bda6cdc67b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770918260, "uuid": "aec7bcd4-9c39-4d55-887c-a601dacc2a0b", "comment": "Malware payload", "value": "76ccc1668fb27a8634d8bb36464b0b0813007cd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770918260, "uuid": "d92e9be1-c1ec-4bad-baf3-57ed6adf481f", "comment": "Malware payload", "value": "bae0b0469c66778561cb31b031dd1b7a418a165508d8e6c5be3ba67d1df8d7b5855f83bc96f9ebc677cefa7f9c7f4096", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770918260, "uuid": "d343916a-a412-4705-803a-5575a0289a35", "value": "T10015330027755CB0D3F8E80949CCBCAD633A8951163B1FCBE46149FB2ADDD172B5BA68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770918260, "uuid": "e96a73f9-89d0-45ea-9343-30066f55fbb3", "value": "24576:hzfEtBkjj8t0D/p5fAZ6LNnw3sXQyXQ9enZ2:hzKB8j8y/fvNn005geE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770918260, "uuid": "1269a949-5e03-4d7d-84c0-c9bd39ae41e5", "value": 933628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770918260, "uuid": "378b5428-136e-4509-92af-000baa882f3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770918260, "uuid": "0a23a96b-b781-4db5-a5f0-84ac26f7382f", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eae7503-0843-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770922167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922167, "uuid": "f7619625-22ce-4aff-ba20-31c418f53e4f", "comment": "Malware payload", "value": "f3bd13736fd97201869d81a6d3f4558a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922167, "uuid": "ddb72915-7ce7-40d5-b737-6e95706ffdd4", "comment": "Malware payload", "value": "86097885c004c4d92d99768559813bc4549dd55dc793dc1710e7753783b364bd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922167, "uuid": "c08816aa-b0d6-4a72-b36a-c98cccc4c0fd", "comment": "Malware payload", "value": "51c9ade8b80df2ff00dde84ab979ca2fafa75fb4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922167, "uuid": "89dfb9c9-2d46-4d18-b8bd-0835cfb0b07a", "comment": "Malware payload", "value": "9837f6ece23686e7d0923eaec338fbe48ed65d6d290b67ae6cd76f0ae8ad3e448c479920d8ab46f6a32193cb2d4f3120", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922167, "uuid": "c4b8a2f2-3bd8-4fb5-810b-a52662926e00", "value": "T11AC3B06EE70F0915DF5596BB034A4A4A06FCB33DB38140B139AC977437AD83E4A6297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922167, "uuid": "4c3f240b-aa48-4874-aadf-46ce9160183c", "value": "3072:UQCTxqfm7WPIe72h2S8cJXXWAxmSsuch4YD3:buqYe6h2SbZmAxm7uch4YL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922167, "uuid": "9a1b9cac-96b3-41e3-b1ca-bf98920fc300", "value": 119069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922167, "uuid": "8f6ddd65-b254-4e39-8e76-5a316a7bf10c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922167, "uuid": "319a32b1-ccb1-4328-adca-bfb839e29b35", "value": "00000.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b10ad4-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770877800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877800, "uuid": "00b1bba6-c7ec-4e00-a65b-efb940f02f7b", "comment": "Malware payload", "value": "238208e5ca2604c9bfaf676400e7e9f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877800, "uuid": "7e6c007b-2f00-4235-b68a-292c887a4552", "comment": "Malware payload", "value": "88823d7df240a5a747767947839644257d714fca1831bc6cde4be5e7aed111d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877800, "uuid": "96f14617-3d6e-4c06-8cc7-ad75eae7b0fe", "comment": "Malware payload", "value": "7303afb587ff0b0131f8937fb344aff87567a26a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877800, "uuid": "e01eb995-1d7c-4c53-9fa0-41d04e24fc48", "comment": "Malware payload", "value": "a2f08d42fb869e411191c7be954bb80aac0264c37a7ae3ebfdc4c74dec99783464ba7eb71ce13f986ea358fb66030620", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877800, "uuid": "e3c6a23c-32f5-4faa-9709-dcd6a2324b84", "value": "T1A114C70A3A228FEFF56D877147F34A30976976D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877800, "uuid": "c71b6f3b-4392-4f0e-a79a-3f4db5a54e9a", "value": "6144:4g6eQCbeoufx4Kdf2dp06GtCqjYW8nY1j20WI:aely4Kdfap06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877800, "uuid": "dd74e4b4-277b-4778-baa2-5843d55df805", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877800, "uuid": "6c0208e0-33ba-491b-9d5c-2a96b58ffc38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877800, "uuid": "e84b1903-4773-4419-a396-4789df10dbf5", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5378109-084e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927010, "uuid": "772dbcd4-81af-4ace-a068-c6ccecc0857d", "comment": "Malware payload (Mirai)", "value": "f691f16f10e15070661936c75d603e13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927010, "uuid": "1129a6db-6297-4392-87da-a264ef2d7af2", "comment": "Malware payload (Mirai)", "value": "88de54e79bfaf05f1a643581418d9f8ee63280c00d19167ecbee7969071e5231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927010, "uuid": "60428ba1-a3b9-49fe-a4c3-fd02b6aeb4df", "comment": "Malware payload (Mirai)", "value": "bbeee60c1276a525c8a81cb98ae664d6b4af3815", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927010, "uuid": "07e3af89-2322-4951-b4c8-fec217c8be53", "comment": "Malware payload (Mirai)", "value": "165894813a43c6f56ea16603ecaccb497f7feb21a62c603847f23e8fa608c962cf75915cf490ba39deac04bf03fe5870", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927010, "uuid": "1dffeef3-45c2-4047-932e-9f313bb523ea", "value": "T14CF2E16B19085ADDC85488FE8EDC1B821D19CFE195527E877B62BF7F849703424837E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927010, "uuid": "4c0f8c89-19db-4978-85e5-228331ad2030", "value": "768:O/QW8I+3XjxGXVz1+xvz6QNFrK1GIldg9m2F9SrKYe0JgGlzDpbuR1Ji:O/l0D9FNFrKAIINzJsVJuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927010, "uuid": "c6047408-4bf9-42e0-982f-c47bf7e8f2d2", "value": 35844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927010, "uuid": "1d8a592a-38cb-4000-ada0-52aa6982126f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927010, "uuid": "810659ee-5cbd-46d3-a59a-2e6d73b66730", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06290bca-07b6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770861379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861379, "uuid": "ac885e56-06dd-4e94-8d63-1e17bc925f2e", "comment": "Malware payload", "value": "d5a1ae492630a8ba93bb6e4c36868dea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861379, "uuid": "2817c153-5107-4149-ab5e-b5eaf264e1d4", "comment": "Malware payload", "value": "8910c8ff30f8efb936682d857aafd54f039ac65f850ba8be004ef901f3a25bd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861379, "uuid": "0aab44df-bc1b-4ac4-83f3-831a34bc1df5", "comment": "Malware payload", "value": "125d2efbc5a5682be04af0a8edef31215d712752", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861379, "uuid": "5237406e-cd21-4826-af50-f71d6360f1d1", "comment": "Malware payload", "value": "410560ea6d2b1eb037126f54192f9b2b1a3bc378e3e2dc1ff65feb1c8cdb9abfb7f87770b94c9ad7a8b1f3e22af9b31a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861379, "uuid": "bff2106c-4268-4a7e-a5ef-77bea7659fc5", "value": "T175D52A137F28EB1EC66812341CB1CAD86B2D5C4541CAA517B391F31EB9B20AC5D6EEF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861379, "uuid": "5a0cf96e-41ec-47f2-ac61-7310260c16eb", "value": "24576:5y+J/bDKvqC+UWSdFKR3diUEZEDi7qRJKGAa6OZp2J7eHdydcoXINt4zj0dEegN:bREZEk17edoVzOgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770861379, "uuid": "1ef5ec72-24cd-4162-a102-a03e82a4e682", "value": 2752695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770861379, "uuid": "3ff003ac-fb37-42c3-81b1-80cc7ae22acc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861379, "uuid": "3ef07a02-4573-4955-bac5-ac58070d852f", "value": "bot_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41f0da9-07e0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770879817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879817, "uuid": "9f48aa35-2c4b-41e3-a367-961b376d7763", "comment": "Malware payload", "value": "0ef9813503d9ea3f9aa9d61d8c6b8101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879817, "uuid": "b7c81130-c4a2-45ff-b35b-a8719b0d1d6d", "comment": "Malware payload", "value": "8a5c0a87031ee5c181f637d33cecbbbfeffdb8fdcddd884b3a215e4ea13ea0d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879817, "uuid": "206ca4d6-b4d7-4d69-945e-a3d2ed40d519", "comment": "Malware payload", "value": "c6c97de5edecc888eacc8b7e07e35ec45b530f21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879817, "uuid": "c6734615-d5c4-4684-96ef-75039b935524", "comment": "Malware payload", "value": "8e0881c8bf3a8fa808912e1f6efdbd951d285e3674809221f98d325be06c4b23547e7d71790b12fa39da0478c2ef26c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879817, "uuid": "013ae1ee-85d6-4998-8e44-ad2811d70849", "value": "T155C5AE65F3C82199E43BCA798B41E323D1B278234776A4CB0696130A1F77ED25BBB711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879817, "uuid": "fadb7afb-5c7a-4712-b5e7-2e1cc2dcac82", "value": "4832d002c2d20da9fa0051e0a06c07d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879817, "uuid": "010f1f20-cdd6-4863-bedd-13ddd581ed72", "value": "49152:9K2HMZmSskF7QllxUCzfyx9UwA6iTTB4A07CBT8J6IS+DSL:IhmWhA6iTTB4A07CBT8J6IS+DSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770879817, "uuid": "6b4d5204-f3a1-4b1a-826e-858e780f1bb5", "value": 2515968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770879817, "uuid": "f73886fe-25cc-4015-9469-13b5c9e4fc9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879817, "uuid": "ec42de02-debe-4a16-a05b-3c2b7add2562", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47815b14-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877809, "uuid": "13b96a1f-6122-4881-ab36-db1190bd2fdc", "comment": "Malware payload (Mirai)", "value": "b9038cd0743e8d03bea2780180efe9e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877809, "uuid": "6a21bf16-a5cb-48c1-96ac-beee5fcdf005", "comment": "Malware payload (Mirai)", "value": "8bc0a92bf66caf01130502dd61f9de4424f152aadd4b3c58b1cfcda4d8c9ff72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877809, "uuid": "70bae3a6-bf50-4f2e-acd1-6c574710f007", "comment": "Malware payload (Mirai)", "value": "156f55b07e6fc2b28764758e814ef4f3ee9083b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877809, "uuid": "53c0936b-3ba1-41f7-b22a-b66995dc9c8d", "comment": "Malware payload (Mirai)", "value": "1b942b1b677b36c1e8ccc2f51e3381176add4a56e63edece9eced783e8369cba457a51bcfed925b9cb9262dacf7a34b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877809, "uuid": "62f2509b-adfb-4b54-920f-46d0ea7dba76", "value": "T15EF33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877809, "uuid": "ccaad76b-07f1-4d2e-9eb0-3bad9720de40", "value": "1536:wdMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMpfEn5p5M/LW:i7vDtrnPTR71gmX7Dy7fMpfxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877809, "uuid": "d26fe6ec-2e74-406c-9524-114d503563f3", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877809, "uuid": "67148f3c-c2e6-47ef-97c1-347be3e77bfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877809, "uuid": "56f4b7b8-a05d-4f89-b3a5-4b9cd04708b2", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d353c98-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877926, "uuid": "af7df2dd-204a-4b06-b7d7-452652db1d99", "comment": "Malware payload (Mirai)", "value": "c142b6acd58935b4c73426e11e1316ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877926, "uuid": "1f0da937-1597-461e-bbe9-c9aff0369dc0", "comment": "Malware payload (Mirai)", "value": "8c8e16c9f369f83e23cbdbea8ab0d01f30566fe0070801cca38473a7ddfe4817", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877926, "uuid": "18564a9b-a568-467c-b7be-45ae591f4f9b", "comment": "Malware payload (Mirai)", "value": "a893868fcbc06bf3eda1b323d8bf870a5e70a4c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877926, "uuid": "bd981e84-2e04-4bad-ac20-f271fdb3008f", "comment": "Malware payload (Mirai)", "value": "0e1f8e544a5ffa2bec1849fdc358285db8a4f473f54bd76157677771556bb316aa89c0187263577bbad7322bf801b9d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877926, "uuid": "333eaed0-5673-44b2-a47f-ed2fb06f937e", "value": "T126737E53A5A4AEA7C1964BBC6B5384354313F8094FE32EF6E219EEF54107DECB809361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877926, "uuid": "2ce0cf5e-906b-4ee0-8db3-41ccaaed5c44", "value": "1536:Z/L+M3lzS1Ga9wtE/s1cbE/t11Afs36vcn/52tBClMja54nrkgCq:Zz+czKGG9sYE/tkf+uG52tBzWmkJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877926, "uuid": "86b0ed85-4d2c-4233-9571-810ae3095b14", "value": 76503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877926, "uuid": "bdb9e422-9684-4b5c-9ad0-085460c7f44d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877926, "uuid": "070dd5a2-f7ba-48ff-b0be-6a902127dc9c", "value": "xd.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee6b9ff-07b6-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770861555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861555, "uuid": "bd6a53a3-b1a0-464c-b648-b9c828958957", "comment": "Malware payload (Mirai)", "value": "acd90d563b348d21c3c31bd68a572084", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861555, "uuid": "cd32f849-b7b7-48f8-8069-0eb81f0156dd", "comment": "Malware payload (Mirai)", "value": "90d53828763ce56bf2cef0cd47449a768ff7d3ebbe790c79e5b6ba6e8462020f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861555, "uuid": "37928ba3-19b9-4779-ba80-1a820ccd8a0e", "comment": "Malware payload (Mirai)", "value": "9ba7961b910d250cb4dd9776958a754160dbfa40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861555, "uuid": "1419ccd9-b154-4651-9fb3-fb90dbcb9340", "comment": "Malware payload (Mirai)", "value": "a40d31d6d74a96435a04d8364d9d4889dd82aa8aadd5c8e2e88028b13f6d1679a0b5a3769d02ba26a7bce5407d703a8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861555, "uuid": "c49354bb-c4ec-4906-8c06-44059faded67", "value": "T174736BC4E5C3E4F6EC160879207BBF725D73E63E7235DA9BC3D895629801602E21A35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861555, "uuid": "e51ac65e-0b91-4c8b-8190-f3c5bb4cd95a", "value": "1536:grh+qniJkqN1VHnNZCzIjvoChKo+q/5Re6YSL2oYnLum8IMAcS:QniJJN1VHnguvoCwoP/jNYL5nBVMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770861555, "uuid": "7c239f5e-9be9-4703-93a9-c8ab2c73d6d1", "value": 76560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770861555, "uuid": "50dcf043-72c8-484d-8101-0cc67a801aee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861555, "uuid": "0890f358-8006-44df-ab84-16d9f2a7e8b4", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911f3822-0843-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770922171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922171, "uuid": "291ec275-88b8-4f4d-81c7-83d0c257b3a6", "comment": "Malware payload", "value": "33ee00a706a4a9f36d2226bf281955d7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922171, "uuid": "09b01ea9-464f-4fb9-a31f-79e1acdd4d5c", "comment": "Malware payload", "value": "9122e32c6d39fbff3bb2623fffc020766b185c2392b15b24c739b9c9e1bc23a1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922171, "uuid": "377522a5-0b0f-4442-b0ef-a80e660177ad", "comment": "Malware payload", "value": "6089cfb41c923d1cf57a3c4d2ef16e31d07cb849", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922171, "uuid": "c403de41-3769-4efe-8a9c-1a9a9b5063bb", "comment": "Malware payload", "value": "671b3afc5fdf54d08c4b01db1d3d4f22a41348662d523af8d1b80c4120600a744748efea6fb21c5b7b59b40103b15d8b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922171, "uuid": "5a3d00c6-37df-4bc5-b46d-7d3021563a10", "value": "T1A0B39E29E70F0955DF91A67B434A4A8A49FCB33DB38500B179AC973437DDC2E4A2297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922171, "uuid": "17f633fa-1fe0-4399-9f01-0f09ccd6aad8", "value": "3072:OlM+hkeT0LtM9d9+hqp7r3ikF5oV3P5TeGzKh:Ouar0Lmn+hqp3ik/SPVeGOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922171, "uuid": "cb8581bd-bc98-4df2-bbf3-0e639db6d21a", "value": 114191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922171, "uuid": "c6abc92f-af97-4829-8167-ceca0731c90c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922171, "uuid": "9c567864-c7de-45ec-9f22-dd900621653c", "value": "2302990sdf90ad0f90d9f0sd0f0df0s0df0sdf0.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c0453a-07e3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770881046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881046, "uuid": "d5b46cd8-50d7-468e-8951-12ccf949e714", "comment": "Malware payload", "value": "2ee2c5f3f1ef8c7a2dafa47627785209", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881046, "uuid": "5746404a-adde-4e37-8d4b-fb75d29b647f", "comment": "Malware payload", "value": "936f904acf29319762d894bd8e81cf95a2a7e556cb539e842904771e8a02d21c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881046, "uuid": "75b5ab9a-7cbd-4964-bcf3-c1ce2f404fd7", "comment": "Malware payload", "value": "481e840fb36ccb51e3556441a220e8353b7bbe90", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881046, "uuid": "232cfa8d-e028-41a3-8d12-3f601d2a37b3", "comment": "Malware payload", "value": "11816f15f5268357eed28cdda9edd844dd7755207741c93fb92df0ac5e76d77040d1aa8f8c443913adc0dfe94dfa9fd6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881046, "uuid": "628d8bec-4652-4ce8-9894-0608c3ff9a22", "value": "T197545C41B982E0BBDF6C2134316DDBE5007D192817A4BCFB63B92DB85D10EC16B3669B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881046, "uuid": "d930f253-e213-4dd3-a268-3db56b0f41b4", "value": "11a7bdc1948fb4e343a04c8a7a2d39de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881046, "uuid": "33772212-6774-458f-a40f-b76397c12ac3", "value": "6144:4Ll9jTCs7VkmPra0vLsS4hTRG0lj/4hjuLHTae72Aq:6NTCQ+G54hejKTaDAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770881046, "uuid": "aebc0968-019a-4b94-95ea-201bb78b1e87", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770881046, "uuid": "4ba15016-9bb2-425b-bd82-e6db819ad218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881046, "uuid": "fd29fc16-fb24-4b1f-8bbe-4d04d5a42883", "value": "2ee2c5f3f1ef8c7a2dafa47627785209.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed46a9ed-07f3-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770887966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887966, "uuid": "a06d0185-1733-4562-a6c0-730d0798e36c", "comment": "Malware payload (GCleaner)", "value": "459da5d05fb8733002e77b5e0621994d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887966, "uuid": "f4d0180f-013a-4925-9b2c-2745eadd16b7", "comment": "Malware payload (GCleaner)", "value": "93f739b675520ba69cc39e7c066383e53161b7d9d03e7b287ca52ee4c146b3ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887966, "uuid": "80b7de6f-e1b8-42a6-bd7d-e92babc376cf", "comment": "Malware payload (GCleaner)", "value": "f3f560c3bceda3663726ab748c089b32c2a99198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887966, "uuid": "02cc1af9-4dde-442d-8318-3b501665220a", "comment": "Malware payload (GCleaner)", "value": "a2f5d0112173aeb6dd8199d61c000ea6a6e0f9268ffead64b6836b81b3423f50ad81fe5732247249f75c9c14def7c3af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887966, "uuid": "e4bc03c8-d654-4995-b02b-1493f8ca56c2", "value": "T13646D0F0A6960920D8EF9638D8F121B8055D7DCF18F8CF746DDCE9CB6B9A043646721A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887966, "uuid": "4389c0ea-0ee8-464f-bec3-f767ff03762b", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887966, "uuid": "6036d161-07ae-424f-a512-3a573de213c1", "value": "49152:+9CiLxsEJnuy2duN2UdL8Rcsq3TgQh0sWKfx/b5/7rwEjG:+9Cexs5XY2URwqjge0sWKfx/RwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770887966, "uuid": "d4f0b5d6-80aa-4a8f-8183-6c39698190bc", "value": 5415424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770887966, "uuid": "578d8904-83de-42ff-81fd-e08f1a3f4207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887966, "uuid": "16f82124-2f8e-4b57-943b-bde8272165b6", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9608dbe-0847-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770923957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923957, "uuid": "557ee1d9-9666-4304-a4d9-c802dc1c540a", "comment": "Malware payload (Mirai)", "value": "72d9904a18e47ea90ec13d11eeedb331", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923957, "uuid": "02641756-81c3-4dd8-a7f3-6d2259771843", "comment": "Malware payload (Mirai)", "value": "94d359b64539c16be4c10131085a603d178630a215a6e49349bdb80cd8c8cf6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923957, "uuid": "9b675794-9887-4a87-be0a-06d58c4191f2", "comment": "Malware payload (Mirai)", "value": "dfdaaaf73f89b6baa60dee5e61877025375ec231", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923957, "uuid": "36cdd99f-a021-4824-b076-43fa9074b7e0", "comment": "Malware payload (Mirai)", "value": "3a55b14edc6b763f8936f5ed1cb7cb2e3b1a7a53d2d21396ad395739f22f4fa899423a00c69031363973f8a1b2b405e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770923957, "uuid": "b7a26707-3795-48a5-8b6a-1d5e61c6cfc6", "value": "T1543301A232AA54F5D6FD5BF71EE60077EEA1207287CB1A3BE3B0D57459C178AD1A4300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770923957, "uuid": "3ddcb1a8-b5ab-4af0-9029-ecc0a6c4b907", "value": "768:/Ds2MNU7C8L1yTn5ha0Sv9MA2bSnWk73U03wfDu2+3FUDM7fXqFSBjFQk+:/Ds87CE1w3aj9umWRfD7+3MfQ2k+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770923957, "uuid": "4db04147-7400-4093-97e0-7206d6e03e13", "value": 53624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770923957, "uuid": "838ee0e5-75a6-4184-8991-8b3ab6cccebc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770923957, "uuid": "d4fe277c-018c-4c34-bd4c-a8b6ab557303", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c3d3ab-082f-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770913428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913428, "uuid": "db6a83fd-63af-4844-b03f-42198a54a571", "comment": "Malware payload (ConnectWise)", "value": "468db0f00ca91dc65197b5dec42415fe", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913428, "uuid": "f13a013f-5efc-4b84-8f4a-2796235d2208", "comment": "Malware payload (ConnectWise)", "value": "94e83c792ceab05ec3697100b15a9518afac464cd6a5d950ddd66f260796c0e0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913428, "uuid": "e655e999-082f-478a-8cf0-a32042cf92a7", "comment": "Malware payload (ConnectWise)", "value": "ae2df65525e17667645ec3e28f9b6766ee4395b7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913428, "uuid": "0c0b0ca1-aaaf-475c-b05d-6b1e06aa1417", "comment": "Malware payload (ConnectWise)", "value": "0f52060bd2e6c8f3ee289267a46ee6a0e42f5f3999b95c0867bb950fcfddeb8f3440e740a7dad9da3b2ae9b8c2741ddf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913428, "uuid": "6c75e463-213e-4287-aff8-97a94e53c775", "value": "T17FC623627BE4842AE6B70A39F93991B199767D55CE27C10F1374790D1BB2E809A33333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913428, "uuid": "b13bf621-9884-425c-ba8b-c9121514e795", "value": "196608:BT0cEhi5owS/wFFV2eOhJgy8T0cEhi5owS/aT0cEhi5owS/AT0cEhi5owS/oT0cU:BT0UR9FFVogy8T0URrT0URlT0UR3T0UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770913428, "uuid": "5ba47ad8-900a-4c6b-9b5b-3362ec875b85", "value": 12189696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770913428, "uuid": "f96fd37a-2329-4cb6-b8c3-e09cf4fbac60", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913428, "uuid": "6305ad7e-b70d-4ff9-9058-63b58f5047a2", "value": "94e83c792ceab05ec3697100b15a9518afac464cd6a5d950ddd66f260796c0e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7950d3-0843-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770922168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922168, "uuid": "5428b91a-6525-4728-94d3-c40923f6f52e", "comment": "Malware payload", "value": "fbd6e04ffe0ff5f51a0871855b7b81c2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922168, "uuid": "a7c83c56-7244-400a-94e6-28bd451b4fe0", "comment": "Malware payload", "value": "95993055acb0ae55633b8451bbbc0533dd6bf45bac6ca71c3feabab4836017f8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922168, "uuid": "f52fdcb8-0332-4f7a-a433-a0b6e1c615a6", "comment": "Malware payload", "value": "e6adc26443380f75a60931fb8a0358d65a205b6e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922168, "uuid": "405bae16-6a5f-45e9-8849-d79f5f9bc16e", "comment": "Malware payload", "value": "a02c707848dbe3b52cf5e40682782a604871aac2054e264c6d1a89dbdf5df1bbf9c36b25dc5e69d53c55f2b8ba7575f9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922168, "uuid": "02f80f34-29a2-40ca-a82f-23ff2fc2b2d4", "value": "T180A3B16AE70F0955DF94967B035B4E8A49FCB33EF24140A1396C977437ADC2E4A2287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922168, "uuid": "eb379019-4b3c-4127-8e91-1c7ad31b4dec", "value": "3072:u64tK02zj1CgO7A6Xcil6T/7GStTLtqqZwp4QWkbj:vcwDfT/7GStTLkugVDbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922168, "uuid": "da3ee060-d6ee-4a80-9124-cba975d7a961", "value": 104312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922168, "uuid": "ec2f763c-bd64-419d-b551-aa8943c21a77", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922168, "uuid": "d8ba2266-0206-40d8-8757-2fd966995130", "value": "0.0.0.0.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d43236-081e-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1770906044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770906044, "uuid": "01c07469-b870-4264-828c-ab9a0b993309", "comment": "Malware payload (DarkVisionRAT)", "value": "27eaadd9646703a7ad6ef2563f0bffd8", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770906044, "uuid": "704506a5-ffa0-4419-874e-38de7f4fd29c", "comment": "Malware payload (DarkVisionRAT)", "value": "95a67324a3b360de5e1012587af185aa511e37a347c45ff0ca0a897ca95d25a8", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770906044, "uuid": "19be3e01-8781-43e1-a737-bbdec63db270", "comment": "Malware payload (DarkVisionRAT)", "value": "8fbdfa518e03676bdb12e5249bb4b965dd4cdbea", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770906044, "uuid": "4715c837-0b58-4c99-b066-633e1420824e", "comment": "Malware payload (DarkVisionRAT)", "value": "fe99f366a08c7302b596cf035d611cd08955356f7bce51338cf1ae5a9644ba8a54df2c835b6c3620e843d421ccedf08b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770906044, "uuid": "77730bac-9baa-46ff-a1bd-9b1f7646fc80", "value": "T1D7451665074983C3BC44DFA98A354C0403FCF93A4F3AC699D1AA64FA7B0B43955B768B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770906044, "uuid": "d7dbc2be-bc96-4b7a-b92f-7b76ddabb534", "value": "384:D7jGihHQnSg2By50zgKdrIumFsjZlQMZ18:d8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770906044, "uuid": "3d703b5d-8511-41bc-862d-2048394489ae", "value": 1177326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770906044, "uuid": "d10c333b-4c7e-4a69-a2a0-ed6af631e004", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770906044, "uuid": "fbd2e4cf-b327-4c74-87fe-777eda19ebb8", "value": "Documents of Inquiry.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc1a40b-082b-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770911646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911646, "uuid": "55743bda-92e2-42a4-a062-a061ffe1f7a8", "comment": "Malware payload (ConnectWise)", "value": "4854ce83a4b880de3cec7838ff0bce97", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911646, "uuid": "45d997df-13ab-4306-b93d-ba39d5f75def", "comment": "Malware payload (ConnectWise)", "value": "965c073c8aecfba000f0c6f55fc1fdc2d0ec1450c8a5018346a41de17324fcaa", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911646, "uuid": "b82ea510-8ec3-4580-9296-d8f19fc2de79", "comment": "Malware payload (ConnectWise)", "value": "a25724bf889cdcde30afd6372aab7216fafc33fe", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911646, "uuid": "3836de79-e42a-47f0-bafc-0d4585dba028", "comment": "Malware payload (ConnectWise)", "value": "3a6de9134448b8c1bab7ea8f91b349302d3382ba42f3c6c4b6b47210e830d100f20317885c028104f77362a19bbbb034", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911646, "uuid": "4cbe76dd-ed82-4f48-a164-5bf2298df3dd", "value": "T17AC623627BE4842AE6B70A39F93991B199767D55CE27C10F1374790D1BB2E809A33333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911646, "uuid": "f02061cd-5b62-4358-be3c-f820755482c6", "value": "196608:VT0cEhi5owS/wFFV2eOhJgy8T0cEhi5owS/aT0cEhi5owS/AT0cEhi5owS/oT0cU:VT0UR9FFVogy8T0URrT0URlT0UR3T0UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770911646, "uuid": "68571d55-79a2-432b-867a-14b542349a08", "value": 12189696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770911646, "uuid": "219d003f-4863-4962-a8e9-14f1d34082d9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911646, "uuid": "ed190703-b844-4b36-96cb-a82977c6c987", "value": "965c073c8aecfba000f0c6f55fc1fdc2d0ec1450c8a5018346a41de17324fcaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a79954-0836-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770916728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916728, "uuid": "9b9082d3-b35a-4526-8570-f6c20a2c1d4e", "comment": "Malware payload", "value": "e7bedf56407b2a6d0d02f14d855f394f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916728, "uuid": "5d72ffc0-3338-491d-8530-0da082ed02ce", "comment": "Malware payload", "value": "988573180d8f31d221783ee30cf011c099bba0fb8ecc99c00598876703900cb0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916728, "uuid": "e6a898d5-c372-4d79-be67-c1d687822b4c", "comment": "Malware payload", "value": "d1c59efb694ea3dc3675c2841be6100154112c23", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916728, "uuid": "69cfa839-2c19-415d-98d3-08b991b0125f", "comment": "Malware payload", "value": "50ce8820896fb8663d93376355a40c2f106e359a7d96211a0d57121011e6acb071ebc35d2d7420aed732f4b8dd8dd7c6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916728, "uuid": "9365753d-44a5-45b3-829b-68c174423c5e", "value": "T16B77F103F7499D32C9EEC33989B6475277339DA6AB8393871404F1B87CB36C49E99294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916728, "uuid": "1ebdb324-ff5b-49c3-b532-523ebe8b4bb6", "value": "393216:xCW9LS9YxEqGHH8rdqcD6wLKfZAoSzA7RIgGQvb5vuqX1ivI/ZDRiHgMYw:soaY4YdhLKx/t9vdvXXQARRiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770916728, "uuid": "5c1b9a5c-3622-478d-912e-441826ea368b", "value": 34464857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770916728, "uuid": "a2c3a77e-8ca7-4b7b-ae85-eca7ce602201", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916728, "uuid": "dd4bce63-1d88-486b-8b7e-4b68035ecaae", "value": "Download_Monument_Valley_3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb331a7-083c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770919187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919187, "uuid": "dff99a23-6514-4abc-8a9d-720d3d071b2e", "comment": "Malware payload (Mirai)", "value": "674e2d6bb4d5437971c4a9b4c96e6ccd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919187, "uuid": "65875d71-742b-4e6e-90f4-8689d6ba33de", "comment": "Malware payload (Mirai)", "value": "99fbcc2aa0582ff5e0a38d83b10c6b0886a45a8979d2b1e37a5e6d1dddcaa6a7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919187, "uuid": "43fe7dc8-4596-4549-b1ba-5f26188da4f0", "comment": "Malware payload (Mirai)", "value": "cbc0748a227b2bd9ef0f7324b796d576f2536494", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919187, "uuid": "067cc830-0106-4019-a7ff-873ae266b9f4", "comment": "Malware payload (Mirai)", "value": "719689b6bd5ba9d38fadfeaeec41c16f31d47607fcbb24677ddb7250f33ce258b34adc7310427b869e8aaca955dc9729", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919187, "uuid": "f6fe79ca-1b7d-4bca-849b-cc065b5e4740", "value": "T1A0417385F3426831FFB35E5A71B48404B0D0E06AEED6EE41D4EC76ED884EF08A468B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919187, "uuid": "e1163ecb-f3cf-4537-b119-6f24b1af98b1", "value": "24:v4OSLaIOSFTykaUoOSZoOSVOSPMOSzOSxOSCOSRrOl:v4RTRBURZoRVR0RzRxRCRte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770919187, "uuid": "2015b4ab-7c18-4e00-b844-f925b1fba854", "value": 1933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770919187, "uuid": "c7dc30e3-af2b-42db-8edb-76710f80fe8a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919187, "uuid": "5fca52ba-1119-4876-a52d-1f683e061ffb", "value": "sora.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce507d3-082b-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770911722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911722, "uuid": "5969a2eb-94e1-4ee3-b1b1-0309705172ad", "comment": "Malware payload (AsyncRAT)", "value": "a92e1af89325326e99d7b79ad2ca917a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911722, "uuid": "e492a024-eec8-4f9e-a22d-7b103d69aa88", "comment": "Malware payload (AsyncRAT)", "value": "9af60b3b186d547cff657c634cb23ba5bcb3a2e25dcd352b8c9af2904740cace", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911722, "uuid": "1374a0ce-92b0-4514-b99c-708f24df6727", "comment": "Malware payload (AsyncRAT)", "value": "4df18c030b38f2e29f5e9773610074328dc7cb36", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911722, "uuid": "eee034fd-dbdc-48ed-a2eb-096e96ca50ec", "comment": "Malware payload (AsyncRAT)", "value": "7f82ce8f323e98e3915b679bb819747819d76d95f38eea7785d42d061d34f445b1e0fc140b811885971448c13611e0c6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911722, "uuid": "8929d729-1765-4865-af6c-996c99f90b82", "value": "T161637D2837E54526E0FF9FF069F13216CA32B3176903D65F24DD029B1A27A8DCE522E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911722, "uuid": "b9cda798-a299-41bf-a79d-2eb7ec3e6826", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911722, "uuid": "bc0bbd80-62d1-4bb5-8472-83d1c649a93c", "value": "1536:E9skhcWHUr4TMw3+P429QiYga5bNY7rHnrUS6SMxOe9KtnQGd:EjhcWc4T13+P4Cpa5bNWEOe9snfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770911722, "uuid": "b603be8b-a7f3-46ce-b6ff-97c22d5876c6", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770911722, "uuid": "5dafdee0-7302-427d-9b89-566f178a9f1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911722, "uuid": "fc3e4e76-e335-4b16-bc29-cdf0dadd5beb", "value": "9af60b3b186d547cff657c634cb23ba5bcb3a2e25dcd352b8c9af2904740cace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95e5450-084e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927017, "uuid": "30c735d3-f9b6-4721-bdb7-3fb2b636fce9", "comment": "Malware payload (Mirai)", "value": "ff9778db461f39c976a505d07d943ea3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927017, "uuid": "beb30fb1-0d0c-4968-bdf5-8fb716378ed8", "comment": "Malware payload (Mirai)", "value": "9b2d7043767ff72b0880e345d00cc4ff086cd9f1c32e12f5a0a3e9b2d8c4b606", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927017, "uuid": "46a94b5c-dd5d-4f2d-8b4e-500b2ee1939b", "comment": "Malware payload (Mirai)", "value": "dca00dc19f00704e6805312835e11cc659358a08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927017, "uuid": "d83d3143-c34d-4eae-8521-0d3cb9f1896d", "comment": "Malware payload (Mirai)", "value": "f9b18c722c8a32ca25eeff973f8a88b3b872e12e884cad5217e08332bb2b51a1965ebec3637ae57c74bd83735e09a9c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927017, "uuid": "d45af44f-be30-4841-a209-eab9b218c27d", "value": "T18B7339D6F400DD7DF80ED77B44A34A06B630A79146831F3A6797BA67FD721A40862EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927017, "uuid": "616ca87a-196c-49c6-9f80-1a6549e9f3ec", "value": "1536:fxIPCn5VdAypsie884++Iu+IVU6uFbTqeecIMh3tjOBXyt:fxIqtrpsieykNmUnFvnh3tact", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927017, "uuid": "880d35e0-fc9f-4f29-993c-76c7f8a45cad", "value": 79012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927017, "uuid": "3049b163-416b-43ee-abc2-a1cec1870b24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927017, "uuid": "74520493-ded5-4f9c-9369-0527c9484cd7", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11eaa322-07f4-11f1-a129-42010a9c0007", "comment": "Malware payload (NirCmd)", "timestamp": 1770888027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888027, "uuid": "56ecbaa9-c2ed-491f-8d7f-ff5396405c63", "comment": "Malware payload (NirCmd)", "value": "5d0cd41793424c64bb553959bdffeae6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888027, "uuid": "e6b56d65-81cc-498a-bee2-b7e089a060c6", "comment": "Malware payload (NirCmd)", "value": "9bcd5ac3c41c2c6d448e8c23878058b4461b26be229cec9431b610b70d55f154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888027, "uuid": "21e21054-7a14-40d9-a195-64de4e6a5338", "comment": "Malware payload (NirCmd)", "value": "2793a641555165f5451f1c7efd365ae12fd38d14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888027, "uuid": "caaf972a-c239-4cfc-bbb5-9f429e24a450", "comment": "Malware payload (NirCmd)", "value": "d58ab563cbf58de168e1cad67efdc4385e11d8307a5c24ed66875a586c2922efbf35c22814207982654e661bf8734a95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888027, "uuid": "f8029f98-d882-49c6-abf6-80f7cdffaeed", "value": "T115A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888027, "uuid": "680cbe1b-3244-41a2-bd73-2b8f39f3fc6d", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888027, "uuid": "e79838aa-48f5-4fee-a889-9008ecf854d9", "value": "49152:ABReTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:asTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770888027, "uuid": "97d6e72b-b023-4e67-bb22-cf0d29c067cb", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770888027, "uuid": "e3bb09fb-a01a-49c4-ae58-5dd6689e99b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888027, "uuid": "b4ac1b37-d8eb-4d9d-bced-4368c6a88b10", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179d1531-07d1-11f1-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1770873005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770873005, "uuid": "65db03ac-a6de-4be6-996c-ef5be87227fe", "comment": "Malware payload (Loki)", "value": "4f88c112e23f2e7bb169801c388bb0bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770873005, "uuid": "cf2a7377-73da-4d01-8aa6-a10fc6ba2577", "comment": "Malware payload (Loki)", "value": "9c50d267e39a9268264624b050ea8ba1fa29f014ca0bb21222d6a8d715b28d3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770873005, "uuid": "7377f4e0-ab9c-425a-a3cd-bb35ef33e169", "comment": "Malware payload (Loki)", "value": "805f365ca684589e5b1f466bd5f10362c274c0f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770873005, "uuid": "ead1ff91-e9e0-4471-a0d0-540b9a932cdf", "comment": "Malware payload (Loki)", "value": "773388e028cdd2d35f1e78384b48026dec7860b536ccd83a69c14ea1a2d0f4a798863e09f5729816bd2f522666080aaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770873005, "uuid": "9c4d6be8-adee-4733-8732-40399614b80f", "value": "T1D9C48E3E61BC4A33D423267ACE3B46699932BDD13B7859892BF81CCC9F74341B536192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770873005, "uuid": "21c1008e-695b-47d0-ac2f-3ca01eb627c2", "value": "6a5b34ba09a4b1dcfa5c7ddce3109ef9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770873005, "uuid": "217e2337-b91c-4e0a-978f-00208f1f1c70", "value": "12288:Pdo8eOaMXdoFDWDemKoW2vFpEGWa9ceVV118jc3+a03jl6c:VzeyXdoFDWDemKoW2vFp6a9/ZT0Tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770873005, "uuid": "e15962f3-2a45-491b-a222-66bbf8cc1a5a", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770873005, "uuid": "e5f88fc3-1018-4f3e-bbae-2e018f28d7f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770873005, "uuid": "1abf85f2-72ec-4d75-95f6-110ed2dddd87", "value": "4F88C112E23F2E7BB169801C388BB0BD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd5c795-081b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770904957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904957, "uuid": "763d85fc-be02-4d56-ab46-995efa1642e4", "comment": "Malware payload", "value": "69090148e89182e8f392ab21f7b35d87", "object_relation": "md5", "Tag": [ { "name": "room155", "colour": "#DF2CDF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904957, "uuid": "9515fe64-501c-4095-9e55-32ebab39c736", "comment": "Malware payload", "value": "9c7d99f385b5abcd88bc100be0cf69b34e29d091d285d8b014c16a50b1711e17", "object_relation": "sha256", "Tag": [ { "name": "room155", "colour": "#DF2CDF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904957, "uuid": "3869b503-862e-40b4-b21a-30fba853594e", "comment": "Malware payload", "value": "9cc8c358aabf96f6c9bbc1d63ece6ea2621cc4b9", "object_relation": "sha1", "Tag": [ { "name": "room155", "colour": "#DF2CDF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904957, "uuid": "44f35095-50a3-4340-b884-8dec822cd0eb", "comment": "Malware payload", "value": "8db9c8726eb2f4a3d3f522f3df6e295c880e5cdbe13c5d184fc35311143f6833fac38cd070a907a30c79d05229de63f2", "object_relation": "sha3-384", "Tag": [ { "name": "room155", "colour": "#DF2CDF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904957, "uuid": "41e2868d-9ae7-4daa-adce-28923af2f0bf", "value": "T18D2423077C90B1C69678B13838FE22D68F0166C9795741894587B753C9E2ED3BDE6BC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904957, "uuid": "b4a9708e-47ca-4ccc-9863-9158506d3ff5", "value": "6144:XRNrQWcHdneZ1Yd6v3zXdsElzC8WrVOyu2CJHrs:BNslz6vLlzC8qVOy/0Hrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770904957, "uuid": "e15886f4-2b7a-44c8-909d-bf9d7a01d80c", "value": 224727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770904957, "uuid": "19f97a96-dc71-435a-b972-db516852d404", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904957, "uuid": "baf14c1c-d843-45a2-8f75-33a52764ad9f", "value": "1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1036d0be-07e1-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1770879864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879864, "uuid": "1fae0eff-64da-44d3-a5aa-e9433132120d", "comment": "Malware payload (DarkCloud)", "value": "d5f64376900220e8f129f022ba3266b3", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879864, "uuid": "18bacda9-0bf3-47a3-a72d-76eca3d22147", "comment": "Malware payload (DarkCloud)", "value": "9e4efb8300d61fa29a18a9169965c531fc547234d3ced0532aa341f899801621", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879864, "uuid": "d8148288-0f9a-47ea-a304-8d7794c14ea0", "comment": "Malware payload (DarkCloud)", "value": "f763ed631795476525fb49829d34ed3d84b89cdd", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879864, "uuid": "17f5ece4-d71e-40df-b820-b3682b20e7d5", "comment": "Malware payload (DarkCloud)", "value": "f8bd652b121eb9e809038a8905d45078d9d07ce35e4a90a8f34a485f670622a3542c260ca926005c6d44db70f454f691", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879864, "uuid": "5d5ca833-780e-4868-a1ab-fa0444db6c22", "value": "T18965230825ECEE1BC4A817F90572E3708BB01C1D6572C356CEFB9CEB342ABA69554787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879864, "uuid": "17f99bb2-e007-49d1-89da-fc70603cfcb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879864, "uuid": "6993b098-662f-4d66-b8f2-9cf0bae5bebb", "value": "24576:ZguQ03q2abLX1AISD0Qa3bUr31ESg/4YcAFIuRc6dLmCmU8CgUzqNecVictq:WuN3q2Ey0bUr31Ev4hAFIac6dyCZ8Cg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770879864, "uuid": "e0883700-e124-496d-9d38-cddf28ef0f45", "value": 1451008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770879864, "uuid": "067d365c-28f3-4247-9bcc-6de4f1db1a18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879864, "uuid": "1da605d4-772d-4d20-a3a2-010b20ff0677", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2690926c-07d0-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770872600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872600, "uuid": "0eb74e03-3303-4cbd-8f14-2f9dfeb6184f", "comment": "Malware payload (Gafgyt)", "value": "023421501f50e3e9607f633959aa7b4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872600, "uuid": "48cbf717-85b0-4e60-b91e-1a5e337d1df4", "comment": "Malware payload (Gafgyt)", "value": "9e843b0714b885e788875821496cb20cc4207682f88de3c8f629255cc9eec895", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872600, "uuid": "47fe39b8-e331-482a-b9df-9ddd5dceef6d", "comment": "Malware payload (Gafgyt)", "value": "52f89a74d2c1ae477bc962c3c535e7c5f3c83ac8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872600, "uuid": "80aa4bc8-6351-49a1-a7ad-daecad09eafb", "comment": "Malware payload (Gafgyt)", "value": "ae4c9c13e674790a20a4153bd0a78d54fd332b8f23cb57d06d1a5d60681172d2911fe96000ca515153cc61d5190fefa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872600, "uuid": "679169e1-f6ca-49f9-a22a-3c3c54cc0ac1", "value": "T17E930892B900EFB6F40ED77A44D34724B670FBA24E531672731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872600, "uuid": "842301c3-f29d-4adf-9120-5887c0dd7d83", "value": "1536:4mZMaXpB8F9OEG6ktQm3r/FS3n9RIB6Yy36gR62f7vTmQ9VqXjewf2Le:v7p09W6KTG/IB6Yy36ANfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770872600, "uuid": "1bfa443c-14ad-4758-ac90-b03396c967c7", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770872600, "uuid": "95889fbc-ca53-4c94-99d6-168ce0be3883", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872600, "uuid": "26bb133d-a862-4214-a084-f31488915fb0", "value": "m-6.8-k.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b8804a-07a9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770855976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855976, "uuid": "b7a5c0dc-df4c-497d-8b26-5eb44fabab9b", "comment": "Malware payload (Mirai)", "value": "a30e229b9a3daba488dd8f3566872811", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855976, "uuid": "42406141-3c7f-4677-ac05-304506c9dd31", "comment": "Malware payload (Mirai)", "value": "9eb104438d1b188349e7d8afedfad8f13bdb06c545a17e76b5900e55064bd598", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855976, "uuid": "e88ed87a-6650-4bed-a3c5-49822d3a21c2", "comment": "Malware payload (Mirai)", "value": "6383622316c09e8c80a675e813804a73d94a53ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855976, "uuid": "6ec2f52e-8973-4a3a-a7e1-88409cef7e7d", "comment": "Malware payload (Mirai)", "value": "de0b9988f218e416485ae2b1eb658a1c2df611072c30f4d056dcd4f383629d310ee6ccb0ce601d691b073b94a4efa97f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770855976, "uuid": "8d6b0c31-2613-44bf-9f98-271ef537536b", "value": "T149B3B84E7E618F7EFBB8C63847B74920A24823D526E1C585D1BCEB051E6028E641FFB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770855976, "uuid": "162befff-383e-4818-8ff5-d1e03bc42c7c", "value": "3072:lUEXPY6X2M/R4RDEd6XLcGKkrPQBwtGXKmE:lUAQ69/R4RDEd6XLc8jNExE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770855976, "uuid": "93dcbcd2-7bcc-4029-abef-4a292707d327", "value": 109756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770855976, "uuid": "eb731e91-d46e-4d38-a31e-b3e3a9539de1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770855976, "uuid": "503eebf2-f5e8-4ba4-933c-03321028592c", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427bd3bc-081b-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1770904859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904859, "uuid": "74a638a3-74e6-4582-960c-5cf477270ec4", "comment": "Malware payload (DonutLoader)", "value": "a4241c341d0bbdf9617f4f17b7132565", "object_relation": "md5", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904859, "uuid": "bbedbd33-d3b4-4a9d-8361-0394d1ac526d", "comment": "Malware payload (DonutLoader)", "value": "9f420824ec0cad72ccf7fe465df69037a8a0c73798ed01da4392f4fdae57ec26", "object_relation": "sha256", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904859, "uuid": "6bc4ea53-6a7d-40e5-97f7-ac2e019960b6", "comment": "Malware payload (DonutLoader)", "value": "339bdfd0d17d7b8e227b067fda33ce1364ff34e4", "object_relation": "sha1", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904859, "uuid": "fcbd068a-591c-4ad7-9a77-46468c03b109", "comment": "Malware payload (DonutLoader)", "value": "b4f309342c4a9952b34347746647c8e88b637a2d839f012c4db95ac1db971bac2fae0157ab6029c894c75284d61dd0b4", "object_relation": "sha3-384", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904859, "uuid": "0e365e44-6065-4a00-adc0-1ecca1c7b575", "value": "T13C2413C85CFD4720F152DE048895ABA640A645620D2F6BF41B6B394B0CABDFF973B19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904859, "uuid": "12a4d035-5392-4b19-95c7-b0211dc93bf7", "value": "3072:84/y4JoK8g3eFSRqvZ9qCYxxKloRbNQdpmPYk0uZlDj6UFHS+HcIKeYiJ1YhHZoN:82Jgg37qx9qCYfoCYkNbj6U4kKeh1gqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770904859, "uuid": "2593cfa6-82dd-41c6-85db-1eae13a37ac4", "value": 209550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770904859, "uuid": "ce3756f6-b259-4b74-aa06-b289f2005904", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904859, "uuid": "8c564e1c-eb9d-441d-9042-9dfe31049acb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18b74de-084d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770926494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926494, "uuid": "0a9fc9e2-c20d-4945-8e20-31206c1b8720", "comment": "Malware payload", "value": "3cce3eea3e1fc3b1ef42d1cd72c7f36f", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926494, "uuid": "8bc22e27-345e-4c5f-86ab-dae6b9107aaa", "comment": "Malware payload", "value": "a10c966707679e4593a3741b9e6ba8c4841f507bfcdbb3197e9a180aa0623180", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926494, "uuid": "5a43d546-6f74-48fa-8a83-cbca1852c775", "comment": "Malware payload", "value": "e95dab355849a9d3d1232c36a842f40d3d6aaecd", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926494, "uuid": "d234df29-f5cc-4dfa-9d7a-9de2b2ef5c6f", "comment": "Malware payload", "value": "d7a9e52e7b805b240e2f148469455e7d42f251549341409158022df09466ada364700790e0e58ce80264ce8944a69ad4", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926494, "uuid": "4bab0b58-fb59-449b-9721-7fef34e38029", "value": "T17AC4231568361C51D1D96ABB5F6929AAD79CCBBEBC0B3270CF40F145B1828F4DB4CB0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926494, "uuid": "62844a05-9efb-43b4-91a4-e361011f5561", "value": "12288:tU+XhUY/9nA/q/aVIlOmaVyTeDal3QCz4iBCLQqzZzzGlU2:t1XhUYOvWoVyTeDaZ3z0QqdX8U2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770926494, "uuid": "e6af3373-f96c-41dc-b63f-79ed641341f4", "value": 584956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770926494, "uuid": "93cd2bcd-7cd7-4fa1-b9a2-bf32a7a3402b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926494, "uuid": "20194c7b-4b16-4492-b08a-31f6440087e7", "value": "SecuriteInfo.com.Trojan.GenericKD.79119004.4761.12956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ca86a2-0840-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770920682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920682, "uuid": "3fc02d2a-df25-49c0-b8cf-b5788f41b79b", "comment": "Malware payload (Mirai)", "value": "3f7f47a9cda780cfc44923a33261d29d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920682, "uuid": "182e36be-d30d-4b0d-9ddc-92a721abfe09", "comment": "Malware payload (Mirai)", "value": "a24546bb7cbe798ed46f1ab2c7da1e8dee11db7e7a78d4957dfcc9ed9a87facb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920682, "uuid": "d201233e-9d1f-42f4-be8e-5e74b9fa5871", "comment": "Malware payload (Mirai)", "value": "5f1975be8eeb08ca6b450f6f525c51a919d83dec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920682, "uuid": "c1cf0189-b174-4834-84e3-7b3619af0ebf", "comment": "Malware payload (Mirai)", "value": "df6727fd72012b425e6677f4e2f26ffde3da5e08df7e24e30ade246ee6e6bc818155c3217f3380909b3dfadee8598798", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920682, "uuid": "6762bb96-d1d6-4ac8-a227-ed1965d7045c", "value": "T1C843F1E104076A78FD32DC71D8590580756D4330A27AB5307AECBAB877B28CB71ADB0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920682, "uuid": "84c050a0-4c6b-40ab-a7bd-6f0aff0da740", "value": "1536:L9ipPE6wWszUEr7GOZnHNhfnI21yo9NbV:ZE4NPGOZthw21yoDbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770920682, "uuid": "b1a6c356-820f-49db-aaf2-57ca0c10ca79", "value": 55464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770920682, "uuid": "87e544d2-2582-462b-b407-91b677450a73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920682, "uuid": "d45a1ac9-6bda-45e5-a4fa-deccc0eb6894", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0beeea3-080c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770898709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898709, "uuid": "808a1a79-cd78-45a9-911c-15b6e358c4d9", "comment": "Malware payload", "value": "c3fc09fa71ba0c262e57be624d05a003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898709, "uuid": "223fb46b-24d9-4b2c-bace-8a9163839621", "comment": "Malware payload", "value": "a27be262b85ab4e836f019084466142fde9e3f80d805d06d3d203e6e4e458c16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898709, "uuid": "c404ffc1-89f6-495d-a5e0-b4c1aaf9eb8f", "comment": "Malware payload", "value": "5c0cd0d34fedf7374a274262b3dcd4ba61a7b6b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898709, "uuid": "220b6c08-afae-4ac2-9adf-a9c934f48851", "comment": "Malware payload", "value": "ad6f87e2b06757533f5106ae1ca8d7d4afa22e95b316b5391a31eb0e6aadb37d051af2fb01eb13901c566bb3306b9bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898709, "uuid": "d7a16689-eaea-4819-8a3f-91d36be2675e", "value": "T17A9533F3754543EBE98144F92257E4E7047CA72A39EF6A78DD08A8C7B078A81838D3D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898709, "uuid": "c2a829b2-0da3-46b9-8c41-ee422f30b0f4", "value": "61976cd41236d9169cbc46a6896faa16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898709, "uuid": "f328361f-0834-47f7-bfa1-590641089509", "value": "49152:mSmbmO7WXacs2AiDRzxaAsY+sPs5cSVBDXIxq:nmV0lsritzooErVBDYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770898709, "uuid": "d3fa4fe4-55d5-4d09-8b9c-670d1889e2e4", "value": 1914368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770898709, "uuid": "608fab47-7a7f-416a-a098-6e8e6ce2825d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898709, "uuid": "40135f3f-3f36-4ca3-8cf9-2575be72f08e", "value": "unknown_windows_pe_36.133.126.84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c268ddd8-0860-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770934709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770934709, "uuid": "0cf9142a-b3da-4c29-84ca-4889f313747d", "comment": "Malware payload", "value": "0ac1fb9b40d84ea85a1284ea58d927b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770934709, "uuid": "399d782f-e109-4d6f-9e8a-644efc6efa99", "comment": "Malware payload", "value": "a4031880851b90f63898fd29e36a9b515d6a6ed4ff11bb5ef4688077212330ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770934709, "uuid": "113273e9-0c09-4602-94d8-abaf42ee2617", "comment": "Malware payload", "value": "a2a61465acb20d6efa57adf6dc034f7051097f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770934709, "uuid": "fa80fd1e-751c-4e1a-ac41-0ec79c4b1489", "comment": "Malware payload", "value": "dabc8d6a942a67714d8e3c3499a135b73e0bdb25f1708fc041fdc7dc54b672f51aa7c6d81ab814d952066db3aaa76da0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770934709, "uuid": "545c78f1-45ab-4221-b92e-a0143cef9482", "value": "T1A2070223B2CBE03EF05E4B3B05B2B25494FBA7616527AD1686E4889CCF650601E3F747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770934709, "uuid": "0c600e13-375b-4f2a-9a2b-65761d05f043", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770934709, "uuid": "397548c7-6ea2-4669-82a6-087899ec1af7", "value": "49152:i+MRdOHApa5Jo9UgC7kbuOZwlUObCxjFWLsy+r3xZpETRT688zbafcepV+b:irn2oyPIbvGKjFRbxzETRL84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770934709, "uuid": "893ce94e-2547-4a38-af7e-cd0975726f8b", "value": 18037289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770934709, "uuid": "9c70c3a9-ea79-45af-a2d3-c6d2ae07843f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770934709, "uuid": "4e9c55a8-231d-4d1a-a9aa-6d2d18c8807f", "value": "adbgview.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3aef3f-07c8-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770869125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770869125, "uuid": "743789e3-9cfc-4de8-ae5b-38424c1daa26", "comment": "Malware payload (AsyncRAT)", "value": "0dd57c9174c6ddd9d0b8a5eaeb35e791", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770869125, "uuid": "1b790615-0a42-4286-abcd-11551b002600", "comment": "Malware payload (AsyncRAT)", "value": "a44268e9d063dafaeb1cc3cf854cb8cc71bbd9a1376add61bdb3ea4eaf98684a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770869125, "uuid": "7e0446d4-9a36-4115-ac8d-0825dd9fd16a", "comment": "Malware payload (AsyncRAT)", "value": "d6a2ec2af0a9e298a77f7090a8570b3bb42bb684", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770869125, "uuid": "cdf3680c-7342-41d3-8634-31f863abff3b", "comment": "Malware payload (AsyncRAT)", "value": "e4e65c47565525fde997f1194558b4b16a004275bf92a3307b7990e41af164d9836414118da5e2df548879e319862283", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770869125, "uuid": "c4396ec5-0a32-4933-b67c-22e324d323ed", "value": "T1E0D23B08B3D88561E1FD57B94D7292048775EE4BA973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770869125, "uuid": "76f9796f-dcdf-4400-9ac5-bf13558fd8f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770869125, "uuid": "c26a4747-b81b-47af-96ce-22220d28c74f", "value": "768:mwwbRXxZb2uSEg/cIRGqo2/Rb7fB/dTZSX/+:mbbRXvb2uSV1iIRbN/qX/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770869125, "uuid": "78b07895-2182-457f-b6ee-78ad4b16b4e8", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770869125, "uuid": "47dc81f4-e2db-4e19-869f-3e985df54e14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770869125, "uuid": "c191a0f3-8426-4c08-bcff-5715fcd989a2", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a889652d-0824-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770908896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770908896, "uuid": "85bea63e-bb3d-4f66-8cd3-5c552ba12679", "comment": "Malware payload", "value": "a7555d57d1ce71f88edd4e9070bf9918", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770908896, "uuid": "c225d58c-6b00-49d3-bfd0-626bc7633312", "comment": "Malware payload", "value": "a60b5dac7148fdb49878c7cc156a39f4235c2a047584d0b4d7bc9f60c0ac44c1", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770908896, "uuid": "a2affc2a-fc5f-4838-a790-8b797f0489f0", "comment": "Malware payload", "value": "92785deb8e90351508452357d1f6ff4493a82024", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770908896, "uuid": "53f16dbf-1936-4e64-8874-ea2cc390d1d3", "comment": "Malware payload", "value": "4abc81bfc5ef3ce45604a088d526091dce3a5d0d20160d070df68b54e73ddd1ae31b8f55694547c24deb74dc4af2d269", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770908896, "uuid": "ad9bc6ed-479b-41b3-9b6f-901dac9ca395", "value": "T1A50833A0DDB949DEC0528FBCA0069E021A6627F69551AC03ABB87D5D25F34ECCB3D14F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770908896, "uuid": "2b695d76-dbcd-4893-8fbb-98c3ee734e59", "value": "1572864:FitlxDa4BCdXTSlZtHu5qn7O2u88ydz/UamGrUcSiGqXf5:EtK4BCdeZHugPcxqVSiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770908896, "uuid": "90a9f425-c8cc-49de-91df-25aee0f382dd", "value": 80187571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770908896, "uuid": "c5247c65-4cfd-4e87-a434-facc8b614c5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770908896, "uuid": "ab070f31-90f3-4c6e-b9b5-161cd0259d5f", "value": "zip1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec64213-07a8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770855676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855676, "uuid": "a3885ccf-7abc-4075-9562-1831e28a62c8", "comment": "Malware payload (Mirai)", "value": "16d99425f016cc9f6e77936b5d679b13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855676, "uuid": "dda51b4b-88f1-47a5-8b38-5619b7076a64", "comment": "Malware payload (Mirai)", "value": "a64f31e75e1f738f2232f1356c3171ec3abe6aef1b004988173730449b561f82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855676, "uuid": "66ee72c2-2cd9-4d31-9e22-f9beb845ccbc", "comment": "Malware payload (Mirai)", "value": "b0ffaadb6eac823cb21b55621455b7e50db3cdb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855676, "uuid": "247dca7c-ab70-4c2c-bd3d-431407873626", "comment": "Malware payload (Mirai)", "value": "a7e17e22c4fc318f75066bd60b2646ff6059f031fc3a7e65bbf1eeebcc95acbaca0e681e114fca5b69f9de7358a87b5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770855676, "uuid": "c7f7f71b-0ec0-4d4a-80f3-f4cf5aa1e052", "value": "T1DD832AC5FAC781F5C8574C38906AF33FDA72D47A40708BADDF9A9F32CA27601521625A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770855676, "uuid": "4e5f2324-82a0-437e-9402-483ca3ccdc21", "value": "1536:2ugZ1pnqk3Tuh8vzULN+nfyr39kZZq4WN6n8TswGjs1gezL:VgZ1pnp3T5ALNH2Z40n2swGsuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770855676, "uuid": "faadfccd-4297-469e-b3bf-91e0d57c6312", "value": 84176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770855676, "uuid": "b5326f72-4492-444d-8f5c-ea90cc51cbe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770855676, "uuid": "aa07e2b4-5a97-45c5-96e5-6d5f33b5c09f", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ededea-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877805, "uuid": "c800c0b0-18cd-4dc0-a7f4-74334c8f5dfd", "comment": "Malware payload (Mirai)", "value": "768a2164514f8499ba480b263428cab5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877805, "uuid": "7b729d3e-4c52-4379-8ee9-39f9d0907132", "comment": "Malware payload (Mirai)", "value": "a6cadd3627a088f1a80c557edfc6fbece78ec246d1c01b717ce8e5b8693db8c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877805, "uuid": "3c8d18d0-bc55-42af-8e36-b3ffe673dfa9", "comment": "Malware payload (Mirai)", "value": "6946c94f091a1133b497ce49f79561013c22670d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877805, "uuid": "e1634e3a-4b0a-427f-8190-eee6c3f0f0bd", "comment": "Malware payload (Mirai)", "value": "25fdb199d19e36803090f9089b42a416de3c9ce139032093a47200d8463c84e00dd7bde734f0d374703428d2e9b8e9d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877805, "uuid": "543ac3af-fedd-4bd0-a4bd-fa0dbfe4ba0d", "value": "T189930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA5B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877805, "uuid": "d39bc38a-9084-40dc-a54e-746676f1f6ab", "value": "1536:wqnZd8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1YQn:F8NUv5nTacgzafVAwe4BNRIbT2gXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877805, "uuid": "73d464ab-c5fe-471f-b951-542658a13084", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877805, "uuid": "ce7bb531-f6b7-44c8-9992-9f912d7fde25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877805, "uuid": "30b6b9f1-b7bf-4159-8335-631c96b76d7b", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae4bfea-0809-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770897411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897411, "uuid": "a2ea528b-b381-49b0-8543-b040448a70b9", "comment": "Malware payload", "value": "5e09c553377917a05e27431c4fe26377", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897411, "uuid": "5b40ee06-daa6-4cb7-9a2f-4bcac4aad70e", "comment": "Malware payload", "value": "a70a195c37e7d33b80c1f5df4fdb33ae6488e5deb7b5179a006d5e8db8735da6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897411, "uuid": "96636bd6-d938-4f67-a468-f1c079af83f7", "comment": "Malware payload", "value": "05dc4511191cf18081ea4cc9d6b989b743c4cf6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897411, "uuid": "e9a3b520-9809-4ff0-bf88-0559d732fe31", "comment": "Malware payload", "value": "ae3631faf1531f7d106422113f3ed02851c4d178c9f3cb96b5793594dbea12c2ca235bccd54d798acc71acacda989710", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897411, "uuid": "6d815a1d-a49c-483b-af2d-5a80d46bcd1f", "value": "T149362329D7A445F8F063E6B8CE828A57F7737C054361EB8F47A4B5951F272608E3A702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897411, "uuid": "c1040474-3fab-4800-84c1-f722dd949995", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897411, "uuid": "c3ea43d5-f290-43a5-9b2b-624ee24c3bcc", "value": "98304:xvOIxUX28jR9CfDIc8++dqCnd8fHVwUecqFH/SiQ158t0xAVEz8cYdSCDa3az:YIxUX2A7CfSnQwLco6iQ4yXzCAUaKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770897411, "uuid": "92bc4ffc-84a4-4cf9-a4be-190a94206222", "value": 4999294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770897411, "uuid": "30f44c35-ee22-4236-8186-f9943fdbb36f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897411, "uuid": "7aeef6ea-cb16-47ac-9c6d-ec0f12682001", "value": "TelegramFixUlt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eae23fa-082f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770913497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913497, "uuid": "ed42410d-e7d1-4fe3-8c23-0f8ccec9c574", "comment": "Malware payload", "value": "4d6ed8a968bd9289e5c097e33b8aeec1", "object_relation": "md5", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913497, "uuid": "03e535b9-7ca5-4d60-a8fc-9af92b95031e", "comment": "Malware payload", "value": "a743530682221786096fc59a4c163054c947cc6d0604c766ca0af8928a3a52af", "object_relation": "sha256", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913497, "uuid": "f979d471-8de2-42de-9b13-ed827757b029", "comment": "Malware payload", "value": "25707aa36fe07af7f240db2ebde196110f57d11f", "object_relation": "sha1", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913497, "uuid": "fcd60fba-d3d5-40fa-a766-ecc0e68cbd55", "comment": "Malware payload", "value": "8449010a6b97949f2d5094264b741a245f40f662091db8b5476b5a407528327d2754b5baa7c1495d57003b2290709cf1", "object_relation": "sha3-384", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913497, "uuid": "d07ffb25-c1b5-45aa-bd4e-e8b248402e1a", "value": "T1702105E3A75593D635DDC385896EF8DE7B00C8B661AB01E5ECCF0E0E206AD8151D4E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913497, "uuid": "61a3b6a6-22df-4f45-b62b-34b3da18938a", "value": "24:fByOdkfABFZ4/OPfABpYSO/NfABCO/NfABjYgxEfABtm7fABwYAp7fABU:fBJkM2UOY7NmN0Yv8+5YUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770913497, "uuid": "07146f99-f5af-40d0-b7fb-3b2f3fac3c9e", "value": 1436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770913497, "uuid": "b99e3abc-f8aa-4837-96b8-735b836efa25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913497, "uuid": "2fc1aa48-f369-4e2a-841b-f84c1b2d184f", "value": "a743530682221786096fc59a4c163054c947cc6d0604c766ca0af8928a3a52af.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a513df8-083a-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770918133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770918133, "uuid": "1e092ae0-c946-4cd2-9655-8482ff89cd03", "comment": "Malware payload (RemcosRAT)", "value": "878aa6a3a6446444a6945ec9874d89e4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770918133, "uuid": "dcbaa7c0-3408-411f-a5e5-27aa208c76a0", "comment": "Malware payload (RemcosRAT)", "value": "ab2fd42fc874f71b7bfc9db59b056eb937a2422c79b6e3c4524cd8c1ef76cf04", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770918133, "uuid": "3dc62647-6bfc-4317-aac2-d1e1cd8f933f", "comment": "Malware payload (RemcosRAT)", "value": "07880fc9c96dad6e8631e22d9b0b303b1417c97f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770918133, "uuid": "69c9f330-826c-48b5-8311-90c72f68e810", "comment": "Malware payload (RemcosRAT)", "value": "5535a9cdc4719c14222d749964decec6388e7870c5dcc18a47c000173d1364013827dfc0eebc537c4ffc51ab697badaf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770918133, "uuid": "c6ad024d-4ffe-4fef-80c1-9f6f0c5142f6", "value": "T17AF2C4CDF0C3B0744657BDA2393FF69AEA6F8F0066898050D2565DA8FC2D71DC826DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770918133, "uuid": "5b58ccb2-55b3-41f5-ba1c-526f89e57e47", "value": "384:nEHVCObkQ2FmRNlT2VzrF8Xl8Cddst+mzEWg8R1Jw1eGowtgWeyV7WyVgsYw3kkV:nEVSUXlTGt8aCd2+pT1HmH4kDcKrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770918133, "uuid": "f0aef3c0-143f-41c1-b8cc-57194af733aa", "value": 34943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770918133, "uuid": "3af130e9-bfff-4c9e-9927-683833f32fee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770918133, "uuid": "dff517fb-ab59-452a-b44f-7a10b6eb35ce", "value": "878aa6a3a6446444a6945ec9874d89e4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "405555e8-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877797, "uuid": "0b5e29ac-d364-4d58-8c12-5f87459d6d9e", "comment": "Malware payload (Mirai)", "value": "e98bc53871341a43d49040c32be2653b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877797, "uuid": "fa6f16e7-0baa-401f-a4b0-2ce5c1a8bedb", "comment": "Malware payload (Mirai)", "value": "ac2df5d9e7e1e117d3f8a1ccecd1b8d9fa5e90322ac161b08f40be76537910cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877797, "uuid": "5154e8d6-c5d9-4bb5-9f71-ce2aa7f4533d", "comment": "Malware payload (Mirai)", "value": "139bcacaab389dd4cf166c7e119473d3b16183d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877797, "uuid": "6fc67574-34df-4dc9-8917-bdd77f650fe6", "comment": "Malware payload (Mirai)", "value": "96ef729e597cd5b4afd4eab541c4abd5bba3d66e2332723809ef272db3bedd02bce476f546a1c93e45293f0023bcdd6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877797, "uuid": "45a414ad-9d47-48f9-ad95-16396281a8e2", "value": "T1C2B30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877797, "uuid": "2b0ad30a-fdd9-4ef6-a40d-f84f55134d37", "value": "1536:c7jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCx0:6zPqF41OUBljSIxecUtCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877797, "uuid": "61b32aac-6929-4c67-b4d1-250f01ea77b0", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877797, "uuid": "6838f415-2cbb-4c13-ba21-b90905254a1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877797, "uuid": "8daf01dc-e380-4590-a47d-d30de0b25051", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0093618-07a8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770855624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855624, "uuid": "67626445-f560-4571-a8f5-a40ac11044e0", "comment": "Malware payload (Mirai)", "value": "b25178d1450b6fc6dc89c2ec2855eadc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855624, "uuid": "7705b101-8bd0-462d-9f43-399d4ad13dda", "comment": "Malware payload (Mirai)", "value": "ad703b9521823df06995fff60e27709551e6fb70c48202b9372677d20fed5dd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855624, "uuid": "3e4a25a7-e121-43a9-9cdf-f4e7b301f65d", "comment": "Malware payload (Mirai)", "value": "fab9e0f23b1c6ccda9fc94669a4d9f87e4817ca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855624, "uuid": "84e33c40-fe3f-4cf2-8afb-542c27c9f26b", "comment": "Malware payload (Mirai)", "value": "e92b4df2aa473dbbb8303441f9016454e981dda0a68291f8beff9343844066b115b0bfbbd16e269eb76f489e61bb30e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770855624, "uuid": "46d9eb23-5980-4063-a255-f60605cfc94a", "value": "T1DF03F108A9D24714D27E5173922F3A1BFEE2172E213476DB9BFC9436E884B12590ECD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770855624, "uuid": "8c83194c-8aef-48e0-b48a-de4a86a49635", "value": "768:xvhS64LMs7sDNW+Xc+m+fw/oTmwWZo4f/wOoGN89XSjmIgQ+BnbcuyD7UM7x:xZSH7gxl0oA/fPoa8tSfgQ+Bnouy8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770855624, "uuid": "12885cbc-749e-4ca1-b567-6a545bd5aceb", "value": 38928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770855624, "uuid": "e86ccf01-e5c1-4703-99f9-1b1f895d3b5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770855624, "uuid": "cd3ef1bc-acb1-46ce-a533-2c2588cfd124", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4944c4a4-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877812, "uuid": "f0216384-7aae-43e4-a24b-72f31b9b31c9", "comment": "Malware payload (Mirai)", "value": "e26c4aa34edff3059c44e87173b8adaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877812, "uuid": "404883f5-c14b-4703-9ead-987e083be8fc", "comment": "Malware payload (Mirai)", "value": "ad9dbf2200d4b998f20540d08b5d8f0b4a2f3e8938efa20e1663a6e7648557df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877812, "uuid": "822ec5ec-b917-4ddd-a291-e32d3f40e6bd", "comment": "Malware payload (Mirai)", "value": "88ac0787a2de0ef2b471dbfcd6075da5af03fcce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877812, "uuid": "c6fd06cb-e8f6-47b5-b7c6-95680ff98d6c", "comment": "Malware payload (Mirai)", "value": "e4aca858213390597504d42fd890b1f4b6df8068412b68e173081e7f92e52b0aabaca9e3f355acfd0cd6e14357255be2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877812, "uuid": "dd38fbb8-364c-43cb-87fa-019a55bec6d0", "value": "T10BE3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877812, "uuid": "3c4b862d-a35c-43b9-a53d-41318f9b9aac", "value": "1536:p+8TcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxOdbK:pflybKpzEOfGQ+vEubTt4ouftL4KdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877812, "uuid": "9efff3e9-3ae5-4732-83e0-c1039599208a", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877812, "uuid": "6f31efec-8f66-4748-a23d-7e5998ce75e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877812, "uuid": "2b194a5c-9a93-456a-9f3f-138ea64eee5e", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17644c10-082b-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770911659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911659, "uuid": "fd338f4a-a63b-4bf5-8987-1ddbe8f5c7f9", "comment": "Malware payload (XWorm)", "value": "1e42dee27620428093cdfe7f2f3fe6cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911659, "uuid": "c1247ea0-5740-4931-bf8a-1b5ec402a71c", "comment": "Malware payload (XWorm)", "value": "aede2107d738ac4bf5dda44a26da450a4c4bada3170b3e8da4482e798eb69874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911659, "uuid": "4242f7de-bd26-4561-a595-4d46f74ab3ab", "comment": "Malware payload (XWorm)", "value": "cdb024793ae053acb6c5fb927a6ee170937196b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911659, "uuid": "d0e856e8-bf19-4b7f-aa9c-a8cd16c4b7e7", "comment": "Malware payload (XWorm)", "value": "8bfde3ff1aa3f395fb9b6c463e2cfa9d750c462d39dbff49a322a3262c626a8dfd64673c61db4a801b9867191bedf218", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911659, "uuid": "bcabf02e-2e35-48c6-9e14-80f6dd15dfd0", "value": "T1ED134B057BA18625E5FEABB419B256070731E7038E23D75E0CD8969B2B6BBC0CE407D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911659, "uuid": "efd6c3d5-0604-472d-ad5e-f494ddb380ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911659, "uuid": "ece9baca-fe5e-4b50-be53-2b7674fa8c65", "value": "768:BXKGeQ11qoqA4k8womL1dlJF5Pr9p5J6iOwhR3/O7:lr1qNZvBQLFp9TJ6iOwT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770911659, "uuid": "74e49e26-f571-4e33-a8b3-245153ced249", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770911659, "uuid": "93b7a2a6-1b9a-4021-b1bb-e62b9eab9c2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911659, "uuid": "609f0a35-8565-436b-8fc5-48c157856b2f", "value": "aede2107d738ac4bf5dda44a26da450a4c4bada3170b3e8da4482e798eb69874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08d7b37-080f-11f1-a129-42010a9c0007", "comment": "Malware payload (Lazarus)", "timestamp": 1770899863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899863, "uuid": "27287d88-3e5b-4a5b-8d26-2addffcad1c9", "comment": "Malware payload (Lazarus)", "value": "447557d5236f1b97be0314b317ca9fff", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899863, "uuid": "cc13c4be-a332-4a88-ad2f-04ce6e966b9f", "comment": "Malware payload (Lazarus)", "value": "aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899863, "uuid": "64919e97-2895-4964-9f2c-1a6223b0f901", "comment": "Malware payload (Lazarus)", "value": "28978e987bc59e75ca22562924eab93355cf679e", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899863, "uuid": "dcb6d0ca-f944-4ed3-a3b5-a0e0d1458d2d", "comment": "Malware payload (Lazarus)", "value": "2e6121599c65fe076be18e9f2a2bdc357176a3c9c0d43c80bbaa0304c71a376d818dd53efd04ff11c9090ec0e7c0f283", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899863, "uuid": "37766fa6-beab-4709-82ea-087ce1d07679", "value": "T124053846735481A9D4678179CD43CA69EAB2BC519B1093CB23F477AF6E333E11B3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899863, "uuid": "9b3aef2c-a430-4f31-bf12-2b725ad21b47", "value": "655221b6bcad7b5b0b9766142cbc257a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899863, "uuid": "f590784c-ef5a-4c6c-973a-3c67bfb2b787", "value": "12288:oWujjXB8pkTnyDjVBRxQ1UdiG/Mclbvc/Z:oWujFl2JFQ1Udi2MKc/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770899863, "uuid": "9d131860-1877-470b-9260-09fce644ad18", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770899863, "uuid": "03771be3-f620-4675-9d95-9a4d53f7e338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899863, "uuid": "b40252a8-8276-4e49-b0f7-433b3a32b32c", "value": "TSMSISrv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7785bbc-0817-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770903445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770903445, "uuid": "615025d4-3708-4aa2-92cf-bef0b6248dbe", "comment": "Malware payload (Mirai)", "value": "ca704b1ddd14162e36d975efeda4478f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770903445, "uuid": "c7a0baa9-e21c-4c95-8d51-1766a8d98ee8", "comment": "Malware payload (Mirai)", "value": "aef72df2eb6efbb2fe4e16f30dbf4c5f580989632f7073ab4c2ae0d83756ab99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770903445, "uuid": "023d2b8f-7641-4b80-8078-5470decf4bb8", "comment": "Malware payload (Mirai)", "value": "a37a4ee37ea5a6bdcbecbe07687cdae604a6ac3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770903445, "uuid": "65517f57-e84d-47c4-95c3-3031a05fc844", "comment": "Malware payload (Mirai)", "value": "a98acdafcb90a372875ffa5ef87b74895a2ae107d6ea7b79cb274b15da7477efab978ae36cacad89d50baa971586be19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770903445, "uuid": "e4600fcc-689a-4ea3-a9ed-6fdda56d4244", "value": "T139D31856A9919F11D4C735BAFAAF414933536FB8E3EA7102DD206F60278A8DF0E77102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770903445, "uuid": "93fcec4d-ed10-4415-aa30-d657dec04982", "value": "3072:vh2VcxW1B6lanQ42FRm3y90o8grn5BYfjnhH+:vhxxvlaQ42FRm3K0oDn5+fDB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770903445, "uuid": "ed5f536d-9f28-49ca-b458-205b33f33a8e", "value": 133716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770903445, "uuid": "79c6526b-17ba-4767-a140-348e2af14086", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770903445, "uuid": "05941382-f251-47ab-9536-d4163fbcc465", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544ef4ca-07b6-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770861510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861510, "uuid": "2cbb6001-5ad1-43da-aa49-99fe507fc7ce", "comment": "Malware payload (Mirai)", "value": "b09e6663f69ba8d328268e346084168b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861510, "uuid": "f2324c41-ba85-4735-bc6f-772fc26b17df", "comment": "Malware payload (Mirai)", "value": "af1d95a549d195f78af156bfec8a51adff5951c9aa19b35c657c39cb454594f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861510, "uuid": "03c3a98c-7b80-4fbd-8453-c9583c182586", "comment": "Malware payload (Mirai)", "value": "242acbda5d1ed8a64cd78468a913cb540ffaf006", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861510, "uuid": "96de0b74-0a20-4d2b-9eef-9e7c621ad73a", "comment": "Malware payload (Mirai)", "value": "829657176842efdf72a8ed68bf811b7458ba4cd3a6c0d3ff890a24dded16b30fb1c76345037ab50e973b3488de708032", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861510, "uuid": "efa1dad5-e753-48e2-ad5f-42544732ea94", "value": "T1EDF2F1C9D6FFB686F6F512B47CAE132C0428DEA48F855694B8A8C03E8AA0F104D5C2D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861510, "uuid": "d8c0aeb7-1b53-4999-ba13-96919d0a7b5c", "value": "768:dbg6OYl1La47UqibnsVBReHvZDFRgNv/J3ERKA6xYnbcuyD7UM7j:doYl12eirmkjmh/6RK9Ynouy8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770861510, "uuid": "b5e1647a-3231-42a7-a1b3-297de807a362", "value": 37412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770861510, "uuid": "7245de57-176b-4bee-84a8-978606f4cd34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861510, "uuid": "c4f57c81-4e6e-4628-9020-b51d8fc73f05", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb820c64-07c1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770866434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770866434, "uuid": "15ea5068-a722-4fd4-9b64-608cc0415304", "comment": "Malware payload (Mirai)", "value": "d41ee58891bcc9731745de4b25b0b9f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770866434, "uuid": "d442f068-52e2-4d64-8459-7e7479d11674", "comment": "Malware payload (Mirai)", "value": "af599625d2e344fcba1f3fd9089383e21dac7f4f9f4a75fae94f184cf990ae28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770866434, "uuid": "9a2fe084-b10f-4efd-b86d-a0c3e04b8082", "comment": "Malware payload (Mirai)", "value": "7515ef1f306c5e4dde8705a51964d323bc71fe9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770866434, "uuid": "5e37baab-559d-4ca2-8664-199fc6521b7f", "comment": "Malware payload (Mirai)", "value": "8ca923bfb298b91b41c266d3bf7f88040d380d21919025142421b37b6c81168a9a33fc44754b43e17d9ada5dd0a9d8f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770866434, "uuid": "869299c4-8e1b-456d-b8a4-b4c6b6420bbd", "value": "T1E5A3299ABCC5C602C5E071B2FB1F918E371643A8E3E6B107CD196F29674B8970E3B255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770866434, "uuid": "50a894ff-b510-4b42-84d8-1284db241031", "value": "1536:HHuYGhfYO6dEdNmQLp4n1yHdOUat62ADj20okpe5rBC1qvsX:HH5GhwdGNm/1y9Olt6vDjEkU5rA4sX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770866434, "uuid": "38345a0e-3d51-46c6-a81d-30fe5e4e9cfd", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770866434, "uuid": "7fd50a04-d0c2-480a-80cc-224256f11a86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770866434, "uuid": "d8f0e8b5-75bd-493a-bd2c-d79df4f5ebcc", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5424ccc2-083c-11f1-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1770919062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919062, "uuid": "b5db69c9-a80c-4bdf-b303-75bc2c77b329", "comment": "Malware payload (GoProxy)", "value": "4ab50f833545b8dbbb5458f166ff7da4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919062, "uuid": "db38d5e9-6a3d-4fa6-bc01-c81301fe0f8d", "comment": "Malware payload (GoProxy)", "value": "af6848386a183fb7718cc808ba8a6b8c3d7565b435acbd2beebe079018da50d0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919062, "uuid": "29270164-bdde-4adc-87c3-4c8c75aa3dc9", "comment": "Malware payload (GoProxy)", "value": "7fed3f4a4f34f4acfb001f7621abf87686643399", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919062, "uuid": "0f58cb8c-38b8-476d-bedb-5e002344bdd2", "comment": "Malware payload (GoProxy)", "value": "8ad80f34338710a4ae48d0365f251f1c65c8446e2390d318e88c5584fa1ea9b9f817def8986176cc06405b662008d3bb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919062, "uuid": "8e72b09d-1af8-4257-85d0-8ee02da005f2", "value": "T1B5664A03ECA155E8C0AAE2308A669253BB717C485B3123D72F90F7356F76BD0AEB5750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919062, "uuid": "f280e235-425c-48b9-90af-de35d631df0f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919062, "uuid": "157b85b1-6cf2-4b0d-864c-6e12c2c64bfc", "value": "49152:loE3ewMZrIqTfg1Ytm7rdZxW0SLGxm3Gsc5JN9Icya6W/jNtjz5edfKiK9Kv5dWJ:lFUEgIW8xmy5o8X8b5BEMbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770919062, "uuid": "7ba96630-47c8-496c-9f40-3447d48b182e", "value": 6609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770919062, "uuid": "bce1f6a4-6d14-4c9b-8b2e-f9c6c4042573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919062, "uuid": "5d761478-fc59-4004-ab5d-2453bdb32b66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ea270b-084f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927117, "uuid": "2ab72578-588d-40c3-904a-4da834cb0fce", "comment": "Malware payload (Mirai)", "value": "af74d8656cd066df815fd5ec0eb2624e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927117, "uuid": "54786544-b0a0-4cab-82bf-96b0339be465", "comment": "Malware payload (Mirai)", "value": "b18948ac0b88b063cd2831a5751dbd64d8c6e198987d0c39beaea439debe47de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927117, "uuid": "0fa52fa0-1e0c-42a8-8c21-c0a94f2e4f75", "comment": "Malware payload (Mirai)", "value": "58193cfb0a433a94afb7522983891ad1e99ae4a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927117, "uuid": "49efd1a1-16c1-46ec-b3f8-112e2dcce1ef", "comment": "Malware payload (Mirai)", "value": "df1f1bb804dc940214cfa69717328768a76146980bc65a8d8dbfad51214a87f809bbc30531b264d4d8df453db2dbbb7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927117, "uuid": "307da924-82e3-45a0-b63e-3b4524627a33", "value": "T100732995B8814B12D5D412BEFA1E118E3313177CE3DE73229E206F24778B96B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927117, "uuid": "3b014b0b-e1f3-444e-a545-e85504bc7aaf", "value": "1536:eDnWmQsTyn2JXZm3F4E9waQ7ImQqM7iHjD7SoO7Cn50Y0s/g1:yJTN6V4E9waQFjD7SoOenqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927117, "uuid": "41efc932-0cd2-49c4-ae8d-0aecc0dc92cd", "value": 79476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927117, "uuid": "25544f0c-60c4-4df2-afc5-5a0809588cb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927117, "uuid": "decb1ece-22f2-4f78-a9ee-e1aa8d3f92e5", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fa4120-0840-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770920736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920736, "uuid": "c63c022e-7513-4ef0-b106-7c513166f802", "comment": "Malware payload (Mirai)", "value": "d0a3b8d32cdbfca3fef3107b5a2e9a95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920736, "uuid": "d5c83af6-dfdc-4007-94a4-4140bc7aadea", "comment": "Malware payload (Mirai)", "value": "b23622ff4b73f238d2758f089c6b99cd8a44ea6915946ccd7651f65cce6b5dc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920736, "uuid": "9fe1d6b0-ae20-48b9-996c-ec21c9d4b26a", "comment": "Malware payload (Mirai)", "value": "88a7d2d795a81f00f2602e307b9a4cdd1af9bdf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920736, "uuid": "ea6f4e7e-13f8-4b65-9772-9248804939b7", "comment": "Malware payload (Mirai)", "value": "571b88e988f30f719a688166ffa98d8eb9c4e023b7e0c3cf46d9e86e8be1e533d1f520085b6067a7dabd55b78069b1ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920736, "uuid": "e513b24c-b220-4f04-9e4a-15944ae7be90", "value": "T194233AC0A682F9F5EC11457C307BA7729E77F436A03AEDDFD7D9A423A841602920729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920736, "uuid": "02cce7e0-1a3f-44c9-afea-08018939fdee", "value": "1536:Ovmt6GStZRjrMcPzOubNr1toPgdIYfQ5Igomv4a/:O5GS1HMcPCuh7oPQI7iavj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770920736, "uuid": "00b045f6-2a9c-429b-a3d6-7083bbd8fca3", "value": 49852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770920736, "uuid": "c7162887-a2d5-4041-a2e7-ab97dd7ca099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920736, "uuid": "cc86f1a8-d8b4-4d61-ad3c-7ae1991994cf", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4cfd11-07e6-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770882216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882216, "uuid": "946a95ca-1c66-4a1f-a086-93ce7bb93e2c", "comment": "Malware payload (Vidar)", "value": "7496ca5e35abd94b7705da3d849d87f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882216, "uuid": "c0df96ec-253b-46d2-8dcc-c117672f7e9f", "comment": "Malware payload (Vidar)", "value": "b255c9d58838d384276bc5c08e3e3e53fd57997a43c7618c27538bab49a38ffc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882216, "uuid": "951182fb-40fc-4a61-9517-c5e23e6ecb83", "comment": "Malware payload (Vidar)", "value": "2205ba3a3750b445d4e5bc3531d29667ee82dd0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882216, "uuid": "4476db5d-da01-42ff-8b37-10178dfaab04", "comment": "Malware payload (Vidar)", "value": "b21e1ca59b75ab8c789bcc5d91a69af006b4fab5431ed3ab986bed03f449eca98a2399e8f2a246800815acc1a272edd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882216, "uuid": "cf4f62f7-902e-4d21-9734-d86feb30a791", "value": "T14DD5E10AE3A801FCD0B7C3B8CB569513EBB1B80A1631A69F57D18E962F237715A3D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882216, "uuid": "9a231564-77d6-4cdd-a04d-e03e8f5cac3f", "value": "238581f334bfa448f3f05a5b7c90b69e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882216, "uuid": "af8f2dd9-2679-4be8-bce1-0b75053cb86b", "value": "49152:cSn8Uwjj72fgZN4hs7AfEI5lUueFtf4700AWVoKToFC8c5eLXYvmYr:caFK4h/2Ft4dbVkC8c0LQmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770882216, "uuid": "de621bf2-4996-48fc-ab96-c6cf13d22183", "value": 3000320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770882216, "uuid": "2581770f-4d88-4aa1-8d84-384ecebda9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882216, "uuid": "f2f6d123-7347-4d59-82a6-1509fee8ed6e", "value": "7496ca5e35abd94b7705da3d849d87f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1832fb09-0807-11f1-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1770896198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770896198, "uuid": "874f5138-fae9-4dac-9dbd-f68aa050fd54", "comment": "Malware payload (GoProxy)", "value": "f47a50fc4b0dd4390a75b66bfd3cfc6c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770896198, "uuid": "b167d27e-7467-46ad-bd5a-e9418578f540", "comment": "Malware payload (GoProxy)", "value": "b3a3db403e2223132a5bd458cf3cc495f30ef33c5f9a428ff7429a26a0ce93f0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770896198, "uuid": "9324d899-3607-4c95-9b24-927fd075cc23", "comment": "Malware payload (GoProxy)", "value": "1691cd565a32c2456004643a96d47b4af52dbf20", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770896198, "uuid": "ef90dade-087a-450e-abd3-72c44d5b4ab4", "comment": "Malware payload (GoProxy)", "value": "b07bc9b5fb5c7856555ec78a0a55a1cb54395c96f98721f5d4cf458a4d77bf0fbf1a75732138f7905f826d8992208dd4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770896198, "uuid": "3655c5bf-b8d2-4582-84b8-cc6179056325", "value": "T13E664A03ECA545E5C0AAE23186679252FBB17C485B3523D72BA0F3382F76BD06E79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770896198, "uuid": "22c5f563-b8f2-451e-a8e8-e67854b14b36", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770896198, "uuid": "cbbdb0de-aec5-4f4b-84e0-7a3dae2a7f00", "value": "49152:3+pLh/gCuf/nroYrSCfQaPNMqnPHpalsHjyl2PP3j5c3ZK5SVkjISQrd5BIfKiKi:3i94XoS/jtPPT5sKcpAbud+BEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770896198, "uuid": "cf8c5e79-d863-455c-9596-f7bf6461fd34", "value": 6574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770896198, "uuid": "b06f24e3-1879-40b2-949a-2172fc24d495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770896198, "uuid": "c7180a28-838e-4e7f-a5b5-870684660d8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93966eef-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877937, "uuid": "9a242d9a-dbfe-4993-a772-fa2d6b4d5d5b", "comment": "Malware payload (Mirai)", "value": "881c6bb8e7eaa58a6758ae7d8c6f641d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877937, "uuid": "0a089e35-7633-4878-a0e4-90a34b3d9060", "comment": "Malware payload (Mirai)", "value": "b3e091224abfb5d6e9272a30f9968301ad5f4c6f4849266ed8cae32d3ebf8112", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877937, "uuid": "96824143-80e1-42d4-abe5-a7a85ff2ea7b", "comment": "Malware payload (Mirai)", "value": "7e98a406204e6f5c6d4a9d0465f37f60e1062f84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877937, "uuid": "06557589-30cb-4f0d-b6ea-26c1a2904b0d", "comment": "Malware payload (Mirai)", "value": "044597c556d4946ce45ec87398fcf81576deda912163e4cc26438388f90f0da915046225d7159be30a4256923974067a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877937, "uuid": "e7556d4a-adbb-460f-be50-8c9b8dda8e71", "value": "T10A34A645FD559B6EC7E2B2FBF75803CE363A0E58E7A631268D314E5023C4B64793A220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877937, "uuid": "937fc306-291e-4030-817c-dab648b7986e", "value": "3072:LTuWq4M0CkeEYWK4oP31NsGzXz9IFxXA8vjX4kueKzplX8PNX/8+a:LTFdCl6FSNsgz9EA8vjzuhXX8FX0+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877937, "uuid": "c0b1208e-a81b-4813-a296-9d7d9b70062c", "value": 240348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877937, "uuid": "0ec99e21-02a6-42ac-80ea-c70e2b4f054b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877937, "uuid": "ad9e9218-6d31-4511-a0dd-8de1f0444e6d", "value": "arm5.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce95afb-084d-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770926486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926486, "uuid": "8b4eadc6-54b9-470e-b9f5-45f80ae4cd35", "comment": "Malware payload (PureLogsStealer)", "value": "266c4c01b8e7813d532a8909117efdc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926486, "uuid": "e0e7e992-4f4d-4671-8054-c090bb1c1d0e", "comment": "Malware payload (PureLogsStealer)", "value": "b3e614b5a01c062091955dccf6ebb4b2351875cc4017e90609d8ec5b767e075b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926486, "uuid": "621c1bc9-7b1d-4215-9231-24aca78bf71f", "comment": "Malware payload (PureLogsStealer)", "value": "f2df78c851ca8102782a17a7a883805260efe531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926486, "uuid": "6a9a5348-656a-4497-a40e-db551fe29ac6", "comment": "Malware payload (PureLogsStealer)", "value": "c7af8c6c0cf0aacf9031832ba92d58751727b71d36a61775c26a0d081e8e49661bb4483a750665bf0941112c0ceae4d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926486, "uuid": "8b9e4f95-8441-4bf7-a640-d5d0c8876069", "value": "T122251228321ADA16D1A64FB809B1E2B82B7CAEE9F651D607CFD57DDFF432B940451203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926486, "uuid": "3114f99e-db54-406d-b94f-923685ff914d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926486, "uuid": "e6d7a07b-4cc4-4a5b-96fa-4a5fa964c1ee", "value": "24576:EuJJD1sL+Z1kKm6sWVG5h3W5XJuLkz3+ixs40A:Z/ZDDL55uc3+ie40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770926486, "uuid": "29f35ffe-d15d-4cea-8288-64adc305edc0", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770926486, "uuid": "94c0c8d6-5799-469e-92a9-7b92802cafbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926486, "uuid": "c1116543-86f2-4135-bfd4-04b60ad23ed1", "value": "SecuriteInfo.com.Trojan.Inject6.24366.12291.25878", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905d525d-07d2-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770873637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770873637, "uuid": "20d0ec77-e875-49c6-9120-f4b6a45181c7", "comment": "Malware payload (Gafgyt)", "value": "213e0fc4c30f224c324816f8b7f17551", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770873637, "uuid": "349999b9-4d0d-458e-a355-985a2a28390c", "comment": "Malware payload (Gafgyt)", "value": "b4adb27c059ba6456cd1c8682dc37c9010d4cc3399821737e36d87d4fdb11599", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770873637, "uuid": "e0365e29-8e1e-43f6-a923-d23f01873d08", "comment": "Malware payload (Gafgyt)", "value": "d207e9df6848e92f724b0b52a317ae8c32c55ace", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770873637, "uuid": "8e584589-838c-41fd-9310-f3e491da659f", "comment": "Malware payload (Gafgyt)", "value": "2f724601ed3f400148f43285855064cc427273c9726b9cb608a8b01e24c59f9c74ef16c5b1f811dd56d964cb15582d89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770873637, "uuid": "198c5a05-4701-4775-857c-6dca5dd088a0", "value": "T168930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770873637, "uuid": "aa06c55c-80e1-4b7e-9586-a535b021a96e", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOx2ePczYrmREqQ4b/X7XSee:OQ2HYBv1WTbePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770873637, "uuid": "a74e1506-1864-4b45-b309-17a8f4aff9e5", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770873637, "uuid": "19966372-d760-40fd-a90b-ff494b445ed3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770873637, "uuid": "062c574d-f9c6-4f89-818d-821aeb2f774b", "value": "a-r.m-5.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598c8dbd-07a9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770855935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855935, "uuid": "bdb9173a-bdb7-4e0d-96b4-fad607fc32c9", "comment": "Malware payload (Mirai)", "value": "009bc09ed1970452cb8eff318cfada2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855935, "uuid": "21434cae-eaf5-41d1-a30c-089da3cd6fb3", "comment": "Malware payload (Mirai)", "value": "b4fc54d5789edeac0f82e9f47b6bb95d7869d1a4d5e60d9b482423f030be9d28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855935, "uuid": "4015e06f-bbdb-4816-8164-71edc560ad07", "comment": "Malware payload (Mirai)", "value": "d4ff4c481afcef24cb4617ab7913f82f59ea52ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770855935, "uuid": "ff6ce072-8b10-47c7-8e27-9ba388df945f", "comment": "Malware payload (Mirai)", "value": "ad4a453dbc12e1cc708a28e9dc1131c2c67f59852aaaafd712120b44fe8294d464fb4a51b82ebe4519197f024ffc201d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770855935, "uuid": "5a82d0f6-9af6-49de-9973-b9e7527cf8a0", "value": "T1B903F15DBCA804D1FC1ECA3993A607865FED9F316407FD1522A1F9C3BE01A4A229BD01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770855935, "uuid": "a26765a0-25b9-47b2-8ad1-f5cb4b06770e", "value": "768:VEV9JkusvhR/JSKJmohlyqmSlQPzEp/DXuLJgGlzDpjcn:VEVzTsvhBJLly2lOzEZXuBV1cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770855935, "uuid": "d1f0b714-fd05-44ee-ab5f-4fe60f04346a", "value": 39928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770855935, "uuid": "593c47c2-e867-4338-88ff-f8c7ead45d2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770855935, "uuid": "0993646b-e3e7-4224-80b5-06e05dbad3f1", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44bb62c-082e-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770913238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913238, "uuid": "bd9026b4-080a-49bb-824f-cf24771350f9", "comment": "Malware payload (ConnectWise)", "value": "16982d7625b04c838022c42dad23dfa2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913238, "uuid": "fe003e5b-554f-4cf2-a50d-a89a6d0bb360", "comment": "Malware payload (ConnectWise)", "value": "b573418ead9c65a026ab6d9e81756159bae425f449956e5ef3f2f3716056406b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913238, "uuid": "d6631735-3dea-4200-b632-5a7add16aa9e", "comment": "Malware payload (ConnectWise)", "value": "890445009b9c870373cb6e2c9037c4d27cb6e243", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913238, "uuid": "847258c8-0443-4ddc-8231-9512c9e4e0e6", "comment": "Malware payload (ConnectWise)", "value": "633cf7aa8cd2d1a791c3a7ce6b01308d2f4a7ee8cea9a528ba69fe4e962e23196c890ef85a3dcf539b77acfb86504c55", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913238, "uuid": "7a78f7a7-525b-4c9b-b6d3-a383b8a274e7", "value": "T1DFA6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913238, "uuid": "4d6b7431-9b9d-4df4-a416-fb9f1faafc54", "value": "196608:aKaLNkbgbi4QAKaLNkbgRKaLNkbg1KaLNkbg:sWgbiHGWg1WgpWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770913238, "uuid": "42567036-8ce9-415b-9765-dbe90e1641de", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770913238, "uuid": "0ce0273b-f7f7-49e2-a7b5-6ab3eeca9d5b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913238, "uuid": "432a400d-213e-4ae5-9656-ca68c5f6e681", "value": "b573418ead9c65a026ab6d9e81756159bae425f449956e5ef3f2f3716056406b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a5080c-080e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770899175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899175, "uuid": "c33940cf-aa61-420d-9617-069376ecc071", "comment": "Malware payload (Mirai)", "value": "794f5b71f5f77e0f120b51d4a43035c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899175, "uuid": "bfb683e2-34ac-4393-b953-9b041f9cb108", "comment": "Malware payload (Mirai)", "value": "b5cc30d083fc299e01935b497bcdac9db54f3f90f829a5952f5eea713b4971dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899175, "uuid": "64e3d6cb-611f-46c2-bde0-33476abf6279", "comment": "Malware payload (Mirai)", "value": "87537ba9ed1b432680d81e6e1d6b05e1a337b5dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899175, "uuid": "d0905186-f290-4449-b5e3-4dfc2ea62dec", "comment": "Malware payload (Mirai)", "value": "7cd5fe251f3bd2e3d42a808ecef4187c9bf6a17aec241a4185142ae2d9d6c5df17ae1af06f6c3e9390c93bb6179f5361", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899175, "uuid": "92f4f51c-0a91-4e75-963a-ba51663e0da0", "value": "T1B3E533F9CCCF91F772410E07AA4D7650B988D529EDAB52E0F9C96B0BDD380B4249D31A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899175, "uuid": "e9adecff-bf19-4b86-b87a-e1837dabeca7", "value": "49152:FGbuw2wdJyyHdUSxtbsNSsSXcZ2MiJlMwYtblMlTFqmGgCw3Y4SKyxUmNcYQ/cZR:F7w2MvHec+nVZ1iwtZADFCwI4SKy6mN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770899175, "uuid": "5559ff42-c275-4187-ab9c-e2ff64c50484", "value": 3084004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770899175, "uuid": "5323d12e-ac95-440e-aaa0-8e61dedef058", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899175, "uuid": "6785b0a3-d8cf-4a4d-8cb6-f84124432c46", "value": "omicron_miner_36.133.126.84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945158f6-0843-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770922176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922176, "uuid": "14717f77-918e-46c9-b743-467a9d6acb64", "comment": "Malware payload (Mirai)", "value": "3286520b18aded9d477c520ef7d655f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922176, "uuid": "c2cef002-92b6-4683-b632-01b0d3e77bd4", "comment": "Malware payload (Mirai)", "value": "b8f6e3582f5e04dc95a7826f7936e42022ea4446693892a9a83275eb9f196c79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922176, "uuid": "ae87ed53-005b-4552-a92c-b13ae5a06a16", "comment": "Malware payload (Mirai)", "value": "e91118feedfde939210043610a8f39d887891541", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922176, "uuid": "3dfae077-20b1-4d82-8893-abd74e21ce8d", "comment": "Malware payload (Mirai)", "value": "598f352eecc782e612c97071c918c4f07ac814af1b2f7ccaf75378f3430323fee45b028350188004d8b85fb94d66d14c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922176, "uuid": "6211c56c-7a8a-40db-9dba-222a5d83d392", "value": "T156D2E1D101A34F7AF099BA76796746BCD8186C637A059F7B11C41738C814CA76F3436B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922176, "uuid": "7e764c13-94e4-4851-adab-c74cb89d962e", "value": "384:YDB2N4+N/SiqrPEYy7ANWi6D2vaYPS5gWh9XDHl4YMTZ9za8SadF98HaXnUxaVXl:OBmbRSiqrcYy7cfnCX54NPSadX86XbQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922176, "uuid": "1b82aa67-b0f4-4955-a051-7646ce27605a", "value": 30296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922176, "uuid": "c10887a8-a649-4c3e-b410-8cd6a08773d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922176, "uuid": "5a2d9f0b-7607-45b6-a2f6-0b855c054a9d", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a64ddeb-07e1-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770879962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879962, "uuid": "b6a445b6-c786-4bef-becb-8262a912fb72", "comment": "Malware payload (PhantomStealer)", "value": "5e62a9247799f1ee29afc470cf79965b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879962, "uuid": "571200b7-3be0-4607-8578-5687b6413a3e", "comment": "Malware payload (PhantomStealer)", "value": "b90d1abbfaaaf88746b25e5d0a5e5bdca2bcdb36b9bf4f0caa0097e3ad18155c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879962, "uuid": "7ef881e8-d9b7-4ce4-b816-36d675ff1b45", "comment": "Malware payload (PhantomStealer)", "value": "79e8170626e09e67d766d1d84aa858d5a4ffb398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879962, "uuid": "c4b8723b-de23-4933-b533-72c57ca06ae0", "comment": "Malware payload (PhantomStealer)", "value": "89deca4be1424a439d1adb1f6830c61180ccfa7936c79a1699553272aa8e2f5da4a9739c68dd7a09771cd88d51a01f0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879962, "uuid": "ffdf6d27-d505-4869-9a3d-20fc54342f88", "value": "T19875E00273D2C066FF9B91334B56F6115BBC7A260123A62F13981DBEB9701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879962, "uuid": "015b83a0-aed0-4975-9d92-f44b24f5fe08", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879962, "uuid": "166c9a00-d869-47c5-bffa-652ccff675ff", "value": "49152:5PVt/LZeJbInQRaRG7uope5133B5Iacz1TFk:5TYbInQLur1lD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770879962, "uuid": "31f22b7d-080d-418b-baa4-587b3e94b3b4", "value": 1673728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770879962, "uuid": "c1c5b50a-e755-4d31-84f6-6e5ebd84dfbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879962, "uuid": "86d49511-a2f1-403c-8fd5-c402e8e986e2", "value": "junk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de6c533-082b-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770911670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911670, "uuid": "811e3457-cbcd-460c-8d78-d163368a9382", "comment": "Malware payload (AsyncRAT)", "value": "e973552c4ea0e8d94b2233a7275787fd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911670, "uuid": "41b6ed09-bf46-4375-a6f9-fde8b7b1d2e5", "comment": "Malware payload (AsyncRAT)", "value": "b9a07b5b22c1f49f2f28e5cb4c9854557e3ac8bf9d1a7c348236f6f226f7f9ab", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911670, "uuid": "fddcdd3e-3f04-449b-8c02-c4be30370865", "comment": "Malware payload (AsyncRAT)", "value": "6decbb98c6dbbbe8a5b64abfd04dfcbd76b141a2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770911670, "uuid": "15643911-bc01-4b78-b051-3be4777be0ed", "comment": "Malware payload (AsyncRAT)", "value": "ca2d5d847d7b5190c369086f5a78c87f6ee16a55877bf13f70e7bad70ef139d0f698a43ed60ff1c16241cb026eb52673", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911670, "uuid": "279bd7bb-3a0e-4874-8895-167f0c8f79e1", "value": "T1E2638C283BE20225E2FEAFB418F17256DB75B6538913D61F28C845CB1627A89CD407F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911670, "uuid": "3aa72d48-2eb5-4a03-a2f0-1df25f20150c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911670, "uuid": "db68addd-31e4-4a20-8d23-2f8b18922533", "value": "1536:KMg2Yc51eLTcb35UYkUSoQb/vPgbr/ObVK8V3kwn63xCOsGVLP:u2Pziu35UTfoQjobrkK85kWOsGlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770911670, "uuid": "82759fef-d566-4e2f-b854-6785ec1d0012", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770911670, "uuid": "bbda7667-b5f3-4d76-b5b6-f1d1df3e537b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770911670, "uuid": "85663323-488c-4f4b-b3e6-a15eea1f1627", "value": "b9a07b5b22c1f49f2f28e5cb4c9854557e3ac8bf9d1a7c348236f6f226f7f9ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971d3543-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877943, "uuid": "efb0b225-e0e6-4969-acd6-794425b9bf5e", "comment": "Malware payload (Mirai)", "value": "069822a8059e04f1104146a621bc7818", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877943, "uuid": "a215a711-98ce-4f75-95bb-27bc3b5df540", "comment": "Malware payload (Mirai)", "value": "bb8bba40ca5093d482df464b07454d35fc597351991adad4df250c96d6390824", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877943, "uuid": "d6b8cc1f-c2b6-4ee5-90f2-3b7f79d17392", "comment": "Malware payload (Mirai)", "value": "9cd71ac0157e23d99c65ffd7f95226c02f4124cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877943, "uuid": "5b26b576-fb30-4ae3-8207-e5a3d3bc9904", "comment": "Malware payload (Mirai)", "value": "ebde0d8b2e2a7dfe9ba1fceace01e5180d4b92e8cb811b511e8a7ff73f5323ff3801ba7177437108f794f3cb47c9647f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877943, "uuid": "6183121d-d21f-4a4a-9d40-1039bede3339", "value": "T18BF39E47FA1A5EA6D8810BF50BC74B8C6BB350409F6BC7DB3D0D66394E66ACE5D0A340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877943, "uuid": "44b7c70f-de9f-4581-854b-969564097131", "value": "3072:kho0S+B/QSz7VtT0eMnt9WG/+I3pVngnLqkrWm7ZEq:WrEnpGGpuLqVm7ZEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877943, "uuid": "8f1ef035-d480-4e17-93df-ac48aac6396e", "value": 157956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877943, "uuid": "60941684-4bf7-4635-af86-ed464b04aa47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877943, "uuid": "b7840e18-e073-424d-8e1b-14294d2490ef", "value": "xd.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee31b47b-07cf-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770872506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872506, "uuid": "fce65b73-6d26-474a-9412-3060bd04a5c1", "comment": "Malware payload (Gafgyt)", "value": "cf8925491f3a27cfd1ea16f598b96bd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872506, "uuid": "4c3147bd-8d68-48b3-a101-f584e4113ba2", "comment": "Malware payload (Gafgyt)", "value": "bbf465bce4d8d857da5d855be9b7ac2b1a6c6074c81c5f64e4fcfc5203ba0987", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872506, "uuid": "6583652a-7f4d-4f8f-b3e8-443914caf098", "comment": "Malware payload (Gafgyt)", "value": "f6d314d08c732e52e471f9e74174dbca82dca79c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872506, "uuid": "206acc47-2841-4152-9bee-2974bdbfda96", "comment": "Malware payload (Gafgyt)", "value": "a3a38c1ffe7b278971b57eee4737aa796924b77f8480fe0980f1898674c756c6785e22575f8406558d1a239081e55708", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872506, "uuid": "7ef802d1-58e2-4dcc-9a48-bc901720dcf4", "value": "T155836B23A651C6BBC0875BF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872506, "uuid": "ffef5966-4ae8-40a6-a7e6-9e69c0dde678", "value": "1536:UB7crF7FePF5tZuEqdPUq0aJb9sqx3CjrM3XcuWIr8UmoIYuOVje+ZNne:URQFet5O7dPr0oSwyjr4XcuDnmrYuOVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770872506, "uuid": "406bb0ac-7a51-4bb5-8797-482f4699a1aa", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770872506, "uuid": "ab2d320d-99eb-46e9-bc60-aba344ccd03d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872506, "uuid": "9ed155a2-5d77-4b29-80db-6e2fb8845e17", "value": "x-8.6-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6573a125-082f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770913508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913508, "uuid": "1552f3a6-e621-4b39-8063-10854e22397b", "comment": "Malware payload", "value": "e74c919d8fe385b437de4efb0a3d5886", "object_relation": "md5", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913508, "uuid": "b97da15c-3384-46e2-a3e3-5f465bb5703b", "comment": "Malware payload", "value": "bc8b5281f8de521cd437a01612ac06aa14623f214cddd934ec82fc74ea2196b2", "object_relation": "sha256", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913508, "uuid": "359e604e-2bde-4715-b682-d3ee5f581a3d", "comment": "Malware payload", "value": "8a1baace99e277fe81275da72e29a2c9e66c2361", "object_relation": "sha1", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913508, "uuid": "24f76dfc-1e6e-42d3-90a1-8946e08bf198", "comment": "Malware payload", "value": "b8782b79f0cbaa7996a18fc913f30594d6fa595405b08c823716277f86ea8555992a6d9b1810787a73a76574b982b5c7", "object_relation": "sha3-384", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913508, "uuid": "1cf79e28-5b68-4c9f-b03a-b2ab0941e7e4", "value": "T1BDA1730763972BFB9A468DE95398620724F6C0BB38127A7DF7E515937426E41BC31334", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913508, "uuid": "150e952c-74ba-42a8-9c84-e00b2c2ba535", "value": "48:+7zgZGS0KjSGGSaikGSaaFKzWhkGSa4gGSaaer5K0maJEtGSaaTVtGSaal:+7f1vskTl6L5UwIT2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770913508, "uuid": "85fb1a73-cd85-4f19-8e49-6a4d433b656b", "value": 4914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770913508, "uuid": "048a9843-cb98-4388-800b-3753c59e9518", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913508, "uuid": "4093038a-45b0-4fd5-a0f7-12644e763d33", "value": "bc8b5281f8de521cd437a01612ac06aa14623f214cddd934ec82fc74ea2196b2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a48ddd-085a-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770932144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770932144, "uuid": "12919777-559b-4aa5-a533-a8eca6b5f622", "comment": "Malware payload (ConnectWise)", "value": "895e1c7cc50416995d779d96f4e04237", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770932144, "uuid": "6df5c229-1fba-4d53-9f3c-df24441e4452", "comment": "Malware payload (ConnectWise)", "value": "bd17704aaebca99466e97f73db17e436a01b510e2863c1b434d77b124519e568", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770932144, "uuid": "29fdd01f-46ad-471d-88a6-fe8d6bdeb9d4", "comment": "Malware payload (ConnectWise)", "value": "f3e10d531bf55b04bc4b2ed8ef075fae188b5070", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770932144, "uuid": "f545b4f2-69db-40b3-96f1-698691a396a5", "comment": "Malware payload (ConnectWise)", "value": "afe8f4329025450c32b93c621da08589e13ed8f5bdc792933fd341f361f9edb9a2a7cb224ee5f537d35a694b36200b29", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770932144, "uuid": "e7dcf870-eb29-464b-8251-7bf4d70a8265", "value": "T123A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770932144, "uuid": "4ad3da32-f2f8-4c22-9498-2efe39a3b249", "value": "196608:xKaLNkbgDi4QdKaLNkbgRKaLNkbgvKaLNkbg:VWgDiHxWg1WgHWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770932144, "uuid": "d65d2516-58dd-4825-b04f-a3d991f3ef75", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770932144, "uuid": "f9f8d354-0d99-4fbe-861d-c692ed226f34", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770932144, "uuid": "1d7bc21e-6e00-4a4a-a303-3c7a856c6d01", "value": "NP-000804-260001984.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f21419-0840-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770920730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920730, "uuid": "bc40e435-ddc2-4ef3-8a8b-8ce325482125", "comment": "Malware payload (Mirai)", "value": "55151de5d10fccdba316b863260aaa45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920730, "uuid": "58904695-aef1-4672-b588-f3447cea5af2", "comment": "Malware payload (Mirai)", "value": "bed36a3a51aa2f57acedf8003e97b53ddea9ba16d5fd17722607be51ecd078d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920730, "uuid": "e476134d-761a-4b67-8683-e07410d925d8", "comment": "Malware payload (Mirai)", "value": "725090393f0d51faab5706554466031796e9e547", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920730, "uuid": "a299a33b-d688-4d5d-af9b-b9135d16620d", "comment": "Malware payload (Mirai)", "value": "af0d7079c0ffe1e902e47d2716d23a78f8575bf7a612caed75e1a675590968ea8443e89d79989abc2affb741af091dce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920730, "uuid": "dff13433-25cd-4c94-8253-2f3ba5a1bd3a", "value": "T130E34C45FA409B53C1D517B7FA9F014A3322D758A3EB730689285FB43F8AB5E0E27606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920730, "uuid": "e7bcbfd0-966f-44f5-8ccf-946ed32a230e", "value": "3072:Jtfg6PE4+wyVKJ8sXMhv+yxCG2VpSmSDCAX5k+M/9kKZjI941T:JRg6PEgybRCG2VpJSPX55M/9k541T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770920730, "uuid": "41a541a9-bd23-488d-8439-a1331ea73991", "value": 154201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770920730, "uuid": "d6e041d8-b0fe-4539-a328-2d948f25df1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920730, "uuid": "90666dd9-da8c-42b7-b211-e5b23f93aa36", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf18c00-0862-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770935344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935344, "uuid": "4c19d33d-cbdb-4cba-997c-c36c9f8da814", "comment": "Malware payload (RemcosRAT)", "value": "9a6c46a0e5951746c22e4c9a69a501fc", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935344, "uuid": "494fe74a-01a5-4a1a-aca4-83af041accb6", "comment": "Malware payload (RemcosRAT)", "value": "bf9ebf995e7ddb5222f0aadd2dade006ac376fc8e26555fba5dbcd0403edd1f8", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935344, "uuid": "d5f2c3e9-cc65-477f-ab52-f427402856cc", "comment": "Malware payload (RemcosRAT)", "value": "6eeebfffaa4ded19f600697543f3be8c06279b3b", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935344, "uuid": "6a90fffb-0dd3-4d10-89de-e53555fed71e", "comment": "Malware payload (RemcosRAT)", "value": "56b1a860538b482ad04626d187b57862a4ca52fa730528498db6efc1e28d1ed31b6927d074e5bb16436830bbe5139959", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935344, "uuid": "29e11e7b-56da-4ca7-98cc-d9d7e6ea6c1e", "value": "T176463A8225B09843A13F056D8F06EBFE9901CC2FB68195C2B541EDAFF64E994F7C8674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935344, "uuid": "13ff4af4-b32e-44cf-b8a0-b33f43279d88", "value": "98304:GI1lO4kGN8Qm4gtwFl8jTV5X2NORus2F9MoG9Zkd2ZNlo8doNPDTXuWTSt2VDJh:GIJRN8uRr8jTXuFE99Zmv8dmPDa21h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770935344, "uuid": "2c1b3cf9-d2f3-4e50-bf76-194c14f49a0f", "value": 5419976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770935344, "uuid": "a6895213-9462-426d-a8d5-76a2252d1efa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935344, "uuid": "366840c2-95d9-458d-a71b-de700ed37283", "value": "FIZET\u00c9S_MEGEROSIT\u00c9S_TRANZAKCIO_BEFEJEZVE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1080e1-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877955, "uuid": "6920d7ad-ac0e-4d96-81ac-70f7e34587bc", "comment": "Malware payload (Mirai)", "value": "e362076dd212b2e211638bad035bd997", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877955, "uuid": "cb60650d-47c5-4cb5-977b-ff970fad4948", "comment": "Malware payload (Mirai)", "value": "c07f9a04e75a8104a5f72852a0f304f021f5b075df94939002a89eb9ec8af2f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877955, "uuid": "18474574-48cb-4454-976e-4bf08248eb69", "comment": "Malware payload (Mirai)", "value": "38f273c00acaff7eca559104b0c41e9fa86bd53a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877955, "uuid": "0561d246-5aac-4093-bcdd-e9920d80ec6a", "comment": "Malware payload (Mirai)", "value": "d7afc768eaa839046016e63fcacc7b90e77844f9be58b88b93372444dcca31324c43efd28da9592ca73f16de7d6fe113", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877955, "uuid": "bcf3d75b-168a-465f-bf15-58895b67c50b", "value": "T129C35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877955, "uuid": "3a1ce494-40af-414f-a8ef-3ef906a5ace1", "value": "1536:UUAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK38:U/FmSmviqS1Bs0+Nd6lAqktNMxSNbm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877955, "uuid": "98c8bfa7-7113-484a-bba7-c63667757fcc", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877955, "uuid": "ec00af9e-6c61-4f87-b52d-c8a62176ad54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877955, "uuid": "831bdc14-e79a-4438-b7bd-d9229c97d058", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb989d68-0844-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770922779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922779, "uuid": "781015e8-c8dd-419e-93c7-e9ba06dfdb2a", "comment": "Malware payload", "value": "7be145c0e32d108a5184d559172608b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922779, "uuid": "4710916f-e20f-444a-be3b-4ccf90b23c83", "comment": "Malware payload", "value": "c0ab6879b9e2299a16dccc9f2a6c8bc15050a35e9e219a948b81c38c7414fc8d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922779, "uuid": "9edccf33-69b7-457d-83b8-428a9d7f18f9", "comment": "Malware payload", "value": "6cf73737a7732715923af91a4b7d30dc456a5fdc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922779, "uuid": "1489467f-ae17-4fc2-806a-4953836da544", "comment": "Malware payload", "value": "446d3dff03c904e2e9380bcc58ad58736f4b03dde58c223fd5bfff69b33fc34b4dd8f6fafaf6c994d7aeabc98d4d59ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922779, "uuid": "8f297da2-321f-4d00-a496-8d4673daf2e7", "value": "T16A35A4D15C34FB71AC107364DBB1E845A5A8637351DB4D743EC9F3B6298AA00BAF8AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922779, "uuid": "3e6a4343-7781-4048-923f-3d4f175a81a3", "value": "384:xddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddy:Db4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922779, "uuid": "0c8fcf7d-c11a-4a28-b83f-3e1c02795e8a", "value": 1148359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922779, "uuid": "2d8143b0-d6bd-4c62-962e-a1a029894822", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922779, "uuid": "8aa64b18-09f3-4074-9b76-66e1b71cd4d5", "value": "s2398923492389sd98f89293298f92f9298f9389f2993.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69765f1c-0846-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770923393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923393, "uuid": "7ca574f1-117b-43a4-86c2-f469797f59ac", "comment": "Malware payload (Mirai)", "value": "b579051604fd2e6277473ea39690e621", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923393, "uuid": "00149e86-95ff-4f16-a03d-781eeb091fdc", "comment": "Malware payload (Mirai)", "value": "c2b9972afbbf2d18ab701cba957a7e462ab2ebc669524dbc7e6d47bb514ddcd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923393, "uuid": "b8c393f1-c2b8-49b5-8c94-a6c3f97895b6", "comment": "Malware payload (Mirai)", "value": "5e3bc16963bc6f13e1fd2e68a6df018f149843a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923393, "uuid": "0329a832-0348-4ac3-a7de-249b8fb6c763", "comment": "Malware payload (Mirai)", "value": "a6753621ff32d99409dfad74304f0b08be6eb684882e56c1bc9cba2c4dc27fa212831f1b6da20e14b8f67f604644aac0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770923393, "uuid": "85ec6015-f14c-40eb-9a81-3daddfa8f816", "value": "T1CCB309D9BC858B11D5D626BAFF0E518933139B78E3FA7103CE185B2A538A85B0F3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770923393, "uuid": "0df1c3df-0b2e-410d-af6e-dcefee83b3f8", "value": "3072:whkNIJqDbKJtEG9fYtnCQhOueQm81wf5e9P3TLkwZqoTX:OCKP+nCQhh1wf5e9/TLkqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770923393, "uuid": "b66467a2-f57b-4b00-893e-1c2a6cc8e9ce", "value": 114924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770923393, "uuid": "fcd67f8d-fce8-41af-854c-b8ee93bad925", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770923393, "uuid": "4df5c523-f2aa-48b8-b92f-5f873195f528", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64017171-080d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770898903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898903, "uuid": "e9cfd0cb-481a-473d-8ecf-daf6a5ce388c", "comment": "Malware payload", "value": "b6ed8282db7163bbd32b9685464db286", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898903, "uuid": "a8bbaa43-eb20-4aa3-83ce-2aca129b1a6e", "comment": "Malware payload", "value": "c309debcf994445de5cdde1e387b78b782921a87ebe95328a51187e2b665751a", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898903, "uuid": "2cf3867c-8ab6-4cac-971b-3be54ab41b66", "comment": "Malware payload", "value": "7d066a2b44f2d6554ff0c1d1ae9eeb6627fc3742", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898903, "uuid": "4387e3c5-876d-419d-ae6b-e007b615622b", "comment": "Malware payload", "value": "3657a4580e3848fc7f578f5ae1f85f30a87c5b44ee34957d5b1e1385b6d53f3200d12364c7c7f2739dbe72276c46c36c", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898903, "uuid": "65383e8c-f6c2-4d0c-b013-f2f80d961795", "value": "T1956633E3C624583B13B0B4F7B6F76F416436AEC62A54F2540F00ABA7AC517EC98976D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898903, "uuid": "70a751b5-1a7b-4e88-b982-d624d73cfc8e", "value": "98304:IGu+DDGfC4u8jDi20LwmYBULsN0JEcai3ohsZ/+nORnrwn4ZFuFI+APH+hmFyrr1:pHGfCp7cmQaJEC//qqrwMspmFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770898903, "uuid": "31284e47-431e-4c8e-98d3-1a4a166764b7", "value": 6971036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770898903, "uuid": "83114938-393e-4025-98ed-6d22ef8414c7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898903, "uuid": "550ce107-fed5-46b7-89de-b64621211ff1", "value": "TgFix.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2c4d97-080f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770899965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899965, "uuid": "a970fe18-1cc8-438d-a501-f28efba97a7e", "comment": "Malware payload", "value": "f986eb2659f29b6b2a87e393f6e38100", "object_relation": "md5", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899965, "uuid": "2d627861-9f9b-472f-8fcc-9e50e8a86a0f", "comment": "Malware payload", "value": "c365d45f893403ca7d1a7a05d28d2d153aaeb4fa15218435cab316a0b5d3ff53", "object_relation": "sha256", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899965, "uuid": "c1a595fd-ef08-4bb9-842b-882a76e86783", "comment": "Malware payload", "value": "0e71c32054c1fbd4769f4fb82f10dafe14fda36c", "object_relation": "sha1", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899965, "uuid": "2360f5e9-aa7f-4e0c-8bfe-0d5a3cde70b6", "comment": "Malware payload", "value": "5ae9959a9c72e9ef31fd90023de1b9b40585612ac1ddbf69326075c7ebf99ab134fe6aa3489c4432a7e3bd21540effd7", "object_relation": "sha3-384", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899965, "uuid": "c131804a-6014-41ec-b124-7466625752fb", "value": "T1A253A5314CC69FE9536E1880064DEF0AAE695BDF924A540BF11D3299EF5087097AFC3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899965, "uuid": "1545bd38-037f-42ad-8598-8e85f64082ef", "value": "384:2JglYSIwd+x18c4SFUEZ6eP8wYBI92vNGOWPnQB+5:CgYwAuG+/a92kYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770899965, "uuid": "63959adf-afc1-4941-9c45-4850d81a69ad", "value": 62894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770899965, "uuid": "67e18e83-d13c-40e2-ab0c-ba19bf6f406c", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899965, "uuid": "a5339d47-7cd7-4c8f-a0e8-e28ea5aec57a", "value": "Smart_Policing_Industry_Participation.msc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1ccd9f-0844-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770922782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922782, "uuid": "3d2fdc99-1166-4348-b436-af466c215ec4", "comment": "Malware payload", "value": "f07e403e7b6134afb43981e4fcce775b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922782, "uuid": "039d4474-5707-4bbe-8086-15efdeb7e6eb", "comment": "Malware payload", "value": "c36d3088eec5254ed35d6bc166096e4f99024c60dd8bbdc7dc042a61bb5e6299", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922782, "uuid": "ca74c9f8-1cda-4361-be31-55ccc89d6571", "comment": "Malware payload", "value": "3ee3ae8b2d330a6226873ca614f31d6fc55eaf21", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922782, "uuid": "b0e4ee19-5372-4794-a908-7c9c5c7abe89", "comment": "Malware payload", "value": "773d19a5a33067c88e4c7e70557777109395113d5652e81471a47d80c4e20c7885fa95f9dd2900bb24fe5068b7054951", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922782, "uuid": "509daf00-7180-4d78-b44f-079897e6b006", "value": "T1C3E3AE6EE74F0825DF55A77B434A4A4A49FCB33DB28540B139AC933437ADC2E466287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922782, "uuid": "4c53ef32-8bdb-40f9-8d7d-19748d255921", "value": "3072:sywmKLwShdcofXRcqXLRHdV4Uepi+8zpiixd5Rv:syw/LwSAq7RHdudi+8Fiixd5Rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922782, "uuid": "157168fc-e5dd-4ac0-bfde-4bc97bb49d6a", "value": 144710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922782, "uuid": "325a89e0-db74-4581-a48d-8d1bbcdee5db", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922782, "uuid": "367206df-58a9-4ab2-a01f-e231eecce27f", "value": "cee.doC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92bb6537-0843-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770922174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922174, "uuid": "bed976e6-5e0d-4b36-a38c-0a49e4fb5042", "comment": "Malware payload", "value": "4405ef94b5d7f86fda510ea82bb6d06a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922174, "uuid": "03d2a4df-a72d-405c-a731-c26c082efc6a", "comment": "Malware payload", "value": "c489aca5571eb078a4f49dca031cd30ede179b523d0b9e2d231544bb234b39ec", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922174, "uuid": "3c4274bf-139c-492d-a1fe-3a12541240b3", "comment": "Malware payload", "value": "1e86eebfee79d27cd92bded8b1039a286f7de7d2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922174, "uuid": "3ac5b475-9dd0-4e78-b237-71f775ab7458", "comment": "Malware payload", "value": "9ea40dd291798ec1cb90fc56f8bff04dbbf167dee4e891c32a5ad05d69956aa944be100b0aa761230722755856ab4459", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922174, "uuid": "af4981a9-0554-4ebe-906c-1d94e59e1eaa", "value": "T1C3A3A06EE70B09659F91A77B435B4E4909BCB22DF38540B179AC873437E9C3E462287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922174, "uuid": "f05fd03f-3232-4a30-8840-58e83e155c8a", "value": "3072:YaLbKtQyzaXnOd0ZOk5/vL5G8sYjm/jmUoyQ9k0z:YGb+v0Mk5/vLA8sK1Uo5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922174, "uuid": "2aeaad90-25d9-4fd5-8f52-7c9781220880", "value": 100491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922174, "uuid": "6f862d3b-201d-4fa5-8000-ab875723086c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922174, "uuid": "81508922-6c0a-4f47-9b9c-a134121e268b", "value": "mm.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5314e018-083a-11f1-a129-42010a9c0007", "comment": "Malware payload (Havoc)", "timestamp": 1770918202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770918202, "uuid": "6613c3c6-b51e-419e-9b25-723ba2510a5a", "comment": "Malware payload (Havoc)", "value": "06441b4023afec5c1d2dd86d468edc5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770918202, "uuid": "f810f362-74a9-433f-92cc-e2e9905aa11a", "comment": "Malware payload (Havoc)", "value": "c59b90ec47ee58582813d3036a5dbe770d9b045d14c077666146ec9f5dbf91ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770918202, "uuid": "a5f02123-3de2-4413-8355-956e7b4c0986", "comment": "Malware payload (Havoc)", "value": "bcbd5c0799cad6c6085949885663735058ed1f6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770918202, "uuid": "8ec83e80-2a17-4991-93a7-5c0ec5ee48c8", "comment": "Malware payload (Havoc)", "value": "61991ff43dac61e799b5ef5706a441f6043b29b5b9aaae78f266411dab7ef2e6aaee1d2d50544f3f56cf5abdf7d77777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770918202, "uuid": "35fc3d8f-3a70-4f79-94f8-aafe91e942ca", "value": "T173643CA5E292FC82C83E023957F651D89B3CEE85136BC7176CA562394E06DC0DFEB611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770918202, "uuid": "3da982d5-6449-4a5a-a55c-34297bc3325d", "value": "33049feb738abcad30d45afeab1d22eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770918202, "uuid": "0c2603f1-c351-4b09-82ff-d3cff3926f50", "value": "6144:MUopY9csKdfguoVjaV74Y9tQwQSCHeoKk4m40:dcsEu3YMw+KBmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770918202, "uuid": "b173863d-5d63-46ad-bec9-3ecb873b24a2", "value": 318671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770918202, "uuid": "5beec283-f03b-4b4b-a3a5-5616c900f82c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770918202, "uuid": "e256c474-1f45-4dd8-b0fa-5816bde75f0c", "value": "06441b4023afec5c1d2dd86d468edc5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfa940a-07f4-11f1-a129-42010a9c0007", "comment": "Malware payload (OrcusRAT)", "timestamp": 1770888019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888019, "uuid": "23f9d914-eb4f-4603-b357-90324c60e393", "comment": "Malware payload (OrcusRAT)", "value": "0655ad2eaeb288ecf96c4801c02be851", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888019, "uuid": "32dfe6a0-5346-499a-882b-9398534d20f1", "comment": "Malware payload (OrcusRAT)", "value": "c5c37b03c253c7900b1c810ea10c03f89951d2558743f885ab2d0a8113d7a29f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888019, "uuid": "84406674-1804-4d0a-88f8-b6010284ae65", "comment": "Malware payload (OrcusRAT)", "value": "c565d2a0e0de4f52d08318dc9c8541048989783e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888019, "uuid": "89ae44fa-c895-4bc2-bdaa-6785e7eaa024", "comment": "Malware payload (OrcusRAT)", "value": "fb078567f75be317c6f5eb3c8ead9c0439054d311cf8f4ac2481ebb7d3e3245b23f22c399e41628c6a4587746c5e8853", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888019, "uuid": "178243f9-a394-4adc-8c3d-bfd6b4d4ebff", "value": "T137359E1DADA900BAE077D139CA930546FBB278222720AEDF13D1035D5E67BF57A39318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888019, "uuid": "55f0dde2-65bd-48d7-885b-c1007f741f37", "value": "c65ed3a99850b1c3dea70f50ea322588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888019, "uuid": "4eb60bb0-66ad-4d95-92f8-a8324ad2b050", "value": "24576:8yKtT7g4FwxPPATyiq7hvTxNOTMRyqUn9Cin:2T1+aTStTTIqUn9Xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770888019, "uuid": "7996990c-3973-4d22-ad97-78812a8c71b3", "value": 1129592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770888019, "uuid": "3181c6d5-0ae6-4fc2-90f2-7af1fa3a83dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888019, "uuid": "2dbd994e-1907-4d0c-a257-4fd3152b98ee", "value": "task.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4cdfaf-084f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927099, "uuid": "b27c43c5-1673-48c2-9d35-8d551fef56a6", "comment": "Malware payload (Mirai)", "value": "4aeb22a02b05a2998f8d1dbfe06cae86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927099, "uuid": "29917cf7-d2db-4b86-a72f-ff0b8a8ac466", "comment": "Malware payload (Mirai)", "value": "c5d7535f5e1bfc1dd67a6648f0a8e457348d4fc9156a66e25b9010e38d2847ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927099, "uuid": "5c6fd0c0-d117-4d4e-bb76-ad037bf72fed", "comment": "Malware payload (Mirai)", "value": "28a0d829bf6b99cfeeb8cfc8a90dfe94c082d1b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927099, "uuid": "97f0fc31-d74e-467f-87dd-4ece45b9658f", "comment": "Malware payload (Mirai)", "value": "2959c6166ac36979ae96b7a5285c453056dabb7379331636dc1a34e23ac965868f7a5de3b53389e4f3528e699d231660", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927099, "uuid": "9fc6c80f-939d-43ab-8390-b2e1a1069c53", "value": "T135E32B46E7404A13C4D61779BAEF42453323AB64D3EB73059928BFB43F867AE0E23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927099, "uuid": "e8aec162-df4b-4960-a29b-338e19ba5e88", "value": "3072:7q3ugBZxahqUUTiXjq01W/iR+KCde3RpNM/9P2L7:7q3NxahqUUTizql/w+bU3RLM/9Pq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927099, "uuid": "fb29c78c-ae6d-46e5-a108-639614d9da67", "value": 153188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927099, "uuid": "ee98c4fc-75c8-4794-83aa-efe022ee7298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927099, "uuid": "bf7618ec-28a2-4e0b-8677-35d6c8f41571", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f6e638-082f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770913455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913455, "uuid": "c8097c40-be94-4bef-ad02-53d4fca900f4", "comment": "Malware payload", "value": "213b7960682a9ee77d3806bba4c1ef8c", "object_relation": "md5", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913455, "uuid": "a0070377-6128-4c22-8c63-f074a3adc92d", "comment": "Malware payload", "value": "c76c0146407069fd4c271d6e1e03448c481f0970ddbe7042b31f552e37b55817", "object_relation": "sha256", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913455, "uuid": "022ed83c-e8b9-42cc-820f-72d18446acba", "comment": "Malware payload", "value": "294594f8cc7d0eadc3aee3be5cc74669df4490c4", "object_relation": "sha1", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913455, "uuid": "55542cf1-825e-4c3f-87dc-db8f26054785", "comment": "Malware payload", "value": "399f72fc17533186377ed71a57cbd53b690ca7212b7f48c17a8c0dab31c678bd671ac73fd8d3ed141ce946a57d00bc8f", "object_relation": "sha3-384", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913455, "uuid": "0642b77d-26eb-4569-a005-af22a7d20e9c", "value": "T11C329DD73BAB03050551C08E3EFCE412EAAF52B1945C9EB17E3C127B20B348B9A49C5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913455, "uuid": "75db087e-5cef-471b-a013-055ae0c645bb", "value": "192:NBbfsrngJuX48/+oaTYOX2fJX6Ic+nJVCsbRin19HmsUTqfH2CFpzGW0gLr8u5S:Db9sXH/n1OX4JPfbaGJfCFdGWB38r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770913455, "uuid": "ec64c0be-b0f4-4fdf-90bc-16ca0968a247", "value": 11799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770913455, "uuid": "cf6643b5-5df5-43e5-bcaa-154431dbc75f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913455, "uuid": "15d422d5-d42d-4469-9d77-d62a35d2dd38", "value": "c76c0146407069fd4c271d6e1e03448c481f0970ddbe7042b31f552e37b55817.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db87b7d9-07b5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770861307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861307, "uuid": "34c237e2-f394-42cc-beec-a321533b9861", "comment": "Malware payload", "value": "5789e2e5d5c15db62d9340eb9ef39bcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861307, "uuid": "14fe1cbf-3ff6-41d4-8edd-9d3f2c5ddd1f", "comment": "Malware payload", "value": "c795cc9b618aefdd2dd648325bbeb74b52edfd8227794f912b86194fb7c83950", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861307, "uuid": "5a154064-8b1d-425b-b2db-104db08d8c93", "comment": "Malware payload", "value": "bbf41d87a6321ca4827b9a47dd14376e739349d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861307, "uuid": "14a63f06-1395-4fe2-93ab-47a175bcc48e", "comment": "Malware payload", "value": "7bc652bc0abff1c599123600d7a7f13423dad9c345865fe96b1bbe6c0ea7de4f140303726642517df80000b57cda15a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861307, "uuid": "db885bde-2ea6-40d7-9094-f1f7c62d3246", "value": "T10AB5F757B8D24946C4E43737F8BE81C433665EB99B8A621A6D05FE3C3ABE1D90E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861307, "uuid": "0318ff8f-0685-4a4a-a234-ee8aa2dfed81", "value": "24576:SvtWh87CYNt2Unm5/47Jidoyy3PILuypGUlJn5ADOWcyxJs1KUX4biUkJGfMXaJc:cs0biPgVx2wBVih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770861307, "uuid": "43c81028-6290-4f1d-b851-c42339832242", "value": 2424984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770861307, "uuid": "a250a4c5-3e7d-4e5c-ac04-182e0d7a0f7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861307, "uuid": "f4f2789e-12df-4da5-97f8-860eb6956966", "value": "bot_armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3d4b93-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877819, "uuid": "e72edd42-491e-4454-912e-a0dba493f4cb", "comment": "Malware payload (Mirai)", "value": "6cf6561716d982ad1242a437a4345fa6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877819, "uuid": "3fac47aa-2a90-4839-919c-be29212834e0", "comment": "Malware payload (Mirai)", "value": "c7d48107a4fb5cf55052476cbcd8c658d0d13483cee3356a8b3ca6b279775a66", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877819, "uuid": "9856d7d0-0c93-48f4-894e-6cfe9b2d08ca", "comment": "Malware payload (Mirai)", "value": "690458dd1549b8f1abe32a170ee5c99e7692a304", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877819, "uuid": "f689248c-3a64-4817-bd18-faaa3fef2441", "comment": "Malware payload (Mirai)", "value": "1f9ab6d3376e2642e6c3462a6e04eabcb077097ccd1b4223768d5c2a1ed426ba3f520d97b60e246e295af9953f91d67d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877819, "uuid": "31912f74-3e90-48ae-86e6-d9b9fb0758c4", "value": "T1E9B012A90D14319FF00317322070C131E46CC3613350C737BC7C2490484841C30A4DAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877819, "uuid": "afb89b36-8a99-48bb-aef2-d21ce394edc9", "value": "3:L+mIcTEXIQ1ibJLKoSPQHcLKbKRJMJ0:LPzDFKXQH6K+vMJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877819, "uuid": "0cfd8d76-da14-4b62-b589-234c8e405eca", "value": 106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877819, "uuid": "d77281fa-cc27-40f9-9661-f881ed55f721", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877819, "uuid": "d42e1b2e-16ec-4af8-8ca5-7836e55df20f", "value": "lilin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc5b504-0841-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770921310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921310, "uuid": "5d395592-2324-41cd-93c3-cd4b337359c2", "comment": "Malware payload (njrat)", "value": "45146b7913dac0de49c391733d38e5c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "procon-go-gov-br", "colour": "#FAC3F8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921310, "uuid": "c2a10fca-ac26-4831-876b-6825252d583a", "comment": "Malware payload (njrat)", "value": "c8ca721da8c1cb2ebd0a1a16a0f56af8bd86f4f281f82a423c1ae88e05aa086b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "procon-go-gov-br", "colour": "#FAC3F8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921310, "uuid": "877fe190-adca-4edb-a166-0febec20607f", "comment": "Malware payload (njrat)", "value": "291b94fabaae1b4d3b562867fc09396aa4236afb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "procon-go-gov-br", "colour": "#FAC3F8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921310, "uuid": "b12f0b64-4180-41df-9892-b8d366c01672", "comment": "Malware payload (njrat)", "value": "25913164d3e108284c747f84cde041dcacc6dc265e646e95cc06dc75b6cf93d595fb4d844d53cc22d5751ecb12eb1791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "procon-go-gov-br", "colour": "#FAC3F8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921310, "uuid": "046d86bf-333d-4748-997f-6f48c2ce5bd7", "value": "T141466D10B7719931E5FA07B594BF02A4173894680BD667CB52E0A4FCFD593EB2D3228B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921310, "uuid": "1a3da79a-4348-4acd-b824-a32dbd1e9508", "value": "c487ef6b6a5b1e458b4dcb42330fb829", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921310, "uuid": "8b2c1b5b-dc9a-412a-acfa-87599c363435", "value": "49152:+Vo5rrqzyDAL7CBxnIoeX79r9nRR9tIZn6jJ+dsRlL+qcaTwpDQIAdY:+Vo5rD8U6oy1gZWJ+dARTwpDDAdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770921310, "uuid": "55b491a2-b77e-4d94-8964-66e8d611aabb", "value": 5365352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770921310, "uuid": "d3af4603-5d32-4ba8-873d-f8bb522e6e5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921310, "uuid": "0480a255-2f85-45ff-bf2c-459d57c106ca", "value": "ComprovanteOrdem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635f1fa6-07e4-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770881292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881292, "uuid": "14fcd88c-b361-4c40-8302-9235ffd9356c", "comment": "Malware payload (AsyncRAT)", "value": "9994d0ed9cf5fc8740b6173eaa7a649a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881292, "uuid": "1b652c26-ab76-4590-af0c-afb1fab302d2", "comment": "Malware payload (AsyncRAT)", "value": "c927f754a367cec65dde372e6955d1d70e52a04a4bee037e244df2f74125d75f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881292, "uuid": "63899662-8829-41f0-8a93-24338f40e105", "comment": "Malware payload (AsyncRAT)", "value": "184776ffc2b587c82192c1b34c5062b2f91a4519", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881292, "uuid": "d16a38bb-ef0d-48cc-9005-3571429fbfb0", "comment": "Malware payload (AsyncRAT)", "value": "c3151534fc76a3fc38395098e1c192fc9fc30f235b85b06e069c0e4b45b02adf24756cbe0fae1f54ca5ad1ebe4ca5014", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881292, "uuid": "6705f64d-caaf-4a5d-9295-d69cb0670fe0", "value": "T16A46123137E86A4DF1BA97B45875599027F3F853F320C60DB9D550DE0DA1B8AA223B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881292, "uuid": "0a35eb6a-6dec-4a9b-ab7b-dc19c8acb4c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881292, "uuid": "bee0f0d9-aaf0-4445-bbf2-057c74e4a862", "value": "98304:+s3/ywOPmMe2uUyWIim0B64vecbAkTGg54TItQvddo:7awLIuU7IcB64tCg54ktQv7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770881292, "uuid": "2b3ce3e3-b634-4dd9-94b7-f75365ca41c0", "value": 5389392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770881292, "uuid": "897fac8b-15ac-4e28-9247-c3823fe076ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881292, "uuid": "cc17e326-5959-45ad-aa51-e11e113b7602", "value": "9994d0ed9cf5fc8740b6173eaa7a649a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed61aef6-07cf-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770872504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872504, "uuid": "4a5ef959-401e-4be8-b9ac-9bb48eb84514", "comment": "Malware payload (Gafgyt)", "value": "fc5cb4d966943d0824dc23a6da7aeac4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872504, "uuid": "f1f763b7-147b-4379-a1df-46d011ce4f13", "comment": "Malware payload (Gafgyt)", "value": "c9641550eb3a33f5cdf781a1ae60ec0d3e77345c10b6ea054255afb3797bf001", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872504, "uuid": "57c6128a-869d-405d-8846-183e9b54d74d", "comment": "Malware payload (Gafgyt)", "value": "1c0fe019dc56d2f76caeba75ac8bdf315ee869fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770872504, "uuid": "888bbf60-9e2a-48f9-a7fb-4861e03adbd3", "comment": "Malware payload (Gafgyt)", "value": "ebd2094032c4c6d3f82d57f2c78ddc25418ca11fc2e9bf4377bd975b7f3ccbdd6230c741847ba1483ebd6fda3e866755", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872504, "uuid": "e599c2d6-aedd-474c-ab90-11c38357a2d7", "value": "T166634B03A781CAB3D0931AB606DB9B210132F97B1A1B9F55F32D7CF49B111C8B257B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872504, "uuid": "ece33788-5f0a-4220-a590-f6c41f2bef58", "value": "1536:qSwvRTOUuUwNq0dbvFRexxA6Cxu0MgmPprrmLI2VOCjXUfJRk:PwAUuUwA0db9ReXnC0JpHmU2VOCbUfJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770872504, "uuid": "069f6ab2-27f2-4b78-801a-72cfd2feac2f", "value": 73128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770872504, "uuid": "8a804d02-1fd0-433f-9163-ad39578d50e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770872504, "uuid": "3bc341b8-68a2-464f-8f76-ae9bc2f76c8c", "value": "i-5.8-6.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9ae0e9-0844-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770922704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922704, "uuid": "e85ca3fb-d29c-4080-aa80-2d8062e00d6a", "comment": "Malware payload (Mirai)", "value": "4beaea0eaf8bd503246b41b401ecaae0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922704, "uuid": "8a3440ae-787b-4cfa-9507-5d4d25c3265f", "comment": "Malware payload (Mirai)", "value": "c9b8a918204e04546a7f89ea93067cd0063eff7e5f325412a9849dd8c2a2abe5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922704, "uuid": "a406493f-e948-4606-af32-d812a3e9056f", "comment": "Malware payload (Mirai)", "value": "e0c5b91521312cf9316605d635794b279a037fb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770922704, "uuid": "3f48c195-e60d-44e1-9d28-511e47257015", "comment": "Malware payload (Mirai)", "value": "d87ed8288e0ae46e10eb60411a587e1d0fd9c63b356e582236f23d7380e6efa1c21988f9fcdbe1e69071cd0240a15103", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922704, "uuid": "ab92fbac-9642-412c-8676-7fea836aa885", "value": "T133733A5331284A47D5934AB1253F5BE083FFE99034E4BA88684FDB5A8635E771086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922704, "uuid": "037d7a38-d77c-4c9c-bbdc-469cb23353b2", "value": "1536:lYeo79/C0xj11JpFF4s1AaK1DOEzy7pIHz0:5gNF49oE8pIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770922704, "uuid": "7a935dd3-9eb9-472f-9b26-d47147a24cc3", "value": 77096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770922704, "uuid": "b63bd02a-351c-4384-9a3b-f31a31b64e68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770922704, "uuid": "9150086b-630f-4d4f-a467-cf4cdb84b02d", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4baafc83-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877816, "uuid": "f71466f1-8c8d-44a0-bc97-229eace06d1a", "comment": "Malware payload (Mirai)", "value": "c404e9dbeba92b773167c6c3bdd59280", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877816, "uuid": "dcf801b7-4073-481d-bd1e-de0c2d602c09", "comment": "Malware payload (Mirai)", "value": "c9e26efcaafe9ce1dc2681a463ada5c8cc94839227c61d018be7fa0b5dff5170", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877816, "uuid": "acc4de72-45e2-4849-a60a-7be9d6b672c4", "comment": "Malware payload (Mirai)", "value": "45e2e6ec1650cf53b458c9b40bc03672504bfc89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877816, "uuid": "bae040a2-1361-4d2a-81cd-797e40c5b63b", "comment": "Malware payload (Mirai)", "value": "81811ae46199e9d19e44352d07d4c511475710958d0c85cc8d10a27291920898e623aea5264ab62f0e6a0fe9e56fa7bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877816, "uuid": "476916ab-2153-48dd-8684-2c04a5533923", "value": "T142A328A3CC766F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877816, "uuid": "4299b2b5-bc8f-4f28-acbf-c9a130bdf091", "value": "1536:74ufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAs:rbU2RC4kPCtSzWu3/3L1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877816, "uuid": "9475cefe-f224-4b12-aaba-3e7c8b5beed7", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877816, "uuid": "901cdf85-72c3-4d5f-9879-a6e11ead0e1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877816, "uuid": "b4ff6e42-047e-4c65-adde-ca74e14bac78", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525e78e7-07e4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770881264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881264, "uuid": "c6e9a2a0-7e89-4488-bfd0-de4af494ade4", "comment": "Malware payload", "value": "19dea8a9bc5a90e7ef44be2dd6b40aed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881264, "uuid": "fe2b3751-324a-4ed5-b984-2ea0672cf7e2", "comment": "Malware payload", "value": "ca1d9f1327744953f9aef53fcef8dc5e468b0f2412ea4611c355772d083ec05f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881264, "uuid": "c846e1f4-b62b-4757-ad82-ba246ccd67bf", "comment": "Malware payload", "value": "569d15f131709230df9612adadd3e76dd3baea92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881264, "uuid": "b675ff0b-7a05-411e-8966-7b65b39dccdf", "comment": "Malware payload", "value": "92f86610b587ac32a7e94055cd2070ec98e8986bdf0206725ce08df6114a013e2d6bdaf258d30b583fa68fb722b16950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881264, "uuid": "1aeacfea-5d77-45f9-ad71-4e69fa3ea9fb", "value": "T10F16E082E2DB4279DF635B7988965337C2B03CC503B083D7699D4A64AF639F46A3DB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881264, "uuid": "ef10ed26-d48b-4cb3-b2f6-fb217e9a866f", "value": "8e5889f9628d5fcbea6950cb9a28c0c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881264, "uuid": "f25089e7-09f5-4095-9ccd-e010b6698ec3", "value": "49152:lKH/Xm2WxIvwquGUU/E4y3VkT8+HE3uxuMvAKrTZrNyA+2dWhT8p5QDvqAk+:YHf4F8EjVMxdAGTZ3bL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770881264, "uuid": "8ad00a43-d590-4ce1-9c5d-73d1310b5a81", "value": 4059136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770881264, "uuid": "a313728d-7db6-4cd7-9356-972cf9d7d76b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881264, "uuid": "aea848e2-96e3-4458-a6d4-977f73a2737d", "value": "19dea8a9bc5a90e7ef44be2dd6b40aed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b9a932-0841-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770921488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921488, "uuid": "3ca0be97-5c79-455e-8c80-745efb298868", "comment": "Malware payload (Mirai)", "value": "d752caccdf872826c932fbacd26863bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921488, "uuid": "2fe95483-1a20-48ff-b61a-c165564349a8", "comment": "Malware payload (Mirai)", "value": "cb084158a484ace4a6d2e484aeb4a1019d1a5f1ff59c5a8a6a5aa31063ff5137", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921488, "uuid": "9d044e8b-2472-418e-ac02-4e7d58d074cf", "comment": "Malware payload (Mirai)", "value": "ef67665da22ed6e5f76f2a19dad63f1000afcb30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921488, "uuid": "332f43e7-46de-43e2-a8ef-9f0eee926c2f", "comment": "Malware payload (Mirai)", "value": "b2f8e9a2fa638b61a4976224758dab7e185771cb40a4aaefc8a1027e70cf1fc44ac5ffeefbd8e2ebde00223809c0c5df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921488, "uuid": "3ffefc59-0b84-4ec3-a447-b6b1d7d28d8f", "value": "T1AA93A64E6E53DFBCF32C86344FB38B3A6695239533A0C585E26CDA415D6024E186FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921488, "uuid": "81e73e6b-ecb1-4c83-a52a-62c6d8a923e7", "value": "1536:0XXFOkKidiidL4dCYzQN152Svixd3SiBGS+:0FO3zvNv3VN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770921488, "uuid": "7bc7b2ef-75b0-4940-9f0b-797c66f9d969", "value": 88940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770921488, "uuid": "f7e1b63c-6c09-4da0-a623-b21c07b9288f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921488, "uuid": "b8d75617-f405-4d96-8eb1-c9584ff99164", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921f669a-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877935, "uuid": "72411a5a-c558-46c3-996d-64b856a963a8", "comment": "Malware payload (Mirai)", "value": "14ab10d71e844bd4fa3243f1dd78abcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877935, "uuid": "3934afcf-7a21-45db-8f53-52cec39a65fc", "comment": "Malware payload (Mirai)", "value": "cc3e589e7cd0946c7dec6745a913908b92883c1633648fa98439b34b5e28cce2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877935, "uuid": "8988f9dd-9d32-4a1a-a054-cb54f2116eb0", "comment": "Malware payload (Mirai)", "value": "6c5dc4627f4df9496144b0b774431a9b6b83bc4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877935, "uuid": "c1b3b94d-d583-4b23-8875-d3ac0fc9f551", "comment": "Malware payload (Mirai)", "value": "0d76f627cb432892465bd5bba12408f6053ddc4d544e34d64f33f4db6b78c8bc3bd8e4c4833551ebac06abe9e97c5c64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877935, "uuid": "7df8e266-932c-4c72-93fc-76ce15a1d68a", "value": "T18C83398278819A27C6C11B77EA9F014D3720A798E7DB33439D186FF43F8694E0D2B659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877935, "uuid": "68b1d8ec-0f38-40a9-b7c3-caf58201e235", "value": "1536:cTKXFvhc0I/+aJ/r3Ra0DD1hBeZWE+lTfvgvTM3Etd9gmEZTO0q:cTK1vhc02zk0n1Dwd+lzIvTM3EtYmSTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877935, "uuid": "0b899ba4-d2e4-4350-9c1f-cfc3a455689c", "value": 87455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877935, "uuid": "2323b21a-29d3-4c20-ada1-caad01dc3fed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877935, "uuid": "f5ce0491-8661-492b-aea3-528454ce2129", "value": "xd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9093551-07a9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770856096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770856096, "uuid": "89a6bf72-62f5-46bd-b5cb-64e5262e3903", "comment": "Malware payload (Mirai)", "value": "5526552b4e83e322570981007bc92986", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770856096, "uuid": "dc4f9b85-60ec-4996-8479-f2d34bcd2aef", "comment": "Malware payload (Mirai)", "value": "cdd9e53178192697debf3ebad0fcc3953436cf998ed25b08a40f83a2684182c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770856096, "uuid": "c962f7d4-9e86-4aee-a466-b3d363baf908", "comment": "Malware payload (Mirai)", "value": "8e7e83dadd4ce3c1dec4bc185b145241cdb9f630", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770856096, "uuid": "4ffecdc3-d815-4360-8ede-665e3b7eb287", "comment": "Malware payload (Mirai)", "value": "19668d47e6456ef222c30cc8693e7edbfa769a738a261e8ccf82988851a19f5c0f2ade77ac7e9faa953e80dc7a0a782f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770856096, "uuid": "3af5f7f2-122a-4708-9b50-e322e3338eed", "value": "T14CB30899BC819B11D5D536BAFF0E518933138B78E3FA7113CE185F2A538A86B0B3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770856096, "uuid": "00ac515e-37a9-4a5c-9ee3-e18977945df4", "value": "3072:c9W/CIC7nu3PEuofs48AsS1yv+eRq87aVXc3phW3akIeup74X:Our6hsS1yvR17aVXc3nW3akTup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770856096, "uuid": "6c65b8ab-3387-44b7-a5a5-a186df46dbd6", "value": 116256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770856096, "uuid": "ee2b485e-3841-44a2-aca2-da7f9c328fbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770856096, "uuid": "fac5aa78-3bd8-4161-9826-09f255921e07", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b88486-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877806, "uuid": "87505ebf-9516-4a39-a2c9-cdc93e2fe8ac", "comment": "Malware payload (Mirai)", "value": "a74f95ad4d8fbf43cf10f44fec6284e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877806, "uuid": "09ca15c5-da6f-4379-b640-e5a520cc3a16", "comment": "Malware payload (Mirai)", "value": "cf32a3e93123f3050c364325f0e06a279c6de2cc80e61b56c6cb916e23cbcf03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877806, "uuid": "7e4e5778-dc86-41bb-aa9f-e3db866b85c0", "comment": "Malware payload (Mirai)", "value": "18ddaa583f1c5d6b230819e51a1d0038238af498", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877806, "uuid": "1d5d6f78-9233-43ad-a2ff-be5adafa98d6", "comment": "Malware payload (Mirai)", "value": "4567a5a89e58ddd0218d128ac52a985e2eac6d416e9bdd09a71871f01879e91db81970cdaa4ab22b5b3c5453b0643af3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877806, "uuid": "b2142782-b0d1-4ae2-9d6e-3a90a3fd6d72", "value": "T1EE44E909AF210FFBE8AFDE3706EA0B55148CA90722A53B357574ED58B60B18F09D3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877806, "uuid": "165f90aa-7ae0-4f29-890e-d37f727d87fd", "value": "6144:pOnmhA01LUTxiKRqM1SM8loXNzSiV3bQ8P2vJ0:kTcKKlwzSiV3bQ8P2vJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877806, "uuid": "5bbc95ca-8144-4e0e-aee0-0c73415ceb4f", "value": 259014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877806, "uuid": "6261696b-d40e-47b4-8f20-f9e3a58060b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877806, "uuid": "d8976f26-85d0-4830-b767-656cbfcc1557", "value": "furry.mpslxc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be769988-080a-11f1-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1770897766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897766, "uuid": "aa1aba9c-2c38-405b-859e-65f8eab1bae7", "comment": "Malware payload (Amadey)", "value": "3383520dcbc8e598f1cd1bfe225393d0", "object_relation": "md5", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897766, "uuid": "fc2e84f1-bf58-40a4-aac0-914c58fa82b2", "comment": "Malware payload (Amadey)", "value": "d050752e8481a1d63506f7b0522172425823905e44b3a5bedcfd143732b06a39", "object_relation": "sha256", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897766, "uuid": "e73b9b90-a79f-443a-ad00-d285f6d9322c", "comment": "Malware payload (Amadey)", "value": "0e2b12ff6efc7ac2cd3bb60892afa1c3817d89c6", "object_relation": "sha1", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897766, "uuid": "d16a3006-5f6e-43db-8cd0-f0cf4ad03b3d", "comment": "Malware payload (Amadey)", "value": "af02835c335da9903da54deb4795f7aa128d28b76a00161728dbd1e9445553179e61cce555021eb8662e91a33aab5ba2", "object_relation": "sha3-384", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897766, "uuid": "2c7f142f-6161-46a9-a022-d6c467f0054f", "value": "T124357E06FA52D0B1D8D420B112B6BBF2597C6539A72445DBABC01FB69D201F33E36B2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897766, "uuid": "8e1a89e6-0dc2-4110-ae5b-ee2b72257016", "value": "aca6f08ee5befa37be16bac4bc315573", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897766, "uuid": "dd7df5ef-0d89-4039-b87b-7ad096e2e336", "value": "24576:pf5xDRatdGrWrz4x8/cvmGwDM1H2BPdEnunN1ljhzgPnvzJnRVIZU:pf5xVaU24WGmhkXzFUZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770897766, "uuid": "ba864172-9279-4d0e-af1e-f3cc6793409b", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770897766, "uuid": "0c6aa91d-005c-44b6-b7e9-4f62d219ef87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897766, "uuid": "b1bb71e0-3eeb-45eb-a410-71a7a8bafd1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cd4a8a-0856-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770930445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770930445, "uuid": "ee474bfc-89e3-41b1-8d8c-8fa7d4693a78", "comment": "Malware payload", "value": "d1d7f6e72ad58a49b7bd42bd6aa488b4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770930445, "uuid": "fbf15166-f766-4517-be35-e741bf0ad893", "comment": "Malware payload", "value": "d098b6772c0c4818a8982055967b2f8bcc77dbdf82c9d335caa0629ce41baaf0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770930445, "uuid": "4440bcfc-ac1b-4a7e-8e06-9b99f429f9e7", "comment": "Malware payload", "value": "8f6763954307b56ea01bd552c9bf5878e40024ea", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770930445, "uuid": "c32484ce-c897-441f-b3f4-27c4d9c57dad", "comment": "Malware payload", "value": "611dbdb9f071d0a2685e05a11414ebc585924994c28cb0831eab6c9bb8772e1818cca314385d09b41d0466194a851462", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770930445, "uuid": "d97cd3f9-00e6-4394-a0e3-e77e74a863a5", "value": "T189E0E71620112669F6F5F8C0D4170FC098678544C18F08334C4C280FB5317171A9CC0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770930445, "uuid": "2043c128-715d-4d19-b5aa-bb93cf3b6852", "value": "6:s81R3Ku1eGgdEYlfSjhuMKQLh8JJwKegy5yWCjHzqMT1MFCyW3:s81k5u+fStuMKiG3wqy55CjHzqMT1M4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770930445, "uuid": "9887ebd4-fedc-4f5b-a193-20ee7b1679d3", "value": 312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770930445, "uuid": "450e9841-4d46-4675-89bd-58eafeba0ee1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770930445, "uuid": "22af9e44-fbcf-4b41-a6ee-8494030efae8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca0139e-0842-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770921573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921573, "uuid": "3d754a8f-5302-4f62-9e34-26730b7ffdcb", "comment": "Malware payload (Mirai)", "value": "073115aaecf827ef8ff9f9e8c98be6c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921573, "uuid": "2ce01249-711e-4ac3-8bb7-cec9a0c5eab9", "comment": "Malware payload (Mirai)", "value": "d0a8ba4ff97f6604e620f7ef8abee62e0b64fbbfb5b874a04e7f952cb955ddd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921573, "uuid": "ea9f9af5-4aca-4611-8ef9-cd052ae8b4da", "comment": "Malware payload (Mirai)", "value": "1ee48264c7d01fe324f8aca031df0cc23e987682", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921573, "uuid": "aaed394f-dab0-4639-bb40-88495d6d48c8", "comment": "Malware payload (Mirai)", "value": "23c5df53f4345d25d7be2a6a899c6fc812dfebde35bb38be4e8e6b990390caa852bbf8963715a2ecbd10fdf0989f70fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921573, "uuid": "34506f8c-641a-4e53-843d-3bae22180cc1", "value": "T113C2D04E723CC393D211613B2D6ABECA4434CB6C9554A1656EE8306F9EC67C93E44B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921573, "uuid": "b0343d4e-8144-4b03-8eb8-bb24e064205d", "value": "768:D6y4BMMt4dpiG3oMsiG8WB9c/RjQ82bXv5nbcuyD7UQ74:DIiy6/9siG9e/RjQTXv5nouy8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770921573, "uuid": "ba834e4b-8f4d-495e-9639-5cd512b3a7ec", "value": 27956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770921573, "uuid": "f5b2e499-e37f-4ef0-a8b4-b23aa640af8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921573, "uuid": "8c8ba27a-e9bb-49ad-8c41-3bfb033517f1", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de115415-084e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927025, "uuid": "cc969240-510c-456c-ad8a-17900a53277f", "comment": "Malware payload (Mirai)", "value": "bdcc5ca02aee72b4b3c3c63484b8e82f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927025, "uuid": "5e1ff996-cab9-4795-9553-941218fbe87b", "comment": "Malware payload (Mirai)", "value": "d15545ec26bdb6db565a6ca777af2fad28115164654a8a547ec8f57f7c502d48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927025, "uuid": "c89434ea-588c-4515-866b-8b20fbbcbe11", "comment": "Malware payload (Mirai)", "value": "11e65d4e4046d8f995016b74391bc9f7c1bfa8ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927025, "uuid": "edcdb179-fe8e-4d8c-8172-7d18fc79add4", "comment": "Malware payload (Mirai)", "value": "d578cdf8ead82e69e0c9047e9119a8e40832992edeb906f55afe428ee111893923d89d768052de36d8ff9739b008709b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927025, "uuid": "8015717c-f14e-473c-a77f-5a2a615f4083", "value": "T18FF2F162134E7D25F23A29F6ED7686097F8ABA74A1F071E20411017D42B118475A7FFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927025, "uuid": "d550395f-d634-4616-aab2-5ab79a0a8e73", "value": "768:jpGiYilUYrQEQEimVULFiAQ25c3bjzlWc//Jgq9s3Uozn:VvYuVrQR+O5iGkLJ/eqAzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927025, "uuid": "0004f70b-a2ff-4f6e-8440-2d9d2088182c", "value": 34580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927025, "uuid": "c55c14f3-9e19-4a4f-98cb-e07ec6df4cc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927025, "uuid": "71ad8486-ba89-455f-b1a4-f259d1513a71", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d3ed50-0849-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770924565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770924565, "uuid": "a999e7f5-5e71-4ebf-aba2-9487e53691f3", "comment": "Malware payload (Mirai)", "value": "411e46fed7976f963a7322cf8c722fd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770924565, "uuid": "d07f6a2e-a1aa-4f51-9b60-2be51a9c4f0a", "comment": "Malware payload (Mirai)", "value": "d163b9e7fcaed2fea074d65ca36c5f8b0ec9b0d95e4f75383565f893d9887872", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770924565, "uuid": "0980db8c-6651-4541-ba72-8bc5be84d0b1", "comment": "Malware payload (Mirai)", "value": "732b72952a194fec45589b224a62dec4d91c27e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770924565, "uuid": "54b8ad9a-529d-4a83-89a1-f37a47111cfe", "comment": "Malware payload (Mirai)", "value": "0e156cce645028773a4e380f42f8bf9698a855d4578c1bfe7a8be1c1838efe2474d792525872bf74bd55ce9129a16690", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770924565, "uuid": "a020fdb3-ecd5-4516-846d-dd55b70bb916", "value": "T1FCA3C616BF350FF7E8ABCC3719A51705198C650A22F97B35BA34D818F64B25F1AE3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770924565, "uuid": "b2956285-78b6-41a2-8a7e-863c4e47370d", "value": "1536:/Oc6cuXB3LvkDrNQyWWYRyvx46Vipa5Ya6gC8Z/3jala:/Oc6cuXB3LvurbWDRcxFguC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770924565, "uuid": "ee8924ee-a5f7-4501-81b3-4c31d5a6fe26", "value": 105164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770924565, "uuid": "591f8d1f-7796-498f-b1d9-3ef19dec090a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770924565, "uuid": "2341952c-be0e-4b08-915d-eb6f237c7ba0", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edec2b8e-07aa-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1770856614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770856614, "uuid": "fd44c8b1-2d26-4431-8ee0-84a4936c4811", "comment": "Malware payload (DonutLoader)", "value": "357fc94a8fb39dd1a60d3c41538d8e4b", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770856614, "uuid": "d8a21b06-6f65-4019-8115-5ccaac1fb875", "comment": "Malware payload (DonutLoader)", "value": "d1898d06f9c6252d23347c98870452537afb959a52641781146e4b4268dc082c", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770856614, "uuid": "518d7de8-0e7e-42e6-b987-907967535b3c", "comment": "Malware payload (DonutLoader)", "value": "3a335668c4c0e3142b33438cdf0c52274928b6bd", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770856614, "uuid": "43195fdc-ebc8-410e-b41b-52655056e61a", "comment": "Malware payload (DonutLoader)", "value": "ec259dbcf10a2a4be94b0a8a2f81bcd520966f6291d7af51084cba34d01a43b3ed20a5b087f0bfc02f8628eddaf0adc0", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770856614, "uuid": "9c68c6b6-4381-49c2-850e-8aed6843bdc7", "value": "T1A908334AC0CFEA1AE19E6BBFA6177F4C4A5F3F02152F98161530765E86BA4E003F541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770856614, "uuid": "7614f1a9-3419-4d2c-b32a-f50992640b72", "value": "1572864:uxYSv7kPTtzFifXF9lGUvh2dIJliI4ZUVU6XWBrFOSIg/iFkYpIn:uxYmkPTtxijvAkowWfDPNEIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770856614, "uuid": "a982fe2c-fa64-43cc-aba6-e36ef60cbd2d", "value": 78950248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770856614, "uuid": "8dc6222c-2bb0-4ffd-a0e9-1e7f58c5c582", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770856614, "uuid": "644702cf-d654-4bbf-baca-5544faef3d60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff6052f-07f3-11f1-a129-42010a9c0007", "comment": "Malware payload (NirCmd)", "timestamp": 1770887970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887970, "uuid": "42682e2b-e283-486e-ac45-58915708dccc", "comment": "Malware payload (NirCmd)", "value": "0f46c059956591049fac0dac35ac645a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887970, "uuid": "61c39515-a7b8-4bf0-8b96-f28f92fddc9e", "comment": "Malware payload (NirCmd)", "value": "d1e5f2bccc58ec222e631a206be22181d3da96a7b6567bb5e0c63ee0ae46073d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887970, "uuid": "5364ebf9-7c64-404e-ba86-6d2ad88ac132", "comment": "Malware payload (NirCmd)", "value": "f872ee8f5880485bad5d36da16c89af027fdfe30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887970, "uuid": "df61579b-e110-4a13-b590-c37f8a37c2a4", "comment": "Malware payload (NirCmd)", "value": "a52aad67b7a82ef9f7f09e8a66e14c6426b0044a344a4541d79e52ffdbcceb1d8fb2382531c2f6ffafd5e0c3ada7fa39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887970, "uuid": "dd4f8223-45a4-44e1-be93-012e2d0db226", "value": "T132A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887970, "uuid": "2f24323c-8898-4716-890f-d2ebef0d23b2", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887970, "uuid": "2a22ba67-ecb8-4e86-914b-378952f91612", "value": "49152:ABRPTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:alTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770887970, "uuid": "ceb9e758-af5d-481b-8816-249c71c0c9e5", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770887970, "uuid": "ef4a6177-1093-4d1b-beaf-d097fb450e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887970, "uuid": "07fd8c3a-dcea-4b29-a411-6f218dda501e", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84cbb7cb-0835-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770916137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916137, "uuid": "2daaeef4-35fc-4f20-8da2-d5fad144ed36", "comment": "Malware payload (AsyncRAT)", "value": "6d830689ecbd448bcee2d08c10938881", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916137, "uuid": "63df4fd5-e4d6-4057-a3b9-4514b561bea5", "comment": "Malware payload (AsyncRAT)", "value": "d21eb208f309c264e466594856a305d7a3b27a7cab7a9c5dd4dfdcbfdf442d31", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916137, "uuid": "8dcdbbba-db56-4b25-b1cb-2eb33dcc1d84", "comment": "Malware payload (AsyncRAT)", "value": "9c35ffc9a674c7232cbc5df938205c556c474535", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916137, "uuid": "dfebcbaf-2d91-47db-95b4-40bf6156c104", "comment": "Malware payload (AsyncRAT)", "value": "3a454a8455fa96a2904d98b8d70f08d3a16c7d6dad806fc4b1810ff12e34da3f0f84859e137f4bc71a26e6474e5489a8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916137, "uuid": "16328535-46ad-40b3-add0-53e353090cd5", "value": "T197838E1877E1052AF5FFAFB05DF26252C739F6136803E20F68D8499A2637A48CE416F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916137, "uuid": "5f372cf7-4a46-480a-8183-2f40a952d822", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916137, "uuid": "10e32916-7350-457e-90a0-e906a182833e", "value": "1536:WuQSPuIYVxcOOeGWRjANfbVmQXxHPWy6RkOZIOUNQ5VW3nMy:WuQSPuDVKze3Rj6fbXXRW2rOMYEMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770916137, "uuid": "0edae1af-cf23-456d-b379-dc22b6a67159", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770916137, "uuid": "143dc07d-fa46-4b10-a486-a7ebec91d7ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916137, "uuid": "d6be026c-fc07-4464-a0e3-f5f705e9f625", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edd1e7a-07ae-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770858199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858199, "uuid": "b6daf8f9-2316-428d-978b-9c9e5a52c701", "comment": "Malware payload (Mirai)", "value": "b4e6520f67f163ff0dc736a6d7ba6aee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858199, "uuid": "4d08fcf9-3f56-48ff-96d7-9036c37acb6a", "comment": "Malware payload (Mirai)", "value": "d23dfe7dfc1bced04359894de4c27d409f490707f9ddf95e794cdaa3f5f56959", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858199, "uuid": "1c81d53f-acf6-4439-8145-25861cfe2254", "comment": "Malware payload (Mirai)", "value": "a6076da9d12580a899eb9e9b6350b8dce4fa6bbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858199, "uuid": "6261a236-4f00-44d2-9eb3-0e6f0b4b9e22", "comment": "Malware payload (Mirai)", "value": "0ec6e8bac541bc924314803ab00795968bb418265523303b34644faa1c48c36d17bedbcb3d17edd4935b7a32d06e9f49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858199, "uuid": "715dd26f-816f-4d70-ab46-c4f542c87b0c", "value": "T11BB3F60AABA00FFBECEFDC7745E92B0224DD592625A92F757130D818F14E24F1AD3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858199, "uuid": "01e05732-9531-4481-8a6d-e4fd620ca17c", "value": "1536:O+2/L37bCiWX+eyQXKY9QdVEkqka1UJZS8W6rB9N8GjRZQ0zW1Ni8r:wL37L9e4dKksi8GjR2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770858199, "uuid": "57939aa4-c582-4cda-b503-3c310be3fa81", "value": 109980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770858199, "uuid": "5fdcd50d-65ba-48c3-be49-6a9de0ec2b6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858199, "uuid": "44a6c01b-3dfa-4372-a8f1-b3cc740fc2f0", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50742b5-07e3-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770881053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881053, "uuid": "1f441ad4-3559-4e1f-b155-d069e17fbaa5", "comment": "Malware payload (PureLogsStealer)", "value": "5ebf05cf7c9fce8ad8a6c0d427e6ce4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881053, "uuid": "6d14fa27-da63-4568-ba77-45bb8aff5edf", "comment": "Malware payload (PureLogsStealer)", "value": "d347785d6e3a58d9a7480468f0af29ddf87f2375bef002f0d2aca1af5c0026a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881053, "uuid": "837b178d-e968-4a1e-a267-4db7fa4b6f90", "comment": "Malware payload (PureLogsStealer)", "value": "e95ac6cb5b102af71c1f4a1452218df182e548b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881053, "uuid": "b666c48d-aab0-4829-b0dc-2be1a48f2280", "comment": "Malware payload (PureLogsStealer)", "value": "60c0ff4b71c703fe1b3ce8ebde5c5c218b1b495069618221a4226508a376bbc1f101fbc97907d553d278e8239cc80041", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881053, "uuid": "1619bf4b-0078-406b-a4d7-9d74ef137f64", "value": "T1FDD4AE1BB245CE21D148763BD0C7450093F19592B66BFF1EBAC913560A4B3BEDE0A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881053, "uuid": "9c92a66c-c426-482c-b394-af0dce1129f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881053, "uuid": "f9af6697-5dce-4b01-ac59-9a7b16d045e9", "value": "12288:drJFRQpXsL8liC2VYkjBdoJ/V6Nq8GOBvd5Q2P2Kr/fdQD9k:QaOmVBQmj/r/fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770881053, "uuid": "b46558fc-ef79-4ca4-9711-5fdf1a2d5213", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770881053, "uuid": "2d28405a-c435-47d0-b7f5-e05583277671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881053, "uuid": "b96d42d8-4a68-4014-8b74-57f1fd7800a5", "value": "5ebf05cf7c9fce8ad8a6c0d427e6ce4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddb80f8-083e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770919830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919830, "uuid": "3b8fe18e-4812-4506-8112-6d727e850263", "comment": "Malware payload (Mirai)", "value": "ea500310cb56b40e9eca10f5109ba449", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919830, "uuid": "559240cc-e55d-4cda-a9f5-abd3384ace6b", "comment": "Malware payload (Mirai)", "value": "d370deb479b7324af1d3386e52b1a54186a6fa7343bb0865230a703f07b78500", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919830, "uuid": "be67069f-5694-4555-ba6a-4f248d572763", "comment": "Malware payload (Mirai)", "value": "c73c088efd27b61446ba8d595c086c34e46397b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770919830, "uuid": "82a9069d-6de6-4fbf-a992-ba130f42722e", "comment": "Malware payload (Mirai)", "value": "0399ef5ae7a33873f804489f91fb7e1853270dbf8e088519809b5102809e1ffac4110d668d3465225d7bcac4840f6581", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919830, "uuid": "161e8163-89fe-498a-abbe-461c2391cac4", "value": "T1EE332B027228494FF9D61EF0393F0FE093AFE98024E0B585694EEB458276F771586F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919830, "uuid": "8ae5e379-320a-4375-aefa-0ed341d4e94d", "value": "768:opgPdUwOe1Po/7wni3RiAPSnPfDPK32JjcRlgaizjrvVwipnpBX9Qeu3:D1FOe1Po/kcExm9Mai6wvXeP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770919830, "uuid": "6f40f0a0-eedd-4f81-b0c6-a27b0088568e", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770919830, "uuid": "e29468ef-4ec7-4624-89b4-b96558c2c053", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770919830, "uuid": "d65c8f16-d807-4f1d-99c0-f32fd3a21c78", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ceafcb-082f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770913589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913589, "uuid": "53e642f5-25db-439d-a8be-792b619ef059", "comment": "Malware payload", "value": "60a6a1047255e0ee35e18a9eb80cc37c", "object_relation": "md5", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913589, "uuid": "1bb6b38e-fe5d-48e5-a431-0cc75e3030f2", "comment": "Malware payload", "value": "d447f6c43b9519c77aa72ddcaab3ccb85a5f0e7babd847b1f8288a1140d7c08e", "object_relation": "sha256", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913589, "uuid": "1970b664-3786-45c6-947d-77ee7fa2ebc3", "comment": "Malware payload", "value": "915780532c72cd4c110f8724bb9fe79379453a2f", "object_relation": "sha1", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913589, "uuid": "92d06b53-084a-4764-a587-8732dcbe4b07", "comment": "Malware payload", "value": "0af4bef97bb329a92fbdc524e52bf68f5eb6cc462aa1091801ead175ae34a7c1a62f2d6afeb84729ddd8747cc065b44c", "object_relation": "sha3-384", "Tag": [ { "name": "crashfix", "colour": "#7A45B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913589, "uuid": "183b4a43-8a24-4e75-afb1-3a5e94d459c3", "value": "T1F5F633ABE5FFB0A260776071521D36581BFB29DDF93E2C3D51082A11122F09E19EDEE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913589, "uuid": "1f57645b-834a-4424-9b54-9cb74d293f6f", "value": "393216:3qwKQhfBpJMpSKKqmv8UdqKSy+lxTq0MXzkK7+d:3qw/fupSjvZqKSychqtkKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770913589, "uuid": "9dfabd7c-6bad-490b-a2bd-5058ef4c7357", "value": 16279696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770913589, "uuid": "a99a1c84-f069-4b28-8d52-f88b58fc109e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913589, "uuid": "75180a26-e392-4b7a-bf50-2be5c3ffc692", "value": "c46af9ae6ab0e7567573dbc950a8ffbe30ea848fac90cd15860045fe7640199c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1df4746-081a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770904724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904724, "uuid": "6463d7e0-03ae-4cfa-857d-2e68fcc1df3b", "comment": "Malware payload", "value": "6b3cee28554f2c1a68b3c0188b563931", "object_relation": "md5", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904724, "uuid": "dea28934-2eea-4b78-ab21-4ba0aafcf4b7", "comment": "Malware payload", "value": "d62975d9c56bfcf182d2341c7cf01ea07503b3a00d2d89bc77274d779973de9c", "object_relation": "sha256", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904724, "uuid": "2f6c5ab3-b64c-44e2-bc78-9c2dc152f88f", "comment": "Malware payload", "value": "daa8785fb7e60a52e41ba17aee4d3c8949ab5e02", "object_relation": "sha1", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770904724, "uuid": "ec722c36-4fb2-4286-9b77-e7789464505f", "comment": "Malware payload", "value": "c354d1165b0542f5eb4d04f97a484b5e301cba681faf356b9b7943d08026700cee5d075c9eb4df222e20ff1d826cbc24", "object_relation": "sha3-384", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904724, "uuid": "35579df2-22a4-4f2a-86ab-c881262aeb73", "value": "T1EC083322B15B59A8DA1F233FE0A8EF8845347CA1B31799BBB37C7F6546B158311B1903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904724, "uuid": "b3a32e80-985e-49ca-a0af-ef7ee5ece002", "value": "1572864:gXouVnBos95DgRC/eFckvh04JvSb58t3JrqM4LY1bO7SpE63/x9P:XuD95UCGSX49SU3JSM167SvJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770904724, "uuid": "6dbf52c6-a120-45ef-80dc-d4deb1de3c65", "value": 84614144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770904724, "uuid": "7f2b4f04-4d53-4e41-97c8-2d390bee5b4a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770904724, "uuid": "6b64203a-a39f-41d1-9eaa-f1c31bbbd787", "value": "99999.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f08729b-0842-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770921631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921631, "uuid": "e0168a36-e136-4dce-8604-b09d0d0fa2a3", "comment": "Malware payload (Mirai)", "value": "43ad5aab55c726384e904b6743038d85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921631, "uuid": "9a6a4e61-2ddd-47c4-af5e-a2e44b6db220", "comment": "Malware payload (Mirai)", "value": "d63e083dc57a23a79a551f272a5d6cac761759841a4600d25d7e9bb30bc4687b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921631, "uuid": "30c63be3-bd14-4398-bf0a-c806e985e30d", "comment": "Malware payload (Mirai)", "value": "b42e68358a5aae585ac8c6037adff2b2e0ee3c5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921631, "uuid": "2f7a4191-bc11-4d79-a046-f0b87c89e7d6", "comment": "Malware payload (Mirai)", "value": "616afab0606c0f2abc5ff0d4d67116695b9eef466027c5438e5a1e97112ee86674dfe36320b0e56469086885c3df0ee9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921631, "uuid": "cd68f856-2b12-4c37-892e-29a33b1fa614", "value": "T118634AC4A593E8F4DD1507B43177EB334A77F536211AEAC7D3B8A923BC82A41940B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921631, "uuid": "db4d7a49-e3ed-4ccf-a271-23b7701dc03b", "value": "1536:m4uQwyBcqv117K/Mn9O/kbfvxk2N5rFfEftaNGgh1abVcPrT8y5R73QC:mBRk13jbfvxk2N5rFfE1aNG+ahC8yLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770921631, "uuid": "5d5658f5-fceb-4ce2-a856-f07dd4f9dd54", "value": 70704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770921631, "uuid": "2bb76fbe-45af-447a-aa34-32a31984d696", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921631, "uuid": "0532ecb4-80d0-4e52-9151-b7814bf65ffe", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f190745a-07b2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770860056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770860056, "uuid": "60981a2d-972e-4471-89cd-016fdcbc2e76", "comment": "Malware payload (Mirai)", "value": "aeba465111d4d02ea141e7a90bed21c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770860056, "uuid": "7985dd74-a26b-4af4-9c71-579a9984d90b", "comment": "Malware payload (Mirai)", "value": "d70d9f3c8cfdaa59728178f0b44b9664a956421ecaa4d17a5cb94d1e1118cd4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770860056, "uuid": "5bed34d7-c24e-4d17-87f9-661971be117e", "comment": "Malware payload (Mirai)", "value": "fffc6294b15df7816ec932b9e2209759ba8dbcd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770860056, "uuid": "dc4381c4-b9b6-4b3c-a4bb-7223b22c2bf7", "comment": "Malware payload (Mirai)", "value": "73601f67f0d26fdbd4ebfb8f5b4f3841371dfd49a4371f272ba112e2f4e9407ef1c4f61c45e11296f8404cf7b59fef51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770860056, "uuid": "0ee342b2-8932-4e48-a040-eabf8d42863d", "value": "T15A833A47B58484FCC1C9E17807BFB236D962F43D123A729B63C4AF1A2D19E602F2D55A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770860056, "uuid": "6abe540c-b7b5-4297-88e4-278c82c40842", "value": "1536:KHxbPPvlWwSLLG0i2L9s4oA3/Su2UOLt8RuCw/dHZ0UXbUb5X/W:KRb3vlWwSL60BeQfdORSi/dHXbUbR/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770860056, "uuid": "d081962d-7112-40a2-b420-b8e80d81106a", "value": 83776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770860056, "uuid": "94579b60-3d3d-4435-850a-a2d0e60560fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770860056, "uuid": "200ccc65-d92d-4d97-ba01-d1dcf14e3060", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e54330-0834-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770915839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770915839, "uuid": "d7f31a91-7a8d-47ba-9425-afc794682be7", "comment": "Malware payload", "value": "fddfce6aaa266f0268fed0c93d3512dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770915839, "uuid": "75730e70-bb2b-419a-bf6e-9f0f1e4258bb", "comment": "Malware payload", "value": "d9b9f5437f146234f6416f90452dc5e5846433d511ff2b84a7df913c9fb57ab5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770915839, "uuid": "c2123bd2-48d6-490c-aad2-3c6b61ce694a", "comment": "Malware payload", "value": "554ea711fdc5e58c1dbd095ebf908fb8770253d6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770915839, "uuid": "849e3495-997e-44b5-b2b3-c39616123796", "comment": "Malware payload", "value": "8ec0ab788b524d7a6ca52af03bcfe3f9cc4fcd3d9102ad64c58fb93be42f059e69f1d3cc670e66a20d6259fe09fd9929", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770915839, "uuid": "60427867-f7bb-404f-a24f-082c022ab411", "value": "T1E8967D07FAA244BCC599C574875FE273EB35B45942217A2B2BC49B313E26F205F1E722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770915839, "uuid": "ba132838-8928-4c9d-8914-d82ca4e42212", "value": "98304:DjAd4YJPLxBpF/Kt5DpZAr9uJAzikyYwFMbMmlAga+agVVk9n2he7uEv8eZiApZP:d5wAr9bucCL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770915839, "uuid": "10d830b9-3452-4011-b962-326d98371beb", "value": 8730496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770915839, "uuid": "e557ec1f-204e-4da5-a163-4daed61290d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770915839, "uuid": "93ed7f73-41d9-4a87-9765-a3a08792b648", "value": "p2pinfect_v2_unpacked.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5e57b1-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877821, "uuid": "21e28121-fbea-42bb-9819-dbeb997aeffe", "comment": "Malware payload (Mirai)", "value": "a2913a2ccbe45c273287dd285c0e54e1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877821, "uuid": "2a71e99e-ab60-4bbb-80c9-71b938796525", "comment": "Malware payload (Mirai)", "value": "dc0b0ba344048bac47a4928efc1b87046f12c85656224096b637b8a6e9d59c31", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877821, "uuid": "65927cf4-c418-4776-a6e0-5e505de9fb6c", "comment": "Malware payload (Mirai)", "value": "6e45d08f1fdcc49a95fdc2218c07e421c644fc86", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877821, "uuid": "68704017-ff13-4695-915d-44d77f0374b8", "comment": "Malware payload (Mirai)", "value": "cde97f86322d8fec416fafaf7c2491c51dca494b88954a61e7032671bcaf9192d5f9ca8a50e7af8513ba99bea915dd84", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877821, "uuid": "639c6107-5ed4-472e-aee1-fdc991b9ef86", "value": "T1DA31D68E70B49B69C5CCEF01B0E58AC87717F590F2B5C632FD421E6AA0D9D543819A3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877821, "uuid": "167b5154-2e1a-4275-91fb-b50183bff456", "value": "48:A/C/m/I/2/R/3i/Q/w1H/R/gT/N/HS/E/O/A/2/l/6/M/So7Q/L/Pi/6/i/d/u/o:GMQOg13sWw1f1gbx86YGgJkCSnTUksBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877821, "uuid": "e9a755b0-8eec-4183-b27c-567cf9104ba2", "value": 1845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877821, "uuid": "b24cc634-3272-45e4-baf9-4fe25cad3e16", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877821, "uuid": "5cb5a202-4b5f-4334-9e19-18aa4c2ec542", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffec4ae-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877931, "uuid": "9661fbff-cf52-4e69-a642-544d9cfb374f", "comment": "Malware payload (Mirai)", "value": "bd833fe5ca04bc0465238d99428cd602", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877931, "uuid": "f6cb4db8-a996-4e23-bec7-430ac93625d8", "comment": "Malware payload (Mirai)", "value": "dc33e329e9e66dc4271611d11644749f6b5e6d6b091dc38d1bcfff7650287eb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877931, "uuid": "d4f9a03e-13cb-463a-ad1c-8c5e9ac89c02", "comment": "Malware payload (Mirai)", "value": "cc51be4bf552f82f53fbc7bcc525cf005e6c26ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877931, "uuid": "194a2440-f53f-4c20-84b7-9318bc75d1ed", "comment": "Malware payload (Mirai)", "value": "0da40e8ce1ec7fe2a048cc7054370d7ded52d797c79e2a05776110d6b1171fd139b9f0a3f44a9aa161fc4edbbc7e82e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877931, "uuid": "9a3886f8-8625-4c5f-b72c-6a981c35969e", "value": "T1E693A64D3E21AFBEFBAC863847F75A209244379666E2C584D19CFE011E70389781FB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877931, "uuid": "2f65625d-f040-4b09-ad26-99670564e1b0", "value": "1536:Mx5RTStNRogGEcmXygs0vtiUEvS+CpsgJx42Oara5Yjncv:QsNRogJC01TE6psgJx42jSYjncv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877931, "uuid": "e9e1f733-0b3e-4baf-b8e7-f1da71bbc580", "value": 97570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877931, "uuid": "fa07ae44-e52b-4df0-bbd5-7e7f61d23fdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877931, "uuid": "54926556-9349-4133-87fb-d0f9009ff5e6", "value": "xd.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c29d8bb-0836-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770916579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916579, "uuid": "a70c7ac5-1cf7-4f36-b695-8aa5d7e8da96", "comment": "Malware payload", "value": "b9d8827ac91dd6b36cdb48260864c35d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916579, "uuid": "89164483-9a19-4b18-baf9-5024fb66c47e", "comment": "Malware payload", "value": "df10095826dc9566db5a64043f915308fbf923297b7c4780dad61f3ec0127102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916579, "uuid": "338c4946-daa0-46af-918a-76130361f662", "comment": "Malware payload", "value": "255eb9e111b938c50170966ddbf0dfc70cf28621", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916579, "uuid": "5b2e3574-f9a9-4c67-9843-9afe21573266", "comment": "Malware payload", "value": "a1d547e3c3b475e7a4265fe206fdabcf527dff2b0c40e34cb11acf6ae232c8935c1c5dec4e5f42184019b070ce7ef71e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916579, "uuid": "a5615925-0124-4605-a86f-04652cc5537d", "value": "T10CE7334BE273D0DCD67BC039F2AD5336B820759A17A8BA5F1A94CB022E85D54AC1DF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916579, "uuid": "d93dcb56-7dbb-4930-baec-9e79f36da3ac", "value": "5d562a8ef2cc56bc3807a657f44c377d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916579, "uuid": "e9f05be7-52d9-4db0-a1cb-ef03e683ddc5", "value": "1572864:2yzYpw5pSz0r77Y0fizSqtAOqek1bXD5uYKw5pkz0r77Y0fihSqtAOqH1bVCsY:2yzmxA7bSSqtwXkRhA7baSqtKVLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770916579, "uuid": "bbb2fc8b-3b14-46aa-a47c-f33a0c0cbe35", "value": 69011628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770916579, "uuid": "faeda2e7-ea2a-4ce5-a9d4-5e97e01e1247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916579, "uuid": "aca391a2-87f5-44c6-9cf6-4f4912baf891", "value": "SukaV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9a8d75-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877796, "uuid": "1b4b05e8-2ce6-4b4b-8f85-f7dadae1bb40", "comment": "Malware payload (Mirai)", "value": "b5365c8f062db9b09a6a156e2899c3bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877796, "uuid": "7cb909b5-0685-46f6-ac17-1872f06f2400", "comment": "Malware payload (Mirai)", "value": "df615a805418129319ddafe0e720642309762546cbc2fac69db279bccd8dc4fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877796, "uuid": "e683a46e-88d1-438c-9e6e-f7e7c0aeb916", "comment": "Malware payload (Mirai)", "value": "8bf04a46fa3464f9280e2848722530ead25007e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877796, "uuid": "a7db9369-f07c-42ce-bdaf-0eb5efaf1be9", "comment": "Malware payload (Mirai)", "value": "4d23e1e8dff09e727d77b9df465a8871c7befd01726d4011542dcdcce08367447261f625f1cf01e6b2abe45e47932014", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877796, "uuid": "d757a86d-ca20-4860-a3c6-7a9d3cbe69a0", "value": "T140B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877796, "uuid": "dc3ef97d-212a-4257-8bd0-84b3a8b37b5c", "value": "1536:4UK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45Zvb:ZixnUHz4Z+5ypkn3E8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877796, "uuid": "92bc1b57-d379-4a85-afa8-61b456893de8", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877796, "uuid": "9dc7bac4-50c5-48f6-b5e8-4fea5ee6bc02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877796, "uuid": "73394ec1-6009-4cea-8e06-a2b92dce5d16", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3b1589-080b-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770898116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898116, "uuid": "933fab0c-ef74-4394-92a0-79668ef93977", "comment": "Malware payload (SalatStealer)", "value": "b30f2825d3f24c70e1f4ff792c860347", "object_relation": "md5", "Tag": [ { "name": "build", "colour": "#E24B4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898116, "uuid": "33138ef2-bef1-48a8-b62d-aa382364fcbc", "comment": "Malware payload (SalatStealer)", "value": "e010108d9c70e2137939d1f75a40b430a6cfd96e08d762884f1c9cee540d8df5", "object_relation": "sha256", "Tag": [ { "name": "build", "colour": "#E24B4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898116, "uuid": "a5127bdc-85cf-4a61-974e-da57d990b33f", "comment": "Malware payload (SalatStealer)", "value": "5fe802a306d9d50fc8b306292ed7ac7ed435cbd1", "object_relation": "sha1", "Tag": [ { "name": "build", "colour": "#E24B4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898116, "uuid": "d2d560df-1b68-41b8-916f-2616919446a6", "comment": "Malware payload (SalatStealer)", "value": "24f714c46fbba71c30c5b3a1a91eb0b265e46cc3cbb49bac2169a70924acf0a0171a64b4a259bddc2ce91267b811227e", "object_relation": "sha3-384", "Tag": [ { "name": "build", "colour": "#E24B4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898116, "uuid": "482f318c-2f01-44c3-8004-5c3171d49ce7", "value": "T15AE53351FFABDC42D400A43C54CF2DE90AA386811457E3EFA474F53AAEB5119EDBA603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898116, "uuid": "13690981-3920-4751-a60d-f42f88d85434", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898116, "uuid": "7d5be7ee-df34-4405-8ea6-19d1a1b12074", "value": "98304:+P7qtxaLFvuLXLCmV6lWSA9X9Xlg6MSm0:c7qtQLg6l2X9XzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770898116, "uuid": "e98d7232-25e9-40ff-83bf-4bc7a9677479", "value": 3296256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770898116, "uuid": "1fd2e119-0d4f-4e92-ac96-b76d3932f849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898116, "uuid": "4fa5ee42-4261-4d2f-9eea-4fe97be5969d", "value": "TelegramFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452fd47f-07e1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770879953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879953, "uuid": "f25ab784-8a55-49cf-978a-a29026e59e7e", "comment": "Malware payload", "value": "b45da07e9900a0be4bf8abdf3034dccb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879953, "uuid": "03d2effb-d0b6-41ab-933f-459a1599ac78", "comment": "Malware payload", "value": "e066eb89a56458a6d636624b3d22453ada325cca99fb3090dcad5f28b740539e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879953, "uuid": "d3b2944e-20b0-4ff8-b2d0-b99d3656bd47", "comment": "Malware payload", "value": "d7fa50e2fde4ae525341a599349c58e5e9357d06", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770879953, "uuid": "17d3b899-374c-4774-a480-e7564066cf11", "comment": "Malware payload", "value": "2fefdbc534c5921d4fb32dfb2205b5ec704eced6e0e141680e34bd463a7ac5027937f8e03568aaa948a6b0d9043cab4b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879953, "uuid": "7f3ea1d3-b2ba-4d65-a740-f8f89b2f4d1b", "value": "T123F0F40C1BB4D270CB7E8D0244BBFE953D519A88016C33703C9F684D8249E7B8867AF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879953, "uuid": "3aaa2595-27b7-4fac-ac9a-1adf33a31702", "value": "12:3xEmgRLPo5ir+CAd5QtNx54tgAIkFCF6bsFm//5cVaoTfHFYypl3gv:3CDPuirrK5A5qIK//5cVldYCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770879953, "uuid": "2ef28de6-b8c0-4096-a19f-ea8d6bb601de", "value": 623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770879953, "uuid": "42664b08-e8e4-4794-92f4-5a0f261b805a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770879953, "uuid": "fddc3753-0f3c-4778-813d-7924de8faeb9", "value": "663222350329.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e99b97-07a9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770856162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770856162, "uuid": "b4930784-9920-4e4d-8a2e-91524878476a", "comment": "Malware payload (Mirai)", "value": "cba36650728f3d605f927503e2b331fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770856162, "uuid": "2aec1f60-134b-4b70-a45e-6637b37dc8fa", "comment": "Malware payload (Mirai)", "value": "e21cbe2dfa3be11c1e12a44ece0b0ff6cb0c7e0073f58537b621dc29e9931a40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770856162, "uuid": "58f9baad-5a33-4938-a86b-7f07d43fb23b", "comment": "Malware payload (Mirai)", "value": "6c4d744c3c2bc8989f5db063c2bae39f3857fcdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770856162, "uuid": "118885df-df6b-435a-9fc1-26f2593009ea", "comment": "Malware payload (Mirai)", "value": "2d9bb7a228f5f4b12545bb94fe22258535eaad803a7ebc52f0fefb57e929c20ae305397777f888fc90c59a475f9b731d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770856162, "uuid": "faa1e061-f754-4c3c-b4c4-66b01a033135", "value": "T14BA3299ABCC5C602C5E071B2FB1F918E371643A8E3E6B107CD196F29674B8970E3B255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770856162, "uuid": "ffe3c8c2-cbe5-4cb4-bc11-6d723a4627d5", "value": "1536:HHuYGhfYO6dEdNmQLp4n1yHdOUat62ADj20okAe5rBC1qvsX:HH5GhwdGNm/1y9Olt6vDjEkl5rA4sX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770856162, "uuid": "a6d60fc8-8f6e-4743-906a-e39a7f4af843", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770856162, "uuid": "71e28696-12bd-4500-a582-1ba9977f85fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770856162, "uuid": "9b8a3816-8603-4eeb-8245-e34dd8791901", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ff9d3f-084c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770925825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770925825, "uuid": "032dba64-80a2-44e5-8498-81179cb66bc1", "comment": "Malware payload (Mirai)", "value": "2625afc3d990e753a3813405ab5ed69a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770925825, "uuid": "a6925ba9-d200-4e8c-941d-e04876d84b94", "comment": "Malware payload (Mirai)", "value": "e2771b80a9737957d3dd01ee911b1cfdf362030510994a1fb65ccba065ac163c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770925825, "uuid": "8b4d631c-9817-43d3-b658-d61114ad9877", "comment": "Malware payload (Mirai)", "value": "ccaf5953643235c453e1e9d74e9d4a8dc0200b9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770925825, "uuid": "80dc732f-7bb9-451b-b232-1b0308cee203", "comment": "Malware payload (Mirai)", "value": "85d980eab23e6e3209c10326c880fc5033cef4abf64d898d3d733e290e4177ef284da8c2c3290703727147e9543e3ac7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770925825, "uuid": "5d45be72-a2fe-47e9-aa53-9cbadaddd4db", "value": "T1F893E896B8C28E15C5D423BBF92E00CD331667A8E2DF72129D106F2477CA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770925825, "uuid": "4d4937b8-a671-40b5-a775-0ac2c1f4d2fe", "value": "1536:1wNn21vn1P0YAvT7C+P7V2o6Ahb0rkHP8U6jWXOw6M19xAwU85a//5GFYcxIbicy:1FP1sYu7JPZ2oP0r+0U6jW+XMXNH2RCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770925825, "uuid": "5c72a1ee-7b64-47a3-bfcd-4c5e7a270ff9", "value": 91440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770925825, "uuid": "c2cac44a-98a4-4221-bbcf-482bdb13cbb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770925825, "uuid": "217b7987-a0f3-40c9-b8ad-7600f8c38178", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fcb706-080a-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1770897755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897755, "uuid": "d90582f4-c828-4d42-b139-95d234dfcb7d", "comment": "Malware payload (DonutLoader)", "value": "a3c9eb98125f8c161ce2ba8a5648ab14", "object_relation": "md5", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897755, "uuid": "7089837c-7668-419d-b25f-eb7634fe4898", "comment": "Malware payload (DonutLoader)", "value": "e36df1a98574c37e463f13aee1ade962afcadc11ed4756c9c4412e7a71f67fc3", "object_relation": "sha256", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897755, "uuid": "b9f00174-e0b0-481f-8692-7c38ca7e2092", "comment": "Malware payload (DonutLoader)", "value": "6b225061f948db0f4dc142d07781eaae12211351", "object_relation": "sha1", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897755, "uuid": "b0160847-a343-41d0-b2ee-2cc069a094f2", "comment": "Malware payload (DonutLoader)", "value": "95724497ab48f9b2dc3a3e7ffd9f61e382b962837b0320ac60aa65dc1ea5b650e574765b0ac66defe1ae566460facee6", "object_relation": "sha3-384", "Tag": [ { "name": "138f52", "colour": "#D91473", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897755, "uuid": "4da87131-d3e0-4f94-9fde-b14b75009c57", "value": "T163D36C4773A631F8E1778139C4A11A46F776B87557609FEF03A04A6A1F236E08D3BB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897755, "uuid": "94f79530-53e9-47e9-8574-d8f94bedb797", "value": "0599c6cd8dbde331f6fd2d14de683e7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897755, "uuid": "cf6c8590-a40e-4f71-af20-36fefe08aebc", "value": "1536:GIaqakumflUyeGpWOg1hVO2HTHgS6lRc21tVhJEassW6hd39dlzZhbRpYkyw7:Dar4Zv2VOaAdlRdb7JPh3BZhbRpZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770897755, "uuid": "8472b281-9583-4bec-a470-71b3488495ff", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770897755, "uuid": "33a79343-c311-48f3-bd29-63d3f8c9995a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897755, "uuid": "cd2551b6-7c23-4e78-96cd-5b446f3337fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f68ddcc-080e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770899244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899244, "uuid": "7d730a6a-3ccf-4378-8b8c-5dd2dfb5f759", "comment": "Malware payload (Mirai)", "value": "8661393b33a8e0e3c201570edc1357f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899244, "uuid": "5288359f-6478-4eb4-b32d-10f8f57dedf9", "comment": "Malware payload (Mirai)", "value": "e3aca84e46dd7db29cbe436f6e3edffacda3243b60f18d89815da10e489f9a2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899244, "uuid": "90c93cd8-a3cc-43c3-9b5a-49a6b3271c39", "comment": "Malware payload (Mirai)", "value": "00833032c3745ab47599d96aadea6756eb5af9bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770899244, "uuid": "2a4b6715-6fea-4101-b8c6-c034d8ee6229", "comment": "Malware payload (Mirai)", "value": "6fee9dc8197879a5056db47b7fd944976a1c8270e29c3c7d0ba85721e73a0c522b575485369c2ec545f0827c0447d32e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899244, "uuid": "09899a92-eb6f-4656-92fa-ecb175c07c95", "value": "T144865B47B5A368FCC59AC470476FD563BD30B8984221BD7B7698AA302F27E205B1DF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899244, "uuid": "756a2a65-1335-4678-b2d8-86d32ab11437", "value": "98304:8j0RnPcnTwGPukvjnIxIpzHmsy/J5Hg/EBvfJpTkIgbUDFDFtQJpSFGUcW0YNCRb:8MokvfTo+FqnFIVtGp0GK6pBA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770899244, "uuid": "9a1d7e79-b191-4d57-9356-e7e002d237e7", "value": 8424696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770899244, "uuid": "21e12413-1cf6-458e-800a-25395aa9744e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770899244, "uuid": "74ba6193-1bd4-4b50-8a69-b6700069656a", "value": "omicron_miner_36.133.126.84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac4f13f-0846-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770923395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923395, "uuid": "d22499f9-cce0-44a2-b77d-9664394bff5d", "comment": "Malware payload", "value": "e25808eea522ca02bbe542b129babf9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923395, "uuid": "b8e3cb88-1a31-4790-9739-fdbbb729cbf1", "comment": "Malware payload", "value": "e3e2de5c1c39e68db7b0bf42e5b168d0bb3a471b60207d0dcb71ee9c8329f1a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923395, "uuid": "1d5b7e8c-d895-40f2-bd0d-c02e451b2270", "comment": "Malware payload", "value": "4c775762aadb839363b4604fef281a3846d3a95a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770923395, "uuid": "e2ab66c1-fc4c-4e74-8a0c-fa91c0c6207f", "comment": "Malware payload", "value": "e9f916983c35ef3bd3e25d6ca037c36c62ff803b1e939d4b6c1974b0e715ddab57ce2c8585069813665fcfdbd038a86b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770923395, "uuid": "bcc499c7-45a7-446f-b654-9eeb9fbf56fb", "value": "T179A3189ABC85C302C5E071B6FB1F91DE371643A8E3E6B107CD19AB29674B8970E37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770923395, "uuid": "edade623-b9e2-4880-b8fd-ba93c441aced", "value": "3072:vQEiJ789r2kcS3OinY4SU35C75YaWClX:oxJ7Or2ODn+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770923395, "uuid": "7ab39cc6-564e-444c-841b-9f345bf566ac", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770923395, "uuid": "81f73809-26b9-4825-9564-fee8c9590dff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770923395, "uuid": "052fe78b-8372-4844-8eaa-51ccdd1aeea3", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0bbfb9-07e6-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770882221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882221, "uuid": "855bc369-74de-4e51-b549-4110ce505ad1", "comment": "Malware payload (Vidar)", "value": "7a0bb2a1a3660b5e4583d0ee644ff6e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882221, "uuid": "6aa911c1-4dad-4d29-b39c-50738e8da420", "comment": "Malware payload (Vidar)", "value": "e4f2f2267ac09850dbecc02215336f9fc3484b7b2623c87868b98e12bc7e379e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882221, "uuid": "619f4f49-59b5-45df-99df-18dbfffeb99c", "comment": "Malware payload (Vidar)", "value": "0e05056314b1eebe9f205b804140eeb926442e5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770882221, "uuid": "d0e4c3f6-c251-41a1-b838-8b267344a281", "comment": "Malware payload (Vidar)", "value": "2648bbb098343fee1a2481668292bc38d11b91a7b18f166e11722e1ee82c7fadd8b185be5d49dd4984fa2a8bf47c3a7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882221, "uuid": "eb958b2d-58ee-4fed-87ee-67a993fc2d49", "value": "T11CC41A7EAC14E327F60CA0BEE287D3534F6578110236BA931CBA972411495739B877EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882221, "uuid": "edd1d642-f4a5-420b-b413-3c420acd6d09", "value": "bcf81c3e3a1fe52e7b4dee3f058bfdd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882221, "uuid": "b3ea5619-0b93-4d3f-afd0-2e892f1f2c8b", "value": "12288:1cVR9cLXtGJKYvFSPXLI6zavBjR2+Q40S:1cVR9lKocLISavBjR/2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770882221, "uuid": "5f3a7444-c822-4aa1-956b-7786cd5ce50c", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770882221, "uuid": "2fd9ae03-71f9-4b15-b7b1-39dd89d06b53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770882221, "uuid": "66a52a02-052a-441e-940a-5e8ba3cae0d8", "value": "7a0bb2a1a3660b5e4583d0ee644ff6e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fc1461-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877798, "uuid": "57ed2f05-c701-42a4-b502-ff0b4aed3290", "comment": "Malware payload (Mirai)", "value": "bbaee4ee2f5fd965d74ee500f8a8df72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877798, "uuid": "aba61c49-8666-4395-95ea-614acb800a46", "comment": "Malware payload (Mirai)", "value": "e6a8843d347dd57213f4b032b2cdc64f42a853120b78174d0704afb5246cc69e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877798, "uuid": "bf5bc2cb-6eeb-4e72-8e2c-eb0fa8fa890c", "comment": "Malware payload (Mirai)", "value": "c3f58fba2623b4b139f3e95ad75decfc4e08b243", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877798, "uuid": "430426d0-39a6-4b3e-a0eb-5c95b27fbdbf", "comment": "Malware payload (Mirai)", "value": "aeff213167be01bd573ca081fefe53c8e62e3730945a7764f309d7b6b4cfa35e58720fb9a951f9c4aae1e83db0a919bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877798, "uuid": "b3db8028-4433-473d-a49f-bbec36f5abd2", "value": "T1D332B407A7B7AF1BC4D027770193072162AA9FA16025472F7D0D1C4E6E9B3812D3FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877798, "uuid": "7c9d8e8c-d216-4c3b-87f2-a36c32efddcd", "value": "192:xvPOR1CQOV/1NxfAz2HaCD0SdbNlDqM+2mKdc0E++e+f:xvPbbzfa26CISd1/c0E+kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877798, "uuid": "23eb7996-3d82-477a-9384-2045b066d930", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877798, "uuid": "0047ac39-6996-4108-9d14-46f6e5a06ff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877798, "uuid": "e6732abe-2ac5-4725-a5ee-60f1acf56208", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3529d7d1-07f4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770888087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888087, "uuid": "a8802f93-37c1-40df-9d8b-a3837695e02d", "comment": "Malware payload", "value": "840fc9c1be67d9060735154fe5171488", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888087, "uuid": "2dec21af-66c6-459a-9750-e8067f144c1d", "comment": "Malware payload", "value": "e8600c6e28b24a05f65d2687ed80f02649ec220651acad04ecedb7d668574955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888087, "uuid": "0980f34d-22d9-45fd-b55a-e6bca2e3166e", "comment": "Malware payload", "value": "c4b0e2a4b10d18d1c91c015a8767f4ab39f0f81b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888087, "uuid": "89063050-a7a7-4f42-a507-d586693be5c3", "comment": "Malware payload", "value": "6869e78bf02ef3ef8034a27c4071a57d22701b95f58aa13d89362ea71c9bf6982fcf38f054bef3f03a67b0f9dda07243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888087, "uuid": "e281d60d-4590-47c7-add2-c07bc7ebd297", "value": "T16B522B628AC1CAF2FF51207A469ADFF7A43555BF871560C39B609EE284011C1B6BE48F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888087, "uuid": "42ac964b-c983-4cda-b0c6-4497383e5dbb", "value": "192:5vAyaQtubRuF9MTU308WcsPwS2gN/7WEP7uwzEWlsP+iF8Kk9tmhMWJ:xUQtnMUPSftIp+M8KhxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770888087, "uuid": "d030f06e-0e68-4b89-ab3b-b34b647950bf", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770888087, "uuid": "5032bee0-fa8e-4cb8-a5ab-9be5673609f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888087, "uuid": "e7574811-bd82-4d0d-b70c-44b160c08c11", "value": "upm2008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f7578d-084d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770926551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926551, "uuid": "0aa4840a-6833-4c59-8c0e-d69df6c5449a", "comment": "Malware payload", "value": "2b0fa477caec5c954d74f1a0fffba7ea", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926551, "uuid": "6adfb6a2-17dd-42ec-af37-7f17bc949e23", "comment": "Malware payload", "value": "e915df6b17e024e55435f04be8e23ae603cb0d5c0b0361fd2f699560dd398053", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926551, "uuid": "2aa069c5-f9c2-4d07-a1fd-5900586ba240", "comment": "Malware payload", "value": "15088b2308a5a8dcdf293dfc5b7cefbe7f187214", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926551, "uuid": "5f875f48-cf4e-4829-959b-42293f0a60ab", "comment": "Malware payload", "value": "a56cf805992d720dffef8b161e37b1d7ce53ec089d16d49ce56cf08ee08656960c8b6bfac92cc5b83027dae28bd94554", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926551, "uuid": "091c074f-62a9-43dc-afe7-4190dd13d209", "value": "T1E6352318B4A58F02C1C9387B5FD680C3C62CFDBEBD16A2A79711730E71369F1978991A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926551, "uuid": "bb364289-0ba2-47c0-a92a-f616da0fd243", "value": "24576:x1XhUYOvWoVyTeDaZ3z0QqdX8UiXbWNJvIHyH6hLu:x1uYO+WgLZ3zGdXmqNQ9hK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770926551, "uuid": "32e4693e-44f6-4d19-bf32-3010400ddb69", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770926551, "uuid": "e182426a-f95f-4632-b47a-7374eafa7cb8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926551, "uuid": "e0e960ed-a260-49cd-8c32-05e94c8b8eee", "value": "SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16189.21706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab982f8b-080b-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770898164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898164, "uuid": "ab4c6eda-b607-42ae-82aa-8ccca326e7af", "comment": "Malware payload (SalatStealer)", "value": "0b8ec079d8f8071ac294c8c588d9b351", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898164, "uuid": "4ffab1f5-fbd3-4fdb-b75f-94edea90aa15", "comment": "Malware payload (SalatStealer)", "value": "ea13c6307319649958f21be225151865013c0e77a9becea1fa39c960a6b8c7dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898164, "uuid": "6dfb7e5c-1131-4a08-a59a-5c387961561f", "comment": "Malware payload (SalatStealer)", "value": "36c4741853d1713edbdc2c02abb540991353baad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898164, "uuid": "8f43b19c-1c23-4f71-9771-d37b558a1100", "comment": "Malware payload (SalatStealer)", "value": "ce64dcf22fe96ebbfa7e23197239e46aa78dd5e2c8916398552701abd8468ceb61a783ebad3bba31cce72955793e46c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898164, "uuid": "34c3e375-755e-46ae-89e8-294401b3e859", "value": "T11EC64A11FA8B54F5E9031831415BB23F33355E048B28DBEBEB547F6AFC7B681296A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898164, "uuid": "c3b272b1-f563-485d-be99-350645e56711", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898164, "uuid": "ee5758ff-f470-41e8-ac77-d92fea5be4d9", "value": "49152:SVJjWw6SzxbTQxJeTcVU4Dh4Dq3ESPqd8Y3cS2nA1Nn+is2WuJXYxP5FAU9s32N1:itWw64Q5Ts2nS+XX15KMjL5qX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770898164, "uuid": "da48150e-cdcb-4068-b954-4a955f4a118b", "value": 11669504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770898164, "uuid": "13df227e-8f9b-4bf5-ab8f-ab265bf1c0db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898164, "uuid": "ce861f69-217d-44a9-af05-71c2a0f27315", "value": "TelegramFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f664f3de-07f3-11f1-a129-42010a9c0007", "comment": "Malware payload (OrcusRAT)", "timestamp": 1770887981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887981, "uuid": "bb3dca50-e183-46ab-94cb-871f562c6e13", "comment": "Malware payload (OrcusRAT)", "value": "728c3048cd9b3a2830f9fc48cfca62c2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887981, "uuid": "59dc94d5-158f-426e-9ece-9bfbfe84ea20", "comment": "Malware payload (OrcusRAT)", "value": "ea5dde14d246ccd06503dd2b05822618b7d62a9630ccd5d2351efd1e3ede9682", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887981, "uuid": "bc30d019-3a16-4b9d-8dab-d067a16be5e6", "comment": "Malware payload (OrcusRAT)", "value": "a2f7c8ed47b957dbd05287f207dd4dc2b49a82b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770887981, "uuid": "b8dcaf84-0730-4cb1-bee2-39dd66ec9bbb", "comment": "Malware payload (OrcusRAT)", "value": "6d5d8e21fb2d24791d3694fa454a726dae666977d2eba8c292e13f52b92a10a1ef3b741b1cfe3d826ec5a475df105642", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887981, "uuid": "ca989907-ee13-40ac-a0f0-587c3360c9bc", "value": "T1E1359D1DADA900BAD077D039CA930546FBB278222720AEDF13D1035D9E67BF57A39319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887981, "uuid": "d5ba4b89-7432-4ac2-a15e-4fb7006fd127", "value": "c65ed3a99850b1c3dea70f50ea322588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887981, "uuid": "c5541580-47d3-41ed-a336-b2e356e4a8d8", "value": "24576:8yK2T7g4FwxPPATyiq7h0RxNOTMRyqUn9CiV:tT1+aTS+RTIqUn9XV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770887981, "uuid": "fc00566e-6eb4-47c9-aa7a-73b2dfbdbe18", "value": 1129592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770887981, "uuid": "c030f2f3-ce8d-48c7-bcb0-4f435e48b761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770887981, "uuid": "25420753-cf11-4209-aff7-a2c86cd822a7", "value": "task.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec691162-084e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927049, "uuid": "9d5de8a8-1e37-412f-98c6-7f186f9440cb", "comment": "Malware payload (Mirai)", "value": "97c62168aa5d7498591eae35be1a7277", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927049, "uuid": "5905c7e4-b010-486a-a0e6-0ac749876988", "comment": "Malware payload (Mirai)", "value": "ebb1df9e172d40d092726c4d18a8e12766e2d4b56e29824d0eabe9b5c102f007", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927049, "uuid": "2a99cb9c-5811-48a1-beee-3543c88d1d04", "comment": "Malware payload (Mirai)", "value": "be210e0bd396c51003ec460623e6cd0c2e270884", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927049, "uuid": "6e7761b6-a26f-4056-9177-92b8a354b0a7", "comment": "Malware payload (Mirai)", "value": "1051bc77e53e6addd9483a283231f5dba4c9e287270e87745811c80ed6ea84f2c545d470fc0e3df427a5107e421e56da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927049, "uuid": "3b67f497-6eb7-4ef7-8038-f94769820ab5", "value": "T1B293F706BB650FFBDCAFCD3706A9170525CC551A52B93B3A3674C92CF64B21B0AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927049, "uuid": "5f89f2d3-1e60-45d4-a792-02c4e21b594f", "value": "1536:EDxcuHjuPawlXkiOJLUIIz6TQUW1YM7AZGmvi4N9z0zkV/xoQs/xgT:E9cGGawlXcJGj1YmAVNgIo/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927049, "uuid": "96f082c1-0e97-421f-9dd8-f032c4e74208", "value": 93496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927049, "uuid": "a77dab92-1b32-4c80-ae18-d521cfec0e3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927049, "uuid": "ff3facab-36c5-4abd-9b10-4b0f744f8e04", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8d59e1-084e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770927020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927020, "uuid": "3339bf22-1a7d-4f7e-9b3b-95d529b43739", "comment": "Malware payload (Mirai)", "value": "ad2713ffb7a49737c8c79456f0f62282", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927020, "uuid": "18d7c6c0-7393-47c3-beb9-a536d8ad1de8", "comment": "Malware payload (Mirai)", "value": "ec131d3d24dcc2aff49f98412fa0a8fc933f748b6acb5a29e3deb3fd86889829", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927020, "uuid": "bcac27a1-a049-4377-b820-b145031b05c7", "comment": "Malware payload (Mirai)", "value": "8ebd8dd2db7c69e323705e199c81dd4b20a67cb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770927020, "uuid": "24f402a5-4379-47aa-a910-14ab66061440", "comment": "Malware payload (Mirai)", "value": "7d83ac2353d609fc7fe08da91d5aa148a8e10522c41a580d084d60377da82014ce466cd8d27bea030cb7775b3b7f548a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927020, "uuid": "a85780fc-3bfe-4285-9357-64a7123f3cd1", "value": "T10AF2F17DD064A6C0C7BCC6F9904C2AE25D91F16033CCAFD8A322599C7F2990BBA06078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927020, "uuid": "b76a70c2-ebe9-48c1-b97b-6593428452b4", "value": "768:kJ7oi8x8YmgKDSJ68/xj473P5GKRKVD+3yEobDXlWb:kDcKsd/C75U+1oXXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770927020, "uuid": "c01aa854-d94f-4423-a87a-5873f0557957", "value": 36796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770927020, "uuid": "fd3c11fb-6e77-4597-92a2-eb908b287fe7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770927020, "uuid": "c1b62322-1eaf-4230-90b3-b766107b0838", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f356f842-07b6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770861777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861777, "uuid": "d224f423-28c0-4d7a-81bd-562afd826841", "comment": "Malware payload", "value": "155528c5ae70b575b08b0050afe9a34e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861777, "uuid": "3062fe05-8c17-44fc-949d-5098f0070511", "comment": "Malware payload", "value": "ec97b21b96e8537340cc3afe513a65ac33aaf971d8e68aa18bd9837fcc52f945", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861777, "uuid": "2c974242-e95c-410b-a312-4c2ddfa0c1d0", "comment": "Malware payload", "value": "ff4cac9a7c15df5733367790b656e1c0d3536955", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770861777, "uuid": "a10d825a-c29f-4720-a151-5566cf208a70", "comment": "Malware payload", "value": "5479bbe2c9a581517322b01ad7d4d314ce0ae5858d832d83c0a24a12cc41fa70ddbe51db25638861cd491c2efd70f873", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861777, "uuid": "619a2f2c-e5c6-41ff-a9e9-a176d1046092", "value": "T125F2AD16719F860870B3468D4BAB02740B6B7AAF0E7E819904CDEA899FE3515CD573B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861777, "uuid": "4c194ff9-5dbb-4c35-8171-9010601aa25f", "value": "384:pG68id+ah4g4bIUWpAru7nND8Y7/3CrAm:pG68idDh4TIUWpA+hhjyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770861777, "uuid": "b22069b8-f693-4d8b-abce-4b2252ae35fc", "value": 37288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770861777, "uuid": "7db755e9-7b62-4122-b2c1-5603ac5accd2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770861777, "uuid": "57cbca0d-57f5-4b5a-a49f-fd66da080d54", "value": "2102210.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ebafca4-0842-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770921577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921577, "uuid": "bbdc4e94-fda5-4f73-a45c-a118ea091c26", "comment": "Malware payload (Mirai)", "value": "6f3c8b7cf6ccf0efb6ce2f9dfad2fa82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921577, "uuid": "67cff15a-6e31-401a-b81c-d33f633710ab", "comment": "Malware payload (Mirai)", "value": "ed266da616b50e367156aeabf1d96d975d1e14676cd497dac0f4ca7878aaa39f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921577, "uuid": "4719e473-f6ab-475b-89f9-463736dffda3", "comment": "Malware payload (Mirai)", "value": "393cdc8c6e55c3c468496f4bb3d11be01f2ea9e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770921577, "uuid": "4306e4bf-d199-461c-8854-2fe3d62572d5", "comment": "Malware payload (Mirai)", "value": "e5534c78e0cc3359c082d50e6299bb6749765688230a72892eb35522d387d631a0db683d6f285674d288b995e5d5d13d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921577, "uuid": "7647fccc-eafa-4d59-8f2d-0b091183fbd8", "value": "T19363179ABCC5C202C9F061B2BB1F518E371643B8E3E5B157DD19AF29670F8A70A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921577, "uuid": "6d06b205-7c7b-4e4e-a08f-81bfee2ebe21", "value": "768:RImOQ0JE1dlZVz+poGY3ttV1pcS5ac9bGyNPhtnZe3Ij4wv9J0smWh6sxh+CzbyF:qfU31ZZbY6JtpCoqKM4O9UQOr9U0FA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770921577, "uuid": "9e4925bf-f4b3-49b9-b54e-ce8b3a20bc9a", "value": 71292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770921577, "uuid": "240ca85f-b6b2-4da3-bfd0-8ab02f2cc2a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770921577, "uuid": "0dfb17c3-65f7-4241-9175-2fd3d6cb2352", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0ab4d4-0809-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770897443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897443, "uuid": "ef319b67-4bc6-4725-9428-f94de9af2344", "comment": "Malware payload", "value": "df1c059574dd2048471ba8684728b30f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897443, "uuid": "12972d8c-b4dc-40c8-834f-981ee141be12", "comment": "Malware payload", "value": "edc8c18693f76240e3afb424166ebbc91844c4aa3b81c2ede86ff186c70afb91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897443, "uuid": "641322c0-a4f8-48d2-8b8f-fc5022429cb5", "comment": "Malware payload", "value": "88d0c63db7bc8f55b5fff42001d1334b028b2478", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770897443, "uuid": "39a856ee-a8e3-439f-be80-b0d037be1308", "comment": "Malware payload", "value": "bd6e851027def40b6e00df28321b86c3f2175de2261cd4c55460a78f5c65e4c84758d0aea570854d1fbd20915623fb46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897443, "uuid": "f102fa57-7597-4811-88bd-10e969cf8004", "value": "T1B3E53367186E34C5AA54C8FCB6AC66618F2402FB17C718BA078BD16F55BC1E80793EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897443, "uuid": "ad120724-2467-4b29-a5ab-edba4e1e3c92", "value": "49152:wGygn8OVWuNx5sps3FuBbbxl44hs8D9G+MWl0JI4iOS0k2muJWKU7mq0ZfP0LfCI:w5gHWsZ1sN+8U9JI4U0xmu66pZE+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770897443, "uuid": "e9c2d1f4-a71f-45c2-ba9e-83206e3097bf", "value": 3117056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770897443, "uuid": "357517c3-8803-4571-97b0-c8480ed90f88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770897443, "uuid": "fa8f4177-f8c2-43cb-b456-5ab101ad7ebb", "value": "linux_elf_36.133.126.84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ccc42a-084d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770926279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926279, "uuid": "bba4d7c2-4903-47aa-8414-7f0e8a1026a6", "comment": "Malware payload", "value": "9cdaa0637f989853624108a7e9a849ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926279, "uuid": "89a2b409-4f6e-47b5-903f-4a9dc1985c07", "comment": "Malware payload", "value": "ef04342c7283dfcfe4c05428e3563c2fe4512c5b9705ca9abaefa3978d4da197", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926279, "uuid": "654074ab-d715-4987-aa40-9fa5805e18ee", "comment": "Malware payload", "value": "fb0c324a9ac6820d39e45b92e58df7b3f4a91bd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770926279, "uuid": "f0dc545f-5d50-4e9d-b274-56052c752b61", "comment": "Malware payload", "value": "ed43a8bfbf74bcda22e73a6f0de22b7efc0555ecb887efc47a7487dfe9a52f2e4bf2ad001c49aa4e863c3fcfa9432269", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926279, "uuid": "8b75ebe2-1c17-4e1d-b8fb-8a1dad824c68", "value": "T174730BCABC858B11D5C526B6FE1E214D33135B78E3FE7113CE185B2E634A86B0A3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926279, "uuid": "6281d481-d7ae-41c3-b404-714657cf80ae", "value": "1536:6mnuoBGl994os8UHKcde6EmHYfCF4Bhs5f0bfsEMzieWxsf7D:3GlTDUHhde6Em4fCF4BhyRWxsf7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770926279, "uuid": "3fc23e17-f7aa-4528-a229-22a1fe5f7f71", "value": 76624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770926279, "uuid": "8bda8455-eb25-49f6-97e1-e73fc0746ae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770926279, "uuid": "c947e8d0-00b2-4e53-83e1-e266cfcc45b6", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815d328e-07c7-11f1-a129-42010a9c0007", "comment": "Malware payload (N-W0rm)", "timestamp": 1770868887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770868887, "uuid": "6671d296-fa40-4155-beb3-74537ca70006", "comment": "Malware payload (N-W0rm)", "value": "7796e940d482dab2e02b2ded6fc1791a", "object_relation": "md5", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770868887, "uuid": "272c4c77-ab4a-450c-a4d6-a533a449985c", "comment": "Malware payload (N-W0rm)", "value": "f007bc6c53e2995f5490418fac761a64a88e30d1d145a67f3954b8966d8db154", "object_relation": "sha256", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770868887, "uuid": "dd573346-5866-4d78-92b9-57f370f53666", "comment": "Malware payload (N-W0rm)", "value": "713ba217a92ab97444f1a68972dd0afd80347b0a", "object_relation": "sha1", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770868887, "uuid": "f7c3a8ce-ad74-4f74-a8ab-b9c773918a4e", "comment": "Malware payload (N-W0rm)", "value": "6e23f049506d340a0ec692975f072c73e4dc553fcbcbf8c40569f6955143587d65eb7b0d73ef2d6659e517de431826de", "object_relation": "sha3-384", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770868887, "uuid": "4e760f88-3d1d-4bd4-a892-8c3d60f6ad5f", "value": "T1FDF73330B27768D5E62F63BFA0A86F8881347DE1B31BD56B63787FA1897054660B1C43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770868887, "uuid": "1e5e0989-76ba-4b7b-bebc-aa723cd71fe9", "value": "1572864:Bxyzop3xA9HoS9coQcqTv9AIkX9JTB7wScm6S3VTnXM2ZdW8L2j5:LOoDsx9/hqTv9ARTTyMT82Zdqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770868887, "uuid": "152fe09f-f84c-4d58-8171-39a29e889c3c", "value": 76603392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770868887, "uuid": "37770140-6b90-49b9-a226-526094b6b675", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770868887, "uuid": "1817f30c-17cd-4552-8bf4-b611bdaac7c8", "value": "77777.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484f5813-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877811, "uuid": "47ce0cf1-291b-49e6-a424-19ec17d56963", "comment": "Malware payload (Mirai)", "value": "c3fabce77cfcb3c85621366d52d437b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877811, "uuid": "5fa8defc-1b47-4e06-a27e-35c4a9e522eb", "comment": "Malware payload (Mirai)", "value": "f0a0c9e3741457cafafd59cb2b675834b58584ac7c28d4d121b29701a52b57cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877811, "uuid": "741f17ac-67ca-4eff-b8d1-bc2dd5517fc9", "comment": "Malware payload (Mirai)", "value": "321a9b85130d51d976ef3054ca0f6814547b71d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877811, "uuid": "7f18cbab-daaf-443c-84b1-77b5c76067fe", "comment": "Malware payload (Mirai)", "value": "4d686c655c2ec48a8a9d7fff0af861c43f6342ad51b9ecc3afb7ff41745cb5d932e9bc682f018c48c9f501a71a449e38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877811, "uuid": "3cd8f0aa-78b4-43ea-a142-e03b8d45abf4", "value": "T17DC39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877811, "uuid": "80e53441-d485-472b-ba02-d0888bf0199e", "value": "3072:pf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4Xqe:pf0tJBR4NSALD7rnCrheiAqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877811, "uuid": "999ebb71-a41a-4166-9369-85c4f5cb75ef", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877811, "uuid": "d977a33d-afbf-4151-84df-20e124316aca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877811, "uuid": "2fa0ea61-b3c4-4bfb-880c-8e201bce7617", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03bc2369-07f4-11f1-a129-42010a9c0007", "comment": "Malware payload (NirCmd)", "timestamp": 1770888004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888004, "uuid": "2fa199f6-977f-4210-8a14-fdc10e0b1ccc", "comment": "Malware payload (NirCmd)", "value": "71ab4b9fa8037deeea21f71e2d1a782e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888004, "uuid": "da70e053-69a3-408f-ac0f-4e16e2599f6c", "comment": "Malware payload (NirCmd)", "value": "f0a5e08233d8ac840298a15ece34e9c0f325aa347e9f47d6af603b771b62f266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888004, "uuid": "0d8183fe-529f-4031-8043-97e53a34f929", "comment": "Malware payload (NirCmd)", "value": "1ec07ce8b98b922702e277722f1c8992ee7abe08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888004, "uuid": "26638034-f857-4f45-8791-960af1dd32fa", "comment": "Malware payload (NirCmd)", "value": "cffffcd7b2011c0856d7d716868cbb423c2dc37f8a5a779d208ebb57b0dd48ff99fd91cc9810baa60415204f47a4216e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888004, "uuid": "3f514ce4-cbf9-4d81-a53c-f936dc60988b", "value": "T1ADA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888004, "uuid": "28f9e4fc-3e20-499d-89ad-2a1f8c2322ea", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888004, "uuid": "e76a2e2e-5a63-408d-84f5-22081267e3e5", "value": "49152:ABROTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:acTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770888004, "uuid": "441316b4-df79-45ac-922a-89b7d01ad399", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770888004, "uuid": "d01a338c-f287-47af-bc8b-fbe521c4ec53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888004, "uuid": "4cee7123-109a-4126-9881-8da9e917584a", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d95732-07e4-11f1-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1770881288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881288, "uuid": "4ce1003f-1514-4c64-ae1c-0672ed089922", "comment": "Malware payload (Socks5Systemz)", "value": "2d2805398add6517f5086049da92b575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881288, "uuid": "d7c50246-a3a0-44e9-b28f-5caf92684217", "comment": "Malware payload (Socks5Systemz)", "value": "f128d062434b0775880bcb143d069d939d99500cb810b6a96b66bfcb80f4be1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881288, "uuid": "bdd37614-9d6f-46ca-b71e-213faac9c47c", "comment": "Malware payload (Socks5Systemz)", "value": "ec39b00098c3a64ac9957aac0b9e79fd1bff3e47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770881288, "uuid": "1812e094-5454-452a-8c36-bdfce5cec18d", "comment": "Malware payload (Socks5Systemz)", "value": "01464f45350324706eccba074f78b014123e53ee0a5ba32bcf5b9700d07ec3bbad01e3dd24c4ec982c8feb9bc18cd493", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881288, "uuid": "13e36563-d9bf-452c-aa3d-830d63dfdf0a", "value": "T156063373EB50AC34F593E1F2CE42D224CA93610939ED496DB55CAECD8F0779AC6A2305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881288, "uuid": "10e9c719-4086-4a0b-8d46-3d882384a110", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881288, "uuid": "26ac80a5-f411-4c8f-8820-6222c77ccbca", "value": "98304:MRcoA03N3v+bQATOAtp6kK9jIBjCqLqKUUMPDeQ:joj932sQVtiItqKUTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770881288, "uuid": "4096f97c-ed7a-4532-af87-f6ec7dfa700b", "value": 3748833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770881288, "uuid": "7412307e-cd52-48ab-a0f4-85354de33faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770881288, "uuid": "10be7b48-f731-4c3d-9aca-44af21c67f9b", "value": "2d2805398add6517f5086049da92b575.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a087c2-0862-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770935599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935599, "uuid": "9f377127-7103-4ec3-8681-bcee4b1392cc", "comment": "Malware payload (Mirai)", "value": "43a8b794dd606762979750f725cafa5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935599, "uuid": "66a19493-0311-4e86-8c8f-394caab5615c", "comment": "Malware payload (Mirai)", "value": "f14d097fb94245966854ceadc7cd83d678845c7c5a8d7499f5cab284d7052580", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935599, "uuid": "98a4e1fe-4cfb-4258-bb47-6e0c1bf200a9", "comment": "Malware payload (Mirai)", "value": "60ee3ca51fe06cf99aa102154d07076354a518c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770935599, "uuid": "71d68695-a9cf-43ee-a37f-6a05c8fd7e08", "comment": "Malware payload (Mirai)", "value": "ecb0b05a8b3ec38219d30fcf7ee0e9a488622b44b9929abab44f5cd910bd008998a9542d03291754a068589a4cfebe7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935599, "uuid": "49cc3f14-c235-49a6-ae86-857bd176b317", "value": "T19DE3C70AAF610FB7DCABDC7706E90B1135CCB91B25A43B757534E818B64A18B19E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935599, "uuid": "fd94e200-fc50-425b-bd6d-d3a638528ae8", "value": "1536:oVEJIAD1JdMTWtCyQ7lT0kG0ktNq1DHrO8VAIQo1aMmTQpAwXgtAs5OE4Gsr59G8:6TYFe9vktMFHqUZDp2b4Gdg0YRoTpB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770935599, "uuid": "0a169208-5e06-4c75-974a-cb9922352bc2", "value": 144152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770935599, "uuid": "d1f9a7bd-2a6b-4f1e-9b92-003c2de8e5a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770935599, "uuid": "37fc6a36-8880-493e-af25-bc7c086da387", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b727229f-083e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770920087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920087, "uuid": "0421275a-c4fb-44f8-ad5c-4a8675557b35", "comment": "Malware payload (Mirai)", "value": "c9697787eeea630477dc0c2b1cb9d58d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920087, "uuid": "24a25293-3482-4217-97c5-30692c743466", "comment": "Malware payload (Mirai)", "value": "f369d97189f29bad5d1b59ea6284f9d86f4901c291132d64c7a2533c948debd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920087, "uuid": "dea85b33-d22a-4f9c-8775-5e72da811315", "comment": "Malware payload (Mirai)", "value": "7aafa8dc8848888bbdc188b4f7618ffdeb8bdb00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770920087, "uuid": "799f0cea-3a4c-44c4-a1d6-bbd351a84057", "comment": "Malware payload (Mirai)", "value": "04d83d7dae79b9c2e224e6d391a32fcaddc1911ecdd1bcf4d4e026e17262a810b77e9f58a3f4ea410adb6a23e86b335b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920087, "uuid": "2899317c-b040-4fff-914b-c70e6b4dde71", "value": "T1D463188ABCC5C602C5F061B2BB1F51CE375643A8E3E6B157CD19AF29634F8A70A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920087, "uuid": "5c0def89-83a5-49fb-a3e0-d953671ddc59", "value": "768:pe/V3k01WRqdhoUSzV7aI9pnlIWVCw1baaURset/MunH6PBPzSkYtMqeh0ZddswM:d4cjpXYmhM80nVAZzB4ToUUOG1GqivJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770920087, "uuid": "61ec97d5-ca18-4300-a436-b3defd9ea5f6", "value": 71324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770920087, "uuid": "db703059-7c09-4b90-a175-23c1ffe57266", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770920087, "uuid": "146fdf8b-6684-4112-8041-f1ebd27af23e", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1adead-07dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770877814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877814, "uuid": "799dcf7e-5153-454b-a63e-b72120b194b4", "comment": "Malware payload (Mirai)", "value": "fa946439e6c354fc471ceff6ecf165e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877814, "uuid": "da24037d-50d4-4231-925a-1a498877e217", "comment": "Malware payload (Mirai)", "value": "f399ab79453503022e6afa0ca6dc854b248b4940d4047631aa9d363a18d585de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877814, "uuid": "c2a3ce1a-ae55-40da-971a-d3b06158031d", "comment": "Malware payload (Mirai)", "value": "57e44f4798e8345bae7d54e275a1c0a25739f91a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770877814, "uuid": "4bbcb6b1-0023-4b2a-ae4e-d3c83fb5ba28", "comment": "Malware payload (Mirai)", "value": "b351eb8eb10896b731f354cb04c55975ef832835eb22eaa02752a3009ab7d5535b88ccf113117dc7ffe8d3a9bcbc79b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877814, "uuid": "2b768ba7-5233-42d5-92a6-40a1ba9dceb3", "value": "T1DB144B5ABD529F01C5C126FAFF9E814933132BB8D3FA3112DD246F60278A89B0FB6551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877814, "uuid": "43c79ab3-a27f-4703-a4b6-7142705b3173", "value": "3072:6kXP/vG9syDbAuWNCCcRda/03RqGE9k76utnTfj/D8KDha+NMrYrw46:6eX+9syDbAuWNCCuda/GRqGE9k71tnTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770877814, "uuid": "12a67a1f-2589-49f9-944e-30dc762c811b", "value": 190908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770877814, "uuid": "f2912233-11bd-4279-b73b-94d2e54e6a9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770877814, "uuid": "3622f1f2-3856-4dce-9ac2-01121c4337d1", "value": "furry.arm7xc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27428b4-082e-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770913181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913181, "uuid": "a77614e2-a037-4693-a386-2c79df74d5d4", "comment": "Malware payload (PhantomStealer)", "value": "308010fe2d98d4a1080204bedae75013", "object_relation": "md5", "Tag": [ { "name": "phantom", "colour": "#241AB6", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913181, "uuid": "898fca26-dbcd-4dba-aa89-98b288eb312c", "comment": "Malware payload (PhantomStealer)", "value": "f4100380eee3d39d07ee5b3d76ed9fdab0a05e0bd2099303394c35cdf8fcdb50", "object_relation": "sha256", "Tag": [ { "name": "phantom", "colour": "#241AB6", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913181, "uuid": "6189ccba-a50d-400b-a3d2-7f954b4a18d1", "comment": "Malware payload (PhantomStealer)", "value": "137ef8b614954e338f08a183d1886288a12f034b", "object_relation": "sha1", "Tag": [ { "name": "phantom", "colour": "#241AB6", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770913181, "uuid": "5a100990-0d41-4a77-bffa-e18cde54b43f", "comment": "Malware payload (PhantomStealer)", "value": "e761a5192411e57fe9ff4842f19b4efcf09c56083404ba935ae53938895a3d52b921a778d4dec8f8a099c5ce5bafb2d7", "object_relation": "sha3-384", "Tag": [ { "name": "phantom", "colour": "#241AB6", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913181, "uuid": "13226069-11cd-4665-bff9-29ce5be76a39", "value": "T1758533954A31B7AB765450DE5BB062060C3F9BEE344EDE768EA36EAE77113EF0804442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913181, "uuid": "c64aae0e-263d-4341-9d6e-0b03fd2ee4b0", "value": "24576:KAmjnPOJfQgPRQ4sVIPdRWBAtJBoKjeOGFA5ELEu5vtiTfRllQcZTon7hl9Psp2S:KASwZl+Iaud9EguttSJllQtT9GCfJM4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770913181, "uuid": "814b43b6-02d4-4346-9408-1e5a430277cc", "value": 1719653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770913181, "uuid": "fb061ee4-30a8-492b-bf44-5c82ff0bc306", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770913181, "uuid": "00fbf101-2701-4481-b0bf-35a0226bba44", "value": "f4100380eee3d39d07ee5b3d76ed9fdab0a05e0bd2099303394c35cdf8fcdb50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff51b1c-0861-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770934947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770934947, "uuid": "956281b1-60fe-4b68-b97c-e7870501e886", "comment": "Malware payload (RemcosRAT)", "value": "d37c0ddb5fd7ebf5341dfa686ee8007d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770934947, "uuid": "4654c774-6d95-4c79-ade4-d88abbd1f943", "comment": "Malware payload (RemcosRAT)", "value": "f4e4e69b0de9946d4350ab543269629d308b148e652343ff14ef1a1b1d2d5008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770934947, "uuid": "465fa752-efb0-46dc-a7ef-ebcb747b04ef", "comment": "Malware payload (RemcosRAT)", "value": "0fd64ed2a2cccf95b9c2b64724d869e93863908b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770934947, "uuid": "028edc15-8711-440f-bb76-12f73ae7da6f", "comment": "Malware payload (RemcosRAT)", "value": "142abffaa20981d5bcb4997d97bea71509191025f9082ab501fd62d9df23e1f48292595d033b2e1fbb94c4ef3f3d4201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770934947, "uuid": "d844d212-dcfd-4f5d-99f5-455a505a5fa0", "value": "T1F2251577FE9C01E4DC6681B486820C36FFA3A7315570463F02BA3676EB922535E3B616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770934947, "uuid": "30bd8530-f8c6-4fc1-900c-456a98cde788", "value": "8b3e0763eddbb01367bd21396e110071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770934947, "uuid": "9432f8dc-8312-4650-b9f1-222c4c04c745", "value": "12288:HaMwmp7scoHvln/+iB9PQoYYUPGmdou5usyWcjQxoL9:67mScoHvln/+aPQoYDPGmd35oxjQ+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770934947, "uuid": "e7b2efc2-25f0-4c26-bcc8-4fc37e05f893", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770934947, "uuid": "33b7a2bd-9b13-4bbf-a170-a59d3ae02ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770934947, "uuid": "dca67f96-3cf4-42ea-9d62-be5d6ff3171c", "value": "0fd64ed2a2cccf95b9c2b64724d869e93863908b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea479abb-07ca-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770870352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870352, "uuid": "d3249855-f50f-419d-a566-ea2aebed8ae0", "comment": "Malware payload", "value": "30224401aabd4d35fab14648119dca47", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870352, "uuid": "df55e879-8a44-4dd6-954b-4fe6a4a0b06a", "comment": "Malware payload", "value": "f5888c5e87d95ff494573ffb1a7f637dbf69c0a94c001f889cda58da054a32e5", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870352, "uuid": "218aa194-3712-4d28-a1e8-71ed5f82b741", "comment": "Malware payload", "value": "8fa905bbc1e3878145e4b0cafb563dac28b14cbc", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870352, "uuid": "6899818a-6e67-400f-967a-9f57810a622d", "comment": "Malware payload", "value": "6a0f463ff969b39011e6a48d2b542ef41799829a3c74f2f193b244d139bd74f87d9ed41a335ac94d5e64e69068717779", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870352, "uuid": "2250f3d7-c1d5-419d-84e9-91dd9bc23adb", "value": "T10EE40B51FED8060E34DE4847B0EDCA82FAF66F17D5E2B482278B6365240FF6E652D085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870352, "uuid": "e010f6be-7cf8-42d8-88d2-1db8d4261556", "value": "12288:CjEyj7sr3v0jG8rjPx18Mqq7UYK9l6UCti:Cjf3CGzPx18buI9Uti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770870352, "uuid": "67acc49e-f5b7-40d4-809f-cf9f8aa8e683", "value": 714714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770870352, "uuid": "065b58da-a66a-42f4-965b-bb8e2ec8272a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870352, "uuid": "e6577376-8950-493a-8092-24a7fe384889", "value": "sop.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06703ec0-07f4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770888008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888008, "uuid": "2202b2a3-1aaa-475b-8f29-47e573bb1706", "comment": "Malware payload", "value": "190e2ae7724f821ff52418c3417458ae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888008, "uuid": "d1ada16a-ed2c-4a08-a640-7de3b42f30ef", "comment": "Malware payload", "value": "f5fe2bca86e9a326e6a1f10fd49f98d7371b8729b13dff98f61f8667c47bec86", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888008, "uuid": "d9c9529b-30ff-4047-86c8-624ffad717e4", "comment": "Malware payload", "value": "3e29b3a7cc7cc7e68bfcb4740b98ceb7157b2432", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770888008, "uuid": "1004e16b-0b5a-4ee8-8fba-327387c8b45a", "comment": "Malware payload", "value": "98ea31ad6cf69f4aeefcf2e2e97f8c04e41b82ab674d52ff1531fbfcbcb643ae35c665df35fd650b0b6263e369b89b8d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888008, "uuid": "1883b127-271d-400a-9909-cc7d8b13a905", "value": "T1ED9612C17B80AAF85E24CE6C135DBAD2FF312CB0A157724F3D47E6ED8C8119B255A261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888008, "uuid": "d5af234f-92f9-4374-9f25-682d5518e2e2", "value": "96:KtD9c8wK1C+4xs89Qkd6mhmiswj318mcsmY2ju6YmmIHKkf0lCHqkt:SYA5bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770888008, "uuid": "92ebe4eb-26ee-495b-8138-b42a2f00e11c", "value": 8890645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770888008, "uuid": "a4ac1b82-503c-4503-b1ec-5df942a3493d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770888008, "uuid": "b5aa4c15-cae8-4d24-857e-12cd60fb79f8", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc07e62-07af-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770858731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858731, "uuid": "bb98db60-e519-4405-94cd-1e0c2e7cf84a", "comment": "Malware payload", "value": "52a34e2268f33da39c41c313d8050103", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858731, "uuid": "d6297515-6cda-401d-9843-a0e19d299fd0", "comment": "Malware payload", "value": "f81bba00dd8c8e14833309be50a422240168801eb61e3da87636a659883fe15e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858731, "uuid": "14ed79ee-d058-44b8-9a92-d2d915e90488", "comment": "Malware payload", "value": "8127fb7381f0cffd15a4074918a257ec5c9ddc1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770858731, "uuid": "97f384a6-7903-4a46-a5cd-003ccd2e826e", "comment": "Malware payload", "value": "e8fdcf53c213ff9905b2d6c99566be637ff5b84255f9e259629d0fb36d10c1e9624417a41d879f3c4cae4aee0421d1df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858731, "uuid": "433b01b6-daee-49bb-a45b-244158b540c4", "value": "T1F3A5E7217C7EB553E9CCB6347761A2ED302E76C5D9E090369EA0CEA985F4B54CE23432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858731, "uuid": "31803d5e-6bf7-43fb-8a17-5fafe6cb9e2c", "value": "49152:Slds3UPXBQSH14vZh7pIDhG9By8uCGUGan5UPiK/K5F7XlzcKGYH0ye8nanVFfl5:Slds3UPXBQSH14vZh7pIDhG9By8uCGUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770858731, "uuid": "69b0114f-d8cd-4d67-a603-b36fdd896d8b", "value": 2120060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770858731, "uuid": "094ab498-b892-4f77-8194-8afd45d072d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770858731, "uuid": "eef69712-a950-4a9a-8b67-08a36982e9b0", "value": "kinsing_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704a6e10-0837-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770916962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916962, "uuid": "7d787e43-c4b4-424d-a2c2-33fe63896846", "comment": "Malware payload", "value": "ce6b2efbff20f8ae34b0c9ffda7a1c71", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916962, "uuid": "00106798-dab0-4a9e-b09b-19e1b0ad08cd", "comment": "Malware payload", "value": "f9056063e6cfe1b2995471ff5f4b5691f8d62fe38e283bff3e7dc11584d42e7d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916962, "uuid": "ce297e42-4c35-4a04-9ed6-c6ecd750611a", "comment": "Malware payload", "value": "19c6dab3b3791369723ae5e92e4372b2d98c123e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916962, "uuid": "b5fd7484-10fd-4a58-8e9b-561265d7f6fa", "comment": "Malware payload", "value": "70c2f5da33974588585b55acb23deb3c292c7120c5de1b5e4d52571eece84db262764f193d59e5312ec375c31e1cc7b8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916962, "uuid": "417ab58a-5403-4480-9667-30d126c6d855", "value": "T171D171217A82E08DE675C3F5E8C3B141FD39906F5966360C77D886412FB2B274B8A14D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916962, "uuid": "1549cbd0-0fc8-44f3-825c-b5fb48670b01", "value": "96:VGC5cQQ0uTkKiMpqBB0GBPCiO0nfpF0RxQD+n7Y405H/LdqcsLqA1:ru04kKiMcB0kJOEBF4aG7S5H/0csLqA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770916962, "uuid": "3b2c0211-3bc3-4058-a3bf-d24c0d63a402", "value": 6246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770916962, "uuid": "c309d833-058c-4f2a-b779-3fb46f54cbde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916962, "uuid": "01c0901a-ba5f-4a88-b026-53c0463bc9f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c619a0-07ca-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770870337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870337, "uuid": "27a5c2b8-4f2a-45ac-9f15-4940f375e4ea", "comment": "Malware payload", "value": "298ccded6d491fe96651a34f982b6fde", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870337, "uuid": "cd4bdd4d-9f1f-46cf-8119-c72b0ea095c5", "comment": "Malware payload", "value": "f90f2b8f6df0c5756244887adf686f8fb0754c3b23103cee8bf38906d56d9483", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870337, "uuid": "92b38340-5f66-4542-b660-2a95caeb189a", "comment": "Malware payload", "value": "edab20818c80416731fcdb06a897bed9a5dcef51", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770870337, "uuid": "310fd9dd-e506-4b46-86fc-702bee6f833c", "comment": "Malware payload", "value": "c1e33817e419ddf76537210ff5836a9b26ae9a654dc39fcf90c71fcd33dacc8b1cb581436a191f8e10bde2e94db6a1d3", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870337, "uuid": "0176e840-f21e-4343-b102-82a23518f627", "value": "T1A9D533BF1467CEFCE004A5F9A73100CE0847133F7F5A6A17C956566E1262BA23A472B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870337, "uuid": "543427eb-8c11-4ca8-80ff-fc6f2d5ba785", "value": "49152:eGlVH5fDrXGsv84DQ1oJNcHwHlc5y43k9ZbwgMohOwASg9NRp/DmnZjYR0YQ42Wn:/lVZNLapZ5K0wlK2iaW2HJxKWoIoiG8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770870337, "uuid": "c31b9fa8-a6a7-4542-845f-dd472e1045e4", "value": 2846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770870337, "uuid": "1cbf19e2-16c5-4421-be07-1f7ed3e2a68e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770870337, "uuid": "99910453-d09d-4040-abe3-dd71ce12e9a7", "value": "SOP TO ACCESS -NIDMS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979cc1ea-080c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770898560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898560, "uuid": "4f188971-25fe-403d-9340-92480d4ad183", "comment": "Malware payload", "value": "74bdd7b404f343a7fb715fd7da72e4bf", "object_relation": "md5", "Tag": [ { "name": "build", "colour": "#E24B4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakezapret", "colour": "#FD5EF1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898560, "uuid": "1276bb14-89c2-44f8-8bd9-621477a5351a", "comment": "Malware payload", "value": "f938eb86d50a0e4551f51ca3ef1abe34a4c73fe6cdf4420dab38003387196e5f", "object_relation": "sha256", "Tag": [ { "name": "build", "colour": "#E24B4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakezapret", "colour": "#FD5EF1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898560, "uuid": "d7e364e8-433f-4ddb-bbe5-c7fdb337785c", "comment": "Malware payload", "value": "b7f36f1d93361a5f9dab508334adee24f08bbc0b", "object_relation": "sha1", "Tag": [ { "name": "build", "colour": "#E24B4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakezapret", "colour": "#FD5EF1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770898560, "uuid": "d7da8791-49cc-4d26-99a3-554f355eab5c", "comment": "Malware payload", "value": "0ccaaa89b399dd727f72bd805eeb592d4098abbb97875fb2f5716597ccc3666d7b4e7a349fbcf20dc64ca489f1845cd9", "object_relation": "sha3-384", "Tag": [ { "name": "build", "colour": "#E24B4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakezapret", "colour": "#FD5EF1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898560, "uuid": "635853c1-41f0-410b-b658-67ee3b91cbe0", "value": "T17117615F8643137DA4A205B64AB6885BBCEBA9D23311ECE34C3A051A13D84F5C6FE5CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898560, "uuid": "abc4dcf8-ed93-492e-8b44-84bf4f48501c", "value": "9c7027b562b2f711c0812b4fdc74bb3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898560, "uuid": "496d6575-bb09-4b09-b756-ee3b617b8ce5", "value": "49152:WbYbRtJIS/NNUOiZJRxIwhIUlmSOKjyvqlrgiO8AN7LD7VcSxn2THV9E/EGV5oZu:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770898560, "uuid": "27d3a041-3622-458f-bfa9-0bc809a1f68a", "value": 18704896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770898560, "uuid": "a28c2eb0-c0ed-4775-b460-3d4f0f07da7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770898560, "uuid": "207bba87-bced-462d-8ee8-6e5fe083c7a8", "value": "zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4392f040-0822-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1770907868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770907868, "uuid": "02e9f279-2afb-4dcc-91f9-d27131d492ba", "comment": "Malware payload (DarkVisionRAT)", "value": "8d958a6e74fb845f6ea8b45ddea8ecf7", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770907868, "uuid": "c0d05c57-552d-4a8b-bc7e-d8303fa60390", "comment": "Malware payload (DarkVisionRAT)", "value": "fb76ed9669c3c728806fa4d349e46bcec2e51f474ac829269e3713f3909c051b", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770907868, "uuid": "d5ec44ac-f412-469c-9f7e-54a8edceb583", "comment": "Malware payload (DarkVisionRAT)", "value": "704beaeed4452fac272c5a77902a6759620c4edf", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770907868, "uuid": "75964746-1c10-4aa1-8ff5-1810eb8b9e62", "comment": "Malware payload (DarkVisionRAT)", "value": "ea0af0fa44d262befe9ea73a5752ab11aee6fb8763ab667976e93a5a0e1aa9a3b07e2c92c6be9158f1b9ff71be1ad758", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770907868, "uuid": "c35dde1a-6700-441b-ab54-70af2fdc2338", "value": "T1DFB4D847EBB550F4C8B6C0388AA26237F971785D5334ABD797548E171F22BE0A93EB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770907868, "uuid": "f9e34c2a-ec94-4d26-aeb2-3334e1caa1bc", "value": "0a8241508ebbe65c17ae6ec3be86cdff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770907868, "uuid": "5f12f67d-c810-4a2f-b7d7-72436bb805ac", "value": "6144:xnLdxFsMwu9hQ6n4hsc10pUDZq36TutqTASyACfts3Eht4FsRo:xnLf6HCcepIZqqWa3Mt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770907868, "uuid": "7d0d3e1a-1fee-4672-b835-c8ca94bca234", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770907868, "uuid": "694de554-c26b-459c-a404-fd7537d4cd4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770907868, "uuid": "e0924da2-7a12-4e23-bc4c-ca24dc42aca1", "value": "something.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d35e959-0837-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770916957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916957, "uuid": "26469e03-b000-4438-8df2-4bdf2ede5dec", "comment": "Malware payload (CoinMiner)", "value": "9ba269a5292b2baa8acb21488c834460", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916957, "uuid": "dd98958c-0f4c-439c-bbbf-8b02cb39ab01", "comment": "Malware payload (CoinMiner)", "value": "fde6dc8a8d086c22dc4a06f8162c2bcddc9727c1898916bf0b6f303027ffe547", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916957, "uuid": "92f31460-8b4a-4083-b3ec-11c6a5f064fd", "comment": "Malware payload (CoinMiner)", "value": "8847713cc1a8ae0d68375203d6b3563a8fb0302b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770916957, "uuid": "04e4dddd-9bf1-4ac3-8edf-e3b210951a42", "comment": "Malware payload (CoinMiner)", "value": "db319dceb0c4bc0a85571c296bea3fdc23be2e852ecf501e07939881683ac640785bb1fafe661d83d864474149b891d5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916957, "uuid": "a923f3cc-186c-4126-ab13-6588a3e6229b", "value": "T1DFD53351AC52B40FC85CADBE1D17D8721AE5D2DAA2FF248C9C6153A80B2E7C76C50EF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916957, "uuid": "b0e89564-18d9-46d1-8d0c-c67678ca9365", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916957, "uuid": "c1724953-4e5a-4225-aa60-f17888b2044c", "value": "49152:fpbe/GGsd/yVz/pyAmrZPYlv4192j1QvXMlcorjVOGEP1bD/ebLydRDusWo+bsy8:fEhsdq5IA+ZwlQQ1Q/MWofVl21bDMOdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770916957, "uuid": "8a225b5f-6b49-4eb0-bce3-56e33fd25b2c", "value": 2964480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770916957, "uuid": "e03d78bf-32d3-41b3-bf46-78736deace04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770916957, "uuid": "62efa18a-e1ef-4417-8372-cc3152d117bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25cfa3d-0838-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770917610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917610, "uuid": "ecb304c8-3f29-4150-9af3-93cd86414ce8", "comment": "Malware payload (Vidar)", "value": "3a47f0b9220bfb50e9340329c3195196", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917610, "uuid": "a806c962-e7a1-4ae6-b1f2-127346afc8ce", "comment": "Malware payload (Vidar)", "value": "fea31e901389f476014152795ffe55103f575b48845e3a744e3e7be3071605b1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917610, "uuid": "6b7c594f-0c5e-4c21-94c9-476952043bf4", "comment": "Malware payload (Vidar)", "value": "e8ec3dc54a15bafcc795bd5e9ca7f89d6f5de833", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770917610, "uuid": "c30c8a06-be52-418c-9d57-9abb909dda2c", "comment": "Malware payload (Vidar)", "value": "452f1b8de7a5d10ebdb7352e8fe6c94a7f69e24a2e07e29caacd3f04d9a09bfe95cf229ef918072e12bf51ed14059b3e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917610, "uuid": "fe509a86-3088-4d72-a570-375aaaf35642", "value": "T156F53811F8A514BED6FEE13094A1521136BD3C6443323BD30A9825BA1EBABD46B3F71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917610, "uuid": "1e6e7001-93bc-4153-8193-14023beaaf7b", "value": "49152:IY8i3+vUpxvtkrXY/Iie/SQTPLtKgwMzABohWLix4wL3SlpxcSd/cgl7HKoc2I9a:bx3NBcgl7/c39Gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770917610, "uuid": "6a18c0fd-7489-42be-947e-f7c14465af0f", "value": 3366912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770917610, "uuid": "37dddb32-c70c-45c9-8ce2-b43f9382925b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770917610, "uuid": "4bc002a3-690e-4a75-88a5-1835aa752975", "value": "e62d154f1b.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }