{ "Event": { "published": true, "date": "2026-06-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-25", "timestamp": 1782432182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "94429031-f650-4b00-ae7b-284604c7e23b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445bad63-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370707, "uuid": "5777cbbf-8402-40a7-a1ce-c32772b8db8c", "comment": "Malware payload", "value": "351fba0f3432816fc50b7830e8b6a217", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370707, "uuid": "5c310f0e-0ac7-4305-a50b-aef88278eece", "comment": "Malware payload", "value": "00c7649a82317ffc20be5dabe4318a2f808a03c640419ccc982feea29c4b417b", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370707, "uuid": "69ea49c0-c488-4e3f-83cd-c3acdb7ed7cd", "comment": "Malware payload", "value": "04a893489526bebba3a83734c4d8d8697dd7788e", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370707, "uuid": "b2053007-7381-41be-b78e-0b7c3c1d138e", "comment": "Malware payload", "value": "3ef510def95079786928cc6bd9143a217ab3f7963c7dd4ded73e6e1bcc896fc0dc35952f40c0bce5cc6e1ed9567b4189", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370707, "uuid": "897de8aa-4dc9-414c-8c9d-eaece423aec7", "value": "T17F85331B1083B62FADB022F1967DE68481D2CAC453155BFAD3F76F3E9054298F25AE4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370707, "uuid": "d2e268df-9358-439f-8d5f-fc64389430f0", "value": "49152:l/dSZqE+23pI61o/m7AOBBoysUfPF2VoSTHaCmAy:lWDVF14m7AOBxsUHF2NTHxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370707, "uuid": "903055fb-e1fa-43a3-9b1d-88deb081be40", "value": 1776572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370707, "uuid": "f2a5fa21-2427-4807-a329-65ae66803519", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370707, "uuid": "b9d69a03-160a-4d24-bf0f-339425029c86", "value": "zswap_shrinkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceaf187a-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390696, "uuid": "e6c2d933-6c72-49d6-9c77-3a91d49edf55", "comment": "Malware payload (CoinMiner)", "value": "8dca820fa28aa408d9686b79a038631d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390696, "uuid": "93df81e6-9cbb-41c0-b5d9-24ff03acef83", "comment": "Malware payload (CoinMiner)", "value": "00c765d93bbf7f11013dcfb30a0143b0d2620e39f4e8ef47c0dcde10663276bc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390696, "uuid": "1711179e-a1e6-41be-b031-b5524419bc86", "comment": "Malware payload (CoinMiner)", "value": "5b764b2e0ef983ce885b22a6019468141548e6ed", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390696, "uuid": "e9c28498-fc35-49e3-86e2-a918d9ce84d2", "comment": "Malware payload (CoinMiner)", "value": "0ea670fd886e2c8d8baffdd7d08f40b0ca2b124cc638645618c4278349d782522df7fa607510b5b77a9e8931582b99e0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390696, "uuid": "4ea47c93-3aee-4378-b774-31a168ca5ab1", "value": "T119F533C4459D27BCD69E8AB4E76E6FC2976F908D43016E8F73E084B02BD36D19B35608", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390696, "uuid": "90ee104a-d2a6-4b93-808c-9182fb5f23c8", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390696, "uuid": "15c8213a-3d71-47d2-a1d8-213b7590944f", "value": "49152:OUwkzEhdvPicJn8V/VZifVwPDiglJCPqOV0c1LicsKplzH8qI3vbGxD7i1xrVcD:OU9zELacJ89f427igSPB/zc1GFG9Vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390696, "uuid": "f8e4eb36-b7a6-4b99-8de8-388117e20d74", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390696, "uuid": "36e76647-09a4-405a-b762-6292e1bfadea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390696, "uuid": "0acc12fe-676b-44ae-b1c0-7b7e9b234f74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0819071-70d3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782419100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782419100, "uuid": "607c3110-35a8-42ae-a16d-4a816b94566a", "comment": "Malware payload", "value": "a123b45c69ed9c8c0673a436efd52014", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Datzbro", "colour": "#5C16B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782419100, "uuid": "80b916d3-c15b-461f-b1c8-74099337d548", "comment": "Malware payload", "value": "017c798ee129074e96f14fecaef1a924396adcf4e426f506ec668789c3e8fb44", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Datzbro", "colour": "#5C16B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782419100, "uuid": "6c0184c7-3827-4e25-9e6f-6901935d1f4f", "comment": "Malware payload", "value": "b7c7c0dbb708833bb30c6a000a1ca514ab7c4e8a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Datzbro", "colour": "#5C16B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782419100, "uuid": "a4d61ed1-a073-48de-aed0-e8dfd1d40cd5", "comment": "Malware payload", "value": "2711117f074c17e5f908d1614ce3cb2ab288c52a92fbf97fc4af7c740b9f4cd59bcabb288939980454419646c4e85117", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Datzbro", "colour": "#5C16B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782419100, "uuid": "ab45a8f9-f94d-4780-9bfb-21d6c4927ebf", "value": "T17416CEC6FBC8A96AC4F71376C93582A644474C268B83DFD36D15763C18BB6D00E5ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782419100, "uuid": "4edcbf3b-4877-4aa5-b4ac-c3779eddfc8a", "value": "98304:wfPENpmUGMQwA1QoF0iGxAKyY7WYWoE1iRoTYrVmx:wfWpm51QIPKyY5XIia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782419100, "uuid": "146c9777-c80c-43d3-afbc-b1cf8101e779", "value": 4237430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782419100, "uuid": "b9a6558d-59f6-4c22-b0af-bea067ccf88d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782419100, "uuid": "b5c2d5c8-25e5-4409-95ea-c66b47f52960", "value": "target_app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0cfd18-7093-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391254, "uuid": "7dd92471-678f-4403-bb6e-d83924dc260e", "comment": "Malware payload (CoinMiner)", "value": "48c371568ae1e9a7e0b7d094c0b0994d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391254, "uuid": "d0e8907d-3444-4f1b-91a6-ce3b6fe0902b", "comment": "Malware payload (CoinMiner)", "value": "0205aa7b8a0852633918bb36f7b961ea61e6bfb0eec66690a946a33adef4f166", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391254, "uuid": "55d67469-0473-4cc2-97a0-0c1952df0503", "comment": "Malware payload (CoinMiner)", "value": "c0261b0ca2acdb7654f4daaabf85a41a8befc7a9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391254, "uuid": "a762e7f1-730b-4777-b514-340cd40ea5ed", "comment": "Malware payload (CoinMiner)", "value": "7ff59916c69958c12ca3a6db0bb195099b2cffe899a080a3b3972c2398a9cf182f3cb5bcab4676d274a5e16790e08812", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391254, "uuid": "250f9fa0-906f-4dca-945d-b3afd55bff62", "value": "T1A6F5339221A3157EEC17B0325F127F19AD3FF2580F11A9FB33D698A969A2FC81560F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391254, "uuid": "cae2ee88-82e9-44bb-945d-3e7f56202da0", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391254, "uuid": "335a0fde-a434-4129-a098-c18c1c72cb70", "value": "49152:tn7LWbbc8la2gsLxLAD29BVOH5cV3ChDAOOrUV4OAvgspFEcQKVA26K:tn7LS/dxLAarV65eiDAO8e5AvgspFae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391254, "uuid": "14604ecc-4f64-442e-a28f-f5086619c8f1", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391254, "uuid": "dc5b1e1a-5882-4e41-8cca-ff4d92c8e658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391254, "uuid": "fea06f41-b612-4f1a-aa38-8af87eb47d60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5ce414-705a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1782366827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366827, "uuid": "82cfa5bc-674a-46e6-b406-571d75ee6fd2", "comment": "Malware payload (MassLogger)", "value": "07d6596913bc61d8355901940a3adbe1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366827, "uuid": "0b3c0b75-9f41-4186-917a-57a8fa2d9144", "comment": "Malware payload (MassLogger)", "value": "022b876ca9d0ab0ed7ac4619763a389681bb593ab691371ef1098a4ed1f99d6a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366827, "uuid": "e6e0baa3-92c5-4614-8b92-b739e4a5f290", "comment": "Malware payload (MassLogger)", "value": "57bd6e2c49995077bbd30162aaeaeea1564323ca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366827, "uuid": "a3f67a2b-1799-4d5f-b280-a32c133ba137", "comment": "Malware payload (MassLogger)", "value": "47d88f7eb8175d896b88ecb067bb8e3440e4f4313ac04dceeeb8d47d7a314d18e32637dd8cbcf2809f127824964d2ec9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366827, "uuid": "3a1a2a01-d654-4dea-82bc-11bbbd8bfa10", "value": "T18296F8A7A798C616F4F267C955CD88C6A98D30C327FF483260792FDC3B62544A8B164F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366827, "uuid": "3d5eacab-0fcb-4c5d-9958-1892ff082d0d", "value": "6144:wPLkp03F08MxCe+UfGvEy/E31gJWpmMxl:wPYp03Mx1f8xu1gJWLxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782366827, "uuid": "8ae977fb-d7f8-482f-9781-562108313970", "value": 9271034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782366827, "uuid": "3ab709ff-1c74-458c-ac7c-8f87049e4461", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366827, "uuid": "f91ab063-1a01-4807-95ed-90685bec8ca2", "value": "ENQ-PROJECT-U2RPM.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f570a2c-70d1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782417997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782417997, "uuid": "84818e33-2183-4c83-ab17-21c33176c676", "comment": "Malware payload (Mirai)", "value": "444fe7bbed3adaa8cdaae4237f964b8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782417997, "uuid": "32d91b9a-c25a-4089-b812-199f9fd478e0", "comment": "Malware payload (Mirai)", "value": "02cb2c50ef08bcbfae632316ad3e43961980bbeb1ba5213f15d3dd1801762f7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782417997, "uuid": "35ebe5ac-729b-4542-bf28-c58242107eca", "comment": "Malware payload (Mirai)", "value": "03c882b2829c259f560fb80409edfd20eea0ef9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782417997, "uuid": "9c9023fa-60d4-4d3a-9315-de0af0c929b9", "comment": "Malware payload (Mirai)", "value": "2e822d6065f86053595ed7fca4fbb22fa4b61cf547520fae977c700d789e21b4b4c9932ac669f8ecd806ad08b7391f7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782417997, "uuid": "3f6cb60f-1a8e-42d6-a6f4-af8b1569f2cc", "value": "T139934A03B58584FCC48AC2740A2FA539E661F59D13347A6A37D4FF226F5FB201A2DB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782417997, "uuid": "54190a93-c179-41a3-88b5-6e453a58c148", "value": "1536:i3oDFj9phtWk/TmcU45LgpfWFGMRI+chAJaELrwm4CauXVQj:i3ohjWS84+UGMRcAtrwm4Nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782417997, "uuid": "ec1c6ca9-2f97-49ba-9d00-aac5de3c0bd0", "value": 89856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782417997, "uuid": "793a08b7-a13b-4193-b6f7-30896a631976", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782417997, "uuid": "35b8dd23-e5cb-464b-bcd2-43c33654dc7c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8436e1c-70e7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782427703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782427703, "uuid": "ae621db8-b74a-4311-bc5f-87488d3145ea", "comment": "Malware payload", "value": "622cfd2b5012a4c09468b321277ae52b", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782427703, "uuid": "b13889a6-3f1a-4162-994b-a4f92b79f0c2", "comment": "Malware payload", "value": "0302139c32c4c30676f194666cc902f9309be29afa53861866f3258508702360", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782427703, "uuid": "2eced049-b02a-49c9-9f6b-c171b8b6174d", "comment": "Malware payload", "value": "ba5eaecccbb5cf1e1b56dbaccac80069aa151423", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782427703, "uuid": "54650800-3c8b-432f-8bbe-40b83720ac14", "comment": "Malware payload", "value": "c79914b5a8c30c7af54a25d207d8c3380cadef5a836dfde7a19225f295d4ad9593740c4f998843e4b1d68103aaf1d0a4", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782427703, "uuid": "6f5d9d1b-5925-42eb-9e58-7596452a9b2d", "value": "T12BF61273B389A57AF0690B35997295E0143F6EA1EC024C0B96F0B87DEF351613E3B646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782427703, "uuid": "193631ef-ca59-43be-9e9f-8988de70e25a", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782427703, "uuid": "5382995c-6010-47b7-b9dd-e6fd2e864d7a", "value": "196608:qF+ctA9P/8vUy+hMYs5HM/hq8JjKN7z9B9D:qNAtwM/hnjc39D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782427703, "uuid": "9e535a20-410e-421f-bd94-a2800c164b79", "value": 16171737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782427703, "uuid": "8c120507-9f03-4526-aaa9-4037a32c99e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782427703, "uuid": "2c99477b-c1ec-4f97-8022-0e0fc9445b5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f068102-70b4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782405622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405622, "uuid": "3678fbcd-e908-449a-ac77-e677a7bfdae7", "comment": "Malware payload (Prometei)", "value": "910e2f4387f87ac9118ff898cbfc13f2", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405622, "uuid": "e593bc67-e0ae-4c64-8c43-952fc8df65c8", "comment": "Malware payload (Prometei)", "value": "0388ba5c64e193a739485d608a40bde412ec385e7a91a8080b98afee2cf95fcc", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405622, "uuid": "89bfce0c-67ee-4dab-9e60-07e227f30ac1", "comment": "Malware payload (Prometei)", "value": "aea2ac38985b0c0b43dc81a6caf81696b2449b3a", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405622, "uuid": "90674749-9d2c-4b2e-a3a2-741b21bd6668", "comment": "Malware payload (Prometei)", "value": "35cd5d1bc0e4301114edaefeea6b927ae388f66f62b994b6fcf9ee5866e6a8dc7f8ee16d1d3585b41bb86df5de4a87c7", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405622, "uuid": "c8bc7c7d-2dc1-4d92-a614-be2b617173b3", "value": "T18CA423B4F9219E9F6DD76DB91B24831DE182C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405622, "uuid": "690912b7-dc50-44be-ba37-8cbf8c051a82", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsd9:Fs6pyCC/Ya2hpi6T6N4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782405622, "uuid": "c6c9083c-32ef-462d-b678-f11840356183", "value": 449077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782405622, "uuid": "ed235c43-eac9-4640-bad8-d01e309a9e46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405622, "uuid": "4af9643a-80f5-43fe-be46-36028fa20e5a", "value": "0388ba5c64e193a739485d608a40bde412ec385e7a91a8080b98afee2cf95fcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bcb3ea8-707c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782381403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381403, "uuid": "4c289691-d3e5-4d44-b8b6-343b02813d49", "comment": "Malware payload", "value": "41fa3fc243b9a9de9df403cab5b61b64", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381403, "uuid": "80eaf351-a7bf-442e-bbdd-9113878ed3b0", "comment": "Malware payload", "value": "050b6a00ac55da93800da30ce35b6b194a46e58dbbf2097fa60216923c8845c1", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381403, "uuid": "29ce8664-a6d9-4857-81bc-2494a118c6e2", "comment": "Malware payload", "value": "34d2000edce7792d3b6c0bb615cf90ffb2d474cb", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381403, "uuid": "b1ca4127-c9a8-40bc-99b1-af8ea293b798", "comment": "Malware payload", "value": "9dedbfa6a4d729f29fa1978c74d118076775d0fcb66ef150aa3336764b35130c3c3928cf44332721a09a0eb90ebcefb7", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381403, "uuid": "ad2bc6eb-51d3-4eea-ac90-6f6e0140c8a6", "value": "T16622B0AD7E582E1D56C261E103C9B810498B7F9320C9E5D46ABC651BC5421385FEF98A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381403, "uuid": "5671b378-7f7f-4b21-b793-39cca3ba4c10", "value": "192:6d9iFznkGC5xU4PVgz5+NTZ9MBRLjK/9clOTmS0CppPaWelVXKfVHWadn:6d0lnMc4P8SDM7HKFcl20C2WkVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782381403, "uuid": "101fea6b-c40f-4ca6-93fb-542ff8ea06d5", "value": 10232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782381403, "uuid": "cfb27932-459b-4d48-858c-67668a29ba95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381403, "uuid": "97ae99c2-0c32-4c30-aca8-427973cc8173", "value": "config.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4288459e-7029-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782345793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782345793, "uuid": "abfaaa0c-e6b2-4b51-bc5a-e99456f806c3", "comment": "Malware payload (Mirai)", "value": "629ef7a4470c14ee2f3e3fd0210d16d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782345793, "uuid": "045ba6aa-ae60-45f8-b8f6-732ae9c51d22", "comment": "Malware payload (Mirai)", "value": "063e70ebc453de4191e8b37a8508763cccd328fb44c9309ed44c4c13b729f4a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782345793, "uuid": "4f092304-489d-4b33-bbc2-f29f95ac2c74", "comment": "Malware payload (Mirai)", "value": "2b89b384c58d58096c80ece4dd5d1dab50695a15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782345793, "uuid": "df40f3f4-d17a-4089-a4a3-4c2734f7bca7", "comment": "Malware payload (Mirai)", "value": "e9f346a0b72704901f94e6cdce469f4ace36e3e0c3dcc6f14ae136ab3ae57d1df7eaf7a302d00b6ff250a4e205f9e841", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782345793, "uuid": "284fa689-9465-4925-a96b-1df3dad07fc6", "value": "T129B34B5BAA9D3EDBD2C2473D8A82AA701117F47ECF0383721F11528DAE9EA8DDD94444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782345793, "uuid": "434e9e9d-969a-4059-8c43-887cf17e79b6", "value": "1536:EP0lWTj70B+yncrd3c84PVcehLDzaLmgvBbswvgpsYpDAQ:WawP4tcwqLmmNhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782345793, "uuid": "4f1c76e1-9ded-45bd-8f99-eaedf6f46f7f", "value": 109600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782345793, "uuid": "698f4cdb-1ec7-45cf-ade6-a0383ff496f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782345793, "uuid": "d023ddd8-c088-4b7e-a1c7-146e39a51989", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff19dae-707c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782381410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381410, "uuid": "f4512937-ea21-431b-928d-422775f1ec76", "comment": "Malware payload (SilentNet)", "value": "7a30291f1a518f8ac56c1a57d62d3d99", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381410, "uuid": "c17483e5-5fcb-47a8-a4da-b1971b0885a3", "comment": "Malware payload (SilentNet)", "value": "078c76f59091a9682a7549da19f32c4e428513fa356058dbf02397a3523fa690", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381410, "uuid": "46570b57-6b86-461a-8558-4bca850cd307", "comment": "Malware payload (SilentNet)", "value": "fbab6e8620eedd2382a660cdbdcca40e07cce108", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381410, "uuid": "021f8bf6-de18-4dbb-a2a3-1b228b0a80f5", "comment": "Malware payload (SilentNet)", "value": "40658d86d57face7b1c3f5b727162250587e8e864e767421ceae38fdd8b793c21394e71124609fc0ae409fb17edf3dee", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381410, "uuid": "24a0d0ea-67fc-4fb1-aa00-bc6af48faac0", "value": "T1F5B4F1EBB9969DCEE50FE43B00818022F964E0DED44DF90F06B6019989A7DD83B15BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381410, "uuid": "2ba7d25e-79d3-410c-9512-182fefa70810", "value": "6144:Vaiifwf6XYUxi6qUWE57o3AGpCy63ydEnaYYKiB0FZviqCZhzyiF//:cYD8iJUlopdBEnabKHfvibheA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782381410, "uuid": "7fc732e4-92e2-445c-b287-64a69c2d488c", "value": 528231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782381410, "uuid": "a2843c19-e3ab-4527-b304-c0e41740f41d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381410, "uuid": "18cef3f2-6979-4cd7-9428-6da8d97b7c79", "value": "Donut+dupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d5cf92-7085-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1782385534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782385534, "uuid": "2002b96c-777d-4a65-aad7-8e759d0e7ae4", "comment": "Malware payload (Stealc)", "value": "a61025e3511cf9700a38e681a1fcdc81", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782385534, "uuid": "d53fcb64-6014-4cf7-95f0-2cb4c27de701", "comment": "Malware payload (Stealc)", "value": "07cc22c1db2b39a7fc3058b02ec15225b2945e4866a9a0e84b8f73672ae9bcd7", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782385534, "uuid": "0b2aa66c-73dc-494f-ab5f-b38e16d2fa81", "comment": "Malware payload (Stealc)", "value": "7277c32465833b8146cbb896341d7fc35b109b8b", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782385534, "uuid": "6ca8e122-060f-4848-9a38-777bd293ee85", "comment": "Malware payload (Stealc)", "value": "4309e92cd766fca5e7e6adf58a71f4e41a2c03d93681649277d9e5f2402cd85aa41116f87a018dc9359b1ba63a7677c6", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782385534, "uuid": "ce4580f4-74c9-4974-b9f9-8196559a5171", "value": "T135852315A3E4E06AE0B5237488F6C08A9A317CB28A3C665F32D87E3F1D735D69631F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782385534, "uuid": "fd1bd6eb-9bfa-4231-bbcd-c73f28e394d4", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782385534, "uuid": "7fcc1619-673e-4997-b10f-1663ed012542", "value": "49152:kHvvt08QyfTNQp7wOxmLwMYIuxuCpI5jpY3gGeoj8rEkfN:8v6uQVSY2mijggGeoYr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782385534, "uuid": "e4c6b869-e53b-4ef7-9c0e-c1ec0813835c", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782385534, "uuid": "56b6be90-48e2-4083-8ad0-9916b8a029f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782385534, "uuid": "8d74539a-c822-4cd6-ae52-f6f8a10a2720", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b32812-70bf-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782410242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782410242, "uuid": "e95ea5d5-4569-447f-9f1b-fa3f400f4b55", "comment": "Malware payload (Prometei)", "value": "647765644b203a86d3124993b021c98b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782410242, "uuid": "9e733708-db04-40da-8b4d-1c3aa378f568", "comment": "Malware payload (Prometei)", "value": "09f9634edf9c362eedfe04544537e6c8cadd667315bcdd5aab70f4c3fa0b056b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782410242, "uuid": "5ee4d612-f1cf-4ecf-ac96-a23f9be9fd3d", "comment": "Malware payload (Prometei)", "value": "42f3e80f1b8fdac1e2ac3e3f83faba29d7e33aa9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782410242, "uuid": "041d1aa8-f461-43c3-9166-486362a50c58", "comment": "Malware payload (Prometei)", "value": "72b6988344a678f16864ce57e167148767164da8a25a291998080b3090c5fb6ce630f877276cef27953330d1bb12cb0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782410242, "uuid": "8f28514b-9e3e-4257-b82a-17507282a9d6", "value": "T1B1A423B4F9219E9F6DD769B91B24C31DE182C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782410242, "uuid": "c514949f-ed27-4a90-a5f9-9139dc5edb48", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdP:Fs6pyCC/Ya2hpi6T6N4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782410242, "uuid": "8b4d0adc-5508-4cb1-b880-e7c760bdfced", "value": 449053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782410242, "uuid": "0180d9a6-f968-4819-9f08-ead6286f4244", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782410242, "uuid": "35b3aef6-25f0-4dbc-a5ce-b94f10291054", "value": "09f9634edf9c362eedfe04544537e6c8cadd667315bcdd5aab70f4c3fa0b056b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5220ed77-704b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782360422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782360422, "uuid": "cb8f0adb-c0d1-4f6d-936c-525faf65cce7", "comment": "Malware payload (WannaCry)", "value": "d40f14f19c72f1d54250c94bed057906", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782360422, "uuid": "b60b9f1e-09da-42f6-952a-096200db2142", "comment": "Malware payload (WannaCry)", "value": "0b2d6d916b7c65a1ad734ae0798f48edc2c466165c82e60c8f30e82cf2d0cd11", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782360422, "uuid": "590bcf50-7da3-4a6b-bd0e-63161462fe1b", "comment": "Malware payload (WannaCry)", "value": "e824f2c27a3be826f723b98f60161c753456d7db", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782360422, "uuid": "39bcc7b0-cad1-426e-a2b6-6882b77231d2", "comment": "Malware payload (WannaCry)", "value": "483d1a80a3e70865bc4effdf4a7f88f70f410fe2de7c693ba8c034fb7f5640a4799ab3a1ab0836a937cbcec5d3127546", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782360422, "uuid": "480acd09-f7ea-46b4-acf3-1afa9ed2e045", "value": "T1DE36E115A1E86B64E7F36EB2217B871007797E45889B925E1760A04F0C33F5CDEE2F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782360422, "uuid": "222d2a65-3aef-456d-8bd1-5a03b674c11c", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782360422, "uuid": "0a2b36d7-a0ba-4385-87d4-f93da65e4248", "value": "49152:RnaQqMSPbcBVQej/1INRx+TSqTdv1HkQo6SAA:1lqPoBhz1aRxcSUbk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782360422, "uuid": "495ae2df-378b-4f34-b9b4-e03a0fd61ae6", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782360422, "uuid": "681ce1ff-f227-4274-bc56-09c0ed096308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782360422, "uuid": "c8254b02-7191-400d-895c-82aec144d5c6", "value": "0b2d6d916b7c65a1ad734ae0798f48edc2c466165c82e60c8f30e82cf2d0cd11.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01021a52-70b1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1782404095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782404095, "uuid": "c21be623-8cef-414a-af80-d6b485a5e38f", "comment": "Malware payload (Stealc)", "value": "1ce66659db50b6a7bd8e62d6ae432330", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782404095, "uuid": "f8d93b8a-ce58-449f-a6b5-c9873a23110b", "comment": "Malware payload (Stealc)", "value": "0b466e164af0e6da4b2bf92d17ad8e931da9ed5b12ddc89dfc74f1bfcd5e90d1", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782404095, "uuid": "add61be2-f367-43e0-8c67-e264798fb30a", "comment": "Malware payload (Stealc)", "value": "9a972fc5c4a10f75eb445cc9a4fc54cc291747ce", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782404095, "uuid": "a9c3fb7b-3972-40fb-8796-ef8ceb15ef5b", "comment": "Malware payload (Stealc)", "value": "876fdb28d513c07686620565ac1e6fce0898e781fc813fd65417f380a247ff0e4298c8270c367a1076d181a755146dfe", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782404095, "uuid": "7303ff77-02c6-4a41-b0e8-52623bcb0b66", "value": "T1D285232962E49449CC35177884F281E7A0353CA19B3587AF33C5FA2E2F33AD49674F5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782404095, "uuid": "236f5175-0c91-4c44-aa2a-13408922f952", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782404095, "uuid": "41ba5b74-d164-459f-88cc-26a2877474fe", "value": "49152:JHvP+Bs38si5khXnL7VHTJy0Ik5KTpDBcIJODSRteY:9Pb3O5khXLxzJYEuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782404095, "uuid": "a7f20f43-67a4-496c-98e0-21be2cacffa7", "value": 1769472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782404095, "uuid": "e89b2570-a923-4c3b-97da-8daa3599dd33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782404095, "uuid": "060090ae-da13-4a9a-b1cb-846e73cb0dde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0fc3ac-70aa-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782401511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401511, "uuid": "d2510347-fbbd-4daa-b030-79fffd1ca9f2", "comment": "Malware payload", "value": "9d9c592d10a7ffe8edae3bcd1ff2b72e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401511, "uuid": "0ee15355-390a-4700-8a63-a77118e33312", "comment": "Malware payload", "value": "0d4732232d5422f5c0705076f544451a46e490c900dc33fcb221ac219aabae4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401511, "uuid": "e20c522c-c623-45a8-8fd1-31b293cf8a36", "comment": "Malware payload", "value": "28c8867db876befbca0b2517e10d0267913a5cac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401511, "uuid": "3b9b845f-2bde-4013-b391-455c5581dc83", "comment": "Malware payload", "value": "e68a546e9f2e7048a6cf034d264b09eae1fd0ede3b3c4fe91d28c47f3c8850b5813d9401ad252cabba9ea63c1367a375", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401511, "uuid": "3861e064-8048-4436-846f-14da1aacfd6a", "value": "T18565BE9C3611719EC867C972CDA46CB4AB206C76931BD203A4D709EEF90E59BEF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401511, "uuid": "dad75f20-f290-4b2e-adfd-e0474f8d52f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401511, "uuid": "ada881ba-b669-4a9e-b2aa-6c3bf3f4c88f", "value": "24576:LwA/2/zKODA7/43Wv73aPu0WN37kgczdTMwHKjLA7G:LZ2R3WTvVYdTMkKnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782401511, "uuid": "aada4f22-6373-4909-9eee-f56347df56f5", "value": 1536512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782401511, "uuid": "fc12abf0-a8f7-4b7a-b424-4371ea2be3a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401511, "uuid": "ec12d23e-4a6e-4fb1-aeb8-2cfaac405104", "value": "SecuriteInfo.com.Win32.MalwareX-gen.75361541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9937b9ed-7075-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782378580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378580, "uuid": "54a4b4a8-f69b-4478-ac2f-1755c2cedbc0", "comment": "Malware payload", "value": "52378ad598c84a7a1c7f067081b072e1", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378580, "uuid": "a63ae80b-6268-4474-82dc-877fccf37bce", "comment": "Malware payload", "value": "0db5f977a520eb406d2322be4d1443c84994c0246a50d93f4546dc2bcda3a58f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378580, "uuid": "5bd0fefe-99e2-4209-a489-2cb6fef87f36", "comment": "Malware payload", "value": "08090821817ee066ad162d7814e84344341f168f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378580, "uuid": "e5c35707-79bc-4b5c-921b-9c09671c3854", "comment": "Malware payload", "value": "67bebee29c678b31247c18a53a0546ff1ad864bdd7b6ff06607fba353486df02f1dac3bec281ca7ac148d901a91cc0f1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378580, "uuid": "a1ccaf85-c4ca-42be-8235-29292c33f6e1", "value": "T13E96F55B93D403EE01B2B106E84D3969FA12C4BC6B3693652D58793D33B6638933E5F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378580, "uuid": "13e013ef-531c-4f36-98ca-f7870ec00d52", "value": "49152:hrkZqaC0s27+CkH2bFdllMOHShshFhhxK1omSWaX9uerxNjPdN0NDi2kyR1a8fKl:hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782378580, "uuid": "2c6fa634-9ecd-4b00-8e8f-9aadf77adda8", "value": 9026320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782378580, "uuid": "c34929dd-0a5a-4496-aa07-877b28a88865", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378580, "uuid": "791bcec0-d03a-4be2-a051-6c93b0b2a4bd", "value": "nouveau_curriculum_vitae.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9f556e-706c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AndyDesk)", "timestamp": 1782374744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782374744, "uuid": "ea0ac3cf-e533-4a3a-9afa-f158b134ed33", "comment": "Malware payload (AndyDesk)", "value": "144a0a499e007931628c98f38929466f", "object_relation": "md5", "Tag": [ { "name": "AndyDesk", "colour": "#5D99FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LibrarianGhouls", "colour": "#E40994", "exportable": true, "hide_tag": false }, { "name": "LibrarianLikho", "colour": "#FA213E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782374744, "uuid": "c6790b9d-444b-4819-894c-1df38a63028d", "comment": "Malware payload (AndyDesk)", "value": "0dc0fa727f900ed5033f46f8ba6cf2d97d20ab95fd334cabc0f216da6e0622b0", "object_relation": "sha256", "Tag": [ { "name": "AndyDesk", "colour": "#5D99FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LibrarianGhouls", "colour": "#E40994", "exportable": true, "hide_tag": false }, { "name": "LibrarianLikho", "colour": "#FA213E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782374744, "uuid": "5c3ec691-0abd-4087-aa5c-3afebefcf809", "comment": "Malware payload (AndyDesk)", "value": "c7eccd855d2e97b57420afd23a4b9261f42f5b84", "object_relation": "sha1", "Tag": [ { "name": "AndyDesk", "colour": "#5D99FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LibrarianGhouls", "colour": "#E40994", "exportable": true, "hide_tag": false }, { "name": "LibrarianLikho", "colour": "#FA213E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782374744, "uuid": "ce868767-f8d9-4bbe-acdd-40f420090dc3", "comment": "Malware payload (AndyDesk)", "value": "e7d2a3338ad282a6e6ccdaae75f14c886dd6159acfeb326a40a3460802563fdf901676e4ebeb4c9e7b5b76b930af7de6", "object_relation": "sha3-384", "Tag": [ { "name": "AndyDesk", "colour": "#5D99FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LibrarianGhouls", "colour": "#E40994", "exportable": true, "hide_tag": false }, { "name": "LibrarianLikho", "colour": "#FA213E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782374744, "uuid": "218cc044-acc6-4f98-b62f-60530577e04a", "value": "T181751228A0D2D231C1929FF4CCA781BAAD36BF4446F985C7E2F57F05DA372A6181534B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782374744, "uuid": "b637d9f3-2bf6-413a-9d31-0f7837fefad8", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782374744, "uuid": "b008b489-0242-488c-ad60-693212a73919", "value": "24576:ZAT8QE+kdhyUgCy1fTqIiPiUzhSemc43mJv3FCx1RxJrlDC7HCJzvDxwjhMgO:ZAI+zpqIil8WlFG3xJ9CTC9DxwqgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782374744, "uuid": "6565ad15-94d2-44c9-b618-3246543d2437", "value": 1569618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782374744, "uuid": "2d5842a1-de68-49b7-a8b9-14208496f950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782374744, "uuid": "bd348d25-b0c3-4d53-aa34-df831ebf4cac", "value": "\u043f\u043b\u0430\u043d \u0437\u0430\u043a\u0443\u043f\u043a\u0438 \u0441\u0440\u043e\u043a\u0438 \u0438 \u043a\u043f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94bd9f66-70a0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782397041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397041, "uuid": "3e9d0a0d-a822-429d-bb58-084a830f157d", "comment": "Malware payload (CoinMiner)", "value": "5a54ce4005ca964c0f690ce5fcc521c2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397041, "uuid": "b32720c4-c8b5-40cb-8d6e-05a62182e3b3", "comment": "Malware payload (CoinMiner)", "value": "0fd0cb3b4d131fcb375930de708a2a777c2e7dfbe6b81f833ea86000ae043206", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397041, "uuid": "44391bbb-bf50-45a1-8b1e-3438fb21f485", "comment": "Malware payload (CoinMiner)", "value": "86886f5208f4b7bcd5ace35c7eb762d914add596", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397041, "uuid": "c0832177-44c9-4c26-adbc-0708421ddd4e", "comment": "Malware payload (CoinMiner)", "value": "1c58dfc95f206dcd06c6b3bfb51631311e83e70a1f360dec46cb234b5d2e9376a5699a7c561565746879eef06cbea3f5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397041, "uuid": "5d12ee0d-d550-463d-90c2-23c9d855cb9c", "value": "T143345B0AF652E1F1F5A76531018ED37A1A70AD354152D896FF4B3EB0ECB1606AF1A32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397041, "uuid": "ed87b6a8-5b2d-4669-b483-6c411f859250", "value": "6144:XP7fMuCu360OeZj9iiCWBr6CYDnZw+W3TDZ6PWq:fDYu360fZjJCY2CYDSjD96+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782397041, "uuid": "d493ff50-1ffd-4260-826a-3020079fc2f6", "value": 239032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782397041, "uuid": "d5ae8529-077d-4860-a814-c42c4c01cd48", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397041, "uuid": "784a2c22-303a-48f0-bfb7-b5c61c6df7cd", "value": "kworkerd-events", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ddba34-70a1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782397520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397520, "uuid": "f4315b63-29ed-43ae-a234-ec54b493d71d", "comment": "Malware payload (CoinMiner)", "value": "019edf383a054daaff02ac52c47bb1e8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397520, "uuid": "a355cb82-2044-4b55-872a-980d291b29f7", "comment": "Malware payload (CoinMiner)", "value": "1010e0217b8d988721cfb0097cec8a6047edb9fe602e58124cef9e30c20d85df", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397520, "uuid": "5eed5be7-3cb9-4b85-a222-44f48a078d00", "comment": "Malware payload (CoinMiner)", "value": "c29246dc7bf9a68806e39c502fd500311f610383", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397520, "uuid": "dc1ba195-98b4-4ea7-9709-692faca28199", "comment": "Malware payload (CoinMiner)", "value": "ad5775dcbb6ecf144de57cab0f2c9ba56384156ac42ca620304032cb04847c217d1b933f5dd976582c3232f198ed48d4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397520, "uuid": "9411067d-fa16-4509-8a8b-afe39edf669a", "value": "T134D3123986471444DEE3E47B4AE8D6017F5A88EEB3376D9863A0444FC7439E932F249E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397520, "uuid": "622736fb-577d-4e67-9df4-bc684023b4d9", "value": "3072:q/FxazaXImjhfAYkL+MIPB5v2mJM+4/3WDzfHfaQeVZ:qK+ImdAP4v2d+4/3wHiQsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782397520, "uuid": "f0ef4dca-4ff6-4c33-8d13-212571d4dd09", "value": 131552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782397520, "uuid": "603621d4-dcfc-4ce5-b4a2-5bc73af53e26", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397520, "uuid": "b1e8cfe9-f086-404d-8d7a-7dd3815eb21c", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0248baf5-70e8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782427719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782427719, "uuid": "e6aa3d66-31e8-41b6-91be-db029cd4c679", "comment": "Malware payload", "value": "68670b222dfc2828e384592887c6b537", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782427719, "uuid": "3b1805ee-2d71-430b-959c-e22bb5c4ecb4", "comment": "Malware payload", "value": "10345460a079cca7a9c254c7f161c3686d3fb28fe5ee7c6d7f08007c551e5ebe", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782427719, "uuid": "c0d3e36b-ffa8-4036-85f1-f1c5bc702f14", "comment": "Malware payload", "value": "8f548c900616a72a2ac96b3d9843891728ef7d80", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782427719, "uuid": "33c5244e-9737-45f7-9279-a9b9fc3cf766", "comment": "Malware payload", "value": "e3828dde85a7f64c6cd4eeee59c14c46caa7c4cfdd7e82e011b01070f5f0ae90dc4c8a6c213cc17d3d8fee717bf9d3b9", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782427719, "uuid": "2a841181-53a7-4a25-8163-68512d459a16", "value": "T176F57B07BDE108E9C09AD23198B752897B75BC480F3227E72EA0B6782F767D05D36B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782427719, "uuid": "6fd632bf-46ae-4bd6-8dbb-7209387d331b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782427719, "uuid": "ca9bd26d-314d-4a1c-a016-7132eb944fe8", "value": "49152:UpwBZ2wJ7pXd53A3oVrGOKo52/o/Dt8y8QIzxW+nIr8EwYcfDe2vl7/PH3o:U81Gfo52/8t8eIZIr8EwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782427719, "uuid": "0a8c570d-d588-4366-ad20-0b30a2460685", "value": 3529104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782427719, "uuid": "82d02924-7b93-4d66-a505-bf44885e4c39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782427719, "uuid": "4d3f0789-d6bd-44e6-98e7-6a2550f7a028", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33568be-70bb-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782408662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782408662, "uuid": "24d1f49b-f878-4b23-b6b0-cef36be0ed17", "comment": "Malware payload", "value": "d235f2054735ff53cf93f1c2e067430c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782408662, "uuid": "b7e0b210-7d7b-425e-a15b-93af3d5ac5a9", "comment": "Malware payload", "value": "12097f9321ae6226dc089829d626fb9df46f34a8ba941988d1fd5f6c89d2d125", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782408662, "uuid": "9d849442-690b-4786-b880-0e61982a9787", "comment": "Malware payload", "value": "c66f002c8ea1c84e2361963feaa2f834a486487a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782408662, "uuid": "6434346d-646d-4624-8d4e-2731209e5001", "comment": "Malware payload", "value": "6a672264a3d94d48b7a1ef3adfe2be2e092e132210a65a54527c85c2127605565a1012e2c3d4b74c9ebc898b90b235e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782408662, "uuid": "dcc21bc0-12b4-47c4-9235-22948ad848b0", "value": "T1B9D68C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782408662, "uuid": "c6a1c841-7ff3-4acc-80a4-561dbc409609", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQt:cqYUQuVDt0TZEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782408662, "uuid": "1eb35360-0ba7-4a35-86f8-80c3238e6c0d", "value": 13795328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782408662, "uuid": "a967af91-b006-4fdf-aa65-d2f8565d3f0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782408662, "uuid": "2459fd7b-17a6-4d7d-8b52-06a6372c90c7", "value": "12097f9321ae6226dc089829d626fb9df46f34a8ba941988d1fd5f6c89d2d125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b56ce2-7068-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782372803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782372803, "uuid": "8471ae80-63f3-4c83-871b-34ea796c18cf", "comment": "Malware payload", "value": "d521af20df5d4c061ff0087088c4ccc2", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782372803, "uuid": "da439340-0e0a-4f8a-ba5e-d33f9b7a1f1b", "comment": "Malware payload", "value": "123a5caad17ea78cc6852176b4acec080ad03661bc587dd651b62694059e6315", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782372803, "uuid": "311e70a8-6c34-49b8-9583-cb2803c12f56", "comment": "Malware payload", "value": "a49f6ac923cd7bbb7f16c68d31c225624e6a4566", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782372803, "uuid": "a5da829b-0144-4bb6-ab5b-6624af65c4fe", "comment": "Malware payload", "value": "e8d6e042d700a091d9737666a47b5a2fe269f53ec1db73c0de01a36e959c1645177964ed76f4cef4e089821ef6659224", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782372803, "uuid": "43c5167e-33a0-407d-88ff-9cde31693969", "value": "T1EC123BB92875797E38AF1801135CDC1277ED9DF2727CED4AC8AA51B8E6CE2A1403D581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782372803, "uuid": "8d6ab39b-8271-47ab-af40-2861ef27d87c", "value": "192:xH8oxqTsUNldVFq1xqTsUNldCU8XxqTsUNldAF9xPpxqTsUNldN:xH8o2bNld7c2bNld02bNldAF/p2bNldN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782372803, "uuid": "50929a39-b453-4450-8c6a-d80cdea5ba9c", "value": 9450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782372803, "uuid": "983ba85b-f802-4094-b754-de66e433fd5c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782372803, "uuid": "b0771d9d-6f86-41b8-8ba4-9e947f0c1624", "value": "Trading-Strategy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e195dd-706c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782374785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782374785, "uuid": "078d50a4-2c62-41ec-b299-5240ce34bf24", "comment": "Malware payload", "value": "7884be8a701f31421717c0835add92d5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LibrarianGhouls", "colour": "#E40994", "exportable": true, "hide_tag": false }, { "name": "LibrarianLikho", "colour": "#FA213E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782374785, "uuid": "4df456e7-4f64-4128-b5f8-25e4e3136f09", "comment": "Malware payload", "value": "12648cd9d425f78db2dbc6e03c14f11e6ac6aadf8b3975c23cce9519e2b58d33", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LibrarianGhouls", "colour": "#E40994", "exportable": true, "hide_tag": false }, { "name": "LibrarianLikho", "colour": "#FA213E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782374785, "uuid": "5e180e91-dab1-40ee-85cc-7f4d011330f4", "comment": "Malware payload", "value": "5d9d91cf9da3b37d8eee87d5d4dd38dbfec28358", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LibrarianGhouls", "colour": "#E40994", "exportable": true, "hide_tag": false }, { "name": "LibrarianLikho", "colour": "#FA213E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782374785, "uuid": "a38f404b-8475-4401-ba95-d9db551d6fce", "comment": "Malware payload", "value": "7d9408250f92e4cc4c887b6b473429180d7dd689180aa51eef912c99f00a3f50e6ec5a36c1cefd0ed7c1c38197990cff", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LibrarianGhouls", "colour": "#E40994", "exportable": true, "hide_tag": false }, { "name": "LibrarianLikho", "colour": "#FA213E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782374785, "uuid": "673a5b33-65a2-454d-bf9f-fbdc99de85ac", "value": "T10711C6BA762F8F348974A2A6751B14032C70495068F9791475DEA00E524EE4B4F32BBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782374785, "uuid": "c2eeca02-8252-4a44-a0c2-e14aacfa9303", "value": "12:jr0gGr0Im8jgr0L3E9Dr03Aefr0LtBWFCHr0OKkYyjyoKGejjPZ+HZ+car0LtLuR:mjghnekBpSHy1G3oHocacKpA7+FBqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782374785, "uuid": "8dfe180e-9516-4421-b609-ed040b5581eb", "value": 1107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782374785, "uuid": "53728ecb-4cfa-4c71-b32f-d55bd8b561c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782374785, "uuid": "6110ee05-55ce-4b87-bcb4-8e1516492ac3", "value": "wctF522.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e01ca22-7054-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1782364361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364361, "uuid": "368ef1e7-66e1-412e-8db4-8120ab499aa7", "comment": "Malware payload (SalatStealer)", "value": "352fed139c6838c4ccc695a26ccebfd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364361, "uuid": "c66fd0b9-f488-4b01-a89e-2bb47bed3398", "comment": "Malware payload (SalatStealer)", "value": "13a3e7f3955eb52b9e281f191cbcb8cfd7a7c21f371df21246ce5106070541c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364361, "uuid": "fec1335e-766a-48f2-a655-75645cb5cd7f", "comment": "Malware payload (SalatStealer)", "value": "5079c6be00876abfdbc0390bc7aa6d2ecb632536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364361, "uuid": "1c6561d4-1a32-4597-b227-a465b12ece0a", "comment": "Malware payload (SalatStealer)", "value": "e14a1e649c6119968273540356cd836b1c2e4e6b9755910c504c59ff865e7d48d6cb38919a2f81f59d34d80bafe5c964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364361, "uuid": "791e9db3-cf12-4fa0-87a2-e56edf9a90ea", "value": "T1F1C66B11FADB95F6E903583100ABB37F63315D048B28DB9BEB547B2AF8776A10C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364361, "uuid": "94e33bc3-db25-4432-b4e3-81f0553400bc", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364361, "uuid": "62be2277-1555-4eab-8042-73cd5f4c4d3b", "value": "98304:UhsaYAe/J7EChHvcFy0FR9/Mmr4L3HxmcE5O/:cYAifHe79kWsM5O/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782364361, "uuid": "2b9cb709-947e-4844-be65-8db2d535d14c", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782364361, "uuid": "a1acbe3e-4bf2-4866-80e6-ec630eaac485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364361, "uuid": "3f952a19-0669-4538-af85-3a0d7a59ed8f", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9e8834-707e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782382509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382509, "uuid": "c7fddcf5-1678-46bf-b439-68b3784b9f7b", "comment": "Malware payload (WannaCry)", "value": "8928e0f9ade1ca6b96c0a7539ff6c9fb", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382509, "uuid": "e251d14b-b6d7-4135-b985-0b3c91beb607", "comment": "Malware payload (WannaCry)", "value": "1585edaf13490949e78b37a4f39d3001f81af41942dd16567a820eb8369cd9b8", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382509, "uuid": "caa808bf-d3fa-4071-9a57-cd99b602b547", "comment": "Malware payload (WannaCry)", "value": "496c07bab7957c76efd8ade9996f1e1db0746798", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382509, "uuid": "2f9fb81c-762e-4ae3-bb66-ebe5020936be", "comment": "Malware payload (WannaCry)", "value": "4f5616b545688e9bb7186503de784e18016fe0363432889aa265cc94d0cd1000641ac117727a22ef43bb522fcc6d6fd0", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382509, "uuid": "f4c053a9-121b-4c69-9198-9274d107094f", "value": "T15136125932AC80FCD11B6274A4B34E26E7B37C96227D930F8B5487660E13790BF78B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382509, "uuid": "34ffaad1-0cfc-43a8-b4eb-cf486583a361", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382509, "uuid": "7f447d3f-a0e9-4bdf-8e70-c1fbbfee1801", "value": "24576:jbLgBbLguVQhfdmMSirYbcMNgef0QeQjG:jnsnFQqMSPbcBVQej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782382509, "uuid": "e4f00735-be97-4e40-b44d-870ae80b6dbb", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782382509, "uuid": "270be29c-7964-4138-9f7d-d321c7289031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382509, "uuid": "871456b4-30e8-4a82-a7a9-06d3e5943aef", "value": "1585edaf13490949e78b37a4f39d3001f81af41942dd16567a820eb8369cd9b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c97d1c-7055-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1782364962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364962, "uuid": "2b26c7f2-3e66-4181-a2f7-15683d44fbb8", "comment": "Malware payload (SalatStealer)", "value": "a9ab1790f4c6691fa91373bca0812a52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364962, "uuid": "85a93f6e-3de0-4b69-bff3-0538f750191b", "comment": "Malware payload (SalatStealer)", "value": "1737899af08da74b07395f82cff64b0c6c8c0eb30ee9b3b5b5eb652874cd0112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364962, "uuid": "d54596ad-0b91-455b-8cc5-a49bdd0a0af6", "comment": "Malware payload (SalatStealer)", "value": "c7b610e23aae34cc9b03c967d62c58111adcd251", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364962, "uuid": "4db0b9f6-9b4a-401f-b1e9-020e68409a89", "comment": "Malware payload (SalatStealer)", "value": "c578243e71f59eb4f3fac8f8b1c6809ceb778f422c8484577609d1a2a393f385d82a6b9c08c4c881b6746ac50280fefe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364962, "uuid": "2bd42d26-05e5-4fdd-81aa-05a20f4023cd", "value": "T11AF533AFA414D52AF0FFEE775961A4C4A9F6843C81E93368BC648B2530D790B50BF06D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364962, "uuid": "4ebabaa6-d778-4b7f-ae66-e8e19d422e68", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364962, "uuid": "79ec9817-aa1c-41c2-b9dd-1825dbf8a9aa", "value": "98304:pRk/PZVyeq5Pxae32ScA7OWiRp3eFgrHJ4:/k/PZfgPMe3pX7OxTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782364962, "uuid": "2891edb6-53c3-4657-99c3-0ce6e7c88014", "value": 3594240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782364962, "uuid": "b0941f91-5f64-4461-8960-023848218da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364962, "uuid": "46160fd8-3d11-4dc9-a84e-ff50621b601f", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60520965-705f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782369036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782369036, "uuid": "2ca7d11d-6cd8-482a-b827-f6c870f0f1ff", "comment": "Malware payload (RemusStealer)", "value": "e5c0637997dd3b06bf74d9285ce348f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782369036, "uuid": "3f836cca-13fd-41c7-bcf7-9c1aaa4931c3", "comment": "Malware payload (RemusStealer)", "value": "17502e8db2948738ef424ff4e5de9ffeaa7fea6777d0988540d32169cb7609ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782369036, "uuid": "3631b2c9-a33b-4b41-a46f-affdd729f75e", "comment": "Malware payload (RemusStealer)", "value": "0dd1cf091d048c6966a24873e72d6f35b1f97ed4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782369036, "uuid": "ec12718a-36f7-401c-bbe4-151c5b149b47", "comment": "Malware payload (RemusStealer)", "value": "e8de460bde50d127be4b09224231ebbd0ddc54d544089ca065c391846985710ea6a7c9205323359086e3a0843580e10a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782369036, "uuid": "c9bf63d4-ba59-44e4-9ac7-eab16764c736", "value": "T171A56C0BBCD049E9C8AA67328CB661927B78BC050F3263D72E9076782F767D19D36744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782369036, "uuid": "e2a30bf3-fd2d-43fe-a665-c949655d3c12", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782369036, "uuid": "4fec5cf4-f434-4312-8154-82c7fbd8eb5c", "value": "24576:kL9dq0XLjuA//dqYul3plAzQNrH64VPpS6fOLZtxzBele5rK2mM4/xgVh:kL9dDXXuA9qnlZmUra49TfQj4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782369036, "uuid": "675f8065-9ed7-4816-9935-a527570090bf", "value": 2152320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782369036, "uuid": "0d01ecb4-7c3f-4eb1-a978-e2422ad35e83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782369036, "uuid": "5b7096d3-8f3d-4d89-9f7b-055db916e8b0", "value": "S\u0435t_U\u0440 [U\u0420D].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6a4557-7034-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782350835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350835, "uuid": "73a9ec16-3d81-4525-a23a-2ebf8e68e6c5", "comment": "Malware payload (Mirai)", "value": "b6e46a32b8bab6d2d4565876f963f007", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350835, "uuid": "e6d20e77-a6a5-4d2b-8cf3-d74b589f89bc", "comment": "Malware payload (Mirai)", "value": "18372ae33ff340d0c683a4b40f85ce0573bdfb448a8ede0ca1ce031d53a4df87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350835, "uuid": "9ae40695-07f2-4f4f-b4bd-f2d418ac1730", "comment": "Malware payload (Mirai)", "value": "cf56c26ced7e6114489cf5e614e3c2776877e640", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350835, "uuid": "c2dfa93a-e0cb-4338-be29-9d8f521943f9", "comment": "Malware payload (Mirai)", "value": "63752b6ea5fbeaa34d09772b5926ff595a72d1813cbdfa0edb7b1899c9ecffd2c6212b0ad602f08d6dd0cb4b28e36732", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782350835, "uuid": "c7c55138-90d2-49be-80ef-50310f6925f1", "value": "T191734A06B8E2CA56D6D5727ABA1E818C331213F4C2DF3207CD05AF797BC695A0E7B584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782350835, "uuid": "3e014a08-16bb-47ad-a3f9-044c15935c2a", "value": "1536:MKipeAE86kDOihhb1I9UokbGyxVVdOH0AutplLNiR/ts+FEsR:MKipeAE8nbbRIrkCcdOULplLco+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782350835, "uuid": "ae40def0-e237-43b8-ba65-154117c29744", "value": 74892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782350835, "uuid": "97bfeed3-3d47-41e4-8c32-0a5386e08ff8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782350835, "uuid": "ead8f830-15b3-41cc-a235-f28e9f893f6d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da968c39-70e8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782428082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782428082, "uuid": "625d66ab-9e9f-4ef8-bff1-2b671ecee6e8", "comment": "Malware payload", "value": "1331d2072e64ab6615007219a26191c7", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782428082, "uuid": "86100ab7-0479-4c0f-8623-21287a341720", "comment": "Malware payload", "value": "1852de00559ee34e019c3c315cc57fb2872699bd33854e0eae82af78c71cd81e", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782428082, "uuid": "8692c1c7-370d-4a4b-8bfb-1454a7027f28", "comment": "Malware payload", "value": "f1c3299d61676d7ba29c406e4caeed2ba29a134b", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782428082, "uuid": "3138a30a-9713-4257-a714-525fb998a2be", "comment": "Malware payload", "value": "ae37cd5efca7ccbd757a3ff15d729ee0b29cf3f6bb3e88e3f88b7a3bc332517b9f6363a98c2af9b5e7b0027b7664f99d", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782428082, "uuid": "8ef5dc14-39ca-48a4-9ee2-93812a547a10", "value": "T1ABD31259482D0113DCEB5B757222DBF7D105842A0D52C608CEABDBD0BAF25C7AEF0D99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782428082, "uuid": "946a8c31-e75e-46c4-8726-8404a46fc4c8", "value": "3072:vaa3dSbfXFtYu2J0651csosIjrfB10hkN7dUE3oJCW6UBsRhV:PNSLXrYu2J0YrCH0v8h8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782428082, "uuid": "412dc97b-5fa6-488d-b9b0-6fb7876ab1a1", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782428082, "uuid": "955e2ada-6c3e-4345-b508-e9a5a7ffa1a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782428082, "uuid": "6e009b76-e4f9-4b6d-bb09-7418bc10e0dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90ffa45-708e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782389398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782389398, "uuid": "65b382a8-98cd-46ab-b696-1c84cf8c4510", "comment": "Malware payload", "value": "d6d80bdbabc7b9e36fc6450c3198346c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782389398, "uuid": "b0902123-0a40-4ff6-871b-55711d0560e3", "comment": "Malware payload", "value": "18bfcd4fd809da2c66319763af3e3df7c6eb5adb502a9966b28726ecd8833133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782389398, "uuid": "884b86fc-26a8-49cd-986a-7d064b9994d3", "comment": "Malware payload", "value": "53971fd64378b709bc5c9f6abf952eda734036cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782389398, "uuid": "ace918a1-1f93-4955-988c-681978e803b9", "comment": "Malware payload", "value": "52096c435b0f66529c65375dfa19046c25f075614f20927ac0b424f7100b981c9a91ae101aec1ed071b14a6acea84648", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782389398, "uuid": "e113f656-7ba8-45e2-a47b-1d70b4967d73", "value": "T1C2623C46B7E60CD6E236877A84B31A11E476BA340F7183EF4790951D1CBABC1EDB1742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782389398, "uuid": "46af1527-0fa2-4eeb-af10-e35890255472", "value": "cf5ad78f736dbd109d5972e64ffab70a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782389398, "uuid": "fd71e2ef-0614-4c7d-bf9e-92d7fb5f6bb0", "value": "192:DZnNIbmLbDJIJbs7Wfg3zb4Z1E+JGzcvH0TPuFp55tfA00W9hbWyT:DIoNI5sf3zMEYcc0PuFpWW9hbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782389398, "uuid": "eb7de1ec-3500-4782-8a70-b02027b0f563", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782389398, "uuid": "fe83d620-0bec-4827-808c-e31e8668310a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782389398, "uuid": "dea6f854-bf40-477a-bf5a-c7676a9d3367", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a46808-70b4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782405685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405685, "uuid": "eb8a9c8c-6164-484a-906e-1252ee1cd9d9", "comment": "Malware payload", "value": "97cc3ad3056f82de0dde57adc9e4518e", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405685, "uuid": "1bb1b927-6e73-4783-bcd9-788ddec00d36", "comment": "Malware payload", "value": "19e78c00d07f011fcb708ffb12f8dd2fd0f1e57faaf21129b53c7f68ae611e60", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405685, "uuid": "9bd76155-9317-409b-aee0-ef1085f0743e", "comment": "Malware payload", "value": "aa16e8838f8392b8283235760b8a4aa2be14a7a6", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405685, "uuid": "c414fbf7-05d4-45f5-8b02-b9d3e9ecf766", "comment": "Malware payload", "value": "1cdbd3bb3eda43072abff83d73400c9fe466312ecd2f1894bc623643177ab68f00697dcba3bdb1de96502020f8a16cb7", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405685, "uuid": "a10b1e42-7135-4eb9-9a6e-5b41157f7708", "value": "T1C7C5F857E49590E4C0EEE174C726A213BEA13499073437E36FA19BF11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405685, "uuid": "92a18ea8-20cb-45c8-87ab-787d79ea53d1", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2U:cqYUQuVDt0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782405685, "uuid": "4b954332-7928-40a6-9c26-328c771b0ba0", "value": 2654208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782405685, "uuid": "258bd462-632c-4c20-9c2c-c4e2f9cbd83e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405685, "uuid": "06930895-c2c5-4e7c-b0a0-6c9dd98ace68", "value": "19e78c00d07f011fcb708ffb12f8dd2fd0f1e57faaf21129b53c7f68ae611e60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b2a283-703c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782354117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782354117, "uuid": "25e312c4-919c-4dc8-9b82-81f3491f2a91", "comment": "Malware payload (ValleyRAT)", "value": "d2894a452a69cd574591dd927e38f105", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782354117, "uuid": "8b050494-fab1-405b-8c0e-6eff3d5b0af2", "comment": "Malware payload (ValleyRAT)", "value": "1bee14b1afc29e401d0f8f6e559cab82d2b40c6fde24e38bcaf70631795fac21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782354117, "uuid": "59cc31b4-b154-4fbd-8f67-11c9f5bfcbfb", "comment": "Malware payload (ValleyRAT)", "value": "ea19b2afb22abede82c1e2fb8c00eee4a2230c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782354117, "uuid": "54734913-8748-4222-a665-9238cc041ccd", "comment": "Malware payload (ValleyRAT)", "value": "3902e5beafeae6b97fa22e8dfd9daebefcdf2740b66b5e710d294e8eab23ea1e644d4804161dff4e6f102a45061d7777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782354117, "uuid": "c44d1452-04c3-4303-ba79-1379c822bee1", "value": "T175E52C2ED6A9C2F8C7BAC0348A1F4133F5B1781A971897C75028C6726EFB6C56E39714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782354117, "uuid": "dddfd155-bca6-4c68-bd4c-27d3fab3bcda", "value": "5bf3e23a459983ccf98096c50cb7d303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782354117, "uuid": "6fbc8c9c-d45a-4fd3-bde9-037d1b017d1f", "value": "98304:3f5wcbhKfSxJvZb+Gey3FaeW0Z24tRuY4cLDw:3f5wcbhKfSxJvZb+GJ3FaeW0Z24tRuYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782354117, "uuid": "4931f3b8-34c4-4b4e-bace-e0c96449ea92", "value": 3219968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782354117, "uuid": "66802ead-9544-4f92-848c-aab130ab27d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782354117, "uuid": "bb2ee566-65c0-40b4-be2e-615b94b2bc78", "value": "\u6587\u6863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60091aa7-7097-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782393087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782393087, "uuid": "527aed96-48fd-477a-bea7-c99beaf9538a", "comment": "Malware payload (Mirai)", "value": "5ae50f66c98b80677e768ae7cc974691", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782393087, "uuid": "ad5a0e00-6465-46c8-a8c1-f5d5317bc3d4", "comment": "Malware payload (Mirai)", "value": "1c1783aa832ade07b12a8ca6110816b8ce378de5463a0c5584bc7d848fa88510", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782393087, "uuid": "6c4ba934-578d-44bc-a55e-04e542470a9a", "comment": "Malware payload (Mirai)", "value": "6a1236c2646f8e88082ec8c11db6644d85d124cb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782393087, "uuid": "070c7354-adc0-4472-a4f5-5d5770a99464", "comment": "Malware payload (Mirai)", "value": "023ca5d6aa23553074aecc1474a158ea5657d146b6a39e9873fabd9adcd05281c0be8c6a2d78fc3e64d72e56e92bc771", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782393087, "uuid": "6c4f42b1-1ccc-43c9-8e5d-b30f9e78d59c", "value": "T112014CDA8501FD00501A9D5E779766A0B820C3CE06564B787FAC5D3DFB98914F026F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782393087, "uuid": "9290cd89-4f89-4683-9d62-0dce524ac1bb", "value": "24:kXCKysE2hi0ziQvZohaMHA+4R3wLtK4K7:e9Qp+MsMHB4RsKj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782393087, "uuid": "5cd5e1e5-5bba-4d86-acf2-388dbab6d4f8", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782393087, "uuid": "04af01f9-7dd1-4878-99c8-f04c3b6d5903", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782393087, "uuid": "61d75401-085b-4052-835e-e826b674c226", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455c4f1c-702e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782347945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347945, "uuid": "84d762d6-c416-4abd-8615-0308ad14d797", "comment": "Malware payload (Mirai)", "value": "29589f29ef42e4da59ffa12511596ae0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347945, "uuid": "bf9b2713-6eca-4ed6-acd5-d7fa67790ebc", "comment": "Malware payload (Mirai)", "value": "1e31599608087395f5f717647667581f5d90107bab7517fc4e4d26ecde9e2534", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347945, "uuid": "b4ee083f-dab3-4009-b84a-66902793747a", "comment": "Malware payload (Mirai)", "value": "b0653399cc458f4a1cf4c60b2a99427ac07db662", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347945, "uuid": "f7c6c371-3703-4b26-9aaa-2cc32511bdcc", "comment": "Malware payload (Mirai)", "value": "6403393adc51bc3b15f3ba95118c4e7e821fd1b03a934e535d8e813f13c05cca9c52595ff9766d81d00fdcb52786e0e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782347945, "uuid": "7f686beb-e3a5-429f-b3de-e792a9da873a", "value": "T129A3B4097F710EF7D8ABCD3355B84702219C9B0622A97BB67C74D518FB4A54F0AE3828", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782347945, "uuid": "04399fc0-2282-4609-9726-6a9c3bf9f14e", "value": "1536:nRqZbd/i9o9d5ryvXs2ui8q8n7LqnhQIalbpmFJpPzgnwNUdZQGogBQDv:n47iitcs2obpmawCd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782347945, "uuid": "2f1d3d9a-abe4-4a74-86a2-8c669b589621", "value": 105200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782347945, "uuid": "dbbb58d8-3d09-434b-b3c5-83c4267e6f92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782347945, "uuid": "12e3b9e4-2e70-47ff-a540-e7d30fcca9f2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e376dc-707d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782381903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381903, "uuid": "79cb215d-e860-4a94-9888-5aa56f0ec5c1", "comment": "Malware payload", "value": "0ceb24632364b9a372ae4d8640a4598a", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381903, "uuid": "64f00c0f-6e82-431c-8862-52f867e3c72f", "comment": "Malware payload", "value": "1f557a73f974bff5ced48e7b0beb82cd748976495be537ea5dd63a2b202ae077", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381903, "uuid": "ff32c755-98a3-4cc9-b113-70e95bc58ee9", "comment": "Malware payload", "value": "e4a76475ddfb24b4ff720fba99fe2310bfa6daa6", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381903, "uuid": "072f759f-065f-4ec6-9f4b-80b596899fef", "comment": "Malware payload", "value": "40a529fef13a4539e8d94801561ec08bb06baf98d4128e6d7b89fd2b7b8fb2f7969ea6d74ac905a43b4d3b7f5e6eeda2", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381903, "uuid": "e9e76084-2a72-41c7-a28c-707b69e36ab2", "value": "T1FAA2E118EEB020E786F39968C575035D351C1FECA29E25FB15FE92CA84BD5933E8D604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381903, "uuid": "99964149-5d3b-4740-8e99-b675939bcedb", "value": "384:VgMEk1/2o9IckZBb0klrxgH0KhH2/u5ncDCmAkKQNOPGt9kswFkzbt:V3/2oTA0kzoHF5ncu7kKQNO0Ykzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782381903, "uuid": "f91579eb-a9e3-45fb-83f8-a864c1b48ad3", "value": 22073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782381903, "uuid": "c0a56f9d-032c-4166-9d81-a92c83951b12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381903, "uuid": "03584c13-fa32-4ab1-ad9a-cfa16321c6b5", "value": "dll_load.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c23f69-70a8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782400638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400638, "uuid": "2381b105-67a7-4103-b3f2-b64a18803fa6", "comment": "Malware payload (Mirai)", "value": "b8d9c698a786536c6f836eaaa22a31d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400638, "uuid": "4d40768b-b5ce-420b-a2d6-182a6d33b930", "comment": "Malware payload (Mirai)", "value": "2092969d0d27117a0d6afaa95c05a547ced39191a2c9008a92eb88dc8366c096", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400638, "uuid": "b666af84-fb7c-4f6a-85b9-7337c879b712", "comment": "Malware payload (Mirai)", "value": "317c21e4cb83a257021284994cc2acebec690f86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400638, "uuid": "34e5c00a-c392-430e-9fb3-e3b738d39065", "comment": "Malware payload (Mirai)", "value": "d2b978483c8b2e88083b91d140fff33f4fd8213df4d033dc42e08f410e9345d062e053428e0d26f10b341cb1c61654e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782400638, "uuid": "2da93349-2873-46c8-a448-bc7d78aa92ca", "value": "T14593285ABC819B55C9C1017AFE1E634D332327ACE3DE7213FA145B6C378B46B0E2A156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782400638, "uuid": "27c3b628-a0a7-45c2-86ad-7c890938545b", "value": "1536:BynILJBX4962BhCaPqWrFEVRU6AoIXbgVSDSiZKna7M4asA2FUg5yYEk0TeIP+Yo:RXolyGrFEvU6uzKna7M4asFWgUXlTeI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782400638, "uuid": "f3e4a1cf-b842-4b51-89b7-4ab1830621b6", "value": 96320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782400638, "uuid": "b515f16c-eeac-455a-9089-e9a8f1b798bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782400638, "uuid": "b41786dc-212d-49d9-8ecc-ff819422e586", "value": "1AB", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb888a4-70c9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782414555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414555, "uuid": "be9c00f7-533a-474d-b05d-57d2625b0375", "comment": "Malware payload", "value": "05bd2701f3806b16a60f4499f2ee3508", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414555, "uuid": "08a2f863-07ec-45b0-a390-b9977f50b6db", "comment": "Malware payload", "value": "20d69242658743e277ea561377857b11bcaa15faf47160edfa62eac33c3068ab", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414555, "uuid": "9b290f76-3676-4ac9-a5f3-9459e1fa542f", "comment": "Malware payload", "value": "4630c297473dcf824276c992bc5cb88c71b2ca70", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414555, "uuid": "8abf6403-47e4-4b2e-a1f3-1a9d2038f91f", "comment": "Malware payload", "value": "fed78fe05facaed29a7f13194f244842cdb9a9d13dd8ecd49b2ef46ccc9b3e5e51bd1c37e3c57c2f602ac757ba5cb0d9", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414555, "uuid": "2ed8d461-5823-46df-88d1-4ac080671904", "value": "T18907022365851529E2AD2B353677DFE0A7376E90681F880FA6F0347ECB351E029366C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414555, "uuid": "35d32678-e1c5-48e0-a426-c6fd2c7c1aa1", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414555, "uuid": "2dfb89c4-9709-4a10-8e7d-313e36819c72", "value": "98304:hAX7EMA4bn7Dr3ZN5wxzcPGpcFUid3iXespErKsjUMZkPdHQYcy+ZCi+TJYVJ+q:APhnbaRcPG74spETUM/YczCjTJM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782414555, "uuid": "91924463-0813-424d-8405-c25f91c3061f", "value": 17395021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782414555, "uuid": "f1286333-a0ac-4567-bcce-541cc1bec593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414555, "uuid": "f9a3b7cc-253e-4204-b531-9264d1b32fe1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8284d02-7095-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782392376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782392376, "uuid": "8368f8dd-d21a-4b4a-aaa4-ed47af51a998", "comment": "Malware payload", "value": "8e521558b4d49cef704fc6a44bd32f61", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782392376, "uuid": "fe096abc-a24d-4fc9-98c1-c78871d8ad91", "comment": "Malware payload", "value": "2235f58a1caba846be3de9557235ef6f0d8a39430c791164e1eca9cfeea515b1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782392376, "uuid": "9960211f-7bc8-4cca-9011-bcd4493e6f97", "comment": "Malware payload", "value": "6b4f12b7b9a6ad9e4b7c416164e738cbaa0d9aa4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782392376, "uuid": "8f04642b-d03e-4a11-9daa-3a3d26838418", "comment": "Malware payload", "value": "698d008368314c660a26e8bbd10817e30a2f5fd4f036bbe8238d4920f0ef196ad29333f1837671c61e253fc6bf2adc5a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782392376, "uuid": "b3650c24-3d73-4c7a-94de-7de0e09a4382", "value": "T128136D6566853C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782392376, "uuid": "a5fbd575-ad4f-4400-990d-cf65585ba2bd", "value": "768:gXRWNGxV29GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:0lxFco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782392376, "uuid": "76e2222d-3c2e-4109-90fb-5caadeeed32d", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782392376, "uuid": "6072d997-b039-43ad-bce3-b10377fbbe3c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782392376, "uuid": "d3417347-c83d-438d-9125-2c0fa3bde44f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064ae7cd-70c8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782413982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413982, "uuid": "55eb79e0-5ef9-469c-8128-9f682362a9da", "comment": "Malware payload (Mirai)", "value": "dfda920f539224f0572844576497d517", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413982, "uuid": "8a40996a-7501-42c4-915e-f77d824fdde5", "comment": "Malware payload (Mirai)", "value": "223b9372c092ab4d81d5bb257680759b2bd69d3954364dca0d92773adbe990a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413982, "uuid": "3c45e314-919d-4db1-a5fe-cf7716db75b2", "comment": "Malware payload (Mirai)", "value": "45e9ddca625a4b4751b762edb9ff8c60bcd84391", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413982, "uuid": "1621582c-c700-4643-a5c2-7e5c94c6d706", "comment": "Malware payload (Mirai)", "value": "6cd8194952493e674ed8b5a56d4be869d45e466e16b45dd4c0109c61adf95da3ab8de07c21db32f766a9b397f4c1da1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413982, "uuid": "2ce16a5e-e480-4ed3-8d23-6254acc23a5b", "value": "T1C5A34C87B401EC7CFC0BA67B46174906F938E7654F620E32A3A2BC275D660E54D5AF48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413982, "uuid": "153e7daa-cdf0-4cc1-a84f-f095a19fafef", "value": "3072:kxyqzisNIKtXPFIIKdJ/MhY+B/NVeZcnvphKMX:Y4KAIKdJ/MhNE2nRhdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782413982, "uuid": "bd911524-7341-4ce9-8856-72be7f88bfef", "value": 102036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782413982, "uuid": "4ed1922f-7cda-43a5-8a39-4f06ffd20bf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413982, "uuid": "673c4f7f-7fd6-426d-a585-b476b1b90210", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce057699-70c1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782411311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411311, "uuid": "3f8cd6de-2f15-4c6f-a245-d97f62e83215", "comment": "Malware payload (CoinMiner)", "value": "5c418512c9c5e322a48803a1d5d0a851", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411311, "uuid": "bd4737cd-0f3e-4f3a-825c-7d13dea2289f", "comment": "Malware payload (CoinMiner)", "value": "22fb0c5e2a8ac8087df00e90507edeb9a57756d5ddb81d78952ae7ce4e690c51", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411311, "uuid": "85916a27-187e-4eb3-943c-90c072c0ae13", "comment": "Malware payload (CoinMiner)", "value": "ae2367db274dcd90d6cd037389aa317a843cd110", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411311, "uuid": "36166fa0-46c8-443b-bfaf-39ded1fde920", "comment": "Malware payload (CoinMiner)", "value": "e55fa1552e3954493663621016321fba303d7c59f294818035d1ae6ab6268738a4e567f501474c9b3b271eb458eb3423", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411311, "uuid": "e308ba09-19e2-404d-964b-2c57fff8e546", "value": "T1E6D3136461711C8EE693607E6BF513B17624164E32CBEEC7BEBB6379CC084893C86517", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411311, "uuid": "acb22a29-32f4-4771-a203-6afb69bcfb1e", "value": "3072:E7PR2COr3MArjxZ6QHfEq19k+MG9G41y58oYOcVp:8Z2Tr8AGQ8qkpWGcy58o2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782411311, "uuid": "035d1513-4846-4d74-adb5-946853cc6ad8", "value": 131996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782411311, "uuid": "431684a6-6ea9-479f-b717-272f8e096070", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411311, "uuid": "c36c503e-5ff8-4838-8e01-f89698bde41d", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5126da3c-70a7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782399934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399934, "uuid": "7e6a101f-b288-4fb1-b428-adb2910cd4bd", "comment": "Malware payload (Mirai)", "value": "9465bde56195740cf8e99aaa98bdd29d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399934, "uuid": "404832eb-4dc9-4441-a8f1-26f9f8d52985", "comment": "Malware payload (Mirai)", "value": "249c001e01bb8c3a7a63686bd1a10736d71d10bf6a779f83afa62520f48eada0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399934, "uuid": "bcfb32a7-9c78-414e-b16f-d1bb46363ec7", "comment": "Malware payload (Mirai)", "value": "c13cb06c0733c7c37a6cf8c256600aadc3d54e2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399934, "uuid": "8abcd3b5-c0bf-43ef-bb7b-b3ae3cfd30aa", "comment": "Malware payload (Mirai)", "value": "061e666ad446322e635217f6ea55531bb308f7d4fa7a27b86d0574e2dd4bc47628f5c10a8b503b0fd81c149ca2190b29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782399934, "uuid": "e4f9122b-d092-451e-b5b2-f47d50467df4", "value": "T1CEC3094ABF511DBBD81BCC3705AC170279CC950B629937753A38DA1CB64B94F8AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782399934, "uuid": "6115c17e-bcdf-473a-9c94-43b10f970977", "value": "1536:hoArGJzjCpQZAaSWcuJ5hQC9s0zN9a6fgOZpRl9dk0T+IP+38E:aACJzmaA6cuPw6rPlT+IP+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782399934, "uuid": "dc8362a5-2b4f-414d-9db9-469bd740d8c3", "value": 126344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782399934, "uuid": "e9a1260b-e17d-4da3-9b81-687405f5f2cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782399934, "uuid": "6b895162-a107-49ac-89fa-b521a1c3c675", "value": "yqFn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906cf34a-70c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782413355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413355, "uuid": "58cdbda7-e9a4-499d-a856-6df87d7e476c", "comment": "Malware payload (Mirai)", "value": "43171313b88deed6ac806a8adb93bb73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413355, "uuid": "3f12bd39-fefc-44bb-8580-5eb7f6eedd4a", "comment": "Malware payload (Mirai)", "value": "26ec9509f7bccf0ea1ecb2fddb117ae710fc7470e49b29439e34fedddf914799", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413355, "uuid": "572b3176-19ce-4445-b920-5d873d817989", "comment": "Malware payload (Mirai)", "value": "089e441f952615a1ea7a115ec6ed942b78f02d4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413355, "uuid": "6cffa902-4c9b-43c3-8eeb-234bffdddc6b", "comment": "Malware payload (Mirai)", "value": "008c3756cfeb3d78058f1b7643b67bd344db935d42f2f1127d2ae591dfc52539b35fb997a26c8b2b33601639a8c97179", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413355, "uuid": "3df7a63d-4ac5-46d5-9937-2e8f044938ad", "value": "T11134C40DBB610EBBD8ABDE3309E91A0228CC644721A93B357574D71CF54A64F5AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413355, "uuid": "7467e0ba-5e7a-41bc-a1f3-417fb8a085d4", "value": "3072:G1TpGsBvvCk8dWpEr+3PO2xQFQJuivA2ZekpozpD:G1TpGfk8H63POriZ4kpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782413355, "uuid": "1536cc7f-16cf-42f1-9892-7173442e2723", "value": 236588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782413355, "uuid": "00a79448-05d6-44bc-a9bd-835b1ce2f1b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413355, "uuid": "e4ade995-cf4b-42d8-901e-1c3eaa2aa9a9", "value": "onie_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43171536-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370705, "uuid": "502859cc-b57b-41fa-9ba0-52660680e178", "comment": "Malware payload", "value": "32ecbf1af51a7a0d6b78e4e7b02df069", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370705, "uuid": "c01bc75f-90b3-449b-a245-d489658e7ee7", "comment": "Malware payload", "value": "2ba0f4e3ba0b8319340a39a43ef89f4cf7c3e3074f395982cd22dadcb9a3a76c", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370705, "uuid": "ac8bc560-65c6-4231-b0b6-d72aa7849e9d", "comment": "Malware payload", "value": "d3be423b37f2c9ebd64a6ab941a30e105a1e050a", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370705, "uuid": "bd73b5ce-00dc-4a46-a9a7-5689c5de83b5", "comment": "Malware payload", "value": "adb6eff03a7dc40ec6c45492860e3c0e0331131ae3105a103d1c066d4e6ae8a5f335bb1605811328a0a3bf5e0b7c3f80", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370705, "uuid": "6db6a658-2dfe-43b3-8401-e7986d83893a", "value": "T1D5853359D417D7F1B1A84EBCFC387C41716BF9B91A5511B4460FEE0A2A4D923A28E30F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370705, "uuid": "3fe81870-9b64-413a-a252-f0422c910a10", "value": "24576:bwQB8RJTNPe0XH/a4ttjUPTkJ5g7RF/KVGKP3W/BXc3xqaKg24Q7nM/A98flWY5B:8QqFSoJibCVJPm/BAL2rmo8td2u6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370705, "uuid": "a628463d-f24c-4101-969f-5cdb8bb9e67f", "value": 1731808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370705, "uuid": "f4e54548-4729-4bad-9ad9-e18252670c5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370705, "uuid": "e0fca6d3-d288-4ea8-a3f0-a5a9bbb47536", "value": "jbd2_sda1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae64237-70d2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782418580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782418580, "uuid": "ad6ca6b1-54a1-4cbb-9b01-fdbd0ccfce82", "comment": "Malware payload (Mirai)", "value": "37e01fde1857e551dc7548fe02578cb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782418580, "uuid": "46b82742-1b7e-43a3-b5d8-2dd33fc47316", "comment": "Malware payload (Mirai)", "value": "2bd2ab1d4b75aa2b4eed1af697188b8bce35a882faf4335cb4fafc2847197995", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782418580, "uuid": "26ae74cc-e64c-4ed7-9c77-3bc39c822e65", "comment": "Malware payload (Mirai)", "value": "764e0d7bb0d9381bc71ed0b0a60c59ea5622f0b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782418580, "uuid": "27dadd52-bfbc-4266-bbf3-f580270d6c4d", "comment": "Malware payload (Mirai)", "value": "a7ce68b40ced01f2772b63e57b945067cad443ff625604ff20ac43b71150041d880bb7874cb384afa14c99e8c1051f36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782418580, "uuid": "32a40fa2-9714-4840-8408-17eb57a98ad2", "value": "T197040793B904DAF3F40EE77204D347217272FB664A531A36B317B979AA3A2C43426F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782418580, "uuid": "18f6ef59-903c-49fa-81c3-62e18ef29e1b", "value": "3072:FAG/1PHyneys6nTw2nZbXviyyF/rrq2Lm/vz38nmHvYMGAZsPQaLI8tYyuP:F5Hyn/s6nT97viyULmT0mHvYMGAZsPQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782418580, "uuid": "2f35c3ac-d1ab-42d7-83e2-d5a8d64edae2", "value": 182064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782418580, "uuid": "a812e197-6af9-401d-a78a-be8e37be3091", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782418580, "uuid": "11e7bc16-afcf-434e-9e7d-5955e6310f1b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f1c142-70c7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782413908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413908, "uuid": "4e956ff0-c45b-4bd4-8212-9f050833d328", "comment": "Malware payload", "value": "6ab5d1b223e947c5427ba79644e8cf0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413908, "uuid": "0676ddf9-0c00-48a3-8ab3-e7081532fa4e", "comment": "Malware payload", "value": "2cda814bd93157b2c94e794ff3af01f97a584608686875e9b1cf0bd74511bdee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413908, "uuid": "b4e9d607-c712-48c7-907a-17b0c020363b", "comment": "Malware payload", "value": "52ad4aa1992ef4dc3e71a6c66d82de941487b227", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413908, "uuid": "6a26014d-57c2-4c5d-8ebe-c77d156fa090", "comment": "Malware payload", "value": "428c4316326dc23a13caaa5149c03c001430e570a388acadec2aa8dffb8d75a5ede76228793014fcfe632c11a737964b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413908, "uuid": "57b80392-d852-4778-a1b4-420d3629e53b", "value": "T1DCA3011CD0AC50FBF3C19439974AB324A94632F595B0B5F768898F706F1F45B09E80A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413908, "uuid": "ba9ce0c8-63c6-4c42-98ff-404f4884e4e4", "value": "3072:1173MEmwT5+u2fCJBUoKdWqT3n2066W99MoGp:Dz++B7qh5oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782413908, "uuid": "d99eaa48-a619-42a1-b097-d47c4c3bfcd4", "value": 100448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782413908, "uuid": "d8fc6d99-7c5a-4519-bcc1-0305c5ef148e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413908, "uuid": "fe1b83bf-db42-4fa3-ab7b-35001797ff05", "value": "kworkerd-softirq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0611f7-7093-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391341, "uuid": "8c9e60b3-76a0-44a5-8b1a-91d9e9f34a08", "comment": "Malware payload (CoinMiner)", "value": "1664066b37236ad9855a4397f1981ad4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391341, "uuid": "e1b831f4-2379-4e87-be0c-01a088aec094", "comment": "Malware payload (CoinMiner)", "value": "2d4991fd72a7944cdc0593555d35f1dc7896e50bda71a0443376c3290d0ab0b4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391341, "uuid": "a2db8f0b-4c4e-4632-98b6-af8e506e1d9c", "comment": "Malware payload (CoinMiner)", "value": "857eef40b9e9397263db3ab2bc25039a12ae0be4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391341, "uuid": "b5cbcd2b-7e08-44ff-9005-bb44b55b30d9", "comment": "Malware payload (CoinMiner)", "value": "6280b6c42e4d5ce594fa25672d9e6f9244f5f6cb9ca4a9d3084c2930e3c0c8ca6434b6b9ec1a56d76396c4cb560faabf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391341, "uuid": "0f87243a-d79e-4cf6-a107-4069427e8c53", "value": "T112F533E1A1C2A4B9CB8999388B584B349FBFF5615BA1F2E717D41132483FD845E78B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391341, "uuid": "444ae3d2-81f7-4fe0-a7d8-5a2407730412", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391341, "uuid": "48f12592-8289-4f60-97f2-351dd0999617", "value": "98304:knsCkb8C1ARGArcpAKn2bTHn8Ye3GzVbC/kI:b8oArcqtLHVG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391341, "uuid": "714cdb3b-f72e-4951-b6fc-7c02a33c613b", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391341, "uuid": "e2ca0624-fa41-4b1c-a9a6-5c166015bdfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391341, "uuid": "b16fcfa6-9c3b-4498-af9b-900ba3785f7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c568a7ee-70a3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782398411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398411, "uuid": "d3c99d9b-5161-45bb-9644-2303e97d0edd", "comment": "Malware payload", "value": "b1cd16a7c76f6e33b12219b7f45e3a3f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398411, "uuid": "3b7cadf5-c3fd-4e43-bd0f-7c389bf6f442", "comment": "Malware payload", "value": "2dccb75698eaeb3eb604e46dc7e650803ecf702933e0b40964b0f5f192fe6993", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398411, "uuid": "59bcef2c-68e2-4abf-8fbe-d8d4290c6eec", "comment": "Malware payload", "value": "3af8b41875fd1aa61843247f41bab6454915aa29", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398411, "uuid": "6785bb46-e8ad-462f-b1c1-26c7cc51a1c0", "comment": "Malware payload", "value": "6d7efdff3227d5821bdfe7d594d864684fd81343b795342022689d77d29024f6d0c1256dbc4d24fdf2b9924418cf0b0b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398411, "uuid": "37545f3d-af82-4ace-96d3-585a7869ceb4", "value": "T13553638063C1789423476F6B7B6BB0E5F92909EE3D44094FE215BCD4FAB471AEAD0931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398411, "uuid": "cc66a280-87a3-4acd-8b00-660c76ac5672", "value": "768:2gM6YiO1q2hgzldk3vm2wsReuMmt3au1C6LCkR4rvNNpgRx6CFzeQtND1ZDH8mh8:6qs3eFaTNO9m4bB7KsVtu1U+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782398411, "uuid": "90fb9b5a-4e9a-4e43-83cd-2fcd3d7dcb50", "value": 64162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782398411, "uuid": "5f65fc77-f51c-4f5a-8b9c-a251133b6978", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398411, "uuid": "84af4fae-ec8f-48e0-bc5c-b323032c8898", "value": "Dekont#2026-25-067T1250551.750.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ce599c-702d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782347723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347723, "uuid": "5f2d1a10-b0fb-4b37-8900-c47c743116f5", "comment": "Malware payload (Mirai)", "value": "473b9e0bd4590ba3b3ffe67a28c2e594", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347723, "uuid": "5d6e8e2e-44d2-479d-b932-763e2bb39020", "comment": "Malware payload (Mirai)", "value": "2e8441299af33b3ad8701c04b159d8a0ff5bfca6d6f1d8bc0f0bfa0c50130b15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347723, "uuid": "3d45566f-e4ee-481d-a63a-b30ba99a1059", "comment": "Malware payload (Mirai)", "value": "f75eace52beb7a481ccde715e3bd8a410d39f4d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347723, "uuid": "18fc12e4-c20f-40e4-b410-ac3fd9fdd22d", "comment": "Malware payload (Mirai)", "value": "cbb47ad2c9a21b430f80f181f4e6f883672320a6cf36d52be7e3272adf2a47751b1043ed252881215ee79f1b852b4a30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782347723, "uuid": "3f6caf5b-10d6-4b58-9036-e60778ce1905", "value": "T12E933C4AE393D4F0ED4255B006EBF7BB6A3099266150FA2FE74CF9B77932603211661C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782347723, "uuid": "f8bee17f-8664-4a42-ad9a-00ee2e16ba0c", "value": "1536:U7ATdAqhd1xOOtUsod5bFVhNh6hthYhfhEZ9U9yvXo9MtUn31kkeQ5PJr:Hxxesod5U9UEgpao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782347723, "uuid": "61ce4416-50d0-4a89-b5b2-ae3ba74ef842", "value": 90932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782347723, "uuid": "ab5a7bfa-1dd1-48cc-9ac3-2cc084e10ca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782347723, "uuid": "370545cf-e0f8-4a9a-a051-22b3387cf703", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9c9a40-70a7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782399932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399932, "uuid": "5c2f92c2-2460-40de-a131-2863112691e3", "comment": "Malware payload (Mirai)", "value": "44a9254a60db6873a8258c4134d7e533", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399932, "uuid": "9d4fb7a6-90d2-4454-88ed-9de1d3598a19", "comment": "Malware payload (Mirai)", "value": "2ec3c178119f91ee51971b5fa285dd720fa7eabf971fedb19e5b82de1c95a710", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399932, "uuid": "01cb4632-f207-451d-89a4-29d73aedc42c", "comment": "Malware payload (Mirai)", "value": "837aaef5477a2947cadad0dc5336a2c2374807ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399932, "uuid": "e1136f74-ed1f-4f18-b144-ebcef77d9193", "comment": "Malware payload (Mirai)", "value": "91c2b94f718a8648411f9cde1166b23552ebc9695a593dca3f4985172649d3f2711a20184d41ee920ec1c251de2d007c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782399932, "uuid": "36923d54-56a9-4428-b51b-2b4ed9f9c894", "value": "T14DB3295ABC816F05D9C515BAFE1E534933131BACE3EE7212F9145B2C368B91B0F7A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782399932, "uuid": "c43c6ed0-602f-4921-b459-4ec03512e298", "value": "3072:7jTPNj7YQv6VwgZ77XeX91tIkayvAsD/9lTeIP+c:7fPNj7Yq6VrZ77XeXHtIkaagc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782399932, "uuid": "04a5fcbb-0856-476c-b8d7-6c4962d5a78c", "value": 112824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782399932, "uuid": "35fff3d2-796c-41f2-a150-b3ad38f28fa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782399932, "uuid": "7c70b5b6-6aa5-44c0-b317-eeb10e32af6b", "value": "LyUL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99db5b67-7099-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782394043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782394043, "uuid": "92eb479c-d0fd-4506-ae25-3b4ce404a838", "comment": "Malware payload (RemcosRAT)", "value": "3ec82bddfe9b89fcffd48e1db04d05f0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782394043, "uuid": "d18ee11e-0130-4cd8-9e27-b54f17f4ef8a", "comment": "Malware payload (RemcosRAT)", "value": "2ff4fb4ccc187c5ce24154fd6f9bd2af267e3cc46fbfdb6e5848bf2059c516f3", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782394043, "uuid": "dd8f4234-86d3-47d8-9224-8840f6e717bf", "comment": "Malware payload (RemcosRAT)", "value": "9888a2e8ab12e161bd33e8ca90303621bdb8b51a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782394043, "uuid": "54d571d1-3040-4134-a85f-f397a1cb8a4d", "comment": "Malware payload (RemcosRAT)", "value": "f36de13b278ab5e72ab0e70a348626d6b6627a9e451115d7df4930df3f708130e5f22934b72d995b09f1b89a1b95039f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782394043, "uuid": "ee25c32e-7ff2-44c4-bbd0-b95920d40649", "value": "T1FEE6C8499B4C11059BFF27C19AFCF406A8FBBE4485FD6ECE39762E256A9C04853867C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782394043, "uuid": "74f601d2-9f1a-4766-b020-66052a52b15f", "value": "1536:hqmOL/ZIIzuhBGRwIz2RhwoIQLFw5fcUUCMJZekktDN+BHd/5xOuYLtwId0EW2E/:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782394043, "uuid": "9c51720f-c097-4fd3-92f5-c9cbe1a9cf20", "value": 14558614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782394043, "uuid": "f3da2630-01cc-44b8-83e3-3be80834bee9", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782394043, "uuid": "7868e2c6-23d0-4c64-9dba-6a29384d5f30", "value": "purchase order MPO-51720.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999ef912-707b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782381158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381158, "uuid": "de2dc5d2-5e91-438a-93dc-303c957c994b", "comment": "Malware payload (AgentTesla)", "value": "e4448c514aa3e8eeb8f46be530c8bfb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381158, "uuid": "89686b85-dc8c-4014-9d98-d9237c73d90d", "comment": "Malware payload (AgentTesla)", "value": "30589245784138e5090de169988a1295031618ccc1f78f2c75416980f7539774", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381158, "uuid": "bdd80496-b757-413a-b135-fc3c69088e38", "comment": "Malware payload (AgentTesla)", "value": "e061b8df251188e4223e1212307514cf5eb4ae43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381158, "uuid": "a6f66ab0-1119-4ac5-9426-eb919eea29ac", "comment": "Malware payload (AgentTesla)", "value": "7853c2d72433eecf713907a7bc7c64193e06bfe1fc50ce292fe9eb418739313a87311cec9a60e4ab164dd1833a0ac275", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381158, "uuid": "240afe4c-2299-4059-b3ab-74ef29204a0f", "value": "T14E54238628B9B559F36DA0E14F23305CB14B1EDD16EB223876BE48ECDD90CD391AD193", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381158, "uuid": "db26128d-900c-43b9-99b0-072d4d5a3568", "value": "6144:5tO6fcJq+3yEW7O0eUXDUmkMsWw5dKqCNt6G7SSavJA/fO01M0fVezG:br0ZEVebmkxWwvi4GBae/N1pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782381158, "uuid": "2c6ca404-d7e4-4cb0-9b58-d98c50eb55b0", "value": 289002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782381158, "uuid": "132431c0-3be8-4e65-ab02-e994eb5fc5a6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381158, "uuid": "b7ff22f8-9dce-45d2-b578-07368a12d9b4", "value": "PI No.358 - SPB n\u0303\u00a0 FCL.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fac2375-70c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782413354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413354, "uuid": "e1beb673-3575-493a-8098-49c2a941d32a", "comment": "Malware payload (Mirai)", "value": "1429909f9f26cb766933d7bfb0b14308", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413354, "uuid": "152a0263-d2fd-477d-82a8-f881b92b3107", "comment": "Malware payload (Mirai)", "value": "31764032ea9adb75b70c06c1e612606c8ea3a5f52773af8b04ab23ace6453e74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413354, "uuid": "887c0d75-eb67-4ca2-adc7-d71dafc86d41", "comment": "Malware payload (Mirai)", "value": "e3b39c1c37388e16a7476cd27f32a7dbed8d58dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413354, "uuid": "c1e38dbb-e3a2-4de5-96a2-7c614bb4ffa4", "comment": "Malware payload (Mirai)", "value": "97927fe40b5b9885a93f1dbdab4230ec862fe1d02018a240758af46afce9ccf19aca27ce3e20c112e615be4bfb6de3f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413354, "uuid": "296e1f75-b0ea-41f4-8d47-a1b1cb3c1281", "value": "T1A8934B06B892CA12D6C562BAFB5F818C331617F8D2DB3203CD159F747BC695A0EBB584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413354, "uuid": "445d5f0d-4ce7-4de2-a639-248d5c66a342", "value": "1536:0VP7pmAE9Bo3UT8G9s0nrb9lAoUJaWn6nXut7ldWHRlMVVGsdpgcrRSKjbDFJvf1:gP7pmAE9KkT8GTnFlAoaaW6n67ld4QVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782413354, "uuid": "5628b825-8f26-49aa-994f-61c9bf9a9332", "value": 95688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782413354, "uuid": "ef5a2595-0ece-4e30-8108-5972bae4a63e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413354, "uuid": "9bf4e727-58e8-46ae-a32d-52233787f30d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fa120e-70c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782411913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411913, "uuid": "db148d34-923b-4dc3-8cde-db20b07e175a", "comment": "Malware payload", "value": "7e98b8570f72bc9744f571d9aa62e1b6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411913, "uuid": "1d8a9f0b-5007-46db-848f-480c16f358a7", "comment": "Malware payload", "value": "3183600f33275ca27aee2888d0468dd376c18809625ff69081149f4f93f037bc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411913, "uuid": "036e557f-017a-43b5-b4ec-dea6396ae701", "comment": "Malware payload", "value": "a15f2b1dc9a1112e31653767bb4b1854dabb44f5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411913, "uuid": "94eeb931-fc21-45fa-9f51-92d42c215665", "comment": "Malware payload", "value": "15c577bee0b5789dcce8ef493a1d60fe2dce7128e3f51a6b9e0bdaed018487b34915398a97ab9c3d6a173f434ca1423e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411913, "uuid": "d265e963-372e-4735-94fb-2b0c9c2e6799", "value": "T1E4136C6526913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411913, "uuid": "47090d2b-28a6-42db-a741-6475c3efc771", "value": "768:NdXRWNGxVt9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:NnlxAco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782411913, "uuid": "880e1426-8123-43b2-8d82-e49e7b3ce60f", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782411913, "uuid": "991d17d5-f6b2-47ce-9770-3e95cbc49c1e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411913, "uuid": "93756176-1dc6-4310-af65-c21b96726c59", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc67198-705f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782368976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368976, "uuid": "485d59aa-cd2b-450f-ab33-57f2dfe05694", "comment": "Malware payload", "value": "0859085d3ab968de9ccfb9a829ea19af", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368976, "uuid": "958a5563-a6cc-46d4-baaf-20f4a0596970", "comment": "Malware payload", "value": "3284e55f4a28711e455a3118abc6b4a83642176ca2956b014c562609eef5ee9f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368976, "uuid": "9d678445-3b5b-438a-9893-74c51fd87ad3", "comment": "Malware payload", "value": "e7698d45f8108fa36322c6a626f2d9c97b926835", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368976, "uuid": "0724d133-20e9-445b-8d5f-714ac37553f7", "comment": "Malware payload", "value": "749fa718d2096e4759580a8dc1da811bac19111ac9070f56fa8d56dd642f6879f2bf51a67da2e9c53795629390fac40a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782368976, "uuid": "cb226471-e83f-4155-90b2-e59b1c94acf0", "value": "T1CC4150C722A1C872BCA9D467B15E85C079C7A49214FC7EA678CCF8E1498FC7C7510EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782368976, "uuid": "5b72a6c5-1b9e-4150-8a2a-b50b8f47edf8", "value": "48:Op9FYpCctpFIi/pbNSk3p3z0pOs9plTBupX66JoglpRt7pTnn:OevXLBqFk35l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782368976, "uuid": "07ae288b-be49-4053-ac3b-029fe69096ec", "value": 1907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782368976, "uuid": "b9ef3b79-b790-4d1b-bbca-c0b26fcb4de5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782368976, "uuid": "5388fb19-78e7-4798-aa5f-bb3c4dae02da", "value": "ghost.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8bf443-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390562, "uuid": "7ac214a6-e628-4075-a55d-d9c3f9a2da80", "comment": "Malware payload (CoinMiner)", "value": "232966840c8f399ee9ae7a9d073c554b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390562, "uuid": "ca39a7b2-e311-4f51-a512-a8e24c20d106", "comment": "Malware payload (CoinMiner)", "value": "330b792df60d23ef400d9347bd3bc3e001ddc2062d9ca7e54e66f834d41d4307", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390562, "uuid": "bfa61760-5ccf-4982-8741-2366559230d5", "comment": "Malware payload (CoinMiner)", "value": "69acea57abd10f45672ef719d75476c53e424b59", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390562, "uuid": "122a3a07-23a5-43e3-b654-1876b89da7fb", "comment": "Malware payload (CoinMiner)", "value": "46798a34545bb2fe9ca917ac01f1b0eeffec82baa42bf087906492e20cbfa6c2369e9203d02b4b869dfe74ff114bda1c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390562, "uuid": "252d24b7-254a-40a6-88b5-b38c584c61d1", "value": "T19FF533D4E09130BCDCCB8CB952DBBF12E55676A20BE169EB02DA69B01533BC35E36471", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390562, "uuid": "2aa9a1ce-18ec-4c4b-a52d-43d1900c501f", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390562, "uuid": "b0c38af9-47ac-4744-98f9-cbfc375ff617", "value": "98304:AE9QNdwM5kPzJZC0WXZgD5rIVbn6+2BiSQW:ATNdwMWPq45rSnL2YSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390562, "uuid": "17019417-1df3-4f81-926a-6799bce1798f", "value": 3449832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390562, "uuid": "4443007c-3473-4f15-8e26-6a85a1ac05b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390562, "uuid": "ec2c9423-c52c-4261-bff6-bacca0932da6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ff875a-707d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782381825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381825, "uuid": "7c1ad711-cece-47e2-a9ff-4d403d76f4d0", "comment": "Malware payload (Vidar)", "value": "b8fc34330f8eedcabb6b3c71d1748620", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381825, "uuid": "ca0d540d-aa10-4b3c-ac56-e04087e03c26", "comment": "Malware payload (Vidar)", "value": "33bb1e43c6d93702f68f4238ffafda1c1c0766c1816d8e51328e872fe055c8e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381825, "uuid": "9ed103ca-f846-44d6-9d1a-48f434fedb5b", "comment": "Malware payload (Vidar)", "value": "da4e18766a3d1d114f888fd42bf448c771ebad90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381825, "uuid": "a016a776-9123-4208-8236-6c4020e26b1e", "comment": "Malware payload (Vidar)", "value": "9f9171edbc92b36aae841e1af31cc967ca947fcf4607096d4b4b2cacefe19ac9fc43599afc4f978b0249c94067d62206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381825, "uuid": "a7c9edf3-18fd-4381-bc68-cba277bcf761", "value": "T13E06AE0B6CD29DA5C4E6A37085B25281B73EF814573A63D72E60B5753F322C19EB7B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381825, "uuid": "1a668dfc-0956-4761-995e-259d3d477d6f", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381825, "uuid": "15d39f4b-44f4-40fe-a19a-f79a137194ae", "value": "49152:W3AJskIb5FNDXdRv+ig+zYjWb+iwJKmBYssGb:W3rVNKVjZiwJKmBYBGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782381825, "uuid": "9719cc4f-0132-4f10-9b35-f4884818da55", "value": 3750128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782381825, "uuid": "871ad068-a582-46e3-88d6-ba426919a11f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381825, "uuid": "d2dd04c9-9b0c-451a-b589-597dbab94c97", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8faeef5-7052-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782363574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782363574, "uuid": "afac86a8-4649-497e-a5f7-17d752c53e2e", "comment": "Malware payload (Vidar)", "value": "06cab9b5ed4cd7f73393ebfeba6e4a75", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782363574, "uuid": "0a31f367-4a89-4583-8d11-8ae601b11e5b", "comment": "Malware payload (Vidar)", "value": "34ae1b40cc36ff02ab71f076a78dd3961e1accb50dc158dc02f3b9c3ba538633", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782363574, "uuid": "c358c206-8d4f-4208-8b6f-e1515236cf99", "comment": "Malware payload (Vidar)", "value": "58ae2f9830d5ad8864ef33aa9c1db659abed2e69", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782363574, "uuid": "4c1a52de-5678-4a5d-acc5-afeff34ddc18", "comment": "Malware payload (Vidar)", "value": "41913be141dab88ef74baf2aac4fe332f419cbebe9f3fa8c244fc99f427941917c3198a99ddd1ce265c5883dc70e3044", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782363574, "uuid": "bda14496-348a-42b0-954e-6f196bb80199", "value": "T1F7069D0BACD18AA9D4E9B3724DB262617B7DB8141B3657D72E40B6782F372D19C37B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782363574, "uuid": "0e08d7d8-c1dc-48bd-acea-c65e73cdcfdf", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782363574, "uuid": "31102d5d-9d03-45e1-b124-72784c108da6", "value": "49152:GHIH4JgyzaSxjPwdbN5tzL0vgKcY9sX+sf2x:GHZNjodZ/zL0vgK8X+jx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782363574, "uuid": "c04a56b3-2213-46e8-9acf-d4c93da1dd43", "value": 3672448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782363574, "uuid": "15776e62-6f77-4e65-a356-a31ac0f6d196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782363574, "uuid": "98707b24-ce92-4975-8856-29345d7e53b0", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549142fd-7047-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782358708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782358708, "uuid": "60771eb9-edc3-4e0e-a47e-b9cbeb92d22a", "comment": "Malware payload", "value": "72304734486b1010ccdd69dd0369daf1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782358708, "uuid": "6a72d448-33db-4b16-94e4-415820dc11e2", "comment": "Malware payload", "value": "34b1ab13d92e0551fb4bd85319cdec417ef110628d6af437b734c81358257254", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782358708, "uuid": "c4f058e0-b077-4f00-a7b1-1c96aa8cfc73", "comment": "Malware payload", "value": "2eac89a4cade7be7e088425410351949fcc1f9bd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782358708, "uuid": "68d35ff8-07be-48e7-87cf-299e41fcfdb6", "comment": "Malware payload", "value": "2c89ef7ece879486c56897c58005f3499f333de6fa860222576c15e6e66348a663385c0dfc37fabc233af3fd536acfd7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782358708, "uuid": "5b7f1b2f-8c7c-4769-8eea-d6e1f20d3b7e", "value": "T1BA136D6526953C25AE99883B5C7E2F0CBDA983E1304491DDBFCA3CF18C15A9CE319B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782358708, "uuid": "c819ad23-a996-466f-becf-0c074ae3338a", "value": "768:Hr9NyXsZztCL9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:LHusZFco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782358708, "uuid": "0604ab0b-86de-4120-8590-f7f56d9482cc", "value": 45509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782358708, "uuid": "877c3d38-11bc-4073-8872-0d449173fddf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782358708, "uuid": "da6f63c7-2219-42b8-92c5-299945d6ced8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a52c174-705d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782368140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368140, "uuid": "c3441aff-0812-48eb-96c6-4e04aa0151e5", "comment": "Malware payload", "value": "5bbfa8b4112a1a0a0d9d65a96179a1ee", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368140, "uuid": "7584d6d4-f31b-45dd-8e89-876c26bb7dd9", "comment": "Malware payload", "value": "34e5d32a68713e8bb3fbe8e83d8af62e2d56ef554831f30c4df6ea93fcecf531", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368140, "uuid": "767220b6-6d78-4ed2-992d-145f0e8edcd4", "comment": "Malware payload", "value": "3183016910161e280eec2650db6d65e82610fbf6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368140, "uuid": "99af002f-4b92-4221-9640-beb5230582a0", "comment": "Malware payload", "value": "b6f16140a94e89751de32eebf0dc4ab67e0a69969aaa56d2835792303f55c20f253921dfe6d3e8f7bbc80b42d2881973", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782368140, "uuid": "53b58008-87e2-4e84-9c41-9aa6eec79853", "value": "T173136D6526953C25AE99883B5C7F2F0CBDA983E1304491DDBF8A3CF18C15A9CE71871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782368140, "uuid": "6bd8d54e-2e96-40f5-bedb-ec582d5f632e", "value": "768:qr9NyXsZztCJ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:UHusZbco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782368140, "uuid": "6d344541-8ecd-4005-92af-0dd8cfcc2389", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782368140, "uuid": "55686028-8a8b-4978-9119-0eb3cbfb271b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782368140, "uuid": "015127d0-24ce-4527-aa78-4b3274453c51", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178b2ebb-70c4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782412293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412293, "uuid": "b5d2fd22-3605-47dd-aa5d-c3480ef5df8d", "comment": "Malware payload (Mirai)", "value": "dba0ebcf2dd99e27a8b14c9c0f5f6969", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412293, "uuid": "0607356f-8627-4920-98ed-c9b71a6d520e", "comment": "Malware payload (Mirai)", "value": "3595026925810438583250f2ceceb6dc82130335b98ec31f0af8fc114f364ff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412293, "uuid": "07d2bd21-86e2-4678-aa87-fd94a2613cbc", "comment": "Malware payload (Mirai)", "value": "44fcd63ce78c120f30a79ecd0d963fe750a3809d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412293, "uuid": "0836048f-2d09-4ee0-b3f6-ed49d4f642ae", "comment": "Malware payload (Mirai)", "value": "da229a8183b73c011f99bd6b9ec32f46d0a289ec38940ed0222c2470bfc3c02c62c62db18ec0d35d7c8e2c1b421212fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412293, "uuid": "bb4f3df9-304b-408a-a175-eddbcd9be734", "value": "T194E3C71A9F620EBBCC6FDD3706A9060639CD944722A43B753674D928F54E90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412293, "uuid": "57149917-0bff-4c06-9521-4d772213e1da", "value": "3072:CmlJg62MXpP9BwnnV6D/QvMxTEvHXhp2h1++QoowoQclCJmt89KZU8xuQtAAKuS4:jJDrQFBaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782412293, "uuid": "eeb39990-d520-40d9-97d9-2c393909c032", "value": 156736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782412293, "uuid": "8b24540c-cbfa-4d56-b6ea-5c1ee7caff2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412293, "uuid": "c452f418-9cd3-43e8-9101-63d1b22f2bac", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a4df22-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390538, "uuid": "c0de1b30-2c09-488b-bf35-c4413f030641", "comment": "Malware payload (CoinMiner)", "value": "51db895887aa65d11f4548cec0ce7c1a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390538, "uuid": "d4dc7e81-9258-408a-9558-9089dabd9fbf", "comment": "Malware payload (CoinMiner)", "value": "3596dcb90c580070993afc073e7158b4bcac5b4fb930b8e184fc531629012b14", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390538, "uuid": "b17c1037-9801-43c3-8937-c6d402d2e817", "comment": "Malware payload (CoinMiner)", "value": "4ed9bb6625c5f4d465a89ee04ddb0f1eef6c4ee6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390538, "uuid": "9c369b43-a24a-46c0-9d70-46bc6d320896", "comment": "Malware payload (CoinMiner)", "value": "f38a625e9478b92f20a3db68123e73cb801ac7c076fb7f64978e8e314648bcfc95d4919076922ccbfb5fdd70b9e317b8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390538, "uuid": "dc281ff8-376f-4893-b6c1-7d430a396fd5", "value": "T1A0F533C84C9055BCFE6A4671A5DE0FA9242631762D41BFFB00DAE5F037A23EA7917843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390538, "uuid": "9c8d16b4-60fe-4506-a05d-b4ff116e60e4", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390538, "uuid": "8832cab9-eada-45ce-8a22-01187585c57a", "value": "49152:svh4299+nZzQrmaS5xxjHNaHVphtg4A+b/zll1/fhzX1XdOiD:svhN99uQrdi/HNgo4A+vlb3hxYiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390538, "uuid": "c441cdd4-ebcb-4031-ab34-5623180bba4d", "value": 3449832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390538, "uuid": "a2540562-d300-40b4-9123-3bef10769a38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390538, "uuid": "a551710e-577d-4b9c-a1e6-db5cb0cd4342", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc293c6-7078-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1782379665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782379665, "uuid": "b3691078-8058-435b-95a4-961a7450533f", "comment": "Malware payload (PhantomStealer)", "value": "9856ca926fc6b0b41d1548c9b7878b9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782379665, "uuid": "c28ffdbc-da08-4f81-80ec-c4f0e259e13c", "comment": "Malware payload (PhantomStealer)", "value": "361ef56a8016de1052d39311bbf1288e3673d2fc8c06eb4a864841d018979eb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782379665, "uuid": "74f51548-85e6-4823-b1c8-d821671c77d2", "comment": "Malware payload (PhantomStealer)", "value": "dd08c8c89c4b6f02df0abe4876a51e9d7fc83c36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782379665, "uuid": "715c0e5f-2119-4a16-971d-ada7a6c5f52d", "comment": "Malware payload (PhantomStealer)", "value": "c5889d804cf86fd5176d0d7e2ca820f438f6cb821047e997872d9922abd47169841e706905ef3ef7d5aab13db3726168", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782379665, "uuid": "98434b5c-375c-4dee-9719-4c8a93b9a684", "value": "T1436522291527C809E5E23EB05C71F1F9AB62AE9AF339C0291FC64D67B62752D3C04736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782379665, "uuid": "d1cdb475-092d-457f-83c1-de6a00d393dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782379665, "uuid": "1ac39c37-47f9-4e54-8195-55b8b0a3a8ba", "value": "24576:sEYY2Lg+d2yk8auTMnqn70jI0ZLvmPu4ugIe8VeEtBwxhUdCfe3vLP0z8+3/CGUp:sC29ZTOqn70JZjmW4u7vBkUke3vLE33U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782379665, "uuid": "70affc61-9c6a-4a70-a37a-3b27d08b476a", "value": 1523712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782379665, "uuid": "83cdc259-0589-4b5a-ad31-54e6b6127127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782379665, "uuid": "f5166bc1-9339-4606-8d79-382e253fd2b8", "value": "SGYI01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a219256-7093-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391306, "uuid": "40892ee8-3415-417e-a46d-d588ed1093b3", "comment": "Malware payload (CoinMiner)", "value": "2177d4601c94e659d142751797f3486a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391306, "uuid": "74859975-4834-4db6-9dbf-af827431f088", "comment": "Malware payload (CoinMiner)", "value": "3690225f09b36394ee90c3ca13bc11db63b9411bf5145f39acd028ac1a1da201", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391306, "uuid": "b4d97dce-244a-4cb4-8e19-b94b4e8b3e25", "comment": "Malware payload (CoinMiner)", "value": "b41511d55690e6deaaa49666d597106262a73f7a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391306, "uuid": "7523cca4-ac98-44b6-8782-721bde655d00", "comment": "Malware payload (CoinMiner)", "value": "4c115628e347e4d6e1764e700d21c6b5a62abcc4abcd339185b37293999c2a609ed39e00a56c4eb0f6e440ad741b69e4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391306, "uuid": "d3fab6e3-0acb-4f5b-8827-8510f203d46c", "value": "T130F533D2E58274FCED42483482ECBF01FBA475160FA1D2CB13E79AA9B87DDD52931512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391306, "uuid": "bf7899ae-64d1-41dc-ad2a-c23d897038cd", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391306, "uuid": "b61e4da4-937e-4a9a-9d15-61926153c501", "value": "98304:bzr3faPC42KgsbHZCn0rHgdydLgyzgAyrvlm:TfuC25CnqLg+qvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391306, "uuid": "550085d8-9f62-417f-81f8-25b28721c336", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391306, "uuid": "8d0a0bb9-7f6d-434e-bbe4-218b9f981188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391306, "uuid": "e535b9d0-a0b4-4381-af77-f615b07c3e8f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f74fc8-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370705, "uuid": "05f198ad-ba0f-4870-9fbe-83db63050eaa", "comment": "Malware payload", "value": "7907ae1e9061e1a18a730d3411edc75a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370705, "uuid": "9e6ae639-efeb-44fd-a342-5886c44ef7ee", "comment": "Malware payload", "value": "37a729a1abe8e43ddf6818a92214f54ed99c86d39d14cec6bfc52c2c0f3b4e47", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370705, "uuid": "757a7010-6439-4ae4-a740-a77649e7912b", "comment": "Malware payload", "value": "d88f7d1b66604393637db17e566b0367121d14a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370705, "uuid": "e4944bc2-9449-45a1-97ca-4a79aea5046c", "comment": "Malware payload", "value": "831302247ad159a0ddc952e37016e8577022bb5d26aa01c2500eed4be62dc7020f43287370c4a927de53a3cddf0b2a5f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370705, "uuid": "fa34f26d-4a8e-4434-b99f-67b9b6d6c9c7", "value": "T15E853373FDBC4DA0EAA27AE9F179C12595560C58B5080A3CC66C5B5A5E3FEF0C0678C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370705, "uuid": "d8df5289-168d-48fb-9a7d-f6adb9db679a", "value": "49152:ySTwFPnDbhVmLonL4+xzS86U8TedxFK7L3aAP71wG4om:ySkZDb7m8nL4+MXU8TedxFKX3aA71wLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370705, "uuid": "56895482-5823-4a1a-9264-6a8745ca0c37", "value": 1857340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370705, "uuid": "7f4d18a1-76a2-40a8-a384-b4cb0dcb76e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370705, "uuid": "907226b2-1b7d-4711-b84e-b5722db18d11", "value": "ksoftirqd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632610d1-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390516, "uuid": "2b327a76-7621-4c6b-a82f-3b9cbb50b553", "comment": "Malware payload (CoinMiner)", "value": "f73a3a4e3c0aa4bfa571c98c439dd7f0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390516, "uuid": "18bd906e-1f32-4b1a-b111-8ec2e6450c68", "comment": "Malware payload (CoinMiner)", "value": "38475cd6250b74e515d6f39e49ba51ab31fb5ab3e510e49756b45236e5a2f7cf", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390516, "uuid": "42e78978-14a8-41b7-9808-42255cf83fdf", "comment": "Malware payload (CoinMiner)", "value": "41b6b2f8cf99d9499b01fc4ef0f1ace2b3529a6f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390516, "uuid": "42a5521c-076f-46a2-92ef-3be2a7f23d64", "comment": "Malware payload (CoinMiner)", "value": "64ee2c308a8639038be4279e82696b2089a42f2f9b03f03917ecaae30800c6596377f77804a392a9828b471a36ce5ad8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390516, "uuid": "f52d00b1-1594-4f2d-80c2-b083dd34708e", "value": "T1F9F533CC33C286FDD449A9B06B9D9FA6942B36928FA271F320C6A4B05536FDC5B74C50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390516, "uuid": "168e130b-103a-4a1d-86b4-3a2eef41272a", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390516, "uuid": "21825f50-384d-4b5e-bc94-37c63113ceaa", "value": "49152:4hxkzfC4KZYFLJ9iUQMBXhHcgdS7cS+3J1GM+KdDpdN6eNJp0/2XTqY1S1dt8haa:4hx0LlBuUXhDfV+GrNfNW6ujt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390516, "uuid": "0d228845-be5c-43e0-a4ab-377082f0f9c3", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390516, "uuid": "a1dd474b-75a2-4254-a947-c31abb477a9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390516, "uuid": "f5846445-46d4-46bd-a15d-e495bb1cc4b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90763fd-707d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782382123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382123, "uuid": "3859fe3e-af89-4995-95b7-4486529237b0", "comment": "Malware payload", "value": "1ce0cb120a9b3d993351fd2b55785663", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382123, "uuid": "f6b7dfda-6b38-497a-b1e3-b66e3f1fe7fd", "comment": "Malware payload", "value": "385f85a8d7160f221065ae9501d5d6d544dd1018eba65f8fb30e1fb2032d4957", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382123, "uuid": "9d8fc43d-dca3-42da-b8e9-d04aab3da23b", "comment": "Malware payload", "value": "eab880fe733a8bb255975eb4fee8085e26b41271", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382123, "uuid": "ad750806-51b0-4984-bb4d-4cce3c7ad9c4", "comment": "Malware payload", "value": "797a880c7ee1b6854024ef23e3b247562352573ee22ec7237f5ca672429667b7ed28eba3aeb7b1490f029c5a4233c249", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382123, "uuid": "eca8ce72-1098-4540-b3f8-8103ae5ae496", "value": "T196C42358BAF09098F64936321A5A8779A7C37C362745C7FF81A3501DFC3BB4806675A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382123, "uuid": "cdecef51-065a-4a59-8771-b4d8c5b460c4", "value": "12288:BOOEXUlD72LabpRSuoM4dsx1HWSwVlczoyCOiWhvGc+gxOo2jTIHgG:jX2LOpRSWHW5yniWhOchx3MVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782382123, "uuid": "456ed13a-02c8-47a7-859a-af4f5977124e", "value": 584420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782382123, "uuid": "67426c71-c2bb-44f8-8fe3-46d9e8b2d039", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382123, "uuid": "8e5be872-d43c-429f-8cb6-558593ed544c", "value": "NewOpportunity.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84909195-7039-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782352776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352776, "uuid": "749dc1e4-55c2-419b-929d-d2808929a83c", "comment": "Malware payload (Mirai)", "value": "f0f3aa80f9a768400028faa9d1c54e9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352776, "uuid": "b93b8407-ac27-4c3e-9cd2-1d0478d3ebc2", "comment": "Malware payload (Mirai)", "value": "396c4ffc3d7428e57ecf71eb3dca8a7f07deee530ed28aad065d9dc83b130662", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352776, "uuid": "0c691cf6-a370-418f-94c0-bbf45a4324c0", "comment": "Malware payload (Mirai)", "value": "8aa8341d1d8bb62f03b081941b27042fcb3de9ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352776, "uuid": "046b0994-861b-42b4-a9de-ffb224ac0a6d", "comment": "Malware payload (Mirai)", "value": "62a841a3ab1f8b06f2eb6fb24ec3ae9d58221bee5e2867ddfa1e1235ffd2a0d8911917f723e6fad51ce4be91dcb8df1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782352776, "uuid": "cead52a9-ebfa-4706-9c11-d49c5dd951b1", "value": "T165A3C64E2E628F6EF76D82354BB35F35C654339B2AD0C641D1BCE9055E2020EA85FB78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782352776, "uuid": "6111e3da-663e-44de-a42f-619f1c4f6fec", "value": "1536:ZQcccZPj95viyJq/6sEUPr6hQTgEeNlszkdDusEZMw3xs759EtECbbkV5/:ZQvcZviyJVnfceksEZMw3xs7YyC3Kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782352776, "uuid": "1dd1cb8f-ffe7-447b-b6cc-d8bbc73026c5", "value": 101184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782352776, "uuid": "748567ef-5fa6-4471-b428-d27dad79c65e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782352776, "uuid": "5c6fa263-f171-49ff-bbc4-ecaade5fb327", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa3fe42-7054-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1782364329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364329, "uuid": "6b4bb207-0c9d-41e6-adc2-701ff4638ea0", "comment": "Malware payload (SalatStealer)", "value": "104f3ba9a4884a153696833fb7d90c24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364329, "uuid": "ebaa7009-2121-4e08-b40b-2b1049d7c81b", "comment": "Malware payload (SalatStealer)", "value": "3972f0b20671837938996ebf0e6dba5e36a8dd3dcd9cf72ade6300506e670380", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364329, "uuid": "acee8b87-f020-4b99-86da-b83dc14cf4e2", "comment": "Malware payload (SalatStealer)", "value": "e6fae54cba02e2aeb468b874d87f549e2129a6fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364329, "uuid": "af45745a-9a4f-40fa-a55c-fa19e479ac97", "comment": "Malware payload (SalatStealer)", "value": "240b99bba6633a7528e9c78de193738c7506481be1b13e9c28b54c094f2e62619a9f8ec529792e0efa08437cfa81201e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364329, "uuid": "8869ad08-db5d-4e7f-a6e0-cfcdcef618d3", "value": "T16DF533D3FDBC92B2FC5489B159A5C15F683C6F411383AF2BB0928BA4BCC74564628C9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364329, "uuid": "d8289db9-03d3-4d7b-9faf-2c1c9980189a", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364329, "uuid": "4bb36872-5b56-4c79-b9c7-a5752298aa6e", "value": "98304:F/BMa9HM2I/N31GZOwpl75UJMlUjYxHesSZLfc:F/uaZpKmZOa75UGlUjYxHes4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782364329, "uuid": "59194e82-292f-4ddd-b677-5e8631906bba", "value": 3593216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782364329, "uuid": "9f9b7606-20b9-4bc2-be4e-92252d6c6ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364329, "uuid": "060937dd-3d20-44e1-a5d1-8b2bcc3528d3", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013cdc67-709c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782395076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395076, "uuid": "f4d5c211-e471-4a34-ae0b-e1679748013e", "comment": "Malware payload", "value": "1b3e54f7c4a622c3331c947e0c4c63c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395076, "uuid": "df837159-f6e8-4342-ad15-dfa893166d12", "comment": "Malware payload", "value": "3b0a4269912d555ce9819a8f3e62d0d0440af53267da5844c68c41be8be4a77e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395076, "uuid": "26b36e95-689a-4ba7-bde6-97b843fa91a9", "comment": "Malware payload", "value": "cc37ffd50910b91b15a361414ea6a6bec1d71e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395076, "uuid": "1fba98a2-4e97-4ada-8a5c-a868c1a5a3b6", "comment": "Malware payload", "value": "6ffd9221832d711e665f93173e0f26d8d768bc2004272117bcc5abbfda76d74974fe758abf1738ee66a930150525861a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395076, "uuid": "49169700-ae12-4a70-a484-191e11fcfef2", "value": "T12494192BE3BF4D90C030D6FEED0366751DE8B2211A1DF6D696618C72BCEC650B91A093", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395076, "uuid": "0065bba4-04c7-4c8e-a945-edf0b9dcde07", "value": "4bc8f96c7329c4ee58a3d11dc6cdc794", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395076, "uuid": "a52a447d-435c-4a79-be0f-bb2b16a12a09", "value": "12288:cBTbaBh46iPA8888V888888f88888888888888888888888888xArM/68Y:cBnC5a2Awe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782395076, "uuid": "0ad6be50-c414-4cb7-a23f-20005645a6a4", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782395076, "uuid": "0e1e81ad-9cfe-44df-8ae3-7ab35d5a99af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395076, "uuid": "2dc40d2e-66d4-4e73-a45b-4e1574c319ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08aa413c-705b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782367171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782367171, "uuid": "827d023c-23b5-42ea-b738-1cc6ea862435", "comment": "Malware payload (Vidar)", "value": "3ed1aa6794d410b4c93bde4a7b04cc4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782367171, "uuid": "3896d760-8315-4aae-bcf3-b9da3c4e7cee", "comment": "Malware payload (Vidar)", "value": "3bb4f904ef0475df99243a5c00d041840b660252c837efc8523e2d2712251e87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782367171, "uuid": "f0f69d12-5f6e-4f25-af18-73737ba28059", "comment": "Malware payload (Vidar)", "value": "6391658acacb8c8dce3778b17d136c6bfaec40b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782367171, "uuid": "0a29cc08-2596-4ca7-9cd5-bea156373055", "comment": "Malware payload (Vidar)", "value": "b13a16f2a24be42f444b6a17300dedd92ba9a4c962b1c22e5e2dba8eac602b29b001753f44cc522cc2e7363f45a4a248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782367171, "uuid": "7acb90e4-608a-45df-a251-0c2b0cffc484", "value": "T196D58C0B7DE90DEAD4A9933589B681527B35BC194F3227D76B8077782F322D0AC36B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782367171, "uuid": "9e5018bc-0e1a-499e-88bf-7e8f621d8d4c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782367171, "uuid": "451fa348-4e8a-4cff-96e4-7374c5659829", "value": "49152:MytaAUDCikTEAPmZbnAC/8qwj3T2tI5gngfQzSY5V:MmqZrhnAC/jwj3T6I5gngfKSY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782367171, "uuid": "46645445-b7cc-470a-8ad5-a164819fc2bb", "value": 2901864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782367171, "uuid": "f4e3039e-32b0-4da1-b0d2-82eed02abe0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782367171, "uuid": "c2aa8521-97d5-4249-9d3f-3f8726d32127", "value": "Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa099366-70cd-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782416539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782416539, "uuid": "6d196566-07e2-4ec4-a246-c4f087defbd3", "comment": "Malware payload", "value": "04a3fe17dfadace16cd526a68cb5245a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782416539, "uuid": "56e5df58-b147-42c2-b046-d10a49b527e5", "comment": "Malware payload", "value": "3bea8f120a6006083937a8a990c351f4784ce9f9ec8397345448f1f65da2d7ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782416539, "uuid": "fad43afc-d9a1-495e-9645-8f79379e2ca8", "comment": "Malware payload", "value": "e6f01edbd14f5f7433bb6b4a6019ac989d3eeebd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782416539, "uuid": "1800e68f-cbe9-43ff-b978-49d0c7e57e9e", "comment": "Malware payload", "value": "c2659b89a9405a6932b755296b3b7b3434ce88d3fbee7e8804cdd61fd9bcc2d81597aeeb7246019700f9b1a1a4627c7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782416539, "uuid": "8964d970-a21e-48a7-b082-4994ffaab59f", "value": "T1F9D3236461711C8EE692607E6BF513B17A24164E33CBEEC7BEBB6379CC084893C86517", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782416539, "uuid": "e5191854-e2ee-4628-9511-c1d3b48df9e5", "value": "3072:E7PR2COr3MArjxZ6QHfEq19k+MG9G41y58oYOcV/:8Z2Tr8AGQ8qkpWGcy58o2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782416539, "uuid": "212482cc-1ad7-436f-849a-6099820066f5", "value": 131996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782416539, "uuid": "7d5324ed-6e34-461c-8efd-323329335c90", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782416539, "uuid": "c27f6380-4b89-4557-b66c-fa11715d0662", "value": "kworkerd-netns-rt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426ffa63-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370704, "uuid": "d855a36e-86cc-4e04-af11-910de9f593cc", "comment": "Malware payload", "value": "41230f73ba0666124149781699003b49", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370704, "uuid": "63f107c7-62dc-47f2-a90b-6e478d64e71c", "comment": "Malware payload", "value": "3e17cd295681d4b8f330e2bdc3050e16b1fff75a2b9aa4cc31ca2a6b1c73d50c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370704, "uuid": "03d08efa-f538-44b1-8977-f1cf5139f258", "comment": "Malware payload", "value": "d81160f2914a438c427696abb083899da5410020", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370704, "uuid": "57855d2a-1b44-4400-9420-52f603068e2b", "comment": "Malware payload", "value": "3b4f4a3ea03f8819f77c120c9e207a764bdbc0d1e6a8ac55c720ae43196008f7a993775dd1822644c559e59d4db6c0d2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370704, "uuid": "681e8cc7-fac9-40ad-b511-bd3e192a7f6a", "value": "T108567C0EFD24CFB5C6A003B649B812981371AD026FC74B03A239F77CBDB6694DE46695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370704, "uuid": "928bd41a-39f6-4259-a45e-5d7312f740cc", "value": "49152:0SJG4OlZ1SOr/kQzaZyNqYYupigw+8p15Yutg5EU:i44SOr/k4/tEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370704, "uuid": "01ea1feb-7e13-47fb-b93b-fd01a9bde523", "value": 5963924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370704, "uuid": "34ab5409-6ece-4e02-9697-5933189cf6b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370704, "uuid": "89ecd3d9-fb26-472b-a9f1-7f40381ca542", "value": "cfg80211d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32fdb6f-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391160, "uuid": "45ad39e8-5715-4005-8f0e-43eab2593f92", "comment": "Malware payload (CoinMiner)", "value": "3e0499a96d5b14b1b37ff738b1d1953a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391160, "uuid": "85c6fdea-ec38-4da2-acee-ca942ae55040", "comment": "Malware payload (CoinMiner)", "value": "3eb586bc3205268becc78c10b6949d8c2960bfce9bceeab622201b1091b7f1b3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391160, "uuid": "2c15752b-3ae0-40da-a02e-d2da1301e5ae", "comment": "Malware payload (CoinMiner)", "value": "6d89c53f1de4003837bbd88fbc072fcc4edee0d5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391160, "uuid": "55edaac1-ab75-4fce-8a28-d8e7948b1f0b", "comment": "Malware payload (CoinMiner)", "value": "ebcaa85d02849a1cafa9898c000a6f0c48af888147b90e7307dbac4be9e0acbbb5414931aee5dc27ac3e297eedae0b91", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391160, "uuid": "da2d1596-d2c7-45bb-899e-e5d243c4609c", "value": "T1A0F533A2696612BCD467F4FDCBA03FA253793192077148CBBBE2048035BB7D66833D95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391160, "uuid": "5eeb97bc-3441-4436-a42e-f6143598eaa9", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391160, "uuid": "ee25482a-3b04-434b-b35b-5d5e4c617b36", "value": "98304:CTqHDlJJUY54OiP1RUjXYXMo/1bVjtl1fB:CaEY54OifUjo/Hz1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391160, "uuid": "361e6377-0c3b-4c5a-b1ad-fc0005542588", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391160, "uuid": "cb833f6f-a8a5-4452-96b0-969743a7d69b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391160, "uuid": "048da064-3bcc-407e-b1af-ddc728059e63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ebf773b-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390857, "uuid": "8c024edb-06c5-4f39-8ba5-8fb5d8231c25", "comment": "Malware payload (CoinMiner)", "value": "31fd05d7375ec32b6d92c2df9f2cf077", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390857, "uuid": "0a249e60-f869-46d8-bf63-dfd0ac4a07f3", "comment": "Malware payload (CoinMiner)", "value": "3ebeb21ddf3a0913397058609db41cf23e440dbdee26a2a569752521fb09d1eb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390857, "uuid": "377c4958-feac-42e5-abc1-c5aba0e46f78", "comment": "Malware payload (CoinMiner)", "value": "fbcbb0f32b0a2c4d6eb1a9098b4b9fad3e0734eb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390857, "uuid": "22260116-ca3c-4de8-a45b-032026a6bb7b", "comment": "Malware payload (CoinMiner)", "value": "c07805f75eb41ec4f48e7b15a20599280ff784b72b20526f1d92c5aca8a7155d079cfe9c0aab0a49c81fc744899e1ecc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390857, "uuid": "6ee6d734-2ccc-445f-a338-ac0989cf4c37", "value": "T1D8F53388789062F8C9F7C735C7BF2FAD2A3521A507162DDB016772A17E21BCB3C5A904", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390857, "uuid": "53ea4813-730a-40d7-bd0b-bebb03c83179", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390857, "uuid": "c1576386-c834-4dcf-a48d-d88679345343", "value": "98304:KPqiDU1GrZ+FHkaOZt+GHy83nV20Y7kyEUD:KUDkaOa23nVhRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390857, "uuid": "6d9f3b08-b6fa-4d81-9ee6-d05effe0db1c", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390857, "uuid": "8be06891-25c5-4706-b782-cea82e15a94c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390857, "uuid": "e35f2a62-bad0-4b2b-a7ff-0d39fb511595", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85eecfac-707e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782382414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382414, "uuid": "8a0343cf-f26b-48aa-8e63-7903a7a7acf0", "comment": "Malware payload (Vidar)", "value": "b37e5964bddc09f0532077bf8915bd16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382414, "uuid": "92af1c5c-1be9-4f04-b270-70f3412de87e", "comment": "Malware payload (Vidar)", "value": "3ff379fcedca10405d22eb467db5d93a9393e3e5b69f179989e02ec1ff23a578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382414, "uuid": "08b7fc6f-1d70-44f2-8f0b-bc98728a26e8", "comment": "Malware payload (Vidar)", "value": "7f8ba4fb2dcfa3ab390df14899ca23c8b280eb62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382414, "uuid": "5d5a3310-1fdb-4942-8ff2-95aedeaf558e", "comment": "Malware payload (Vidar)", "value": "dcafe57af277d94e9b905fa246f26b55ec789f5e581b48a0c1aebe898afdc2b67fd8a4b85e91b0c0793cff730a5bddb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382414, "uuid": "264271e7-6285-4373-bd50-7d62645d93df", "value": "T1D1D58D0B2CD10CF9C8E993728976A2937BB5BC155B32B3D32E8176B82E3A6D05D75350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382414, "uuid": "284ff0a2-b781-4c92-806e-1e71cd8f89b4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382414, "uuid": "38c1eb72-ea62-4f78-9694-d97f3e2a2e11", "value": "49152:nWbqlkA466erkBFzNJe0TTfEj2nlDaW02RIyDOf2ivn+lzQtUKLxeyWA:nRkTLNJ3R1ZIjPwuPLx4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782382414, "uuid": "be94c242-422e-49f4-b261-880abe251f93", "value": 2978688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782382414, "uuid": "331eb33f-765b-46a6-bb12-898947b43007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382414, "uuid": "92d68050-b8f9-4f3f-b130-9a94c04e6ee5", "value": "bootstrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6f0d39-705d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782368115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368115, "uuid": "81b3af90-a6f5-4772-ae0d-c3512cc4cc81", "comment": "Malware payload (WannaCry)", "value": "4ca5e797a633675885e5676641291289", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368115, "uuid": "c7851d00-e00a-4a88-9c82-36f1b534f863", "comment": "Malware payload (WannaCry)", "value": "401ed2d083d047422220358d8d73f4c666a82e565e9cd915c6d52749bfba4bcf", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368115, "uuid": "98d7097d-27cf-43f9-8208-562952437478", "comment": "Malware payload (WannaCry)", "value": "6275c7084ac75d0b96cc3371a9cc46a0ef8cdf1b", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368115, "uuid": "b526ecd0-597b-4e93-9862-3f87c0e8f8eb", "comment": "Malware payload (WannaCry)", "value": "2e8ed2c506d131f5db1bb73c7c296fabf99b9ec4e6fa62b24c37c086657f9a3ecd8b3d3f656dab2b721aeebf23346a9b", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782368115, "uuid": "5dcbcfdb-a699-4134-99c6-9eec443b276a", "value": "T1F236235A32BC90BCD1172334A4B38E26D6B77C4A22B9970F4B5487670E13795EF68B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782368115, "uuid": "db09125b-fee1-424f-affe-17c6b34b27be", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782368115, "uuid": "e98acec8-2dd6-461a-8135-f732f18f2783", "value": "24576:jbLg1bLgdeQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAd:jnYnjQqMSPbcBVQej/1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782368115, "uuid": "2d6fa6b1-bf4a-43f1-8f09-ce86ffcd6e26", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782368115, "uuid": "887d33ef-8de1-4429-8a87-c9f386f1493e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782368115, "uuid": "0c71946a-63f7-4a8a-9434-c9f2480e4ceb", "value": "401ed2d083d047422220358d8d73f4c666a82e565e9cd915c6d52749bfba4bcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92f18a0-7058-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782366286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366286, "uuid": "aa27e8c0-1cc4-48ff-8c10-f5d90a8f5912", "comment": "Malware payload", "value": "3e5bb3e15bdf45d2a2aa0af7fb709ac0", "object_relation": "md5", "Tag": [ { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366286, "uuid": "2ede8842-caaa-4732-8226-089907e4dbfd", "comment": "Malware payload", "value": "425ca8c8c287ddc0c783b49319bf21423201c6195289cdb6738f56fb475a2894", "object_relation": "sha256", "Tag": [ { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366286, "uuid": "897b6663-dc48-4abe-81ac-77e7df1a0669", "comment": "Malware payload", "value": "7622fa158f9daa06b3d8aff928f1f088e0ef6819", "object_relation": "sha1", "Tag": [ { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366286, "uuid": "06ed5d86-426a-4210-b0ef-090fdde9d63d", "comment": "Malware payload", "value": "185d7f7bff7979f9883b851e17be61ce31aa7d1468ff0151cf2ab3d36c45a4196eb9a517aac7b5a04b3d8d877a75f8f5", "object_relation": "sha3-384", "Tag": [ { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366286, "uuid": "4e9d0224-8fbb-40c2-a0f2-a0b7ee05726b", "value": "T11CB2E7DB1D4AA4ECD936D139F667072ABB7DF001172686CF06D0427D5B23BD24B39588", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366286, "uuid": "b2c363d1-b921-4f73-99b2-a7d7b85e6331", "value": "5dc92efa6b9e8657b452ff9ed97ffbed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366286, "uuid": "23935ede-d73c-46e0-93cf-11c89453148a", "value": "384:2NN+KyYWJA+tY5yEecoOPycnDVE21Cg8TqvUT8uPFJ:2NN+TYd5yEZoEZE21zwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782366286, "uuid": "a057655d-96f4-4b47-a4f4-b971a7351492", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782366286, "uuid": "a8d8b5b3-1e27-4ece-a1ea-6c7094237e26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366286, "uuid": "36b7c214-0b59-4b72-bd3c-e0c3af9cfb8a", "value": "hv.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe13900-7049-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782359714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782359714, "uuid": "711c4af2-1fd2-432c-93e3-92bdd92b894a", "comment": "Malware payload (CoinMiner)", "value": "3969cc1ce4476e0e6595101866079277", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782359714, "uuid": "7ab5a51c-20d0-4279-b4cb-31e7461c0a6b", "comment": "Malware payload (CoinMiner)", "value": "43172e45afb4cef97225b8ed783bd66bd7b06839c6fa95c957d248d67ca1725d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782359714, "uuid": "aeffc3ef-83af-49ab-98e0-6f71cda64137", "comment": "Malware payload (CoinMiner)", "value": "854aca99f735289be8c349b266f88ba819a3b74f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782359714, "uuid": "105e59fa-43a0-461b-a6b6-e03c55817fbc", "comment": "Malware payload (CoinMiner)", "value": "d7c863bb8c749d8674497cb126eef4b3e0a1f7f1babed9d81dc3c33423983f0949ad7c035d8a98e3c0872a957c51cef9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782359714, "uuid": "2ed5a0d8-0584-4398-b767-c195b8c94d7a", "value": "T12A529672BA65D57638ACC22C998E9110392B3AEB36183458B4ED76043FFC31D51F277A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782359714, "uuid": "8bf27f4f-50a3-4687-9d78-b48a7c989281", "value": "192:2875rR274COKyAVF1mBt6e4egQq1GZ0HRit4Nmn5PH03/BNGBggGQd:T5zT4LyMiXn5PUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782359714, "uuid": "a9385149-6f70-4e1e-a504-3211adae6f78", "value": 13811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782359714, "uuid": "e8fe7a81-b6c2-41a9-aa42-3a7c453e7844", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782359714, "uuid": "0d2caed0-c5c6-4292-b576-ab811091e0fb", "value": "deploy_softwaretech.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd5dc6b-7088-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782386883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782386883, "uuid": "4f7f6a1c-0ffd-468f-aa11-a20ef728f330", "comment": "Malware payload", "value": "c7c95a2ef183f2fe6209c0472dce41d6", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782386883, "uuid": "42251b01-9d9a-4d00-839b-935794dd571c", "comment": "Malware payload", "value": "437dfe21d76e65add52dde296ffb12d8d3f2e006f7aa78797f708d157891d513", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782386883, "uuid": "03651bab-74e1-469c-9001-18dd3a21919e", "comment": "Malware payload", "value": "aa667e8895dcdad772bd4fb7778e8a25ea373092", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782386883, "uuid": "b47e01d3-ddc1-4155-9937-394f592b1301", "comment": "Malware payload", "value": "90117c9d15acdd55651a95bca1f33b0f328a8b00cb5432aeefd3e6b19e5b40f49c498919a8193b43f6a164dbc01756d1", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782386883, "uuid": "1e318dc1-2733-4ac2-8916-54f3a2f57acc", "value": "T152E58C077C904CEAC0AE6372497695A17B31B8480F3267DB2E44BB793E367D19D3AB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782386883, "uuid": "998e07dd-325b-436b-bfbc-e5bbf151f9d4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782386883, "uuid": "b305f668-6ad3-45a2-97fc-fed3fd1ed806", "value": "24576:2iuT6lTK66WGvNEjK3bmpHYS+ZcGou1tk+wXnHK9Jti+s6Qwr8VOMebftxzBelen:2iuWlTr6dEO3bO4S+pjkIQymkbl4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782386883, "uuid": "96ed275f-19cd-40db-83fb-dab67bda2b9e", "value": 3037032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782386883, "uuid": "839c7b53-ebf0-4f57-99a6-78bc83664d75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782386883, "uuid": "be817a5b-3818-4e58-9982-6566fddca136", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be67836-7066-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782372062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782372062, "uuid": "5d0170cf-ade8-48d5-b00c-d8c0990aebb0", "comment": "Malware payload", "value": "ad4616cbe1bce9e6fbb06100bc348ea4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782372062, "uuid": "59135ef5-ac29-46df-bde5-3ff9b2ba60e6", "comment": "Malware payload", "value": "4415235dd13cd292338aa4a507fee5f8049df83b9496ff72f7e90fa2a5708ed6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782372062, "uuid": "88fefbc1-0d8e-40c4-8515-09fa346a55ea", "comment": "Malware payload", "value": "77a5bd39cbe7afae7bf6f61387bdc68783e374ba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782372062, "uuid": "7294da97-f117-4215-ad8a-743baf8cb897", "comment": "Malware payload", "value": "c9c0acccc364254e903c7146e47d0a65c4316b08733c42f49b38e17df70dd3a05026fc54d6bfac97a61a2b2e4f49e93c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782372062, "uuid": "2375e3e1-0510-4506-b62b-d432b64f0947", "value": "T1BB41ACCA7AA3D97197CBC4381FDAE101E35624430996A998B08EBC303F69120FCB5E57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782372062, "uuid": "4ab8ae7b-8105-4c73-83fe-bf61c3e47d29", "value": "48:3KGVdxxzGG1eCFeZdzVKN5Q1f/neHuDmmlBFInKIYgQAul4N7vGxQ:3KkdnIu2mQlGaL2nKI3QaTGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782372062, "uuid": "b4a0cf69-2352-46a5-a740-9f61376803d3", "value": 1968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782372062, "uuid": "a225518c-c9b3-4940-9d1c-8d06bae1ede1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782372062, "uuid": "2dfb99d2-82ba-4808-b831-d8a27b766eee", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea296d5-70c9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782414694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414694, "uuid": "b20b0eb0-07d2-4638-a18e-e4d34b6946ab", "comment": "Malware payload (Mirai)", "value": "c99e45dd8533d024660f1736398c5ec6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414694, "uuid": "a43c2f43-e778-4bd4-a8a6-486ba29c6da3", "comment": "Malware payload (Mirai)", "value": "444a82019a75b5754035cb39e788f4d1818a6bb84fb12462ac953ee872f995fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414694, "uuid": "1c03ff11-216b-4f04-ab2d-0c924b7472a5", "comment": "Malware payload (Mirai)", "value": "11b1d3b8da05d1bffbdc6e3b77f90918d8d6e144", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414694, "uuid": "723ae43b-999c-4d8d-8915-c843eed36883", "comment": "Malware payload (Mirai)", "value": "f26e36585bae6a44c5959b54bbdffcbf094b3318c58671db5981506cf25fe451b8fb85e8122e1390cc2e7bed62563eb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414694, "uuid": "5e330020-d1e6-4e8f-9b22-0090e82f5b9d", "value": "T12DE389192E328FAEF27C873547B74A34975923D623E1D684E2ACC1146F2039E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414694, "uuid": "876bb97e-85e7-4c3e-b4df-928438e33300", "value": "3072:BC0ahB+j8gJ94wiQjSz/VUM818txHyRhwiLFOvAY7C:BCrhx29jSrVuCHNiLUvAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782414694, "uuid": "33238061-d71c-427d-8d0d-deec16490799", "value": 154080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782414694, "uuid": "34f8b009-702f-4a7e-a065-41b87fa969d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414694, "uuid": "425aaa00-d7dc-4acf-ba97-d1198b5c18d0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55719523-7065-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782371595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371595, "uuid": "e94b5ace-409c-4c0d-b040-d6e508236270", "comment": "Malware payload (Mirai)", "value": "8e401e905d80de29873c40562ab74d50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371595, "uuid": "f75bddff-add3-4681-9434-2b173981d052", "comment": "Malware payload (Mirai)", "value": "4481c88954298a5e5e0f0d70cd011644e8442e1aeb0ce42cc3c8b4d51a637f02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371595, "uuid": "6e064e48-7af8-4293-acd1-c9d60681f0b1", "comment": "Malware payload (Mirai)", "value": "8ebb4337130dc1c32127c0253d17b1b4ccceeafb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371595, "uuid": "84cf469b-417d-43f1-b736-219eb6eafdca", "comment": "Malware payload (Mirai)", "value": "50544ff32fa2c82fe74c537cc4f238e614d1670568f3e3de6cdb668b4cb94e9898145d006554d3c026a8f3ea02a17635", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371595, "uuid": "6f255a1f-a0d1-49ae-9d99-ac7365828aa9", "value": "T1C632B5964282C85BC1D18736966F477CA312D54ACE8B8B0FD30CCEA41DA63DC6F22F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371595, "uuid": "581ae5d6-374f-4041-a78e-8a9945ccc459", "value": "192:AC+H+IVMBoxyaOYoEY/BCvCECELq5jDBa5zX/XZDOQd:TXBoo6o3BCvCECELqRDBa5zvJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782371595, "uuid": "077cae3c-fed8-4935-bff5-8cbf7de9f744", "value": 11625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782371595, "uuid": "b08c8d54-4f7c-443c-b800-0b8ec3167e43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371595, "uuid": "991f5238-6bc5-4f0a-9caa-354fbaedb082", "value": "4481c88954298a5e5e0f0d70cd011644e8442e1aeb0ce42cc3c8b4d51a637f02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850100ff-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390572, "uuid": "0b58de4f-6eed-437d-b662-ebdd260d1099", "comment": "Malware payload (CoinMiner)", "value": "3617e75cac18b8b7ff534014fa64f134", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390572, "uuid": "3b694352-3e89-4d19-ad04-2f85e4f1b2c9", "comment": "Malware payload (CoinMiner)", "value": "46be6a8ec8d32e8f534c96ab1f7e792b273ecaedf320f32080d3310cc7f7590d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390572, "uuid": "a20443ff-6028-4e9e-8188-25c3b9bd4975", "comment": "Malware payload (CoinMiner)", "value": "d8902d4506d660c3c46c9bbb46774b83ec17a82b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390572, "uuid": "72b0a3d2-30c0-4052-a405-bfed36c82621", "comment": "Malware payload (CoinMiner)", "value": "fb8f2f8237826e5b4a498f291d077eaa8ca84ade21c7f6fbeab1130d950204c0cb7ee209ee8f337f6b4e78891f35cc6b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390572, "uuid": "3e19b4f7-eb87-4dce-9b82-3298321b61bd", "value": "T1D2F533D2925285FECC47DDB0290A9B626C7A7A328B1406E35FDC01563D35ECFAA74F24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390572, "uuid": "18a3a35e-b185-4d3f-9d0b-a25de65968c3", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390572, "uuid": "b5bf3867-a957-4764-b3e9-6d247f084050", "value": "49152:IOdaDv7lWyakQ/aJW7qvQRKZNkPLdSNDidMxTP3UFSEE4by4TZsT6lHn1:IOd+bfqaJW2KBP5yDidiPclHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390572, "uuid": "c1589aed-5d07-47c7-9b91-8afbfaf43efc", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390572, "uuid": "da224e6b-dab4-4970-a2a7-af3dde8808a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390572, "uuid": "775a9a61-c1e6-4299-a2c2-681bcee34185", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091f5ba5-7056-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1782365024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782365024, "uuid": "b4bbcce5-1118-4bc7-bc22-cbd899f5c0c8", "comment": "Malware payload (SalatStealer)", "value": "0cc9c48a044cdfb621b3c24427e622c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782365024, "uuid": "27767a54-ace7-4c4d-9d2f-e6a018492c20", "comment": "Malware payload (SalatStealer)", "value": "46ea5e72b0203fe4d9e2155a033f7bcd4582c12550d8ea9a112f7c03b24de347", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782365024, "uuid": "186f0739-1605-4a35-9030-a4ed2d66e4f1", "comment": "Malware payload (SalatStealer)", "value": "5521bfe0b2f14fce5c21bcde2f50695c279b8f22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782365024, "uuid": "422a6402-2a28-40e7-bb18-c6d485cbba88", "comment": "Malware payload (SalatStealer)", "value": "27c362014aeaab37cd4fef47cbcc48aaf674bb54cf66a236a741f675bf8298947722a924c475d9251a151ac6a750f810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782365024, "uuid": "2c143a95-c2a5-43d4-bd26-ebe4dcae53a7", "value": "T1DFC66B11FADB95F6E903583100ABB37F63315D048B28DB9BEB547B2AF8776A10C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782365024, "uuid": "7807bb59-ec86-44a4-a781-4a781fc22e70", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782365024, "uuid": "1230df3d-ef30-478d-90c8-215b635ee650", "value": "98304:7hsaYAe/J7EChHvcFy0FR9/7mr4L3HxmcE5O/:dYAifHe79TWsM5O/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782365024, "uuid": "11f4230c-6529-4a84-b2a0-1920a1f8bd85", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782365024, "uuid": "ee6c601b-9a3e-492d-a0fc-e4b85c05ced8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782365024, "uuid": "c8754dda-da97-439b-a966-403eebd42cc6", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe51484-70a7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (KongTuke)", "timestamp": 1782400140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400140, "uuid": "aeb0890b-020b-4f41-84f1-43e832ab6abf", "comment": "Malware payload (KongTuke)", "value": "66bc6678a924e7fcb87b84dea688bb5a", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400140, "uuid": "89b2151e-528c-4b22-9076-12ceff2523d9", "comment": "Malware payload (KongTuke)", "value": "485e853a93284b5ff68752809af6370e774fb965b533c02badbbe7d8471b0ab6", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400140, "uuid": "adc9a1dd-2d15-41d4-9968-02751f2f1ea0", "comment": "Malware payload (KongTuke)", "value": "e911e681b318158f79ba5a5d30ae7b527f727b2a", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400140, "uuid": "d4f75fff-bedf-49a5-b5bd-121160e696be", "comment": "Malware payload (KongTuke)", "value": "c7d4213af9e44cb6e1b072ab9ebce3ad84a1f8e55b6397d15be488bfe4ac66e5f3921d025f24f2bc39fbf125142d39fc", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782400140, "uuid": "07501d04-254f-4c47-b173-a9bc20450652", "value": "T191C14B74B76B3678274A91C6671A0F24137842277005A5DAB71C70D06FC7BC2D3665A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782400140, "uuid": "8ae74c1e-8a96-4d31-8be2-1ce1419d8c78", "value": "96:oSA4a84RluTcqj3wbUlmcU18zgZxUa9zuzQmPLEb4Ly35Sl:zA4oRyxjAbzUs6q8LEb4WJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782400140, "uuid": "04069466-ae00-4860-a1de-49dc408e0e3d", "value": 5665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782400140, "uuid": "b4342724-dcc7-4381-bacc-ceb041022b3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782400140, "uuid": "ea6d3c3c-0ad4-459f-a5d6-fd92327f5459", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569b5892-7065-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782371597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371597, "uuid": "6c7b3515-798a-47da-8d15-edfed526e602", "comment": "Malware payload (Mirai)", "value": "9596501c71c9f3be1d75230df52c0fd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371597, "uuid": "14d54490-6336-461f-ad5b-25f93341a5fb", "comment": "Malware payload (Mirai)", "value": "494ab0439cd9a373aca71bf5107e0718a9e14b9b805632835c99c42b88a50984", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371597, "uuid": "9b1c410c-43c6-4eab-9a68-af55a235c675", "comment": "Malware payload (Mirai)", "value": "cd7ba93b315a1abf52db080e8a97463193d4c09d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371597, "uuid": "b2d2b9bd-e9bc-4f31-b760-b5795101b97d", "comment": "Malware payload (Mirai)", "value": "60d921e6f1c7e84d840afcb5ec447673c385d78c7857f85d00633f47039a58d3dcd353cf5e0da9776d95a972355a0617", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371597, "uuid": "10f02b67-5c4e-474c-997f-17fce31e6ec7", "value": "T16CD31941AA56CAF3C8C30FB602A746654633EC2A5B2BDE45F32DFDF44F065C8B116668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371597, "uuid": "7731f3c2-9a3a-4a6d-91a5-8da291bb84e6", "value": "3072:EPb/ruhRUwRfGLkeL7lq6dZJXrvUUGSGsb0AyL8sYSuF:ikX+h3lq6RXrvUUGSGsb0AyL8sYSuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782371597, "uuid": "b5b57224-b010-4d69-b42c-78b0a60c5b57", "value": 140986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782371597, "uuid": "1a017a35-ec0d-4bbe-9b2a-e4ee6b4b0ddb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371597, "uuid": "d8ba4479-1782-4af3-9cdc-aa7fefbc478e", "value": "494ab0439cd9a373aca71bf5107e0718a9e14b9b805632835c99c42b88a50984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a086a2fd-7065-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782371721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371721, "uuid": "60a31412-a88f-4e2d-ac7f-fe77a21694b8", "comment": "Malware payload (WannaCry)", "value": "456a55c731ff6a8f443fe0fdec426af0", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371721, "uuid": "4deadda3-afdb-4e00-856b-76e427f1750d", "comment": "Malware payload (WannaCry)", "value": "4afdc4faef1f739bb7b53936fea9f58f2f002e2a2b05f783ba797be96757ea9d", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371721, "uuid": "c3a48893-6443-4fe7-9d48-ae4f276951a4", "comment": "Malware payload (WannaCry)", "value": "6f7d5955a7db93de1f9e69c0a47e014d14b5ab12", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371721, "uuid": "ff6ec649-7670-4e90-a416-18fa58ce6a42", "comment": "Malware payload (WannaCry)", "value": "e74032c1d7eeff82124beac69428da112bcf21947791d7623982c9cbe2b6f85439ec535411d6edc9055ea3b8d505ab59", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371721, "uuid": "d1433c7e-5942-44d1-b43d-2c940dcf070a", "value": "T12436234526AC51BCE0A64774A0B30D2AF7B37C5E6375870F87D487AE0D23781AE78B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371721, "uuid": "e4892c78-4d41-418d-b49a-383ebbb32b88", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371721, "uuid": "ccc9574d-913f-4f34-97ea-f0b2fad1c1cd", "value": "24576:jbLg/bLgddQhfdmMSirYbcMNgef0ScL7nEaut/8uME7A4kqAH1pNZtA0p+9XEk:jn6nAQqMSPbcBVzEau3R8yAH1plAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782371721, "uuid": "4a7b9f84-27a9-44d3-b028-28f0755fec31", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782371721, "uuid": "0dc72156-fec2-46a7-8593-b000dbf80d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371721, "uuid": "67453451-af3e-4da4-ac5b-71ba80cf64b4", "value": "4afdc4faef1f739bb7b53936fea9f58f2f002e2a2b05f783ba797be96757ea9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86428ae4-7093-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391434, "uuid": "3da67701-c75b-4926-9e8a-354bb53f1fbf", "comment": "Malware payload (CoinMiner)", "value": "5f5919f7939a670914954b9467cc49e6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391434, "uuid": "7df266b4-1aac-44c2-83af-25ade8860bf9", "comment": "Malware payload (CoinMiner)", "value": "4b0d8c093bf2f79b4297708a35a901735b1bafe812efbcb67b4161c84c037c31", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391434, "uuid": "8a731298-de7e-49b1-8bee-c64cebc463db", "comment": "Malware payload (CoinMiner)", "value": "81b2565b6f79c24f8288e24fe19172c245c31056", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391434, "uuid": "d6e63193-48b1-4609-bc8d-e8d8160b836f", "comment": "Malware payload (CoinMiner)", "value": "d0dcf10cb1212a090ad6625084240151d55d161da283e50f40a60fcd11da4665fb143a5ffcb8cc4073b0c0bb860326f6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391434, "uuid": "b2f4c2a8-85ec-4ac0-a1d2-4db952875688", "value": "T148F53395D49134B4D7AA4AB09A7E1FE5662E75936B0029FF00F4E0402EE77C3B4946EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391434, "uuid": "0572ca1d-98be-4401-83da-d95d8b820bc7", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391434, "uuid": "c5f63265-27cd-4fc0-8bd5-5b99e1a1d7e5", "value": "49152:4nE8O4jUewS+azWsEuqV8s3AHfGOCYfQBgi:4nbjvwS++WsEu48swHfGXYfQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391434, "uuid": "558bbf9e-6f5c-4225-a112-2dd8b195180b", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391434, "uuid": "06cce1f6-9ed3-4e09-8d36-d34f89bc11e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391434, "uuid": "3de1b544-472b-41ae-82a8-711943823e9f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6e8300-7093-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391417, "uuid": "9b0845dc-7a3c-4a75-92a9-eae20016b802", "comment": "Malware payload (CoinMiner)", "value": "19f96cdf0273950f87dd6b674fdcff92", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391417, "uuid": "3dd54372-1716-414e-b93d-082ac184303b", "comment": "Malware payload (CoinMiner)", "value": "4b3d341f6a15caacb540bb2e403dfbfbdbf98b077649f184505839d4a9e27cc2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391417, "uuid": "17011c0d-a180-4d1f-be16-6011e9d81f1b", "comment": "Malware payload (CoinMiner)", "value": "04b7d197b4e795b5bf829085c3eafd90887be3d6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391417, "uuid": "047c85c6-2585-4f7b-932d-03a3651516c6", "comment": "Malware payload (CoinMiner)", "value": "f90bc673be6e38c3c7387980c7a767dbd1014a38e7a457969c4f2fd46f4777df985381b4ba1ab4f6f235a7fdaddd9b23", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391417, "uuid": "9c52e761-5947-400f-98f5-dcf370091d86", "value": "T16EF533D0744155FCE65E893817A80FB6C15234571F22ABE392D3ED6AB73ADC28630F86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391417, "uuid": "cb9e2a43-b05d-400b-8208-8e6bc448a640", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391417, "uuid": "4c697349-a30e-434d-83da-22b50c632479", "value": "49152:ry2Fa1bOsQu039NXit9oonPCwwapOWw7O69hy3kWE6mUMBKJV5UG3va8alZHUu1a:ry2FaD0cL0ycJKJV5j+VuHuW45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391417, "uuid": "73a2e4aa-3eee-406c-9429-a1d1aea39a05", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391417, "uuid": "08efeff9-84bf-4b1e-b3ff-026d6915ed95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391417, "uuid": "b4e92a2e-9e72-4e5a-bdd9-a478e3d96ee5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b46198-7034-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782350597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350597, "uuid": "f1548e70-509d-4549-b2ff-14f6608d7353", "comment": "Malware payload (Mirai)", "value": "2341810d35b3d618caf5bc85d79e8b29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350597, "uuid": "7c7ac44b-d706-491a-a266-3cb5b08460cb", "comment": "Malware payload (Mirai)", "value": "4ba0eea142e43246981a2d7b7f06479affeec4ccf57aaa64b452e77075606a17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350597, "uuid": "53898a20-b80f-4ed8-a502-5f85cb8c8762", "comment": "Malware payload (Mirai)", "value": "e3996aedd3209d18b9bae698250890e0bf226cf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350597, "uuid": "9017decc-0d09-46b1-912a-07fecf66d346", "comment": "Malware payload (Mirai)", "value": "210aeb023333e036e6b14fe592e865d206e6a10c72670dc2f3d247fae1fb455781b042488c02eb7167c577210fa8ecd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782350597, "uuid": "2c52a1c8-fed4-48a2-82b3-ac4ebca39717", "value": "T1E6735A03758080BCC08AC1384A7FB636E562B57E23356E5977D8FF667F87A202A6D714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782350597, "uuid": "920f9eef-3854-44ec-bea0-0d4e6e82f2b6", "value": "768:JuJKrd2SrAG7M2WR2tiOtTdusSRDsQQU0EedtqlEYDUyjOGLcSW5jePpl0uj0YuM:xp2SBM2WOvdolQzvdq4yCGhzr0b8qAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782350597, "uuid": "8f273ac1-10fe-4c06-aae3-0fe16d5e25ac", "value": 75136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782350597, "uuid": "2ebe868a-8614-4d1d-a911-2e687dc8a897", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782350597, "uuid": "461f949d-90fa-45ce-9452-410fb2d8a101", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bbb666-70a2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782398056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398056, "uuid": "12595228-995b-4595-ba73-3109cf24b59a", "comment": "Malware payload (CoinMiner)", "value": "e84d622934fd4bde85a44e36628262da", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398056, "uuid": "e89d4350-0775-4d16-8fb3-0e5244f001ba", "comment": "Malware payload (CoinMiner)", "value": "4ba1f2f1ce3a66164b99059f9312a3fbbadcd8ba337e0e95ee1db6f0dc7a2a59", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398056, "uuid": "3815dc10-6d36-4782-b818-ba7fb4a30a0d", "comment": "Malware payload (CoinMiner)", "value": "0d1855c459ba8d2f98bb402586c8eb30e9efc38c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398056, "uuid": "08306771-fa11-4396-a2e4-df578980f8b7", "comment": "Malware payload (CoinMiner)", "value": "0519f8bc09a86bebea79a046a750e52f82769b374906e1d9300969af32bda9bc3beb7071ceb45ec7609458e54a71a8ef", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398056, "uuid": "6a3fd61f-f839-4e65-940e-677f09f9f664", "value": "T112D312DF5B174BB3C29937369BB04E813AB90B12CD1A1C05654DFD518E250E724B2EEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398056, "uuid": "5c6454b9-fcb4-4945-aee9-d449b8d16556", "value": "3072:0a6NWG6ZF8v6MnHmqo/dIWJEkmJw+YEph+H5Wr9V1:0a9GgFk6jqeWWKu+VOZW31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782398056, "uuid": "ac9bbfcf-38e2-435b-8863-112bcd2f6b21", "value": 131740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782398056, "uuid": "a3394bd8-93cb-49f3-83c9-5b8310bfe046", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398056, "uuid": "7d010817-f011-4452-a647-3145c6353884", "value": "kworkerd-netns-rt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7582c40a-707b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782381097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381097, "uuid": "972d3dfe-e1b3-48a6-a318-6b0e7e5f01ca", "comment": "Malware payload", "value": "acbe330baa19a52ebbef35c2796ded15", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381097, "uuid": "2ae723ef-b5c0-4e0e-a6e6-27b23835bcb1", "comment": "Malware payload", "value": "4c154bb4975982979d7677403588f425e7d53c78b2f9637e208f44b22fe51e13", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381097, "uuid": "d265b86e-213a-460b-8a53-e53e61bbf59f", "comment": "Malware payload", "value": "f01657717e1397c33c27f4436a5c90da6bdad082", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381097, "uuid": "08da23b5-468f-4cbd-bf5a-c3f26a83c7aa", "comment": "Malware payload", "value": "9a3f4779071bdea2d78dbc0994fe66f0313f5ffd52031774df033cb05b441b806c65401265fe11de0ea0f471db75f8f6", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381097, "uuid": "ff94bcf7-fdfe-4faf-8273-4737de8d1f04", "value": "T1A5D533EC060A3A418357E46C88B5ADEF6679023F35A4F68302B976FCD51494CEF14B9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381097, "uuid": "14535203-8fdb-4b2d-8faf-35faf9527590", "value": "49152:cB4ZhNDRqZGT66OBeZctAyA2NXrf3MJ1vYNyaIkcySL7qEqYs0njMSDh3XV36HOc:Q4ZhLqZGFyhfA1QNbIB97NFfhXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782381097, "uuid": "474ad93a-5b9b-45bc-b068-86ee0a47ec4f", "value": 2925972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782381097, "uuid": "e54dadd4-78d8-43f4-a167-e94f261307e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381097, "uuid": "2a91d966-00ff-4f95-9e3d-8a3961aa42cd", "value": "Critical Security Issue Report - Coinbase.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd176bc8-708b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782388197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782388197, "uuid": "b23b080d-f490-421c-8d8b-4578c84fd8a8", "comment": "Malware payload (PureLogsStealer)", "value": "3579eb1d7f2f3fa7685e6b27c9bc853e", "object_relation": "md5", "Tag": [ { "name": "CHE", "colour": "#910C17", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782388197, "uuid": "9ef89829-b955-400e-8585-036a8a265161", "comment": "Malware payload (PureLogsStealer)", "value": "4d68dfcf30f581cdc3467a3b1d564719a6c6dc6d1a437ab2413b13db3052beb7", "object_relation": "sha256", "Tag": [ { "name": "CHE", "colour": "#910C17", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782388197, "uuid": "d87a0677-5cbf-4508-bfd7-5b459e331d23", "comment": "Malware payload (PureLogsStealer)", "value": "eb5078c0919383da38a486f267c574a3e2bbc6a8", "object_relation": "sha1", "Tag": [ { "name": "CHE", "colour": "#910C17", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782388197, "uuid": "55a295f2-3151-4678-b6ae-ff681f9b9b08", "comment": "Malware payload (PureLogsStealer)", "value": "d17e2e91e95667694233f90d7701c2dfca14c394b75f4e2f4b6cca8b20280c4ea764fef1e2495e2a919ac344c0579cd7", "object_relation": "sha3-384", "Tag": [ { "name": "CHE", "colour": "#910C17", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782388197, "uuid": "c8b5ab95-6393-4e93-8624-1bb807ed16a6", "value": "T1ABF6E5CF51FB13D4D3D9DE78585786AC8A53BD98AD5CE00C462A0F3C9BBDE42888AD11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782388197, "uuid": "41880358-891e-4823-96f7-884e4c50d136", "value": "1536:ECECECECECECECECECECECECECECECECECECECECECECECECECECECECECECECEj:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782388197, "uuid": "64c08328-9589-46bb-9b5e-2465b94fabf0", "value": 16727876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782388197, "uuid": "b75bc3b0-5daa-45bb-a88c-8933c1aae19c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782388197, "uuid": "9886d10c-1579-424c-9c6c-81a1bc4e1c28", "value": "RE-417205-908134 Rechnung DE6429037.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b347a31b-702f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782348559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782348559, "uuid": "790bb8d2-def8-4acc-8209-073b3a425017", "comment": "Malware payload (Mirai)", "value": "45a2fc3fc8067fd290a8bd86a1d7d0eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782348559, "uuid": "af9e3d8c-da94-40f8-95d7-9f4e2cccae93", "comment": "Malware payload (Mirai)", "value": "4df5911bd816cd345e4f2f96e55c7026b6f305e40de436a5b928b05f145146c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782348559, "uuid": "00a88596-2547-477c-9f3a-5ad69ad6dd25", "comment": "Malware payload (Mirai)", "value": "55d87d06b3c1c14a1bf4336d1d2f2a24f34e7b33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782348559, "uuid": "7435c9bc-d4c3-4d92-bc6f-89132dcd8cb0", "comment": "Malware payload (Mirai)", "value": "69287baf67d1d1cd977d5d1dbf3082f98b46f80b717a9130df0957ddf8b950893899c1663bb1120d0c5bb0572e99f24e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782348559, "uuid": "e6a3f7dd-8626-44bf-9a6e-007c94071b89", "value": "T16FB32B03BD52CA53D5D217B97AAF91583322A7B5C39B3302C914AFF42F836DA0E7A511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782348559, "uuid": "b305baec-bd92-46cb-b5bd-eb4b2f241c99", "value": "3072:a/jKcGbiouZM7ufcprqISTLwDiQcoH+puio:a/jKcGbiNM7ufUDSTMijOio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782348559, "uuid": "e07be8e0-ce6e-4985-8ed0-18a1099d7809", "value": 117432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782348559, "uuid": "e7c500dd-6ef6-4222-829b-7ae59a7dd6fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782348559, "uuid": "8811d74f-4f59-4df9-93a5-28493b307a45", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de367ba3-707d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782382132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382132, "uuid": "97c5b835-ea64-4b0a-8ff4-9fc04aa11a55", "comment": "Malware payload", "value": "9b6cf17dc14f631b7ffec610ec41a387", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382132, "uuid": "b9a8cc53-36c4-4393-a855-d58c4625cd22", "comment": "Malware payload", "value": "4e9ff7fbbcfeb03eeb922914ed71c8356de8dd0f21c74416fcdc28a800bee764", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382132, "uuid": "da1c4cd9-aa76-4a8f-8ccf-bd79cb30a578", "comment": "Malware payload", "value": "c774ffac8bb54f2261c1824db078b219579b504c", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382132, "uuid": "fdc25e08-39c6-4fb9-9fff-2cb3116b70ff", "comment": "Malware payload", "value": "55726cd0496ad8cce2790f9fe01654ac2e5ea219f09a7931096e06928d61d9f5bd3af9ec8c7d7786f03f2afbb865793a", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382132, "uuid": "72db5f68-8d57-4793-876f-73910b0c22ac", "value": "T1460633D04C995A8DE98FED147A128D854EF8738BE1D96FE11B8C334FA8875BF4125B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382132, "uuid": "38a974b8-c3e4-43a6-b971-92f57d911073", "value": "98304:L9Y217DDvQ6MHzXV2TH8kwN6nR+hVP0w24cwSYfcDb4:L9H1jQ6MHrATHfnR+h+w24rhfcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782382132, "uuid": "181615a6-b52a-48e4-b26c-6dc2c743d5cb", "value": 3962052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782382132, "uuid": "62871461-6aa5-4505-bedb-6b9d33227e4e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382132, "uuid": "c76c1566-3b14-4109-ab62-469834cd359e", "value": "Complete-Trading-System-2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fddafd-707d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782381909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381909, "uuid": "1806c0ae-75b7-4d1e-ad07-6745b569b21a", "comment": "Malware payload (RemcosRAT)", "value": "d58c91e3682d3031a39043150a13c546", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381909, "uuid": "44021422-e952-42dd-bd1a-a43d4d75129d", "comment": "Malware payload (RemcosRAT)", "value": "4ec260e09ccbbc4718902d1668ece35b1d825a8b8470ef3e7901609772ec5c65", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381909, "uuid": "8af24886-8718-43bd-a048-9c6e9c5981c5", "comment": "Malware payload (RemcosRAT)", "value": "7e6de8b4a059bf113ce08ae1370095a8e7fee727", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381909, "uuid": "1015cf30-6249-43ee-8a63-dd10c9b56b78", "comment": "Malware payload (RemcosRAT)", "value": "eb5b9ff5edb833ec2a759e967670513f05cfc2e4df68b178afee4806f19c3e729e137fea8c85496e2ece41f3132e7941", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381909, "uuid": "8b99e1f5-efbc-4170-9130-bed416e006d9", "value": "T142E5021189C46FA4CF9D5A1D90FE161EE3F00A8E5019698EEB33BD46FFE760452072B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381909, "uuid": "7fef856d-05d3-4787-add5-e7aae969ea6e", "value": "49152:1Q0+vaeRZ7K1Wq0/4cN205Yx+hV7PahbbVZ:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782381909, "uuid": "080304e9-9b8e-435a-a32a-708d54be0cfb", "value": 3278736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782381909, "uuid": "0b876fb5-ecae-4485-9215-db9e54437133", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381909, "uuid": "a43ddec5-e9e3-4037-b19b-e0457b0e2690", "value": "New Customer Order Inquiry.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ad0c2f-70c1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782411213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411213, "uuid": "a7fd282d-652d-4e27-ae7d-0bf80984050f", "comment": "Malware payload (CoinMiner)", "value": "a1b0a27b61162d9951b8c8dfd1d37ef0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411213, "uuid": "af053b4c-0b44-4770-b6c1-39befe4264a9", "comment": "Malware payload (CoinMiner)", "value": "514cc4cf71cb5e9ee33579e22c66c10794b03f4adf50001de4e2866d281fd261", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411213, "uuid": "a08dfff0-bd5b-47e7-bad0-5eb165d99160", "comment": "Malware payload (CoinMiner)", "value": "9d3b2e7cb7a2f749a1ee8d20defa96fc66433464", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411213, "uuid": "1b7e7f5b-82f5-483f-a3f4-e1ff6e94fcd7", "comment": "Malware payload (CoinMiner)", "value": "669b23328c0eaf79f5745ed007041bd23548a50e15d0acfa533f1534c397f98fd0f593a68e607a39edc1271f3e386baa", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411213, "uuid": "f24e6dfd-8fad-4926-9f2e-332a02a8f07b", "value": "T1E0A3011CD0AC50FBE3C19439974AF364A94632F595B0B5F768898F706F1F45B09E80A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411213, "uuid": "f11e5aa5-f74c-4691-851b-12882ecd4f7d", "value": "3072:1173MEmwT5+u2fCJBUoKdWqT3n2066W99MoGi:Dz++B7qh5oV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782411213, "uuid": "6162ba0e-d645-4e23-8c4e-deb30992c4ef", "value": 100448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782411213, "uuid": "555e38e1-a331-438d-8766-0de517791ef5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411213, "uuid": "da47affc-f597-4fb3-9bd9-35279e4fa471", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27820d1-70ab-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782401842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401842, "uuid": "459d4b20-1986-400e-9f36-d5704dd06c19", "comment": "Malware payload (CoinMiner)", "value": "341a025fa2b8c640b9b09b8cafb2d329", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401842, "uuid": "fe56267c-3ba1-4903-99e3-12ff36d23164", "comment": "Malware payload (CoinMiner)", "value": "5187e5216ddf0f63d74a69f483c9568d0b04f7ae67dd17ed1d7644b97ce3a8d1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401842, "uuid": "97e75caf-eb6a-419e-84ee-c309adab422e", "comment": "Malware payload (CoinMiner)", "value": "c64ca32757200e42117a290de4c6c56842e5c9a1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401842, "uuid": "92f75d67-8534-440c-9c33-d230c25bce76", "comment": "Malware payload (CoinMiner)", "value": "b628e28b1ddf0a02cd0834d60b4d5b21ff2a5d9361da68a03025d4818f5ab6d4edf77ea6c7d6052ec198ed61d460e43a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401842, "uuid": "c99de4b8-9779-4e9a-88dc-a383ccaaa1c6", "value": "T1A4F5239458D07CBCE5BE8934C6FAAF64962B31727F22AEDB0075B1403F221D2A517C5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401842, "uuid": "c02bce47-277d-46e3-95df-52dc98e62eb8", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401842, "uuid": "f87d5848-f835-4c5f-a172-0ac3269e4788", "value": "49152:iByL2GGjstM2ghb7f4TagEgjLjbBBdPDKhdTrk1WlXj04:iByq/wMgj3JGhdPk1W50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782401842, "uuid": "fb773432-7b2c-43be-83f1-10f710a2937d", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782401842, "uuid": "212f72db-58ad-4217-8e09-57a1b7b666aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401842, "uuid": "e0ae081e-d79a-47f4-9667-5f078fa393de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d40c1f-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390659, "uuid": "0f775f3f-6688-46e2-a8c7-4ac1d6f9acd8", "comment": "Malware payload (CoinMiner)", "value": "3e0365986665180a9f1c96024377a85e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390659, "uuid": "08d8eeee-d602-487f-aed0-18da4c332b7a", "comment": "Malware payload (CoinMiner)", "value": "5195e93ca254b2bcbfffb309848d42f3132538704343865a2dea3b4516c5ced8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390659, "uuid": "403ef94b-c9fb-412b-b46a-3ebb53d089e8", "comment": "Malware payload (CoinMiner)", "value": "dd31154745834ef5cb953ddb452a3a27ab1730c0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390659, "uuid": "f8964509-45a7-4bef-9d92-f219b0d3d4c2", "comment": "Malware payload (CoinMiner)", "value": "b3c8ec0d6e8c13b2e4d93eaff10433ab7c4889d4be5ea0f3c58cc0709e625ed3ae443bf80e82da90e76be9e61d45a1fa", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390659, "uuid": "577a26d5-eec9-44f3-be1a-7904f48a3b60", "value": "T118F533CAE4C365FCDEA7D4B503209732A11FF4B5CF92E4DB15EA842278528EA4E38C51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390659, "uuid": "1d33a710-f98b-4a12-8d28-819464689ef8", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390659, "uuid": "3754e7b9-8033-4863-b987-c78680c8c371", "value": "98304:ipa7vY7VwgeRe02XOQwDVBvmBH0mdRV9c:X8w6xfwDBmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390659, "uuid": "a0377edc-780e-4deb-94ae-f8aa30029134", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390659, "uuid": "a5707e92-9061-46a2-bd1f-6187ab9f60b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390659, "uuid": "62e7dab6-03ee-4fcc-bbc0-a451b8269814", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec0a04c-70b4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782405809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405809, "uuid": "ffb57848-fa6f-4ccd-bcca-37cec6ba7223", "comment": "Malware payload (Prometei)", "value": "345823420e22d311d1b42c285670d482", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405809, "uuid": "0504ecaa-2c6d-45cb-a680-548cb94ce27e", "comment": "Malware payload (Prometei)", "value": "51e8c44dc4ea54d5ee6909c0eb19a829ab4f6dca9de7028dc2a081556bd2e056", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405809, "uuid": "400473f0-93e5-4f68-8bb3-debf8bf1c429", "comment": "Malware payload (Prometei)", "value": "31c05714d3598f7f8fc520a7b0aa91b83bb95b4a", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405809, "uuid": "e7f79ff1-fcb5-4ec6-bcff-6c32f437bc74", "comment": "Malware payload (Prometei)", "value": "1f75b29e888f6455853eab7e00bd98fc4d76309a0f79dcc974899ab28f4b50392ea15fdf9591efb6debe40825e5d91af", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405809, "uuid": "6d310697-ee0f-43a0-802c-8c36c6e803a7", "value": "T10AA423B4F9229E9F6DD76DB91B24C31DE181C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405809, "uuid": "01d93bd2-c0e9-4e07-aed0-c34150ff0ed8", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdM:Fs6pyCC/Ya2hpi6T6N4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782405809, "uuid": "56bbd4e2-7f05-43fa-8e07-a7720e61f65f", "value": 449077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782405809, "uuid": "4c30b0d6-0515-45a6-88d9-4ab2fbb7f595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405809, "uuid": "591c775c-559b-4356-b0bf-073021e2275c", "value": "51e8c44dc4ea54d5ee6909c0eb19a829ab4f6dca9de7028dc2a081556bd2e056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0239845-70c9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782414697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414697, "uuid": "b7f64289-58fd-4057-9a86-ec8d565ed308", "comment": "Malware payload", "value": "e9293ff954fa84237c62f50a5b651744", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414697, "uuid": "f55ebbee-edcb-464c-a093-67bb2a52d307", "comment": "Malware payload", "value": "526c830542c17e6883da850de8dc2c3c2ffc35b446f33c61892b193e50f8d8ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414697, "uuid": "cce391a2-bcc0-4bb5-b56f-d601d468715e", "comment": "Malware payload", "value": "1c925188b92a927308d8d3175918fd5265efdcde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414697, "uuid": "db856cca-b735-41db-921e-8c7b45462317", "comment": "Malware payload", "value": "a3393b4793cae0984d936d31e54fb0d53d2c4a216cf7640c03042b5649e0db1a0ca26297d50f34c8769f402e2a50dbc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414697, "uuid": "b7479722-ee08-49e5-ab05-c80b67abdf2e", "value": "T1E3043C0365918AFBC4D68FF91BDB91228533F8391B32620673A8FCA51F4DED86E1D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414697, "uuid": "1e81dd2c-09f1-4fb9-8a66-031659c7eeb1", "value": "3072:CW/v0uzxl8Z96a7h6v5eJzqySjoGXiQqJvNUGSjsb7syWAYYNuP:C+ZxWt4eJzq45JvNUGSjsb7syWAYYNuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782414697, "uuid": "590f02fc-64a0-407b-9491-6c8f152aef2d", "value": 174377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782414697, "uuid": "29a647eb-d49e-4d5e-a748-888e654341bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414697, "uuid": "a4306f67-dc9e-4aff-8cba-f256ab30d790", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa205817-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390635, "uuid": "5ac038b9-eae8-4b97-ab78-c78727b011c4", "comment": "Malware payload (CoinMiner)", "value": "4a8e84fdae2a9cebfdd8c251cc06d0c5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390635, "uuid": "28f52747-d5c9-427b-b176-21b13582051c", "comment": "Malware payload (CoinMiner)", "value": "536874b4e68c8d067cbdb0100c0e4e46810248ea6fdb3c4fed4720b23d9bed89", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390635, "uuid": "286e83d4-6e93-4cee-a52e-e82dc8677ff7", "comment": "Malware payload (CoinMiner)", "value": "b40af75be8cec229bab1093b2cf87bf809fee3bc", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390635, "uuid": "a0ce7f0a-82b1-408d-8c4c-74a3eb98d246", "comment": "Malware payload (CoinMiner)", "value": "ace775fcfa7ee08ebc174ab5ba7269cc26a40e5f02287b3a2e217faa2ee7903c52065dee9a076505866d1d19b6fa4bd8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390635, "uuid": "7a10bffb-d341-4684-bba4-5b2cb03752f1", "value": "T1D4F523E161D132F6E6AAEC76C34EDB24537771320F2228DB01B066D85D39BC5B912F89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390635, "uuid": "1fc01625-ae13-4f7b-a5cf-7dae8e3f12ee", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390635, "uuid": "0c47002e-45a8-4985-9487-b73e2d0b4af6", "value": "98304:MYhv/eOFxfB5KXTPT3fWVfpzne8qcNgvRGReeGjyQvxRtF:MILnYTr3ofBFOHjy6xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390635, "uuid": "e434814b-2a8f-435a-939f-63c5f26ac88c", "value": 3449832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390635, "uuid": "f35598e9-cbbd-434a-8272-a0cb479aef05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390635, "uuid": "444e9533-a21e-4a5b-975a-9af6316f1e92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c580528-7078-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782379847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782379847, "uuid": "b25dac9a-4e82-4cd3-8444-1c30575935be", "comment": "Malware payload (PureLogsStealer)", "value": "a0b4085cf946ec17dfc382a16f873405", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782379847, "uuid": "7c548a35-6466-45db-9b58-9d5486ccf57f", "comment": "Malware payload (PureLogsStealer)", "value": "56865486886b3755cdf0b29a53d0d599d100565a609f8217e18b3983359b8e7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782379847, "uuid": "7bdda8a0-5baf-443c-aeac-514e76461efb", "comment": "Malware payload (PureLogsStealer)", "value": "cdaf10e2379a3cd341e1b9aed793fb372c4e274b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782379847, "uuid": "5e8f231e-5bc0-4dfe-81d1-8057544892c5", "comment": "Malware payload (PureLogsStealer)", "value": "0f25b41f883ccef43ce28c927557871993213eade1ca4520aeba595f6aaeb18d716abc5621d98677c08f0b0cb6dcbabe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782379847, "uuid": "6e28658a-7cf4-4659-a20e-daf72e299877", "value": "T1D1F4BE1B72528F21D2881232C1DB151193F0644B7A77E71E7A8527DA29033FBEE4B79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782379847, "uuid": "613cb370-3fb2-4059-8ae0-7e4243e1e2d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782379847, "uuid": "f86b9250-57d9-4c50-9022-1fc8364d1668", "value": "12288:q7w9G/YgmDYe3OCcizJZuEfmDKmD53gc+mTmQ1YUeo7wlMGW7tQu:wwjg+3mmLL+DhD53+0YUV7EMGyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782379847, "uuid": "f4cb28ed-7077-41e9-9a86-c0ebffce92cc", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782379847, "uuid": "66c9260d-85dd-4d1d-ad80-9dd37ddbaa87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782379847, "uuid": "1b8fa0f1-6a36-4ba9-9943-667c78c18837", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.65492976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f71910-70b5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782405828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405828, "uuid": "38172792-3f03-497c-96fc-e6ebda8d9c43", "comment": "Malware payload", "value": "122afc8c718cddafa2d2de07ada635ff", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405828, "uuid": "a0ff8600-7bf5-453c-87fb-0b8bb2f3ba0b", "comment": "Malware payload", "value": "56e376fe961db08c622c70a25200a89bec93290bba54f33f9577e3721e05323b", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405828, "uuid": "f112c0da-486a-4a89-a5e7-10aefeb776dd", "comment": "Malware payload", "value": "1cb12312018b973f6af503e59af024a35f3f200b", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405828, "uuid": "824170aa-78bf-4e48-b8b7-7b4fd8055ad3", "comment": "Malware payload", "value": "7d4f7a43c9dc4da7c74a29fbfb4e85b4695a60180b52541a89f87407049de621ca126d442c1f2de53b12a79305b0bc69", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405828, "uuid": "c0c67b3f-67fa-452c-9f68-a603bee7495b", "value": "T1A2665B73905514D8D1AED974C6152213BEA8388B673873DBBBC076F11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405828, "uuid": "24db358a-a7be-4302-90a5-b07535e92918", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ9:cqYUQuVDt0TZE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782405828, "uuid": "0f610bf2-7fcb-4234-bac6-428c08c5455f", "value": 6586368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782405828, "uuid": "8548cd23-02b5-42de-84c6-e3009c8216ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405828, "uuid": "3bd3f69d-50fa-464f-ab92-adaa69949682", "value": "56e376fe961db08c622c70a25200a89bec93290bba54f33f9577e3721e05323b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f0e263-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391064, "uuid": "b58d050c-6c25-4af8-b955-10cf5dc0b5cd", "comment": "Malware payload (CoinMiner)", "value": "18f28fe6464a529300124e6b2ec81766", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391064, "uuid": "2b927952-19fe-4c01-b298-9e4cfd8bbfac", "comment": "Malware payload (CoinMiner)", "value": "5709e15f530c3c281cbd105751610e6ffb24d282207e2176bb98e99170173be7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391064, "uuid": "60595544-d7c3-4f90-8b4c-1e56b6fe2469", "comment": "Malware payload (CoinMiner)", "value": "a31700869eb96a585be8e6b1370d9056088eb467", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391064, "uuid": "89c875a1-be4c-4ebe-8888-75c1facb93d0", "comment": "Malware payload (CoinMiner)", "value": "f5c617482ce9627bde2a9a6d032639c7b56e566ca40bbe64685032485f97669e8da4a64af931b0e851a53ef14e6f6f9c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391064, "uuid": "3322a8d8-f944-4938-b82d-2abcea0fea76", "value": "T175F53348EEB18DBCD5D657781BB93F90A53431560712B8FB22B6359038367C83BB2E94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391064, "uuid": "8a57eb13-00fd-4466-8b01-43349e45e664", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391064, "uuid": "c37a5529-ef65-479d-8180-2f32f7b7e886", "value": "98304:2JbemV92vElzja8ZE2ZHBghkz0Cst6Q5JVNM:lmc6aiNHB9oCsoQ5Jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391064, "uuid": "4a5369cc-a7dd-4832-9050-0b864698e62c", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391064, "uuid": "2a22570d-00a9-4de3-afd3-2ff017b9f735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391064, "uuid": "a89d946d-bf89-4c7b-8072-1d3e9ae9bd07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29befeb9-70ac-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782402016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402016, "uuid": "ace20158-f7b4-48f9-bb54-ce68cf3808ea", "comment": "Malware payload (CoinMiner)", "value": "e891f4796d59fb742f54925714aa49dc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402016, "uuid": "99db5bce-14b7-4a44-bd27-2f20cf8550b6", "comment": "Malware payload (CoinMiner)", "value": "583e86ece98ccc0d5e7f654dd48240809890e3fb61a542cb56e5341a1807887b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402016, "uuid": "3554f6b2-a506-4e57-b705-a8bb54ce3f05", "comment": "Malware payload (CoinMiner)", "value": "3814910648514e6bb5eb3d79839b92c55517e95a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402016, "uuid": "73747d84-b985-4a7b-9f14-c40b8319d216", "comment": "Malware payload (CoinMiner)", "value": "663dab0530493313fbf88f7c40f8ed0ff3cfc16e837c611a72bba85ce6c46909486a422d80819fe40cb07f6d53cb2ad3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782402016, "uuid": "a294e7ba-53f1-40a0-8607-a83d28b4eed3", "value": "T10E345A0AF652E5F0F5A76531018ED36A1A30AD354162D996FF4B3EF0ECB1506AF1A32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782402016, "uuid": "8cd39175-3989-4926-ad68-32449e330165", "value": "6144:Tj7ZMGumHLO3Zj9yCWBrmCYDnZw+W3TzZRPWq:H9zumHLeZjoCYyCYDSjDtR+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782402016, "uuid": "0ae8c102-52bc-4616-bd28-9b583a827e3d", "value": 239032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782402016, "uuid": "30a82ee4-648c-432d-bb94-bb1cd627d3ac", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782402016, "uuid": "bf4132f8-37b1-4d72-9448-ed2ce8f078ab", "value": "kworkerd-events", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450f5bb4-7093-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391324, "uuid": "8a12ad96-3a8b-4f0c-b444-98206e490747", "comment": "Malware payload (CoinMiner)", "value": "8b45d43cf0d9a4dcfb0a372f128725ab", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391324, "uuid": "ab6a73fc-b919-4ff7-b4a5-f92580dbb40f", "comment": "Malware payload (CoinMiner)", "value": "58d923fe877760cf366d83cba548eae53dd8f18f858b5d56c27b699db4f4c633", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391324, "uuid": "e5dc89f9-414a-4f93-822d-34ae08ff1788", "comment": "Malware payload (CoinMiner)", "value": "a8e33ef33f539e8a3dff0153aa4c3b416e658eeb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391324, "uuid": "185ac308-cafa-40e8-88b0-5fff89adf252", "comment": "Malware payload (CoinMiner)", "value": "0f28d3033c3e0dc129b3985981b79fb361da939b261010487c5394e78c7a1e1035307266c32bf020ee5c3fd9c2396ea6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391324, "uuid": "da937ad2-3368-4b02-8a46-a9467bd3ecac", "value": "T194F53355B21130BCD9FADA31D3A49B39877C79604F02B6DB017688737A3BBC6AE25C14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391324, "uuid": "31010b3f-7035-4ad5-95be-78056756bdca", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391324, "uuid": "04e91783-ee57-4f5c-b537-caef849f72bf", "value": "98304:4nL2mrVo8mN/7HQ8UhOE/994htTxV+TDku4V:8rVo8mNzHzUBTstTT+Twu4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391324, "uuid": "7e5b95fa-abf1-4ab1-b50b-14aab8fe84f2", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391324, "uuid": "d993b05a-9a0b-4aa2-b9c0-92f4734ed215", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391324, "uuid": "4c5f7c66-8bfc-4bb3-a4f0-abaa82a0a612", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cece083f-70c1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782411312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411312, "uuid": "7ac4f667-48c7-4b7d-903b-b0987f0813e6", "comment": "Malware payload (Mirai)", "value": "a7446df53049d9afd55759e9b777c6fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411312, "uuid": "81a3403c-a85f-42de-9f33-5f1abaa268a7", "comment": "Malware payload (Mirai)", "value": "59691617d4c9bfe4a9202c318e632faa7c8a2d5dfdb46297e27c1a33971f3530", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411312, "uuid": "a6de0d2b-80d4-44fe-b666-9f01cabe9d36", "comment": "Malware payload (Mirai)", "value": "f3fd893e06f45992d7eae192913ab303839b86e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411312, "uuid": "3b6de7db-548f-46b3-b9bd-3de92a0c4a48", "comment": "Malware payload (Mirai)", "value": "09dd2fbf2d97094d8256fec57fbf51d09fb653a7966e0809bf3e732fc9cfdba759607ac24e21a5d9525cdb235b006de0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411312, "uuid": "dc4e6f4c-e9a8-4d20-80cb-077af7679511", "value": "T159E33A1398659FA7C596AFB562F34A704B53EC150F470B8AB63AEAF40607DCCF809364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411312, "uuid": "9165fdce-0b8e-4617-92f1-bec0180b86a8", "value": "3072:gPT9BVseR34XWYWCmv5OAhLuvtSvAgsPPLLY8tYbuP:gPT9QTmYyv5OWLuvtSvAgsPPLLY8tYb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782411312, "uuid": "10b2d8f5-4425-4352-8b8a-115e982c0cc2", "value": 143310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782411312, "uuid": "8419ba09-26c0-45ce-8c6f-1ebd85c1288b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411312, "uuid": "843f441f-7d18-4ec9-9860-bcdb972a61bb", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135c08a6-70f0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782431184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782431184, "uuid": "95b71cc9-3fb4-4930-90ee-d177ca40bd8e", "comment": "Malware payload (Mirai)", "value": "971a8856822a94cb1d420fb91662284f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782431184, "uuid": "670d6bae-c475-41bb-b87c-ba81ee5cba21", "comment": "Malware payload (Mirai)", "value": "599fea2f9d0ca4a75c5826d8df45d7deab9d9f03d8f4928166ffefddce58218d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782431184, "uuid": "af07f462-41f8-4362-b883-9c52da5f1905", "comment": "Malware payload (Mirai)", "value": "b112d38ae7580604bfd18cbe6707e7c14ec1df32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782431184, "uuid": "ef559057-693e-4060-a1d5-b9c235588ed6", "comment": "Malware payload (Mirai)", "value": "9f0b939e87a86b2130d76c01aad49a5d85d9249673e367aaeeb0c9746b9725d46b66f2afc8cc1e1c6df88f61925b6a4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782431184, "uuid": "dbe48ea5-b062-4498-b008-696e74ea26de", "value": "T155143C5377324FA0D326D1720BB38B5A5DEB01821EE298D5935CCB143A60BE9685FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782431184, "uuid": "6cd8d021-c6e1-4e9f-8085-261f3a7f8fa6", "value": "3072:Do3k0MpJDiNHj8L3F2LzQFOEqkrpL1OoGAkfLIiLc4MXEchMVpZs:D5PG1j8L3TnqG9hpUnLc4/chMNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782431184, "uuid": "6eb345bb-7fad-4ab9-9f19-b7d6aa480a4f", "value": 208648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782431184, "uuid": "b2ae8a3c-e009-4fe8-a28f-699100f68888", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782431184, "uuid": "810edf0d-f093-4d41-ac39-99d23e35883c", "value": "data_mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db1add2-7057-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782365649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782365649, "uuid": "56356a75-d090-4922-904c-1cc1fc47553f", "comment": "Malware payload (AsyncRAT)", "value": "6695bc02e32d5b7c076ab8bae9ca2693", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782365649, "uuid": "b3864f5c-1ef2-4c35-a3c1-9677c4738122", "comment": "Malware payload (AsyncRAT)", "value": "59bb710abe6edad7040227e259f3665f2852f2e954ac82059c746f54e947e6cd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782365649, "uuid": "b83483d5-de32-46b4-baf2-3e7a742a9e73", "comment": "Malware payload (AsyncRAT)", "value": "538d28fbaaa65cb7c69652b0e54e154e431fe8f8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782365649, "uuid": "adf309da-5ce7-4463-8bba-c877fcb22a85", "comment": "Malware payload (AsyncRAT)", "value": "69b2323a3f0111335949df7c1cf95473cad8cb8572e4e31df90d05e213a2c108d3df8f0fb2a90a7d33d993a1b8f0d0dc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782365649, "uuid": "e4c6efcb-88c7-4545-92c4-7e96634ce226", "value": "T135050164335AEE01D4DB47B44860E3B462381E49E802C3039FFBFDDBBA7A64665497D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782365649, "uuid": "f2eeb98d-f9be-4aa7-ba6e-ff6fae75953b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782365649, "uuid": "addd4b8f-1b96-4d6d-990a-6ad82f489c4b", "value": "12288:wAqNLt1wt4g5yk5uSjr4SaeQaADJJFGs/33Fic0nG4J6iJoFtXeHvbzV:wlVt1wt4g5iretAbcMcc0VGuPbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782365649, "uuid": "c48357b8-e771-473a-abd8-82448c4d1883", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782365649, "uuid": "cc705df4-7aaf-4dfe-b5f3-1df8edcaa0df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782365649, "uuid": "5ec42fc8-185b-4a1e-8c0e-7dde242342c9", "value": "6695bc02e32d5b7c076ab8bae9ca2693.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3457c7f6-7034-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782350494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350494, "uuid": "ceec7a64-75c3-49b2-a3e3-1199b61fc754", "comment": "Malware payload (Mirai)", "value": "3e407ccd4d3f0d17745d03342f9a88c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350494, "uuid": "cb435b01-34b6-4e54-a2a1-df602ade7be8", "comment": "Malware payload (Mirai)", "value": "5a8795076e41edd2aa2850f7945b06dfe27059a08eed47450e9fc83c108995f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350494, "uuid": "489045a5-6947-40cb-87e3-44c647ab5e59", "comment": "Malware payload (Mirai)", "value": "39b509caf7c134bec85a705c9968a0a7647f80e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350494, "uuid": "b62be30b-99df-4762-9364-511006baa9d1", "comment": "Malware payload (Mirai)", "value": "a9509b68f66a880e6fc5ee49ad60b2547a7ee3b4af7e0dd843ca21681305524ed196a9fa7a32f5c8282dbc008139fccf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782350494, "uuid": "fa69ebbb-7c14-4130-b84b-16d3c570dcf1", "value": "T13C835C3379B85D17C8C4A67A22E74334F5F7474525F8CA2E7C224EADBB00660226777A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782350494, "uuid": "ee5420a9-d550-46f8-8de7-ebf41475bb8f", "value": "1536:j+W/kOzr3E5Tn/J60cDLwznea7s0Yuo+Ry:j5/kOzrUB0R/6nF7sFuo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782350494, "uuid": "832c47ee-6216-45d4-bcbd-fde6c6780879", "value": 83096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782350494, "uuid": "7bd1f88f-7e5a-455f-b47b-25be4d53b204", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782350494, "uuid": "f4a9a302-1a70-46ae-a887-8815b53fe71a", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cabb28-705a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782366864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366864, "uuid": "fdded3f0-aebe-43a2-b276-65016e025fa2", "comment": "Malware payload", "value": "8ba64af3f91d30fe898ed932129429fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366864, "uuid": "e3684a51-6a15-4389-b9b0-996e478b9c1c", "comment": "Malware payload", "value": "5c8c8c7f7790a1c571ace62badac8de15aa7d8a0cd8843468d8b06fac2c7427b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366864, "uuid": "47545f8e-2fd0-44bb-9c16-dc798e15d503", "comment": "Malware payload", "value": "d6e392b0a95b8b158bbbcaa8a787e7f260c50702", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366864, "uuid": "04b635fc-6d91-44a3-93de-31263d39fa3c", "comment": "Malware payload", "value": "04dbfaa9533542378c07b177bad736c5a0cf93c3ecf7ba812c3f79bd8e278829299fd04095cca4064d6c4215fca0a649", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366864, "uuid": "66ac20b7-1d6d-4fb0-852c-ca40acc0bb48", "value": "T1EB03868D3EC1A471AE63B03B2F2BB1D6E56D7C90B74C45A8F3267051F838304A6667D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366864, "uuid": "265c8220-2180-43ea-bd06-e338bb6655a7", "value": "768:3iUw+rboBKrYNGrtBAj59o6Q4KSH5ox9Hbz87:3kBKhrtajxQ4C9Hbzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782366864, "uuid": "e49708c2-b57d-4f46-bb22-bcfd3cd7ca26", "value": 40141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782366864, "uuid": "9b73034e-5ccf-413a-ac78-b3ebe12cca49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366864, "uuid": "7d7e4a40-7043-46b3-9d3d-015f4f0d44f9", "value": "RFP-000000183432 _ 29062026 _ 12PM.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e38d696-70ca-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782414881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414881, "uuid": "8ca1cb4a-b0b3-4613-ae83-4471c9d984dc", "comment": "Malware payload", "value": "a0a2e863176c4ccc7438c5cfd353dff3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414881, "uuid": "316b67a2-c072-4947-ab95-4c3739c67b87", "comment": "Malware payload", "value": "5d163c9174f024a2f8ab536037371d62c4f4c1df70c83854e61bc9ac1ff8bf98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414881, "uuid": "db84984f-0530-44fa-9cad-cef220dde75c", "comment": "Malware payload", "value": "e47ba6454939dea14a82669bdee6ac6ef4428b2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414881, "uuid": "565037b0-af48-4ea3-87e1-796a99a3a3bf", "comment": "Malware payload", "value": "dcce7cccc1bc232dbf851b5a78b13a6d8ae1ec78bab64ba4cdc04e9b10a903e0640c38b422edefacdea3985ef25cf8ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414881, "uuid": "187953c9-95c5-4d90-8856-a9c008c8093e", "value": "T1FDA312B37A00DEE1EEE954BEC80A02D5536DEEDE69F770522D255FC0A8B688613DD043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414881, "uuid": "9493baee-937b-45ae-946c-06c1494a78f3", "value": "3072:fGqmHWGwaE+vw2VqKgapesT4ae3VPC+eYi3j:+KpD2IKgMeJFVHeYqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782414881, "uuid": "55a0fd83-f656-48f5-8564-ef0c3879a669", "value": 101912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782414881, "uuid": "79aa28ec-ce55-4605-ac9e-d47400225bd7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414881, "uuid": "56bfb96b-ddbe-4958-8ca4-f3c803a858b3", "value": "kworkerd-irq-bal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e157fb87-70c7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782413920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413920, "uuid": "020b6d78-3382-4e96-9321-5f781623064b", "comment": "Malware payload", "value": "0ed8a6fa5fe633a3426db02b1bd67230", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413920, "uuid": "8acce7b0-cd29-498f-95dc-20acf171f32f", "comment": "Malware payload", "value": "5e78e6c39fb638de7536bbf6ceb21ebb6ae852f190447edb751c3a422544e780", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413920, "uuid": "40cd174c-8403-4383-a296-d97433952877", "comment": "Malware payload", "value": "fbb75aa50bd9b77a5dde9b512d61b05116235989", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413920, "uuid": "1df779fa-4d1c-49ba-8672-06fba5a6329a", "comment": "Malware payload", "value": "b4ac813cb5c15de623666d099432a127a0b8a70a7de8a87058e3705905f1627b122977728e40e6cbdd4bef3649dc1306", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413920, "uuid": "6ab13806-910f-406e-8bca-837a52088f5a", "value": "T138644B03FF445A43C5811FB15D7B07B6A3AD44816CA9F03D9D0ABF2506B38BAA5DB388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413920, "uuid": "040be805-158c-4ad0-99b5-749dc254cd3b", "value": "6144:r/RV83+wQUKodT6qTBNPw0XGRCVWfaxuJ9RpAG5zRYQ2fDZTkHY:/3R4ctMf9TkHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782413920, "uuid": "1918439c-0566-45ce-9106-a6a075bf51b3", "value": 329172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782413920, "uuid": "8b6ee9ac-b7da-4367-8482-1d7a7d57c08d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413920, "uuid": "a5ffbf43-272f-44e7-b328-9950aa2dfd4b", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad26918-702b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782346693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782346693, "uuid": "5a3cd7b8-62b1-48de-a53e-e6cc5559c591", "comment": "Malware payload", "value": "5dec96b623802a6f709b51557050e067", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782346693, "uuid": "baa05cae-4009-48c6-a4eb-e57dbd0ae911", "comment": "Malware payload", "value": "5ebed0bd0c875ada468c98854eb88f6244461eea138933380e696f27c67a91be", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782346693, "uuid": "219e0cc6-96ba-43b2-a545-21493c1b114f", "comment": "Malware payload", "value": "db5c1260f708a2a85c3151f97acbce77a50a0eaf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782346693, "uuid": "7e06354b-9ae6-48aa-9f1b-91759c10c89d", "comment": "Malware payload", "value": "a2d925ccd77b8f199b4553c8a12f9d15ceeeed79fd2ad53505f6134e2c70433586bb2798192f0eb95fbf10f5fb7cc788", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782346693, "uuid": "a577f451-ae33-4e02-8480-3918933fdb16", "value": "T1D8137D6566953C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782346693, "uuid": "087f5472-c9df-4bb1-9b57-85ba6dd5c2fe", "value": "768:y4XRWNGxVJb9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:nlxwco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782346693, "uuid": "cc513e17-5cf8-48b2-9229-60cd96150c1b", "value": 45517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782346693, "uuid": "207d3b1a-dbe1-4f5f-b145-1976da7ebd1e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782346693, "uuid": "1a0ce8e6-6f3e-4cb9-9786-f953dfb48e69", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fcaee8-707f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782382736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382736, "uuid": "fdddd88e-f3ad-4a8a-8c82-5433b6604bd0", "comment": "Malware payload", "value": "54654a6e4d5938845697a6a7e39fbee4", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382736, "uuid": "4eb54aa2-2585-45e8-a0bd-ba0e2e5fd48e", "comment": "Malware payload", "value": "5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382736, "uuid": "e24e7a43-1729-4bab-91bd-06df7ffcc638", "comment": "Malware payload", "value": "85b6cdb49f9d2ca609d6230917a550500840b546", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382736, "uuid": "ddc24069-a62c-4cdd-8542-11c925d464c8", "comment": "Malware payload", "value": "b1dd897305016d835ad6ed091a6a0c802a492d4c6092eb97b65816576f6f3ef9f4603d427563f30b684443913d525f24", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382736, "uuid": "01b9a9de-9fac-43ca-8a48-2d21b8767526", "value": "T19D349C09771CE21DC9A90A785C52C7B40B30BD756D00C797BDE87B8F3EB33259A0969A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382736, "uuid": "4fa6d210-f734-473e-98d9-acea27d98fef", "value": "3072:125RyML5r9YAOurxZnjiR9xDc0jpc8VSEuRw6hhKtP+NjX991jk:zOpljjgZc80Q6jR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782382736, "uuid": "b1edb097-983b-429d-9d53-8cf3ebf1107d", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782382736, "uuid": "62db628d-9165-4f05-900d-c3b189515af3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382736, "uuid": "fa89c4e0-9054-413a-a1d6-3cee7e0b7bd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116c10bd-70ea-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782428604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782428604, "uuid": "1518e66a-157a-4759-a8bf-84f88dc44259", "comment": "Malware payload (Mirai)", "value": "d7a93fea804cf60f3dcd745839cca262", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782428604, "uuid": "ca92a30a-981c-4d68-8c9e-c7c171774709", "comment": "Malware payload (Mirai)", "value": "5fb8f703c58eb7a26db0565a95dd120eec4ef55c3380fba1dd267b302f921c3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782428604, "uuid": "6a887ad9-ab89-4ba2-b9a6-ddc545f82f0d", "comment": "Malware payload (Mirai)", "value": "138223bd2f9e9ade8e257f76dd01b3c521a2a808", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782428604, "uuid": "5e444647-14b8-4a66-8be2-1c791bb55ca3", "comment": "Malware payload (Mirai)", "value": "98aaca6c19eb200c59580519a1dd4535409e921cae3fd90793dd8468185afacea4aa905742f6379d93e6cf03c0674bb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782428604, "uuid": "77c0c082-7ac5-40ae-b95a-ba42212a8293", "value": "T165E47D9DFE4E3C42E3D7E2789E4D87E1721B71E0D32391A23982434DD5C69D9CBA1A21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782428604, "uuid": "369720c3-e91f-4091-9d85-1b22277db945", "value": "12288:peDb4Ygy8GnDMXXKkaFGo8kTq2fvOnHzJBOAjzRIhSbExLw5X4teFZQgO:pJY8GnJrGo8kTqk4BN2AEDUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782428604, "uuid": "98a5a882-833e-40c8-b521-42c7ee672015", "value": 704464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782428604, "uuid": "04d61ff0-c0e0-4c61-87b4-18998c1ce434", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782428604, "uuid": "81005267-b872-4bbb-a0f8-c6b50b97dcd9", "value": "data_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f64553c-7093-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391234, "uuid": "e49c970e-cabb-42ed-bc87-da0b1d0bc905", "comment": "Malware payload (CoinMiner)", "value": "630af280e74aa6327ceff433d6dd20f9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391234, "uuid": "a9471761-ee0d-4f99-b69c-01432f2e645b", "comment": "Malware payload (CoinMiner)", "value": "620e1b095c157be83a25c8772b941ee20051b53253d325117788716cbc4f50ed", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391234, "uuid": "e67ccd33-49a8-465f-b3f3-82c8feaafa43", "comment": "Malware payload (CoinMiner)", "value": "9402f48a721e4132924c03cdae287a7e139cc85c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391234, "uuid": "1a5d69e8-3187-4cc8-bd87-555955c29b5f", "comment": "Malware payload (CoinMiner)", "value": "ddd287ce9821c777d971392af3bc9da6476219c6d6daeeaa329586375c743fd446022dc23a07d0a60d0536ccd56f183c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391234, "uuid": "5cb643df-db8f-450a-9ad2-3014fe69c8a0", "value": "T1F9F533809190147CC5B7DC7A13ABDF3369FA6110036261DF3796CDA9333BAC169B6CA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391234, "uuid": "e3f7b1d2-c4bc-4b85-b8b1-17447617b383", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391234, "uuid": "e3e29041-41c4-4386-9a2f-762089a7d347", "value": "98304:/nsccJQkYjO8iLlqGPjx5qw+TtFN6zUtjz3DFNgA4MzrWcqa:EhCdjOsivKJQujzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391234, "uuid": "4c62b5a3-efa0-4ab5-b1a4-21fba6ec3df2", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391234, "uuid": "7eb7f1ea-fe2e-4f83-9ce8-35f4bea43950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391234, "uuid": "dcc1939e-37c1-47b0-8420-132d00627e5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df88f2a-70d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782417565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782417565, "uuid": "27dbae5d-99ee-4a91-9c58-738d17854598", "comment": "Malware payload (Mirai)", "value": "243846bf5447dafc54ae56708fea47e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782417565, "uuid": "a0b804f6-abc0-46d8-898a-dd2afcbcc8b0", "comment": "Malware payload (Mirai)", "value": "626fee2f23932a2e01ffd529420506583a9c670fb545a3a6bbe8041763bd1518", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782417565, "uuid": "f73423ed-12ca-490d-9ece-feeaddd2557d", "comment": "Malware payload (Mirai)", "value": "30b1824b32bc709762e40521a16af2ebc98b7624", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782417565, "uuid": "1ea805cf-f567-42df-aa35-985e0e817f80", "comment": "Malware payload (Mirai)", "value": "7df11ff618c3b67779f56793d20ee3877b88f6e4bc5ef87234986a26dfb0eda7486daa3f870c0f7d367aacbde41537d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782417565, "uuid": "cbc81e85-1dd8-4266-8c70-6ba8e3581fab", "value": "T110143A87F800EDBDF80BD33608538905B530B7A618925B3773577B6FAD3A0951927E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782417565, "uuid": "4062d812-da88-47c2-abdd-be99d0d1d4f9", "value": "3072:vU01Dfrx93dctbRyuSpQtKhhxtZhU1qBnpoVXjbiIL7RG+lZmhuMQ:PeFyuoQtK3xO2npwL7Q+eha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782417565, "uuid": "6569506a-0785-45bc-962d-3f66fd705395", "value": 194656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782417565, "uuid": "608dc127-cb74-404c-a231-39de5daf3fe9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782417565, "uuid": "e27a5595-08ad-4617-ba84-bf6d08eb08d4", "value": "onie_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c989c6f-70d2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782418449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782418449, "uuid": "8c1e55b5-462a-4b7b-85aa-4c03f7daa250", "comment": "Malware payload", "value": "9f53dceee7e9e285f93e75ca1a2fe023", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Oblivion", "colour": "#43159C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782418449, "uuid": "fc73a10c-e513-4030-b976-5b0f4b631c0c", "comment": "Malware payload", "value": "62f841f620cea0ce084274878184808bd346da7195edb079a81ceb7fe346bb75", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Oblivion", "colour": "#43159C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782418449, "uuid": "db67444d-d4a3-4077-96dd-bd3599fb4ae2", "comment": "Malware payload", "value": "e726bfd40b6a6276d748eaf4cdad491f3907625d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Oblivion", "colour": "#43159C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782418449, "uuid": "c2f5895c-e1a6-443a-9803-19b80d3e4694", "comment": "Malware payload", "value": "580468214c85399983df3f6d8ec5de20e62866fc11097c9bbd6072f594a0c01122abefab54acd518c5cffdc98ae34e69", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Oblivion", "colour": "#43159C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782418449, "uuid": "fce0b8d5-4a96-4cdd-8cb3-14a1d0e28250", "value": "T1AFE42397A38ABE37D51F363B05C4C333B7310264E1E8D63B54B5E4929CA26B46F25688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782418449, "uuid": "25ca07ce-68fe-4075-bea0-afe432dd9943", "value": "12288:tKE4wR+t7i/KhgS3Lfy7AEbxJII0ry00hPwZCtl2U3Q0qwvOjNDHLuC:ZG75gmLaUuqNryZ/b1SHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782418449, "uuid": "e23ad57d-5dc5-416d-843c-18c3ca24d685", "value": 718253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782418449, "uuid": "d2347e68-c765-42f9-bf87-4f41f2b22ccf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782418449, "uuid": "2b7a3b39-5f90-41bd-b12f-4522cb452e98", "value": "payload.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2458702-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391132, "uuid": "3293815b-7923-4828-9b02-f2d06928969b", "comment": "Malware payload (CoinMiner)", "value": "df087178f6871ede7e7d88e814572bd3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391132, "uuid": "7733aa2b-b7ba-473f-8123-20d3885df611", "comment": "Malware payload (CoinMiner)", "value": "63c030b19be8dd63081c8d5aeed5c4c1604be565ba4485af93006ad48ab57489", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391132, "uuid": "2ad94b06-1b4e-4654-81b8-abd3a51a4256", "comment": "Malware payload (CoinMiner)", "value": "683b49068305f9c3203bbf415858dbd2ad5c5443", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391132, "uuid": "34d3c7d5-0275-4ade-9f78-06a969faee9a", "comment": "Malware payload (CoinMiner)", "value": "ba0d8ad542dd26286d03f7df27c1b27c40e0d8126625aeb25d03502fcfd2a1b2fa32eb4384a9799d68bf00869ded6fcc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391132, "uuid": "a77cb7de-d3ed-4bcc-96a6-900aa8c40277", "value": "T1CBF533D0210264FCC164ED701B75AF1474397A45C7A19AFB2BD7EA782632BD02D38ECA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391132, "uuid": "49544380-9a70-4092-984f-63b9ff16c312", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391132, "uuid": "d93f23b6-df06-4dc0-8366-c21ad7a9110c", "value": "98304:XnwZ2vjPwkR4MqdGjqFQrPup3ue5LsNHto4l:gZ2vkd/dOweQue5LQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391132, "uuid": "8242462a-fcc3-45db-a2dc-dadbd5d1269a", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391132, "uuid": "73cef836-a50e-4192-8c80-43146b6ac2d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391132, "uuid": "3855dc1c-ea94-45dd-9272-228cc2be3739", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac873e5a-708e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782389350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782389350, "uuid": "7419cb05-ce0f-4115-b8b5-f72e94a19139", "comment": "Malware payload", "value": "42e44546d8f6b1f7f0e2107f40f6ae7b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782389350, "uuid": "3fddd481-e558-4dbb-b5e2-d3c9a1d30ad1", "comment": "Malware payload", "value": "6423a95d9bb21f6930d8a27f19d9b24066b06e7a6b66ac28292bd0a1dabe29c5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782389350, "uuid": "88a0916f-53de-4ab9-a8d1-5f5e47f50b3b", "comment": "Malware payload", "value": "ffd680cbec49af44de5c940f5c38451b3ffffd79", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782389350, "uuid": "fcc65253-d951-4a9b-a83e-241b379102d6", "comment": "Malware payload", "value": "ca1daa0fd19dc98c645e48e349bf1d34724ecd33eb17bdd7a2a5628d62dd1b695c3ce69349f54472da365733568d326b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782389350, "uuid": "efebc0ae-d4ca-45e9-9e97-05ac4ba38634", "value": "T1AE762328B3E61CEAD572527784A7C224FF757C083B21964F4BB4B54D6F3A2A031BA705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782389350, "uuid": "455dabb6-2d0a-40f6-aee4-8245bdcb81df", "value": "196608:loDVVnYPjC5xfChqgc73sZIF7jC6gFsdQYwz4BrgHUceR:loPYPjC5xfuBg4IF7O6gsjwctg0LR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782389350, "uuid": "05492683-2bb0-4dd1-98f8-f7b7d2083ae6", "value": 7720960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782389350, "uuid": "5ac5179e-8f6c-47c2-8d97-407b27e01a6f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782389350, "uuid": "f44b2c49-8d8f-41a3-8693-42a82a4e920c", "value": "npp.8.9.6.4.Installer.x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768dde78-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390978, "uuid": "b0bcd98a-dda7-40a7-a7c1-fa95315d7a83", "comment": "Malware payload (CoinMiner)", "value": "041d3e837d4deeee1a1f1501cb2ea662", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390978, "uuid": "d59132f7-81d0-4708-bd4b-8b29241ac9dc", "comment": "Malware payload (CoinMiner)", "value": "651a64eb4ebe8ef3ba9d6494e205257808c7ca58ae041dffb1b9683162b50328", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390978, "uuid": "501b4974-557c-49ef-b4ac-ce2d8ebfaa0d", "comment": "Malware payload (CoinMiner)", "value": "d24dce407c1593f1f2ca96a93e8a5bbe5d5f9984", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390978, "uuid": "29c0e3e1-c828-4545-ab94-22f5ba817059", "comment": "Malware payload (CoinMiner)", "value": "2685ae5fb4e77fcfcb7cb6328256209688e70e9a13577664a2158e0f5fa9c81de5e4dc81afa20a3aec7e4895ae20f680", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390978, "uuid": "b0c6086c-7106-4514-8051-f88a54ba9c20", "value": "T12AF533CDA592B0B8EC0F9ABA47185593580BBC8B4F51E3CFAA9DD13178D5DDC0A34E90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390978, "uuid": "3b983d2a-5074-462c-b19d-b80eb2e0d3bb", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390978, "uuid": "ee449af3-6d98-42da-bce9-e5438a8b317f", "value": "49152:sAHcLrhqWyBYXMfSS9Ck9IESMKwuFU9HPxXaeUxj2OtlsJGgO3+j:sA8ZDyjSXk9IvMduFAPxtUxj2o8XOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390978, "uuid": "36b76fa1-345d-4c77-8ac4-064e3ab6c221", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390978, "uuid": "15dcd3b2-3865-4be6-a5e5-55ef6d39c3e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390978, "uuid": "dd295e20-9bc3-4e2e-86b3-3d977e9d5fba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8cf36c-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370778, "uuid": "bb1c4fcb-48d0-4fe8-b2f1-7c2867c5b24d", "comment": "Malware payload", "value": "ff8b3a0a424addf4a144bffe2e666ca2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370778, "uuid": "14d6cbfe-97b2-407c-8973-20a5e07ee4f6", "comment": "Malware payload", "value": "652334663c2c1747ad45bac06c5eb8a8dcd63bc681add624cb91b690ca07c43d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370778, "uuid": "e3f68bbe-4579-4e24-954b-f35c21981c62", "comment": "Malware payload", "value": "a885b33b9ef5d0b2b0ac8280474c9c5c3fcca5f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370778, "uuid": "05256482-c741-4693-b3f3-f659426cab3b", "comment": "Malware payload", "value": "af169b31b6e44e682a3a6a9dbab928497366cfb48560b9b0546912553ae1ae075d7bb76e3fa4515bd91ee600d08b7626", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370778, "uuid": "480fe74a-11da-4c22-ae2b-bd134e8776a5", "value": "T1096607136B2CE70FC62831385DB1DA84276A1C5645DB9527B385F30AE9F20AD4DAECF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370778, "uuid": "54cc09ec-814e-40fa-a55c-678771e9973b", "value": "49152:XDamxMRv2lFkhQot+Pp3NTbTX9dTldusKU7ZzbOt1wk0fr8HHEt5ED:HTZds9er8nEjED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370778, "uuid": "41f0c87e-9cbc-4d8d-a4cf-fa87261b940e", "value": 6946995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370778, "uuid": "4ed170e6-6e5e-4e72-9b4a-f6dc167d7d27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370778, "uuid": "989d324c-3a52-41ba-b5f6-a8b378c5ecff", "value": "kswapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281a2f1b-70af-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782403301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782403301, "uuid": "73d38175-a3dc-40f5-ab8c-292ed75fd9ff", "comment": "Malware payload", "value": "6069585ebc9cf3817db15e957f11cf48", "object_relation": "md5", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782403301, "uuid": "6644b0a6-8f8b-4a30-9bb0-81cfe3b46c25", "comment": "Malware payload", "value": "655494075bdbc8687e3d16b9199e6f27780dbae8a23118d95b28523130459a7b", "object_relation": "sha256", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782403301, "uuid": "5bcfc181-76fb-4290-a1bc-9535bbc476f2", "comment": "Malware payload", "value": "d42528086cf77b327fccba4a5b6123b808e40bab", "object_relation": "sha1", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782403301, "uuid": "1f1e7703-c733-40c0-8f46-11d6e64b424e", "comment": "Malware payload", "value": "6f29edcd6f2d718cd0588c0b25648536fe632a9c0c58f3742564773704bc51a3f48021652559d6583712a45975afc652", "object_relation": "sha3-384", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782403301, "uuid": "3946eacb-c188-49d9-8219-0b45e16d9667", "value": "T1A1146A764AFBB124060F5B8C9917C017D29A4342617F94C9A69EF8DDB8BF5C062D0CEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782403301, "uuid": "03a1cb8c-3320-41ce-ac93-be3f83b89bc6", "value": "3072:PesrW8Qs/FJzJkRrsJTUHZvn6TDuj6ihm6ej5HkaXAG17n8TFK2cUHWT:2srW8Qs/FJzJkRrsJTUHZvn6TDuj6ihG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782403301, "uuid": "5d57b774-5d68-42d5-a4b0-129ff792a13d", "value": 194191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782403301, "uuid": "731cd9c5-b740-4f15-8eb6-5322c89982c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782403301, "uuid": "78fa7202-057b-4a22-a848-eaed6473aa57", "value": "smodule.applescript", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413c0e9d-705e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1782368554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368554, "uuid": "0096e4c6-d6a3-42bd-9d58-55fd3a558442", "comment": "Malware payload (Joker)", "value": "f3f5ceb730cc1f75d4bbd113b36e0add", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368554, "uuid": "9f94003d-f5ad-4247-8e41-861504f7b062", "comment": "Malware payload (Joker)", "value": "65adc99e7587827dcf445aa0c204447ad1488cc8641ff7d6be35fa4a97784945", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368554, "uuid": "f5f9f99c-e8d2-4211-b8ae-6d5e961aedc9", "comment": "Malware payload (Joker)", "value": "4a581d33196b83e2ab27e7ca9620925222dd26da", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782368554, "uuid": "b4446410-da58-41e2-bd0a-d1c632206a64", "comment": "Malware payload (Joker)", "value": "dd292c4127ffe8c7f8a17c53cae5c99227343d65505001afa5763539ec842645cf621077fe5949b65cae9970c6a20f5c", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782368554, "uuid": "4bc65379-fdaa-4a9b-9e48-0ebf20e86ba8", "value": "T1BA67F149F60CD92BDDF6B0BC8D8B17A3B5667C151A10C28B2821B20DF9B37D49B15BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782368554, "uuid": "9666045f-b4bb-49ba-ac00-0b4fb5e2e7eb", "value": "393216:xdWoFvxtVrWKt7u/SM+STNsV9qwYG9vEk1skerFRhaKCXBKKMCarQxCuKrW701Qe:yoFVWQgS7tYG9vEk10xRhFCXs/cFv4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782368554, "uuid": "c0d9ad89-be19-4749-b624-acdb4c40a9f1", "value": 30923340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782368554, "uuid": "3dc48a6b-e47c-45b8-a7b2-021f5afc573e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782368554, "uuid": "a0403f66-9db7-4e98-9e24-9cb77d20fcac", "value": "com.textmessage.fastmessages.chat_1.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f591f502-70a8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782400640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400640, "uuid": "a5cea415-b668-4004-99f0-61e18b9a1707", "comment": "Malware payload (Mirai)", "value": "134ba1641a53c31e520d3db33b1938b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400640, "uuid": "ed632c3e-c4e6-4aad-aab7-9a744a3226c9", "comment": "Malware payload (Mirai)", "value": "6733b1f44e0bab80738909cc8846c6a95290e7e310e96fb3ff7eda88ca065779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400640, "uuid": "5dcf9bc6-d002-4711-956f-2229ef938259", "comment": "Malware payload (Mirai)", "value": "ea3f4b17563c48941ea01c850758b611d01838f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400640, "uuid": "3d0bde55-b7a6-4113-a7cf-31306075f08c", "comment": "Malware payload (Mirai)", "value": "9e6f47982f90c80387bffc26448d655c7013476c7dcaaa63552191619e8fd0fcb0598ddbcf0239469fb65cc12ca279d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782400640, "uuid": "42252ba7-bf38-46c2-93ce-abbcb2d9d8c5", "value": "T134C3EA0F7F615B6CF6A8833447B34A70A69823D517D5C280F6ACD7083E2434E995F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782400640, "uuid": "c375de59-15fd-423a-b68f-1e84dba87fe7", "value": "3072:b06xOdlZLEXGCMJJdwdyutQXsnZnd+IP+S9yVS:b06QdlZbCMzedyutD2S9kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782400640, "uuid": "6a7495ee-e7a1-45b2-b07f-512beacfcab2", "value": 126344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782400640, "uuid": "de969e5f-5c20-4fb5-931c-e95328ea7745", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782400640, "uuid": "d0b9b0dc-441a-43e3-9840-bca53d4d1af1", "value": "gq2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165809fe-70ab-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782401554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401554, "uuid": "d2eda3b9-ee61-4b0e-a680-5f5726216568", "comment": "Malware payload (CoinMiner)", "value": "063495b093df9416fa92bc25058ac810", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401554, "uuid": "9c6ac372-45b7-4954-86ed-61207c22ab90", "comment": "Malware payload (CoinMiner)", "value": "681d9f63c25b3d85187b2701b0b66969e34562ee66ef2467ef22e30aae9e25ac", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401554, "uuid": "4207b66a-6e87-4fb4-bed9-a2fb3a7f80ba", "comment": "Malware payload (CoinMiner)", "value": "96571276dee60d1392b1200413524bced3ba3994", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401554, "uuid": "ef788d3f-2656-4d8b-bb98-b472646a3f14", "comment": "Malware payload (CoinMiner)", "value": "954ba07df5bd56533add9f9ef60fc3538f8d55075e7ca9acab81c0ff5dee59b7f3275e570bf88b7ac9fe74f655c39f86", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401554, "uuid": "a4fec041-c0b3-44fb-950c-3db374d483fd", "value": "T167A3128346146EA1E91234B7A4CD06B46FDD4378F0EB34E332866B95E724FDC22765C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401554, "uuid": "26138109-7dae-41eb-a240-4075f4f493a5", "value": "3072:hEFYOq3IXE6rt4n7Gov08nEAlFzgaW9SeLDr:Wg3IXEGmqBWrrz/WBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782401554, "uuid": "5f8dae3e-e707-444e-a600-81ce8dc41d13", "value": 101968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782401554, "uuid": "7557e3a5-ed8f-4154-9665-14146ea47e9d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401554, "uuid": "6a11c32c-eaca-48d5-a274-8801a023957d", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834963fa-7051-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1782363082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782363082, "uuid": "84c3e98c-185c-4b5f-856f-7dea09ef3447", "comment": "Malware payload (MassLogger)", "value": "5bd2852c61cc919340287e61d657c8f5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782363082, "uuid": "495992c6-4b8e-47e8-bfcd-6872715ef7f9", "comment": "Malware payload (MassLogger)", "value": "68aea9911a10b2b3ffc1d5b08ee110390a567de16c7cc4e3c60969752f92741b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782363082, "uuid": "cb6453fb-e739-4417-820a-2244af4c1491", "comment": "Malware payload (MassLogger)", "value": "17993d1b85f089d3c49fbd7e569a349509129163", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782363082, "uuid": "5e6e3908-189b-41cf-a43c-829f6f511b49", "comment": "Malware payload (MassLogger)", "value": "55a1f18eea92d66049e93fe4b2ac237b4c1ed59815b9f1e89e653f9aac9ffdcd27f7b57fbc94f702919a50adfcafc754", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782363082, "uuid": "a2665c3d-fac5-4158-86dc-4a7469b3495b", "value": "T16986CF6AADE3323D7133D8F959F28579C8A2E1627B4D416E034A1703DE267C5DA01E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782363082, "uuid": "13c0758e-e90d-4b35-b693-d889063b8146", "value": "12288:3FTeRu7lSwE2aooXTyoStfl7XT9O7vyU4ZnoTt3TLIikP6PPQkshmgrwQvZEZg/P:wPC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782363082, "uuid": "42ce0b43-2437-41b4-babd-ff87370336b5", "value": 7952898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782363082, "uuid": "3edd3232-6e99-4f17-a848-74707326a13b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782363082, "uuid": "9a7ce748-c68b-4481-81a9-5e07f004cb3a", "value": "SHRS(E-5274).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45ccc93-70a4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782398839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398839, "uuid": "cf5d7db9-30ed-4dea-b305-f2bcd16a9d93", "comment": "Malware payload", "value": "422c8f5d6173261c873421353aac706d", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398839, "uuid": "a0e24cd8-bb9d-47e5-ae5f-8986833eeb63", "comment": "Malware payload", "value": "69805c2f081cd4bd6b43e991f380f7e8a70dcc4b4dcd6a7a62584d3400a300b4", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398839, "uuid": "4dfef8be-e577-434e-b6dd-87808b391701", "comment": "Malware payload", "value": "0e4c3996c3c2be15a55bd3f44ce1a8521159ffea", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398839, "uuid": "f27a2769-c276-4b64-9671-01ba13d9a990", "comment": "Malware payload", "value": "06b0f90bf853a7300bf588865f2cf640d10b63de3ea55c272a7eb4103e3f7520ec2d6243fae5f7d208286c7d1fd68c0e", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398839, "uuid": "38d82d8a-710c-474d-bb13-7a0fe468892d", "value": "T1D4068D17E2A350FCC12BC17C46579672A931B828C534FE7F5A94DB312E31E50AB6EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398839, "uuid": "396116f7-eb08-4c57-b70d-5f57c02e5e5e", "value": "0b5e5be5c80bbfa5fe328363fcad3260", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398839, "uuid": "fdb9251f-a121-402f-9999-9d21fbefb6aa", "value": "98304:5b/KgkK+7dGd91FUztjOdBSm8bILHGWCv5IjjPmgoR:Bvuq1FUzM0egv5IjjPmgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782398839, "uuid": "b75f8ade-7dd9-448d-9fb5-88c1c127ff92", "value": 3798528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782398839, "uuid": "e8181dbb-cbd1-4481-a6ec-92506c932a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398839, "uuid": "b1d3699d-8728-47ea-9bc1-40c929702a38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c54dc0d-706a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1782373727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782373727, "uuid": "cd0426d9-9f9d-4c0f-82c0-2c09923d2cee", "comment": "Malware payload (MaskGramStealer)", "value": "5cdded78f2b177c4245ffb1778b6491f", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782373727, "uuid": "30fb14db-de2e-4569-bf32-5dbf7068dfc6", "comment": "Malware payload (MaskGramStealer)", "value": "6a0dfb7d51c8caed596fa2b89cdedf7180a86f09c4aba4e5bb43d03fd1b9d255", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782373727, "uuid": "33625529-e853-49c9-9cc5-7f1803ffb147", "comment": "Malware payload (MaskGramStealer)", "value": "84c044dc34afb9fad6b2a693ae41e965bc9dd952", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782373727, "uuid": "4e1a846a-edcc-4478-b484-3d5fee4d9a99", "comment": "Malware payload (MaskGramStealer)", "value": "06e1034bdc4182fc63b86695c8b15fdafe97efa81dd286c50d2c2682667890df03bc02f9e0bb0f37adcf766e8af2f519", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782373727, "uuid": "78d36311-ead1-4c04-b336-bc3bddcb0443", "value": "T1B4044B1BD5D540E9EC29C678865AE233A4B3BC561936BA4F2BA0DF152F50B30B72DF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782373727, "uuid": "60fe5ef2-c1c9-47b0-ab38-2cb4c4b60d61", "value": "e8f58099adbf7104a18801c577843dc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782373727, "uuid": "79ee6009-5bbe-4670-9971-ad294ed1a27f", "value": "3072:I3DCPwQyD0RsALBFtzhXMUQl71TGeZkvmv7s7T1D4hBmk:IzCqg/LBFtzhXNQjTHkvmjQMBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782373727, "uuid": "9599461b-8025-4d2a-b7b3-a3a3d0146357", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782373727, "uuid": "1738f003-13ed-4c42-9b7d-b647a316d483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782373727, "uuid": "1d4a1160-3f1b-4260-a867-9fa986b3e7ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f894c8-70c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782411881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411881, "uuid": "2e6050d4-a979-453f-8dc3-d74c0fa916c2", "comment": "Malware payload (CoinMiner)", "value": "4d39d97d59ecd76696c8a25c72492334", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411881, "uuid": "71a91b3c-b27e-407f-9475-bccbc0c7c350", "comment": "Malware payload (CoinMiner)", "value": "6ad6d86c858b8fbfd5d331db3b26079d7128ccac41ce733328946a91cf6edd5b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411881, "uuid": "a8d02d3c-51ce-4917-9697-c9867fa583fa", "comment": "Malware payload (CoinMiner)", "value": "257cb22c864ffcddd2eb9c803ddbafa35ecc248e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411881, "uuid": "436fb861-bc82-4feb-8310-9420aac9c305", "comment": "Malware payload (CoinMiner)", "value": "9f53f473061e00ee98674e6437af291cb28438b6845cdf024ca84a57e9dabff1447c02f8421df2679bda756bc693fb7e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411881, "uuid": "9910b18a-318c-40e5-804c-0352a54821a5", "value": "T13D3428A9BC40DB26C6E427BAFB5D829933134F74C3DD3105CD245F2936EB95B0A3A582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411881, "uuid": "7f86e45b-082e-40e3-940a-d19ad08c533c", "value": "6144:w5cFo3ExQCRGVHSqZhOUrr1v9gbAwUJVvjBmA0AZv:3o3tQGVHXZhOUrr12UD1hv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782411881, "uuid": "edc1d927-095d-4309-af04-e9ce98302ad8", "value": 235336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782411881, "uuid": "8f5df335-2243-4468-aafe-36ab200f2d95", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411881, "uuid": "fca5fb45-5fa7-4c8f-8f54-504fd94f0a72", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d21bc4-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391171, "uuid": "e2876e50-0184-41a0-a420-d8e3b9c150e0", "comment": "Malware payload (CoinMiner)", "value": "c59d0913b35a03b8beb220ec4d261298", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391171, "uuid": "9dfde776-124b-41c9-b972-9115c356a3d2", "comment": "Malware payload (CoinMiner)", "value": "6b7f6d33611b0362d7a60dea3e6f75f3745b3ebb9d25285106bc945943b14af5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391171, "uuid": "02a1ef38-4c28-46c1-b33e-d6a762db93fa", "comment": "Malware payload (CoinMiner)", "value": "9e568ddf9ffbcfbab62f61e592c27d18e0cbc5ba", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391171, "uuid": "1003e3c5-78e1-48be-98e2-23013c0177d0", "comment": "Malware payload (CoinMiner)", "value": "12b0027f50d37f2d01e30b21d894b0dd941bb491d92d3d38cbfd2cef327792278e17ea5bee5165b34eae3f6c2f3d02f8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391171, "uuid": "32ab4cc3-cc1f-4656-a20b-1e8308262718", "value": "T12EF533D1D0426FBCC1D7DB3883BC6F28A77A72B90F1449D70699FA502A36EC35920D99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391171, "uuid": "a475c210-9b1d-444f-8739-590a5179904a", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391171, "uuid": "d637da03-7a98-4c8e-b315-48626b11c3c9", "value": "49152:pzEHKu/txkrLUCojxcCX8SoiUC6hfWYlQa6gr27RGbkc6guxFAa6hdEkGjbCTns2:pzEH/tdTknQsYgIpkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391171, "uuid": "a7b593f9-d5fd-4875-a977-860a1c7e5148", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391171, "uuid": "88d41d36-9b42-40ee-94fa-39460ec8fb2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391171, "uuid": "550c422a-c30c-4bf0-b9e0-e7694dfed6a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd5d3d2-7039-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782352580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352580, "uuid": "c49dff26-11e2-48f3-9737-6a510c4521de", "comment": "Malware payload (Mirai)", "value": "11f4c81f4778a9bb98b0bd29568f3442", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352580, "uuid": "34a1b987-4de8-46cd-ab17-7b329a1ee279", "comment": "Malware payload (Mirai)", "value": "6c876f85aac3f9ba5ea1d6533ab19b366e6a7be2cab00e8b3abd607c9b8b09a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352580, "uuid": "b34eedd6-c75c-4267-aa6c-97a10bd52c01", "comment": "Malware payload (Mirai)", "value": "7802c8433b869cc2cb02d8168b8987f808cbd1c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352580, "uuid": "d526aa4a-3274-4091-820e-29dbe9f7e10a", "comment": "Malware payload (Mirai)", "value": "266cd70ac633b7f916cd57e8aa8b01888ba7e922fbdbf1714dd3d0f50f2e8ec7a9a77960fe02c8e4a9bc9ebeb0cb4228", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782352580, "uuid": "ea28e216-4f36-4b09-8d7b-573b1c26976e", "value": "T1A9E34C47FA418A13C4D22779BAEF9245332397A5D3D733068918AFF83F8369A0E66505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782352580, "uuid": "2a401972-dfb2-4f42-b25f-6eb32d1fca10", "value": "3072:rkXhwtLYo4x8UhPrz696g66G07rd97Xy4FHMXDM/9EO5IbL:IXhwtLYo4xBhPrzq6B6G07rn7FHMTM/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782352580, "uuid": "7baa2b07-5f19-486e-8098-86c240544a26", "value": 154901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782352580, "uuid": "68922482-fc99-4ff3-af8e-66dee39b2760", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782352580, "uuid": "552ac89f-8541-48d5-8814-8ce58c777a30", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9c927a-70c7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782413593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413593, "uuid": "55276a54-02cc-49d1-9d8c-05a567aca7ab", "comment": "Malware payload (Mirai)", "value": "20b92adef21f1eb9c0654a491ee6fdab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413593, "uuid": "cd684c0d-7f95-4fc5-9b71-4fbbd00d1b4c", "comment": "Malware payload (Mirai)", "value": "6cb6c35d7d3faab5b65a1ed166984de9cb94031d85824f408adf7a9da868ec26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413593, "uuid": "9d680b19-e997-4214-8061-0e2628dc2e0d", "comment": "Malware payload (Mirai)", "value": "bef5b1df9eecb4af7a5447cfdd0eada8cd72149b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413593, "uuid": "d53ecb1b-77d8-4861-a1a5-76f7f6bd9c6c", "comment": "Malware payload (Mirai)", "value": "464ab85af005f51c4c2f91a004e1d658e2bd988ccd5c46c3fe6ea6864d02a2152a316bba5a79315e2a438bf68f1b06cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413593, "uuid": "7f90c345-d173-403a-aecd-09b8f10764b9", "value": "T1D9932A80F94BC0F5D84358B494ABF33FA730D9541231965AEF89DE6ADA337125622E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413593, "uuid": "7552191e-8451-4b2c-8cea-0aa7d4a0b001", "value": "1536:C9dT1f2eCZ6VCs8Hp16f5HjwNR7ahCh4hBEhgzM/Wb8xG8OzhbLlqdjP:C7SOjHxj2BavYxG8OzlLgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782413593, "uuid": "68674d04-622e-4a9f-83d9-60940cde5eb8", "value": 91376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782413593, "uuid": "86709c71-40b1-410e-b1ff-84cc681a416d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413593, "uuid": "157b05e5-22a7-40e7-8c56-2193ce77781d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c0ee28-7065-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782371599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371599, "uuid": "36675de3-64e3-4c36-b31c-d6eb9ecb34eb", "comment": "Malware payload (Mirai)", "value": "6af22123788ea86f4bf77226febdfb21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371599, "uuid": "f973cd5b-acf5-4e0e-a11e-19f213f33a4a", "comment": "Malware payload (Mirai)", "value": "6d38d8be9058928878b583202c87b80fe8ff66b347e0d325a3c2b956094bfe7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371599, "uuid": "351b8ec6-f404-42b9-9f96-aaea7a8d0fec", "comment": "Malware payload (Mirai)", "value": "d9f6c298ac9ac370673f7ff83e6bc67b7527471b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371599, "uuid": "3b6f4188-005a-4083-be0f-f7b0c414d11f", "comment": "Malware payload (Mirai)", "value": "c29e238892025e71878d262a6e7a3b4b14a806007047780e7df3abe243ff8f7878a3cbef9d3b951764b7aab61fefd3fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371599, "uuid": "2cf62a7a-2486-450a-adde-8699ec2ac0c9", "value": "T16524A6163A22DFFBE55D863007F38A2056D576963AE09746F26CD71C1F2428E680FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371599, "uuid": "68d74ef5-9f90-4225-88cb-bc2c42112a7a", "value": "6144:LusQDMvKqNaXi9iWPrnLv1XnG0l7EyBYmwWZB0:EDMFLv1XnG0l7EyBYmwWZB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782371599, "uuid": "1a84302f-6935-4ff4-b26a-df350fbb6e8a", "value": 211332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782371599, "uuid": "d3e207e7-b1e7-4fb9-b230-9040041411b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371599, "uuid": "0bd48f6d-5c35-4b12-b68f-fa7581539b8a", "value": "6d38d8be9058928878b583202c87b80fe8ff66b347e0d325a3c2b956094bfe7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ec5582-70c1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782411212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411212, "uuid": "b04ae2c6-2040-441f-8679-352c59b12bb9", "comment": "Malware payload (CoinMiner)", "value": "505d448701ef20edd16392e514c71bf2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411212, "uuid": "6e252351-d708-4839-8be6-19261514c11a", "comment": "Malware payload (CoinMiner)", "value": "6dda8bd9e921d845c95831fd24ab7e9172cc2971d3ae6cc5d810e56e979fb763", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411212, "uuid": "fb9a7469-30da-4d01-ac2e-604b5d5c85ab", "comment": "Malware payload (CoinMiner)", "value": "04a397314d80b855006da3a02c41fe510cb2b2bc", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411212, "uuid": "18615e84-3fa0-4f7f-a66f-d564bee81da5", "comment": "Malware payload (CoinMiner)", "value": "74b42abedc42f002a37e2663a8ce9049c030e31399eb78cb7747eb535d8427b53829f329e3b7270a2211428d0055ee2b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411212, "uuid": "f23e46a2-511d-4887-9f00-f2ef65e5fe9f", "value": "T16FD312AE3398B5D2F95F36BA4C4263D25FB57637019607D122883C964AFA123E0C14FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411212, "uuid": "e7f47766-a856-4db9-88dd-9f3765c68936", "value": "3072:nyzSbKrheYTcrX0zd/moBS9MHHKdk/YIfObOZw1DT7ut:nSlrhrT2Eh/mBOnKvHOZw1Tut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782411212, "uuid": "324fecea-d03a-43b2-9c05-698247198382", "value": 133700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782411212, "uuid": "029b702f-b29f-40bc-a7ac-909b28b34fb3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411212, "uuid": "a05741f0-556f-45b3-a0b5-62e25e565af3", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b14c253-70b1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782404353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782404353, "uuid": "4caf7e4b-989b-464d-ba85-fefdb55b1c4c", "comment": "Malware payload (Prometei)", "value": "6f128486bbb5d376b7a8982d51b81053", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782404353, "uuid": "2876ed23-736b-4965-b5da-1259f0fc6920", "comment": "Malware payload (Prometei)", "value": "6f11a9a2051c398162508ef5555deaff226dd2f930d26e8efaa5c02caf56e534", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782404353, "uuid": "245a4817-0810-4179-9aec-1bdc3f1f41f9", "comment": "Malware payload (Prometei)", "value": "1de790880d7aa547654d9ca46f2bf30924578421", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782404353, "uuid": "e06f56ab-781f-4e87-a7ff-ec257c5f98c8", "comment": "Malware payload (Prometei)", "value": "26f00cbbcf7116e6514c3b9567db0f2a34202673742144429fd30f505097bcb51d63333ddb1f3bdba13b0818fc509f55", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782404353, "uuid": "f44f0d2c-4673-4bea-b974-fef526d5710a", "value": "T18531110B39922470088FE87A2795F451B183011F6215DC2875AFB6316F364F8B9FAF02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782404353, "uuid": "118e573e-06c6-497d-b026-271eaf1d3f37", "value": "48:n+3bdCKo/HVjf3N3xPzhXv8/7HNlnu/2Jjp9U3jSLKzlEiQVkiQInWi:cbdB8dlKS8d9iQKeiVixnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782404353, "uuid": "37dd9897-e1ab-4e54-afe3-9edd843860f2", "value": 1803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782404353, "uuid": "94a4e8d0-e0b7-47f5-8a15-ba9e93228a26", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782404353, "uuid": "33e0c532-47f0-4a90-baf5-9b627b8d05d4", "value": "6f11a9a2051c398162508ef5555deaff226dd2f930d26e8efaa5c02caf56e534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e970956-706e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782375341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782375341, "uuid": "e8387606-93f0-4e2b-931e-9e4b3e16e4d9", "comment": "Malware payload", "value": "c8891fda320e99470a0e78c08cec6d1c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782375341, "uuid": "ca828860-7873-498f-99ea-e31ce63e6ca7", "comment": "Malware payload", "value": "709034663bf2f09826b0a981e525c23f747e5703657696954b194c6cb55fb6bf", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782375341, "uuid": "4cb67f12-2dda-414e-a587-7415153d5961", "comment": "Malware payload", "value": "6cc77876fe123836a6e91edaf4ccf982bb1f3d50", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782375341, "uuid": "57f3952a-d2d5-46af-88b2-18591e8534a1", "comment": "Malware payload", "value": "4306e806f2d75caa6d03d5cb879a9f28a3cca705854f3b5f0ed1b419695a8f4b95a536a2823822485bb5d16005392409", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782375341, "uuid": "a95e6dcd-7c31-4bbe-b834-4972744a04fb", "value": "T1D911C082E820D2181713C3D0F8614D0DE5B6D41714A2AC187DACC94D1F23BFC66A52EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782375341, "uuid": "01704024-1284-4b7e-a172-5a4dfd2e525f", "value": "24:SS01aW3rUAdMS8healQuMyawvmAtzETyy08Nk:10H3AU8gay7DV04E8Nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782375341, "uuid": "ac39ac35-943b-4607-98eb-ab1539f25a9a", "value": 946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782375341, "uuid": "b6e1a62c-9d2d-47ef-869b-b40b01c19688", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782375341, "uuid": "02978cc1-563a-4a71-abce-25d25d3d10c2", "value": "RFQ_20260624_PPTX.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c550ee74-7083-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782384667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782384667, "uuid": "2ab8c5c0-dcd4-403e-b694-340f85893bea", "comment": "Malware payload (AsyncRAT)", "value": "f3f5b3f73221c983693a4658a8875fc1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782384667, "uuid": "51828cc6-5ddf-4347-8e0e-6b709dce9ab7", "comment": "Malware payload (AsyncRAT)", "value": "70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782384667, "uuid": "245e90a1-9c91-4fcb-a5f5-bba1f66a3b60", "comment": "Malware payload (AsyncRAT)", "value": "53b4f3493184045d5bbff9de6b8a94b150c6e0e9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782384667, "uuid": "98e10f98-379d-487d-adf9-c1d53c8d45bd", "comment": "Malware payload (AsyncRAT)", "value": "aa2daede732b16854a5777b3b045e72aef7406f5c2d58834cc0147a5f464289cf1c8d31b3138261b836308db6b913a4e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782384667, "uuid": "6daf70bb-3665-4c0a-ac03-34a06dbefd68", "value": "T10DF40228042BC40AE9F56EB11C71F1F5A7B73D9AB238D0296FC64D6F72636087D89325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782384667, "uuid": "88e85d6e-e12e-4272-ab05-fd89c2f5f639", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782384667, "uuid": "da582d76-3a8f-459f-ad9d-43a58ec614c2", "value": "12288:D2LxnupjXgxUf1sOhbrotlBIeSYsJd3Q8mClXi2zGF9fiRWl:D8IjY0otpSY+d3Mr2zGDqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782384667, "uuid": "7fec5a68-7ae6-4402-9c39-4fbc8fac1ff6", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782384667, "uuid": "e0cc6ddb-83f3-4e96-aba7-95c4cd548528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782384667, "uuid": "90dfc4d1-66c6-4f43-afbb-1a643fb59e61", "value": "Borclusu_Olunan_Cekler_Gunbasi_25.06.2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54715378-7065-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782371593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371593, "uuid": "86b5c41f-c2c7-447a-8f19-11b31ce3e130", "comment": "Malware payload (Mirai)", "value": "1918b27456ed35dc8aaa2f7c72a37cb8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371593, "uuid": "0d669151-7b59-4e93-84c3-77f1860fc902", "comment": "Malware payload (Mirai)", "value": "725d1de20672ed85f32e823fe067ed6eb17149019e146bafbbe59338df78e37f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371593, "uuid": "81783286-f4e3-48d4-a2cd-000cb5d2807b", "comment": "Malware payload (Mirai)", "value": "e1072b542f0d6e4b16869232778b08e66422ff97", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371593, "uuid": "e7496fd0-83ac-4dec-80e8-27da66d33f22", "comment": "Malware payload (Mirai)", "value": "86ed16b95aa048885de324daef7baafec668b8d8c3d72c15a10af44bb381cebb7140c9d99220340363e9f4127c5d7ada", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371593, "uuid": "df9e9380-64d0-4712-abfa-dc976631e361", "value": "T1844152CA27560EB02CA3E92B727957CA74A893EB15C5AF2558DF7CF4488ED0C3540A53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371593, "uuid": "3f3ca84a-690a-4f14-917e-c23cf8a311d4", "value": "24:vDVp/DgKsDa4+Dlw+DMpCc4kDoa9qDV1EsDvnDj3DENJD+J+bCoR:vf2kS+24kV9qlzXoJKcbCoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782371593, "uuid": "e2f23868-211f-4564-a1e5-80596fa30620", "value": 1961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782371593, "uuid": "e72ae3ff-5280-4862-95cb-71bb6696d009", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371593, "uuid": "d26a46b5-27c4-4201-91a6-f746c2abf2a2", "value": "725d1de20672ed85f32e823fe067ed6eb17149019e146bafbbe59338df78e37f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd57330-70a6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782399446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399446, "uuid": "354a15ff-0b73-42f4-a882-7f9103fd7e87", "comment": "Malware payload", "value": "d27b618b9b12910706cba840c1b624e2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399446, "uuid": "387e1756-ee38-4544-908d-c1eef630ddac", "comment": "Malware payload", "value": "72f79d17e8b3fddef6800b134bddb0e26b2ceb47dc34a9ce006cdf2a476c16a0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399446, "uuid": "fcef21b1-90fb-4f59-8321-f5bb07e3cadc", "comment": "Malware payload", "value": "4f225f6d903f180d62f6246ac773c60742afb0be", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399446, "uuid": "16308d82-6b5d-4189-8d3c-bcbeec46d97e", "comment": "Malware payload", "value": "64ebac805a0d5fed85e0e99e876c169e30b9ad78665064240b8bc36726505bf473ccc6ad1a23fe711c867fabef6ecc4c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782399446, "uuid": "ea57022e-1cc6-4c90-81da-b6999c3ea589", "value": "T1B331C928B24D7336F89765E432C83E913742DF49B4B8B98DF55A937C809D2196219D30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782399446, "uuid": "bc8e80be-0fde-48f4-85b8-f3167f4b433a", "value": "24:3XtpR0vE9ubjmYBtgE3yHO6LwK9QlQWFhJte+ShG6TvKBvenSTkO:3N0vGITngE3r6L99QlQWFlJSQeKBvaSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782399446, "uuid": "1264bb1b-15ee-44a4-a400-1cac61fff37a", "value": 1448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782399446, "uuid": "e13899c6-6c91-4992-a824-937b47f8cb53", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782399446, "uuid": "1140cb81-00ea-43a3-985d-bbd0efbd457b", "value": "2dfc3df264e5fdd440df3a7466922a7228001af837832252e15bfd17b5343c68.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b92efe-70ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782416612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782416612, "uuid": "1ef918d0-92e0-4c71-b73a-9bf1af39f3a8", "comment": "Malware payload", "value": "7e7553a9861511706f04dd3b66c2250e", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782416612, "uuid": "a476f58b-1b19-480c-a5cd-8f9f3aad9c69", "comment": "Malware payload", "value": "748e6893727100c5efac1ddab664694b92c73e3b57769019d411712bebc7cae0", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782416612, "uuid": "f9b03ca1-2f75-42a2-a484-9bb25e851fa2", "comment": "Malware payload", "value": "62e7e7f614978010db3c677e2f9838f8d8af0a46", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782416612, "uuid": "c06892fa-7eeb-408c-b001-e35c3c4bb105", "comment": "Malware payload", "value": "0fe678208cf4885f61fdda2e8a0355f956f66020eb209dea546c97d16abef62c4c308754d45c03faad42a99d5660c56f", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782416612, "uuid": "702d9a44-a33b-4a37-b136-a3dd05cc4061", "value": "T1BA346D3BD5F14AF9C862D274CE6A41F3A97AF4A80029E1173271ED327D36B60E32C655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782416612, "uuid": "380f83f1-d81c-443f-a3f7-be95dc4c87f4", "value": "82fa71ea0266137cb2ecc5fcd1539957", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782416612, "uuid": "d50be032-b387-45e7-b97c-f14b2382754f", "value": "3072:pJSnPlGU4y3sEGDppWmMJyo+Lbf0lZYUuQXE8m1C0sKxUqhaovZ8OmoQvy8mulD9:pMM/E1J/+f0LfmsoKvVOQTDubeuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782416612, "uuid": "04045c34-c6cd-420d-a043-9a798fe3c7e3", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782416612, "uuid": "1e48337c-6af4-45ef-a3c9-d576844024c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782416612, "uuid": "0acea00b-b4c3-4bea-8ddb-4f4516fec3d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc73fe13-70c0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782410852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782410852, "uuid": "65b85b04-8ee9-4f17-bd28-770b9f115178", "comment": "Malware payload (Mirai)", "value": "0c9ee6dd268747b53a1cbc30565cf553", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782410852, "uuid": "7af78463-62cf-42a6-8a3b-5a60bda29990", "comment": "Malware payload (Mirai)", "value": "74cb6feae802d1a3c19638ca65fb255a6debb384602181af65671c2faf5a3746", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782410852, "uuid": "73941f81-7195-4e30-98b3-206f036e2cff", "comment": "Malware payload (Mirai)", "value": "9b4b3ea96a42dbe097ddf237442a7a790053f6c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782410852, "uuid": "8ccb65bc-fc22-40e2-be18-ce4e8ed9ce61", "comment": "Malware payload (Mirai)", "value": "6506e067cda71824993528b03a74244918bfe13af364a64022f57eff093cc8533e6c77a72abaa9d261e17c3ee7130436", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782410852, "uuid": "05e9c0f8-9407-4281-8df9-83febcff3d14", "value": "T128341A45FA418E13C0D627B9FA9F82453333A75497E77306B9286FB83B8679E0E27501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782410852, "uuid": "30cd5d67-387e-42ac-b0dd-597a7136d21b", "value": "6144:NKjbYCCKcnKIy8arpiHpATcxkG3nOhr2nZM/RLZM:NKooIy8aFiHpATyNewnC/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782410852, "uuid": "666af804-0f65-4ab0-91aa-755485a32f31", "value": 235231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782410852, "uuid": "d8763907-8e17-45ed-ba0b-c43bc6b31fbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782410852, "uuid": "701c757f-79c1-48f4-9935-7fd570dfbaba", "value": "onie_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c831b4d6-70db-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782422468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782422468, "uuid": "3033decd-bb03-4cbb-8016-2c8a9b940650", "comment": "Malware payload", "value": "4c4ce66669361939a413e7ed55ea62d9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782422468, "uuid": "11d03c7c-caa6-402c-918d-d95f5e432ece", "comment": "Malware payload", "value": "7560867583f5aac374e6050679555bb7e3aed14c6918f2f499f21921f0dab4b1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782422468, "uuid": "a66850a0-2dd5-4ad6-9f67-362424d22fe4", "comment": "Malware payload", "value": "57d393e87fa373de6a82ed2e69bdb1a67c19e7bb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782422468, "uuid": "09d5d236-0cdb-4c6b-b420-4af0a3078d3a", "comment": "Malware payload", "value": "06d0e048ef081ae0db367a0dca349a2c21fa886ba00e442f2148f1464ced2216af203f5592399235706a8f69ec3dc4b4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782422468, "uuid": "6d43a0ff-1acf-499f-ae73-38f5ef91c2aa", "value": "T10B38332175858E27E24FD83B9559DE2F05757E630B3282C7B2F5B92B80F1DC1A2B8613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782422468, "uuid": "c42ce973-457f-4b96-b7d1-522ab51dfd71", "value": "3145728:4Qio/AgGfW1zUq3EIlnVPpmZxC9xVEJ4NVYRoID1W3RZdrDT:41KUq3EIMC9AqN2XwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782422468, "uuid": "2d2a90bc-0f6b-48ae-8935-085cd08caf92", "value": 104568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782422468, "uuid": "2880059c-e11c-430d-ac25-b1e1b817fced", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782422468, "uuid": "144b33ad-68f0-4f27-ab5c-a0b39b991a0f", "value": "Motrix.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94da3890-7093-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391458, "uuid": "ac71811b-a82a-4702-bf29-ca3d3f1919e9", "comment": "Malware payload (CoinMiner)", "value": "73a752c08b30f2deb6a7c5ad3dd55c75", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391458, "uuid": "40f9bf3d-1b15-4ed5-862a-281ac2570e0d", "comment": "Malware payload (CoinMiner)", "value": "75bc2baf3c12afbefb893af00d361d6d66273d7852d8c0f16dce28e01293c3ff", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391458, "uuid": "67cd441b-564c-4954-ae88-c37f4fd120dc", "comment": "Malware payload (CoinMiner)", "value": "3d1aa738506f4344f6ced8842df6c0e156a8b58f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391458, "uuid": "64d490d9-980e-467e-adbe-398c2fde0baa", "comment": "Malware payload (CoinMiner)", "value": "011b905dc79b5ff6e4859025aba3736bd0e59aded13b5f099c259e801daa0c3253925ed25eb0b5eea249aa370e6f8706", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391458, "uuid": "e6e72854-a098-4eaa-bc35-a7bbec009a21", "value": "T1F3F533CD051693FDCAAEC4BD5A5E9F60011E225C8B750ACF79E7E834E9398D01E361E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391458, "uuid": "21265f06-5a46-473c-ba64-4a192e6d5134", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391458, "uuid": "f18b0cea-5961-48b4-b300-82e3d1c81eeb", "value": "98304:gnaLyHtykI2oRVUXdkzmKiEzFTbOQFSuFwrFi:yPIPR2tWNguF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391458, "uuid": "4abf55d9-d5b2-41b3-9c00-2642f75dc15d", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391458, "uuid": "7411cc98-021c-4b3c-bb2c-b7b11c9ea23f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391458, "uuid": "83b0e067-d7e0-4943-b2f4-f8346615c1bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4c45ef-70aa-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782401510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401510, "uuid": "d1b90147-2388-4bd9-a530-4aa380dfed08", "comment": "Malware payload", "value": "6ba7ce12b6c5888a6f842ebc3e5f336c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401510, "uuid": "ab54d74f-c993-47d3-86db-f8344b39f0dc", "comment": "Malware payload", "value": "764a1156c9f370893136fd57a9dc7f9662be521c7870332a43ec88c6fd1ff4a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401510, "uuid": "eb525189-8ded-4701-aebb-87196a9b0777", "comment": "Malware payload", "value": "d893cdae751e7805d8a355dcec97bd752949da84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401510, "uuid": "9d9d5222-0f07-4eab-8858-9b7891b06baf", "comment": "Malware payload", "value": "3ef373b885f93871b47ce7942386e7230dfadb0d4310ffeaf90cc1f2c6ff5c0441d6d7ca1bb18389bf66e1338a0ccd44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401510, "uuid": "2bd60105-1c17-42c1-884b-f08e0f6b1be5", "value": "T13C65BE9C3611B5DFC867C972CDA46C74A720686B531BD203A4D319EDB90EA9BEF041F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401510, "uuid": "405bf5bf-db61-47b5-b0a1-eac4b6e30a22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401510, "uuid": "c93361a4-78f0-49ae-8d9f-b4596a106865", "value": "24576:C24ak+W6aIezTcsrRWjw5fSCP5v9hfZx5mu7t9WQRXk2PSFmEIEWq5ZLLhJ:Q+W3IeTRWjSKEzf5rt9WS02SmYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782401510, "uuid": "a7b09a55-2da9-4862-bed9-c4c8e9f4ed8b", "value": 1538048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782401510, "uuid": "c86afd3d-291e-4b63-a58f-6f8764180da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401510, "uuid": "bb9b147d-6d3f-42d9-86fb-74edcdc10a73", "value": "SecuriteInfo.com.Win32.MalwareX-gen.63536637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d77832-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "a0fd8c4d-1b55-45e6-8d97-2639df0ced60", "comment": "Malware payload", "value": "118e1b18bd8ba7d4b3e41bfaef1f1637", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "f716ca82-e74c-420c-a224-bc7e682af822", "comment": "Malware payload", "value": "774d3370e0cb61a6c32cda22548a065707cd249a294daa99e6ce8cd6745008d5", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "d05ea072-3898-436c-a22b-a45c6e1e2a40", "comment": "Malware payload", "value": "cb6a6344c8b83dbf03cac114316e1bbef7165274", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "496e2f21-c26c-4867-a37b-b6c68ec03137", "comment": "Malware payload", "value": "3547df0970655fef67738833903181cc51132f2bc984a720b73c4b91cdaac84928690a0e37cae0ac91a5e2715f81c341", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "bb4afc00-e06e-4c8a-a721-4f7fbc486997", "value": "T1738533DE3C5C026601CACCB96F19E2692DE5C3A1F4F211D61A689C7DB80F941EEE7207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "88bc2ed6-44b4-4ebe-9c6d-cbe962fbbf4b", "value": "24576:c5Hbp8hN6J8NlsvN91ii6qGs7JTPcZHIhkDOCaTJ59UiXA9wFaRZDIsthT9ILOVW:cBbp6Nnsv71+qGEcCkEOhZUcW/wO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370706, "uuid": "13efa534-2d68-409f-9328-95fd709c212a", "value": 1727104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370706, "uuid": "fac56d9f-137a-4a73-ac35-4945b01d1d48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "d26f62e6-bfb9-4fe3-9172-1e7e94b96e43", "value": "rcuop_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c4cd15-7053-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782364111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364111, "uuid": "25e28436-b7a6-498b-b690-3a9140e6c1a4", "comment": "Malware payload (Vidar)", "value": "e9ed8e24119ccbbd51f18eb58f5e7db0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364111, "uuid": "e9809c98-45bd-4676-80a9-2cf7b639cda8", "comment": "Malware payload (Vidar)", "value": "778ec9e6e0eb33d0e6f0ca3fc56f58f3e6d8c583e2a14e0add906b426d7092e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364111, "uuid": "2f1c8184-a60e-4e4a-b8fa-b3f428728812", "comment": "Malware payload (Vidar)", "value": "ac50efdecc5b5e8074e7b935b7ef3460b9705e72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364111, "uuid": "c317dfa5-ea2c-47bf-ac5c-0ba371165f27", "comment": "Malware payload (Vidar)", "value": "74239c5026c25bcfb28d7ad9b139da47cdb59034cc39a2d86abf56eb8e625cd2ad329056916da2833e3f5f56669d2354", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364111, "uuid": "4bf71d80-9cde-4d15-8691-8865b16dcee0", "value": "T137B51268978BE5FAC19D4130625F4BAF3AB1859D47A1830AC3268C6E2CC3FC47F61E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364111, "uuid": "c6c6d8aa-e114-4033-95fe-74acda5492cc", "value": "49152:t8hL6rEqEuTfr/bFQwdhKCZfmVHnSYAYJ:6x688fr/JQcIyfmpnSkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782364111, "uuid": "6765a7d2-2268-48bf-9478-bb076bb22416", "value": 2436427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782364111, "uuid": "10d8f56c-de23-4083-8ce8-af0fbb52be70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364111, "uuid": "93d92f66-78fe-4d57-8c0f-e1bee63cd35e", "value": "setup-1.5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea09420d-70ad-11f1-ac1e-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1782402768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402768, "uuid": "b667a141-e935-4094-916d-3bb91a50fb0f", "comment": "Malware payload (DarkTortilla)", "value": "6434db989785abb5ce2088e34915935f", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402768, "uuid": "e9695e15-27ab-4963-8c61-12dd1d56e04f", "comment": "Malware payload (DarkTortilla)", "value": "7791be7f06e67cfb2e32c1f709b8bf8afc5f354653d1a2074a47e80d8c04ff49", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402768, "uuid": "a64b088c-c3ab-4c14-a789-81666ccd3513", "comment": "Malware payload (DarkTortilla)", "value": "88c44f87b0decd5d91759514ffa7e4abd7c42471", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402768, "uuid": "245f08c0-b595-403d-bb86-964fb33c090a", "comment": "Malware payload (DarkTortilla)", "value": "bbc1476e24d6a81227c19df894569ac04cf2276c40985435c70d0fb2b71e2a41d1147f16026c676a3814cfff56eb13e0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782402768, "uuid": "59847ab9-9fed-44dc-a462-d85276e93881", "value": "T10605CF2559132B07C23D2F79C0372DD853FBE6424166DF277FE862E859AABC1CA47A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782402768, "uuid": "d2ea2efc-a9b1-4782-bc80-d44bb7988a8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782402768, "uuid": "591a35d3-52a9-4e9f-a45d-a4bcf09a33ef", "value": "24576:Qsgs6KOi1c8/ZwQoZntN9+mMPYldT0BrV+c3:vgLzSc8ebzN86gV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782402768, "uuid": "99111345-02c5-4160-bde8-3ba1ac08a011", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782402768, "uuid": "b885dbb7-55f5-4ae4-ac4c-1d698908d908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782402768, "uuid": "a4629d4e-0752-4df1-b603-fef707cf66d2", "value": "NUEVA ORDEN DE COMPRA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41060ece-70c8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782414081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414081, "uuid": "1c4bf036-541c-4042-bcb2-b66b6f3c9915", "comment": "Malware payload (Mirai)", "value": "542eb18cbfdee2cc408926442edb25c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414081, "uuid": "06ff3bf4-928e-4b04-a7f2-798e1f81348e", "comment": "Malware payload (Mirai)", "value": "78f97b9fd21f5f3e7374eaefa1b2561680c2ec92d03211164b3bd95ae084e062", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414081, "uuid": "be8c07aa-530c-4574-9c4d-3d0dbee6187f", "comment": "Malware payload (Mirai)", "value": "f837146f6ee43890ed3607ee3d1874bdbf005003", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414081, "uuid": "986f3bcd-404b-4301-95dd-42b293cceb08", "comment": "Malware payload (Mirai)", "value": "9158f6d5c1bc56a3064153fae1a9d6b193ae65c23e06c7062234bb4e2012fff7873d530e7ac76144752881c1047ac9c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414081, "uuid": "0196b638-58f9-4dec-af6f-3a0f817d7c66", "value": "T1ECB30945F8509B17CAC651BBFF4E438D7B2A1758D3EE720399256F60378B86B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414081, "uuid": "f363dd75-a3ff-42d0-a362-f8f2d1c4011b", "value": "1536:Bk4J5CZVr7v1W2325CSR4Vj/QjTudurcXO/wjtv0JjYJlV2wywDPJSMwfVvs4OO1:KQ8DrbA2344dQj6daUxv0ZSPRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782414081, "uuid": "9778dff1-1fe0-4430-b011-25d2cad099f0", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782414081, "uuid": "7ac04927-f90e-4c39-a80c-c2a6627a40d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414081, "uuid": "8b0d7bb4-fe34-4196-a28b-8f2d0e870f40", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbdc8393-7089-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782387255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782387255, "uuid": "460d7d00-3440-44bd-93cb-0c88d9a5c9fd", "comment": "Malware payload (PureLogsStealer)", "value": "36d12fd64512e49ba6848028e54a21c8", "object_relation": "md5", "Tag": [ { "name": "CHE", "colour": "#910C17", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782387255, "uuid": "64e618ab-481e-4e03-9e6c-8661499d30cb", "comment": "Malware payload (PureLogsStealer)", "value": "79507c5ec1f7c1fa1b94cf8b5ce534fe1634b8c44f3ebee7e86e1da09ebf84f0", "object_relation": "sha256", "Tag": [ { "name": "CHE", "colour": "#910C17", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782387255, "uuid": "518564c0-12a6-419e-b807-c3ca166f4c6e", "comment": "Malware payload (PureLogsStealer)", "value": "9285103080dd2d7c1934e0457039f5c7d11b8caa", "object_relation": "sha1", "Tag": [ { "name": "CHE", "colour": "#910C17", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782387255, "uuid": "4b049b60-9d0a-44fa-84be-d10dd4189c8c", "comment": "Malware payload (PureLogsStealer)", "value": "3fd763c8e90479e96049b5848cd0bc77115ac7a0d6c4c65d9c9d8972810021b99e6e7c15dfc5f1350b06db444b531f78", "object_relation": "sha3-384", "Tag": [ { "name": "CHE", "colour": "#910C17", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782387255, "uuid": "d66af44b-3bfb-4d75-96a7-62992d7e37d2", "value": "T1C0F6C525CBEE20E6D0973E0426DA132611317D589E38EC45B128B63F95DBC2E64FC7A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782387255, "uuid": "63c020e7-4e5e-48a9-8c16-dbcb89cd17c2", "value": "768:tCZ3QlPDPiKOjf+hG1ukvcq2RKUvxx3Op/qbA6qzu5Yt+Q6Ij+ch1JmIndliipim:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782387255, "uuid": "2d9d0763-ff85-49e0-9c20-3031f0e42f87", "value": 15581290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782387255, "uuid": "5085ba86-5135-4c69-a053-b57e2cf7a609", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782387255, "uuid": "c9450976-094e-48ea-91f9-84f295b82ff7", "value": "RE-690215-374880 Rechnung DE4917602.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c5cb4c-70ad-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782402432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402432, "uuid": "55ae7523-36e1-4cbe-9bcd-bb7c7763bfb8", "comment": "Malware payload (Prometei)", "value": "a13cff29e34dd0decb4e7468d08f5f22", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402432, "uuid": "522a1964-6df9-4729-ad62-fba5324e36d1", "comment": "Malware payload (Prometei)", "value": "7b61a0032297d2b400d3dd5e69556a8ca31adb717464c247aaf997f4b4de26f6", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402432, "uuid": "6a03b4c9-d6d1-45a8-bc7f-66979558ea5d", "comment": "Malware payload (Prometei)", "value": "65c6f6e54f390645dd4fd8fb8288449a463a1631", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402432, "uuid": "909a5a3e-f20a-440d-9b33-cdda0eb84cd9", "comment": "Malware payload (Prometei)", "value": "4b5d86ed987e1eac57fb2f6de775ec51e9e580906536637747d99c9300de60246aa729626d08a5d2d66434f83f22d164", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782402432, "uuid": "e51a6a37-8e04-4e14-9b6b-073159db1f6e", "value": "T1DCC08C6E2513BC4CC663217422C364A0C08E93A7A5AA82228480805331CB29A8AC7396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782402432, "uuid": "21bcaf5d-3459-4c46-a12a-610ddf8546c9", "value": "3:qVoB3tURObOb0qHXboAcMBXqWrKb0GklIVLLPj6DlZ/eIwcWWGu:q43tIkObRHXiMIWObtklI5LPjqeIpfGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782402432, "uuid": "327b370c-f7fe-4bf9-9cd6-3c4ba3b3dc34", "value": 162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782402432, "uuid": "54c12dd7-8dee-4df2-b43e-a65d2a5f265a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782402432, "uuid": "4c047c9f-0508-4720-ab00-f16d79ad3397", "value": "7b61a0032297d2b400d3dd5e69556a8ca31adb717464c247aaf997f4b4de26f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a6ffae-7093-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391520, "uuid": "a46b234b-85fb-4378-ac43-f473464912a1", "comment": "Malware payload (CoinMiner)", "value": "85267c0d6cf650bb021dbe0d1486c15e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391520, "uuid": "e401c88f-08c8-45b1-99ae-a8158590ef34", "comment": "Malware payload (CoinMiner)", "value": "7c82302ecd14f21edfceec918d47b51b5d4bc1792cf77bde61527111d8fdb56c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391520, "uuid": "376a8444-b9f9-4130-8390-fd2ac408fbf8", "comment": "Malware payload (CoinMiner)", "value": "69524b859ca899c87246d7de2d1c143328f7d8d9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391520, "uuid": "270ee312-dc42-4241-97a9-87e591ff4733", "comment": "Malware payload (CoinMiner)", "value": "be67272d0492ab532bc52fa71bf408a37967789958b73ea7a12f8e51b583ef508ea0d543ad9f2100307fb0e64190fa62", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391520, "uuid": "29e82d16-ec2f-4bf9-ad45-087440b45a6f", "value": "T1E6F533C9708438BCD7EDC5B9D3522B6972FA3513CB023CC799FA55A2220BED21932E55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391520, "uuid": "60d5fbc9-55ef-410b-965d-73ce05b0c2b5", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391520, "uuid": "7d559b3d-2a32-4442-81fc-2da875cb3ec6", "value": "98304:VVgfL/GKqEr2vkOh4fKb0DLlxbXqv/gMsW+:rgfL/GK7r2v/8Kb0DLlVXyYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391520, "uuid": "0c7fd49c-27b0-4875-b6d8-b8ce374feed9", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391520, "uuid": "eb879c90-8478-44b5-b2b3-0a413dfeb713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391520, "uuid": "0234f443-953d-45bc-ad68-a9e9f8723fde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260f17cf-7035-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782350899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350899, "uuid": "485e6ff0-3b35-420a-9530-e4b73e376a88", "comment": "Malware payload (Mirai)", "value": "968d03ed4ea22f0010826c271cfa34f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350899, "uuid": "afd5aa90-4143-4daf-b534-238fc92479e5", "comment": "Malware payload (Mirai)", "value": "7db97598eb3c11ab87d56215afc4f053d0db5064d97376cc6278d6af739a2e27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350899, "uuid": "2ab93c3c-d8af-4331-84db-3348eb095792", "comment": "Malware payload (Mirai)", "value": "265bd397ecc7a763d2168a2f9286ad80cd54698d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782350899, "uuid": "9ba74e30-2eec-4b9c-8fbf-488693da3397", "comment": "Malware payload (Mirai)", "value": "68622053dcbb33978fe26fcc365c80fefffa3b7ae321930e2b85ab3a09d6522f43f6b1c791b030c95f60cb24454c638c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782350899, "uuid": "244ee6b1-4c4d-42c5-b1a1-be7c3c77bf9d", "value": "T1A4432A05FB47D9F1D89359B0516BFA3A9A35BC715120D92BE7D0FFA3B9312C2A005329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782350899, "uuid": "432a2dcf-36e3-41ba-b9af-a27f87c8df82", "value": "768:EZZ3t41yZHn2cPGRNNmrds9zddHZxo827KnkXP94plmrq:cZ94clRPGZMW/5R27Ki+m+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782350899, "uuid": "f6b5c4ae-3b1f-4e8f-8acb-898e80bb98b6", "value": 60132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782350899, "uuid": "eb4caad3-da7a-47aa-a0a5-496c7d01faaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782350899, "uuid": "f6edc6de-7ba2-4967-a893-083360b9f54d", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3954988-7074-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AdaptixC2)", "timestamp": 1782378222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378222, "uuid": "021dd102-2c45-479c-b33b-5baf5638e612", "comment": "Malware payload (AdaptixC2)", "value": "a2f47118550285e90517345545e3061c", "object_relation": "md5", "Tag": [ { "name": "Adaptix", "colour": "#915EF9", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378222, "uuid": "11e1cb7e-7c7d-4fb0-b673-b88cb5be2509", "comment": "Malware payload (AdaptixC2)", "value": "7df24f93af9945d9917b46d5996853604603836b08fcc1a730e8f72b99b52537", "object_relation": "sha256", "Tag": [ { "name": "Adaptix", "colour": "#915EF9", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378222, "uuid": "5bc811fd-fa7e-4b47-8e04-56e39dbba91e", "comment": "Malware payload (AdaptixC2)", "value": "3da045844ab2286de615b8e0ce9e8af728d0feaa", "object_relation": "sha1", "Tag": [ { "name": "Adaptix", "colour": "#915EF9", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378222, "uuid": "595a78fa-8d50-4568-a47b-d13030fc8364", "comment": "Malware payload (AdaptixC2)", "value": "389ec32d9cf628bf0f5fded3faecc998d784198303944318ebcb8e1b301b378906c6e9fb5b9550377a8b128333ae0ea9", "object_relation": "sha3-384", "Tag": [ { "name": "Adaptix", "colour": "#915EF9", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378222, "uuid": "95225218-8b89-4632-8210-c9f203c25441", "value": "T16BE49E4EE7E514E5E07B9278867B420AE6B3381D037096CF12E582693F23FE5A53DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378222, "uuid": "7d7df170-0c21-4722-9821-ff9cf0a87212", "value": "f48fdd4441388a3ee83c81ddd1afb1a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378222, "uuid": "3b9b507c-f2d9-46d8-b653-7da1bbb0e9d3", "value": "12288:u2bqoYeb3buHBGmnDqJ4aXxB0+K2gqH6/LAPRjaPJsb4FUPhPmyIg6dcSjA5zekU:uZeb3bSBXHgxSygqH6/LAPRjaPJsb4Fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782378222, "uuid": "1b9108c3-f8f9-49f2-8072-606eaaeab509", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782378222, "uuid": "bcd382c8-21b0-47cd-84ca-dfc5f4dbac00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378222, "uuid": "005da258-3ac5-4a0d-b7ee-1c3ac7b222ae", "value": "7df24f93af9945d9917b46d5996853604603836b08fcc1a730e8f72b99b52537.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52eb2ab0-7058-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782366007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366007, "uuid": "e39142e4-c864-4deb-8adb-607fc46fd7c9", "comment": "Malware payload (RemcosRAT)", "value": "1f2584628e8d257858be7ff3c56dae0c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366007, "uuid": "0092e4fa-2c31-4114-b8e8-048ddfddee0f", "comment": "Malware payload (RemcosRAT)", "value": "7e29c78e049023a3759f246d5e56e947a04dc66881a84af5441ee17a47c146f8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366007, "uuid": "26257e70-f61c-4e45-8150-e551521e5610", "comment": "Malware payload (RemcosRAT)", "value": "4a8a3b46cae8dbbdf475527485048b231fe9ace2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366007, "uuid": "ca4260c8-8c89-489f-b920-7da9a0798627", "comment": "Malware payload (RemcosRAT)", "value": "5a3cf972364c5381f1b851be71be39d112ef572f8f1a2997679c863894c22d6e49f3e53eeabdffe84aa1aee7d6575854", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366007, "uuid": "9cae0c17-87d2-4bd7-a201-30f9c321e516", "value": "T1A6A32870DA2101770F87BB9CBCA40661CAADD3148A2755B0F6D9870D900ADECF77D6AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366007, "uuid": "8221685a-7e90-46c7-96f5-c274d779e017", "value": "3072:lqnndvSkP9nO4AcNGRdBA49Igg9g0QU+Xm0b1EU:6nYkVnOZcEmqIgg9gl7Vb1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782366007, "uuid": "5cf55603-57ef-4529-a0a1-aca1143b7088", "value": 101499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782366007, "uuid": "9799071d-44d8-474a-9417-970abbce1736", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366007, "uuid": "0a635ef4-7b69-44f3-a5ce-1ce842acd5ce", "value": "POGENINC2026-06-25.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99e8605-7037-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782352033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352033, "uuid": "39135580-ce01-4d46-89b4-ec6fcfbd152f", "comment": "Malware payload (Mirai)", "value": "b0c0e3f09a3907b57db92631ec13d2e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352033, "uuid": "32429fd0-7047-47d6-9a29-aa3eb6d62c15", "comment": "Malware payload (Mirai)", "value": "7e65fbe7ff6d5f92090ea2df29477865a234018ec043920471e371fc70fe3ee7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352033, "uuid": "0cbaf0ec-b1b8-462d-8ad9-63958682a997", "comment": "Malware payload (Mirai)", "value": "6bb386d2e6bfdc02cdff81ab9df678619a8cd058", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352033, "uuid": "04c104f7-6609-49ba-96db-054c36d74928", "comment": "Malware payload (Mirai)", "value": "8d6cf2bcc64f41796ccb376271ac0c98ebdd3658eff23a59388dd80f485f0fc8245e1fe075b86bf6d996059c782d1441", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782352033, "uuid": "594510c5-65c2-475c-88f6-b21ee043ec36", "value": "T19A73F750F94784F5D84368B098E7F33FA630D9585231E65FEF9A9B36DA33B0A521224C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782352033, "uuid": "748edfeb-e2c5-4c62-a66d-006c0c2882d1", "value": "1536:LDQTDHEbkwPyDWQ35/qZyEp8HhTVhXhA4hO9X1b7VTLRMx1Sq5Mr:LetB6yEp8xiF1b7BLY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782352033, "uuid": "7bac2bc5-628e-40d6-bb68-ee97c1093c6f", "value": 74704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782352033, "uuid": "3f7a0a5c-c30e-42bb-bbee-045c6c472f29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782352033, "uuid": "4b17bbf8-e0de-443c-bc27-1cfb53a95ed6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd321a71-705f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782369192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782369192, "uuid": "ae7f6785-4610-4a1c-8116-583b145152fe", "comment": "Malware payload (CoinMiner)", "value": "cd6e94bbc4646f9c7d4d8a8aff3d032a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782369192, "uuid": "228361ba-6670-4a6c-b58d-100a31f85c5d", "comment": "Malware payload (CoinMiner)", "value": "7e75768a3114cb8d557cc787ca0c9d264c1fa4caa3990e7c3c399d2202f50fc6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782369192, "uuid": "538d6b67-5d97-479d-a7d0-21eaefb079a7", "comment": "Malware payload (CoinMiner)", "value": "a918b0c55d6604659ecf3c2018f60d308d654402", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782369192, "uuid": "f29a70e4-41ab-42e3-9279-42079899a7db", "comment": "Malware payload (CoinMiner)", "value": "0458ad9ca4fcf5729d7ddc6da9c62a3ee2ba81600dae0d5f3363a82e3c5cb48a9f682337fcfeddd8c0c9b938ff7c6710", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782369192, "uuid": "749494b1-84b7-49dc-8fef-dcdbb47778c4", "value": "T107369E07B90F3C12FADAFB7C5F4BA36276277891D23680767A65820CD9C36C8C6B5950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782369192, "uuid": "0f355de2-a2ef-4f77-89ea-92382e7a8e09", "value": "49152:2j/T1OXk3ZZmL3wWvnhFV+xB74/7gno/EnxcZSct8rwen6mmB4lP/s:29OXkzmL3wWvnhFV9gqezCOmB4l3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782369192, "uuid": "ffa76ae8-0a11-4ec3-adc6-c13e1d4c7bf9", "value": 5102280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782369192, "uuid": "650bfd7c-3ade-4cc2-b149-70d2ec1b42dd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782369192, "uuid": "97a6ee4f-bc9d-4747-a44d-40ad305fcef5", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e5e7b1-704d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1782361506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782361506, "uuid": "f7fd0113-f378-4c5b-a113-153c383d63af", "comment": "Malware payload (RemoteManipulator)", "value": "744c291f1af31190766580c630d0c032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782361506, "uuid": "7e919b13-e638-4135-8ba0-089199ea2b80", "comment": "Malware payload (RemoteManipulator)", "value": "7f01a05055ec07b287de38a6e92f2a04dc512fe1b6972c16e2412ff27c53ce6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782361506, "uuid": "df965f45-4a67-4b4a-9441-d525da5e9d8f", "comment": "Malware payload (RemoteManipulator)", "value": "23f1bb7c643902b3b00b41d43a04ed3fe3b84cf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782361506, "uuid": "0f112319-763e-4bd5-a33e-2edb638142fd", "comment": "Malware payload (RemoteManipulator)", "value": "36b83e49a3367428bf3225776075751e7b418628c4197ffbe7327fd0edd969c9758c48c0939412cde9354d91bc4116b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782361506, "uuid": "ae2a8d60-990a-4a25-988f-6b60c05627b0", "value": "T1E3171227B384693DC4AF1B37497787145A3FBEA169038F4F53F5680C8E396812E3A646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782361506, "uuid": "02860024-4407-4a5b-9b4a-20c5111f6424", "value": "6ce4d8f9b917fabee4acaf8bf0692ddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782361506, "uuid": "c1efa490-b92a-430b-97d9-d321543c4ac8", "value": "393216:2SFCrFhSz35h3tDYUswv53Z8WJ09AEjgKV+ACUub1GRygHT:b7zf3V7v5J8wE/+/UuZ3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782361506, "uuid": "f07d18ca-73a5-4e72-86ac-7812ee6538fd", "value": 18667632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782361506, "uuid": "b5743167-2085-42cb-98b9-5640a38b9ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782361506, "uuid": "43c389d1-6b26-4b36-8301-d6d84b9a8a0b", "value": "744c291f1af31190766580c630d0c032.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3af9a4-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391202, "uuid": "7a796182-2056-4fc7-b163-47469df2321d", "comment": "Malware payload (CoinMiner)", "value": "a37e2db02cd6a1a6da7ccc124cc3d5e6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391202, "uuid": "6100f7a9-5496-4ea2-92f5-521baf7d2af6", "comment": "Malware payload (CoinMiner)", "value": "7fc84a19ee1029403baefd2f0c58ab6e55dfc346e759157a7fab4fd5cc397c4e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391202, "uuid": "891bc034-0350-4530-8ae9-4898871dfd37", "comment": "Malware payload (CoinMiner)", "value": "aba52b1f50bc5f5eff66528241f104a65f06b7b1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391202, "uuid": "fbeeac41-65bf-4c37-a0cc-fbdc07005f7c", "comment": "Malware payload (CoinMiner)", "value": "74cb9eecb2220441ee50323068e2b1d1a538a3a4a10e19bbb9fe2e4225507ffe9b363971d8308cc563d59ec5e373cf30", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391202, "uuid": "b27999ed-076a-45a0-b1ce-5b4d4c4d1d60", "value": "T1B1F533D691817AFEC157C174C33E9B62503B14A24F162DDB62DBB9088A2FEC06F36E15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391202, "uuid": "d8a1fb24-848e-40c4-8932-c834ea2ecf94", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391202, "uuid": "3ed9c2da-4a75-4283-84f1-d67506cc49dc", "value": "98304:bnV4lsQ/1+eRUTt/hjmUuXqpv+Fr+2ER6b:6ll/zRU3v42v+FZIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391202, "uuid": "af35b47d-d99b-467d-8955-c62d14063c32", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391202, "uuid": "c9e5adc4-801c-41b6-99b9-06e436fb0b24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391202, "uuid": "326660cd-e069-4790-a6f0-26fd1924ebf9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bca8dd-70ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782430383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782430383, "uuid": "6f6c690e-0b1d-4947-aeae-13fbebddc43c", "comment": "Malware payload", "value": "32ed7165f0669ea31d55edd043d8d800", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782430383, "uuid": "df1d49f3-66cf-462a-886f-2032417b1847", "comment": "Malware payload", "value": "80a122d55b78572a2c1ac2e2ea62884177f6ef34d1794b2219c7d74a0f03eaa2", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782430383, "uuid": "de481c82-af21-4b35-8a50-4d73d2839cd9", "comment": "Malware payload", "value": "daf93b5166b67547d9082df28bd51ddbdb14233c", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782430383, "uuid": "0bdec288-3310-409a-a307-a94775afc87d", "comment": "Malware payload", "value": "bd981805763a980ee26717e2c42b41350d9c2b2e678ec7c9a3e6bee5c0e673e9329eddc6d6ed667e5cf6b9b0feeb4eb3", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782430383, "uuid": "d46fabc4-2884-4b81-97f0-a6f303fb0b7a", "value": "T144F58C07BDA148E9C09AA33188B6529A7B75BC580F3127E72E90B7782F777D05D36B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782430383, "uuid": "db71b584-ca1c-4bd8-a05d-1b4331b77cc6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782430383, "uuid": "d4747163-978b-4d32-ac16-6fee7252abae", "value": "49152:nmNLjLUgbJqAEzFsvMPueGNuAsp2oGXL4GYj/cMCKBmLgvYARLBqvl7/P4nbj0um:noK5qaGX/YVBs8PbYuYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782430383, "uuid": "966aa6d5-3f6f-4bff-8690-12d57d051d75", "value": 3373456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782430383, "uuid": "bef7843b-5962-422f-ad18-79eab51740ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782430383, "uuid": "af190f77-5ac4-4ff2-a863-142b0351ecea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e2a642-7065-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782371601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371601, "uuid": "ab07c537-a4c6-41df-82f0-8d9a2d3f26d8", "comment": "Malware payload (Mirai)", "value": "a262e4868759028efd48c898f2762c98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371601, "uuid": "f94be936-4869-44a9-b6a6-d5ea78760201", "comment": "Malware payload (Mirai)", "value": "80e404f6a1b7c29380ce6a82ed5379e81b3bd50f9ddfde1ab6a849d30959a3d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371601, "uuid": "18ddf10d-5a51-48bb-9927-83fac308331c", "comment": "Malware payload (Mirai)", "value": "0c1da36b85c4b216694c6de44278918ace9dfc8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371601, "uuid": "506b8e65-ded1-4302-a775-360862512f1b", "comment": "Malware payload (Mirai)", "value": "4c7c389673f6ce180295810cb7f851f633eee505ede8c786b693e66761ed13b8ca5a37c508e8a22fd258a03801b3ff7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371601, "uuid": "a2d3bb35-260a-437c-9910-a2c77edfc5f3", "value": "T15CF32B02731C4E83D1572EF026F717F183ABED511AA6A640F22EFE845376BB16409F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371601, "uuid": "c6d37f77-bc9a-482b-8b33-001cf7b4b545", "value": "3072:8Kya0e6RxMrkJ/ivlGIonhF1WXKv7MvAxsPQtLI8tYyKP:8Kb0e6RxmkJ/itGjr1WXKv7MvAxsPQty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782371601, "uuid": "aa0f9953-2202-490d-82ae-3af2cefd61cc", "value": 158010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782371601, "uuid": "cb9e8bd6-4db0-4fa2-a916-5c4f12fd90cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371601, "uuid": "607b695f-decb-4231-92f9-9d3a790f3659", "value": "80e404f6a1b7c29380ce6a82ed5379e81b3bd50f9ddfde1ab6a849d30959a3d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd3b39d-707d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782382162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382162, "uuid": "3c75eb56-cb8e-4ebc-81af-af2719c0473e", "comment": "Malware payload", "value": "384f2ff9db03aa4482398693973d0f9f", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382162, "uuid": "4fbf275b-9ecd-494a-8995-a3f665c83342", "comment": "Malware payload", "value": "81a37e3d7ff0088dfc2695a0cf31eb8eb5d410c61b3e4bbafdc645c95d5d4253", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382162, "uuid": "81927f97-989d-40a0-88db-4ab0bf7e9d9a", "comment": "Malware payload", "value": "84ebd410a2be38b44f83862aabb4b2a58c31277d", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382162, "uuid": "f8d637f8-d78e-4a6a-a961-2edfb03d8f73", "comment": "Malware payload", "value": "6097cb7cb18a1816ae14d20f4be051a398eff7c1cf28b83f30a83adc6f2faea827e9a690e6f71ba578bf105605a4196a", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382162, "uuid": "fee5a5e6-9f00-4b8d-b6e8-1d6598c0b16b", "value": "T17366337AAF8122022F995EB28B59E6F355F408C758E386C358B77C3318D49156FEBC90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382162, "uuid": "64384afb-0b71-4cf2-82fa-b0477336f9d5", "value": "196608:Yyiaqz3CvFyQSaD5JmqueZH9CEzIWD5ESg:Yyia4yh5prrZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782382162, "uuid": "314ef4a1-11e1-4659-b3f0-186a6583caa2", "value": 7032670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782382162, "uuid": "657f060d-a8e6-4f05-bc77-eb0706164bd6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382162, "uuid": "57d53467-852b-409e-9ffa-1dd3671e1f11", "value": "Hardware Wallet Backdoor.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca622be-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370802, "uuid": "f09d9cc4-255c-444d-af82-3196746d1ecc", "comment": "Malware payload", "value": "4fd52bb0dc16bd09077d0d639b7a8003", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370802, "uuid": "4a143716-7adc-4bd0-8681-f752669d7275", "comment": "Malware payload", "value": "820c86ad1c7fbc062dd941e0d517f889adb13ac1c639c8f6c8c3f783d150fa37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370802, "uuid": "739a772b-3ee4-460e-98ff-2b1d80081c3b", "comment": "Malware payload", "value": "a4b8edcadb5627035f93045fabe2b94749278e3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370802, "uuid": "b8df1112-de4f-446c-b56b-c5817648f7b3", "comment": "Malware payload", "value": "2a13d04cafe5a2c3424fc4d08e827e2f96f0b7c30b3cc97ef3f82b649eb59fdef8dcee5bd2b7a388861016acf8ae71fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370802, "uuid": "dcdb6c8f-1f1e-47c1-aa40-57b0a6431933", "value": "T14C563A42FA082F95C924893389B34EA127626D587B318752E754F37FACF63060F56F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370802, "uuid": "17a34cdb-865f-44c5-a228-921574398425", "value": "49152:i9/AsCQsASQDvcDOJDBz9LfKZD8aTWMs34RySnHEO35E/:+/AsCQsAxDvmOJDVFMEaE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370802, "uuid": "327e10a1-fc53-4b1f-95c8-48224db11ef5", "value": 6094996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370802, "uuid": "7b3bb578-9899-4717-bcd1-6781c57ee500", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370802, "uuid": "3711960b-b7da-4991-a025-5abd80605e3b", "value": "zswap_shrinkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69d591a-70a2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782397930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397930, "uuid": "4edc2cea-6d4c-4134-9a9d-cb29f098a676", "comment": "Malware payload (Mirai)", "value": "d9ec59a0e405c821efb776c548c7c3fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397930, "uuid": "a3faf405-5340-4b33-af1c-2f7af7b0ff85", "comment": "Malware payload (Mirai)", "value": "82d3b584b11e9c35124914a2765f86ecd4d7f5242b447d89c303f96305720f79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397930, "uuid": "5d890ed4-f566-4db0-ba65-5b96c492da48", "comment": "Malware payload (Mirai)", "value": "096ff7e6e9649771803eb131dc5d262161dfcac7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397930, "uuid": "d8056a7d-7dc6-46e6-9d92-690864252532", "comment": "Malware payload (Mirai)", "value": "9a45972118c79193b23169a20ba0909789dc090e96b062ede57ce53103b1531c98810239e15982e92181f843f5c9f5f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397930, "uuid": "7451b85c-2a93-4495-aaa8-696da3de2eb2", "value": "T1B934A65E7E228F7DF6A9833447B78E20975933D626E1D584F1ACC3142E2025E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397930, "uuid": "8cb5d323-ab06-4905-833f-c6823fb7134a", "value": "3072:I2nP4iAQzx2tmWNM0cpZ5y+VxZWPIAvsR/hn8IJIBJrOO/GdsxKZvRwIDdQaajqP:I0W3HiZM+VxZWIAvaORjOoxQRwIWafP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782397930, "uuid": "a0802ed3-f98e-4599-a983-7b46a120fd8f", "value": 233804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782397930, "uuid": "0890d4a7-d1f8-4e26-b054-f2d2473d57d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397930, "uuid": "127c9763-da7c-434e-b66e-172a3383caac", "value": "onie_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08cbb4c-7059-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1782366701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366701, "uuid": "d1300b34-8128-4129-b6ea-54b23e17897f", "comment": "Malware payload (MassLogger)", "value": "abfd77f13c92d8748e37558ecb3db828", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366701, "uuid": "31437ca0-81e8-4846-a6b5-82328ab827da", "comment": "Malware payload (MassLogger)", "value": "85bebb4da660f33be5aefd120cf7e715f76d22d87fc9334413f0061f1a238fa5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366701, "uuid": "963cac34-3e9c-4bdc-8a28-ade1414d6eca", "comment": "Malware payload (MassLogger)", "value": "15c2d2b96830c529d0479061e99a244a430da360", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366701, "uuid": "60355896-2da5-4f3e-8e55-af9d17304f0a", "comment": "Malware payload (MassLogger)", "value": "647796d51611d65f94c033b2143a5baa14433f694e030a076af4a9a33773234bea71137fa7babf1ed86cad919c58322a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366701, "uuid": "cc084c78-5474-43d2-a410-58d30aa5853b", "value": "T1CE961B2DBBEE015C9C26D386EAF151E4C5ACB92203DF651F80765ECE5312386D93226F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366701, "uuid": "a30ae53e-1fce-4fa8-a32b-9f072a00ecb1", "value": "3072:jp8Gqo2IYanVsM+nrT6W22q13CEB78GDGRnaOyyAic2A/f24tIDLlFUCpvnXFRH/:ejHNg8u68p1jC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782366701, "uuid": "dd995ce4-01d8-47af-a22d-a9b6f6684ef2", "value": 8917082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782366701, "uuid": "c01bbf0d-b987-4c3f-93d8-1aa7b489a414", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366701, "uuid": "97d9a748-e963-4fdf-adbb-c4255b2b4073", "value": "comprobante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2820bdc-70eb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782429330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782429330, "uuid": "49bef6e8-305f-425b-9afe-74ecd5d626f1", "comment": "Malware payload (WannaCry)", "value": "bc11d74bc4a22c1ab373a5c713a5e646", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782429330, "uuid": "3799c77b-fe78-46d7-a2f5-ed69ddd89266", "comment": "Malware payload (WannaCry)", "value": "85df30c96a7e810c3711456eb2979e12fcd0a8bef49d9a5a01d1aadfb903b663", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782429330, "uuid": "cb26462c-7a81-4bff-8869-55d0f91954fe", "comment": "Malware payload (WannaCry)", "value": "eb24c3f1d575ae75d4d002caae30be2a27956ae2", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782429330, "uuid": "b1b0a76c-c403-47bf-8c9e-0af07ffd24fb", "comment": "Malware payload (WannaCry)", "value": "39682b274d1e8880ce2f9a6997d5011404670cb3fb470d76d5bfb187ea515ae7520f0cf8e6da03ea72775d0ce5722ae3", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782429330, "uuid": "556730d3-6cb1-45fa-b0d9-24f299e666d7", "value": "T1D736123464A400F8CCCB417460B6DD5B9A327F9762FF4ACA575832E01DF2EA5F626E12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782429330, "uuid": "bdf88d43-5745-4fa2-bc0a-a481646a7cd3", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782429330, "uuid": "16b6c537-d9fe-4c25-8572-6df4a3ce55d8", "value": "49152:jnXnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAUAUq66xSXr+aAGsAja:DXDqPoBhz1aRxcSUDk36SA/AuXAGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782429330, "uuid": "e4aa430d-f9e2-432e-98b8-5fb06d028225", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782429330, "uuid": "735dbc36-e0c6-44ed-89ba-a9943869fef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782429330, "uuid": "34d01f62-ba0b-459d-9259-f30a32da6302", "value": "85df30c96a7e810c3711456eb2979e12fcd0a8bef49d9a5a01d1aadfb903b663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a6f111-70c7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782413734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413734, "uuid": "68512083-9400-4547-949b-46a94dc1105c", "comment": "Malware payload (Gafgyt)", "value": "76c90664511accb69a39f22619d1fea1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413734, "uuid": "7711ddf8-96fc-42f0-a507-144f38930dd0", "comment": "Malware payload (Gafgyt)", "value": "86187dadfd543daafcdec14ea988b546467cf6b374de2ef26cd16c9de5ab3448", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413734, "uuid": "2a931342-23f9-43b1-bd21-e658cc76966c", "comment": "Malware payload (Gafgyt)", "value": "2fdc13a43b43580f11af8d6d8f84466f30a7e037", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413734, "uuid": "f81f5f63-ee70-4922-9e2e-da9f1e3b587e", "comment": "Malware payload (Gafgyt)", "value": "73e56b725b1bdaa23d2bb0a77a8c9d1a5d7d781ae7388d1054af10407ea87fc91b26e0f1062d7d662e8d17dfa5912117", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413734, "uuid": "99a5255b-2c6c-44ec-8694-7ef03fc7686a", "value": "T19BC3F65E2E319F3EF76C82340BB74E35D355239A26D0CB45E1ACE9056E2434E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413734, "uuid": "af9fc58d-9238-495f-9606-4b4c27757a81", "value": "3072:wuzdz9xhm85qQFe9SgMTiIDGt4fT/o57z5:wcxA8QcgMTiIDQYTWz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782413734, "uuid": "5dbcd5b3-380d-4071-b409-e9f6123d5a04", "value": 126096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782413734, "uuid": "faa7490f-25f0-436f-b53a-716267161910", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413734, "uuid": "c0ba85f7-ac21-4090-9656-0ba337d16202", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e490adde-707d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782382143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382143, "uuid": "cdea56d3-e8dc-490c-b1f8-0ad065eed865", "comment": "Malware payload", "value": "078e7b373360b9842ed41563b49e627e", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382143, "uuid": "a0e0e09b-0b96-46eb-95f8-3cc7cd72f355", "comment": "Malware payload", "value": "872d18cc49051ebe2838d0425f79d341553bc82c86e825867e5af775259718b6", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382143, "uuid": "5a29e624-6ca0-4aea-9fce-7b02120d7416", "comment": "Malware payload", "value": "796e86abfda7208e4caeedc88329e210dab6be95", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382143, "uuid": "1c790f49-089e-4f56-be03-0d37571c0b50", "comment": "Malware payload", "value": "fa8daf85fb56ecbe4942b9439a91685188e90852e7cb8d80eb7b505955216a92c68d57a58648445edd779a80bf0b861b", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382143, "uuid": "0fd9e1a8-7d32-4ae8-bffc-5b786612b367", "value": "T187C6333A67C2EE1B23D0D68EECB319D29A796F3101CF364BDBA9D7D311E84195523488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382143, "uuid": "77a6fd68-5472-47b0-b369-7c8680a2ae9f", "value": "196608:EHL+X6uQmOLYY/sPlfNsPgFRNBwcD9IO3c7x0ZoV20810sgtsOwNtkA+ijGwLTr5:EHXb+blOg7T9R3c7x08V80sgtsOwjj+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782382143, "uuid": "dec57c86-8bf9-4474-9e9b-f74667f46dab", "value": 12539546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782382143, "uuid": "c8277592-6536-4ccf-8f02-98ea33edaff2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382143, "uuid": "ab6eae74-0f75-46bc-a744-468176ae0981", "value": "Ronaldo and Messi_s Crypto Betting Showdown.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cebf3d-708e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782389366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782389366, "uuid": "caee484a-8fc2-4949-833f-773605cc9406", "comment": "Malware payload", "value": "6c373c52ddd10327ac72c4f36b074268", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782389366, "uuid": "a7f2c101-0015-463a-a1c8-8a8ffcf089f3", "comment": "Malware payload", "value": "873c3c99b449d49c97496085b3df4c72e2339132fe7c9048f9be5b6804f83ba7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782389366, "uuid": "c4a7e1b4-0534-45bd-abf0-db573f289c4e", "comment": "Malware payload", "value": "13e3abb446328384983b918b9cb448066cf7d173", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782389366, "uuid": "bcf108d6-4bfb-4c2e-a2d5-7de0c2764e06", "comment": "Malware payload", "value": "dc58e42c1465f2721924a5788c82854dab860f4bbf0db19099e300b3b342a2228cf062255379a924cde815103b8e6387", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782389366, "uuid": "a71791d5-5dd5-4847-a2d7-df94e79437e1", "value": "T183952302BE4A0F37D9594278888F935E8B358D054B115A9B521EF36D7E321B0E2F36DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782389366, "uuid": "d15ed584-d929-4a48-9b25-3f2aa219b953", "value": "24576:Cn2aV+e1UdPAA8kklpPDH9Dm0C0y5SE0+iOZWEM6Vj46MK0yDY4BLaflza0mU4u3:JwX1c8lLHx80y5f7ZxMGk3U03y3tPLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782389366, "uuid": "26352761-8aa6-45b8-adb3-0bd289c820e3", "value": 2018816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782389366, "uuid": "5d072711-0a9e-4a43-8c57-12d669cf5237", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782389366, "uuid": "0fb24b56-1160-4403-9f3c-22f714c0e13f", "value": "7z2601-x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d463fa0e-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390706, "uuid": "d3a507af-0646-4f37-8a56-29e2c2f2b520", "comment": "Malware payload (CoinMiner)", "value": "b43622585386544a0ddf1b295ce55e1c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390706, "uuid": "b52427e1-90d3-43ba-bcec-88d30f1325f6", "comment": "Malware payload (CoinMiner)", "value": "882f750531309d59d6ebae6ce9f35a9b55312dc4900e0381e2656226b617102b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390706, "uuid": "a8bab13f-9fec-4519-b2f2-74aa6a099116", "comment": "Malware payload (CoinMiner)", "value": "356e39495f95e93e628d434c64c2e91a1891e4f9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390706, "uuid": "5345a621-498b-4436-9da6-931eb3faf148", "comment": "Malware payload (CoinMiner)", "value": "2beee4f4ddbaafc34e0a8b90cffcad6e37b9bd3f2f379c0eb4869b3a07722c35e7a18fc2b14795e3f95c43b8f245e23e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390706, "uuid": "59329988-0aad-449d-b788-09f86fa2b036", "value": "T1E5F533CEB46030BDF7F65932537BAF320B7A7122875369D38A9272A03C5BAC0DD16519", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390706, "uuid": "b420cc50-07b4-47ab-a17c-6646a959780e", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390706, "uuid": "2fe09cdf-7a00-4013-aaa6-4c375963addd", "value": "98304:OyrokqCvQm1SYbKPOB4lnjrHOxf0r8lTLZOe7qyhT3+rctA+rVzS:AkzQKSYbKPOB4lnjrHS0wlnZOeXT3+rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390706, "uuid": "79c82dd3-c3a8-443c-8c89-b4fc741d0a80", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390706, "uuid": "f65f40e9-813a-4c43-9c70-653f207abd62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390706, "uuid": "1210d2f1-6f72-4e41-b882-8df3185d7a7c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba0cc4c-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391013, "uuid": "161dc82e-4fbe-4cd0-bc2d-8b13cd74baf7", "comment": "Malware payload (CoinMiner)", "value": "f20b87dd56f9686d7090e2eed1e14971", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391013, "uuid": "292b5836-1f7c-4386-8c1f-4823703aed9c", "comment": "Malware payload (CoinMiner)", "value": "88de4138699965edf561a5cd9bacd036fb8e474c61acf311b7a33e0563b04304", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391013, "uuid": "ddacb953-2da4-48c4-8fef-b1e77d3e97ff", "comment": "Malware payload (CoinMiner)", "value": "21691aba761cda40346f13d805e6dc3fefdacc3a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391013, "uuid": "e6c84c2a-7f9a-4b15-ac6a-b0d3ddad4b29", "comment": "Malware payload (CoinMiner)", "value": "b72fe4dcdd08a5b47bba0064ae0c34b2deafb2a7c01be99f16e1ccc4481ab1b18130f786dc135ef3946c08ab8b1add32", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391013, "uuid": "ba8f0d17-ab1a-4bb1-a0b0-f44ef057d411", "value": "T181F533819AD69DFCEAE5C834C36A4B71652BB643833059CB06D275681B3AFC12737C4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391013, "uuid": "4f3de29c-c947-4195-b68d-e5f783efaf50", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391013, "uuid": "7fd3c85f-ca70-4c50-8f9e-09bdadbb4aef", "value": "98304:QnB1JmMYpY00zYrv931lXkyHxKfCul/B2B:A0Yp6F3rkygCul/B2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391013, "uuid": "ce3d8bc9-d2f4-454a-b0f2-704876f66ab6", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391013, "uuid": "c039603c-1e64-4bf9-88cd-44cb2aa107fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391013, "uuid": "6ce0705d-ed81-4e5f-a279-785acc6da1f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56ee729-709b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782395002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395002, "uuid": "c49870da-2da2-4ddf-899a-e91f3b57dd4a", "comment": "Malware payload (Mirai)", "value": "0959e2674dc30965be673fd167f28c79", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395002, "uuid": "73dcf01f-5d96-4c03-ac3e-975bc53daed1", "comment": "Malware payload (Mirai)", "value": "8ac4f5900bf7c7157534a5fd16b0561935088e15cfe25d8c35435d7d5c151a65", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395002, "uuid": "c6486ec6-98de-44f1-9930-85e3ddea907c", "comment": "Malware payload (Mirai)", "value": "f3f3ce071c990a6ae2a9aca4ebbb954eee2d90cd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395002, "uuid": "289a4e63-1070-4aa3-8dfc-a61c7de0bfb7", "comment": "Malware payload (Mirai)", "value": "7ddf8c561cf8b87bc510717ac19f79574137aea7d1555b420c4dc1610b84e0bf80dff534719b69813002dccf76ebb2bb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395002, "uuid": "81f7de3b-d451-4f24-92b4-1b3a63562b4e", "value": "T18A01EFCA8005FD00509AA91E37976464FC20C3CE06568B39BFBC6D3EEB84C04F026F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395002, "uuid": "e2eceaa9-1a85-4d1d-9e18-cb69365d359a", "value": "24:kXCKysE2hi0ziQvZohaMzA+4d3wLRA4eX:e9Qp+MsMzB4d+ApX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782395002, "uuid": "a1d6edc8-5e0d-40fb-9c09-ec5ed03184f3", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782395002, "uuid": "73d95b7c-42ff-41e1-aa28-bb671a02653f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395002, "uuid": "2b8fe29e-64c2-4e56-b713-a780e1014c29", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436c1473-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "b51f142d-138b-4742-9406-be005b4e9e95", "comment": "Malware payload", "value": "095cc18ded14d8eeae2573e5501798be", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "c541d7b1-8fd7-499a-85ab-17773ad29f62", "comment": "Malware payload", "value": "8d15da9bbd69408716e3aafd944a54661402de65e10c76ca302827782f209ade", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "05fcc841-2940-4fed-9b0e-8160bdc4f0d6", "comment": "Malware payload", "value": "480b64e3a9249a05106665aca3f6bf382cebac64", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "fa69d5d6-2620-4072-8021-43fb99830c0e", "comment": "Malware payload", "value": "a01d99d0f588e8993132053e433cbe7329374e465dcaec5594cfd7b815377779b0c12bb18b83b8a097b5ceb4bacb293b", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "770d881a-7bdf-49ca-bc34-e33feb5e012f", "value": "T18D75331C12558F6FD63A1935474408E6FF2320D3C776A36BD747A4220F9E2E66BAD223", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "8b07c5d2-e8d4-4db6-8ef2-0cc9da5e4fef", "value": "49152:J8wDT5Ln9u6L99ED23BHJiB0ognfdARnkmp5kO:OSJ9uW4mBWgnyRkmoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370706, "uuid": "6f31ae58-7a63-4c21-badd-78f190a3583f", "value": 1688720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370706, "uuid": "9af21160-f4d3-4ef0-b608-d3e06fec7250", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "b0224927-01ea-4280-85a7-e5f24a31df93", "value": "kswapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7e2ec6-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390931, "uuid": "7d7031f4-47a2-440a-be90-1d15134ea017", "comment": "Malware payload (CoinMiner)", "value": "9d126c8f171e535a48c779c24d5dcadc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390931, "uuid": "bbf86c12-e1f4-40c9-b23d-ab4921eda1d2", "comment": "Malware payload (CoinMiner)", "value": "8d35b1c48357c10fd6357edb0154e97e02323f16694f13c495a0c7ce23b15a12", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390931, "uuid": "be60d8af-11e9-45e7-a9da-ce81434536d4", "comment": "Malware payload (CoinMiner)", "value": "85b9c90d7b8642bc673921e7750f9a504753896a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390931, "uuid": "2bc40872-37e0-416e-8082-cf0e9978599b", "comment": "Malware payload (CoinMiner)", "value": "2bbe20c8e3698d624d127391243cbd1d06a1ff255802d2911af9b3552d037ff7f5db22004229c4355083e63647a3eaf5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390931, "uuid": "e4f01286-105f-437c-a604-c24a30c47ba6", "value": "T199F5338645C9B5BCE2BECEF153B2AF3D5A3075221721E4CB5AE214D44E317E87871E0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390931, "uuid": "567fae2b-95cd-4be5-821e-8aea478d18a0", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390931, "uuid": "dda7ff1c-f44a-4c48-a6e2-8cb61b40bc4a", "value": "49152:apb7WI63lbvtuZNKyu84+XbwpV1dLy5sV2+GhJewVf0kdk79eBqUCCv0:apb7WI6VLtuyy2+GdL1AcwdkmVC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390931, "uuid": "ed0a6e73-3d25-45fc-a980-9d0ba88ed516", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390931, "uuid": "02b8622d-125d-4c33-ada1-5726e43f4427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390931, "uuid": "bfcc4e8c-5308-434e-b0da-4afab317d084", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56699ddd-7093-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391353, "uuid": "1a4f3ea0-84a2-4943-909d-e86dc8943e44", "comment": "Malware payload (CoinMiner)", "value": "4db7967bfaf6c43d0abdb2ca9abb698b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391353, "uuid": "d47586ed-e455-4b54-8bdc-bde2073457f1", "comment": "Malware payload (CoinMiner)", "value": "8d9fc8a6c1fd93714a36ef4239ee7816a50f092b1b5a9d7fc31218159763d2e8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391353, "uuid": "2cb22ce5-2108-486a-85af-57b0e30bf319", "comment": "Malware payload (CoinMiner)", "value": "5dd82a44fb16ac34c42f0451ca8ed5b60f748390", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391353, "uuid": "b46b896e-4fc5-4aab-82eb-ba09c31e2cc6", "comment": "Malware payload (CoinMiner)", "value": "e87203f8a716a9b0d11575e4e621d4cbe3cf02e27cc152c4c90baee184ab04cab37038b02b87711c19a8ac7fa0cb517b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391353, "uuid": "05bdf53a-7239-40d2-b9ef-b13357700d58", "value": "T1ACF533C53B1464BCF563C93353EC4F02D56335634B0250E7216E9A78AE73ED9AE24E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391353, "uuid": "3a7b5383-4733-4f2e-834c-00188051d815", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391353, "uuid": "adb04c25-7034-4063-8830-e663b7bf0fc7", "value": "49152:izH6Xm304Y6oZH4W1fumET8fgKEhy39PwYuZ3qm6RqXJlR4xPd8bIVBIs:izaXmk4e3DfgKEUwYuZbFXJqxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391353, "uuid": "b9aa513a-0d1f-4523-be16-5d4ea63f03a0", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391353, "uuid": "5b55d4e0-8064-4f63-a095-54999c6c1c96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391353, "uuid": "f474b9ee-2fcb-4d45-8766-36f87f440ed2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b3656e-70b7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782407084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782407084, "uuid": "dfd2a368-c0f7-4e79-a209-d0a0587d8721", "comment": "Malware payload (Prometei)", "value": "3bca42a250c70decf35ea98cab13ebb6", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782407084, "uuid": "897f7864-7fbe-4d5d-8698-7efdfcc3ab17", "comment": "Malware payload (Prometei)", "value": "8e7395ed4110a27c717f63cd7e039b19939c87c9283710108ebc38946f4fbf98", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782407084, "uuid": "63ad783c-2545-4c0d-978c-538b06d960a2", "comment": "Malware payload (Prometei)", "value": "8eb686530b894db1aa3c219ee802a76621cccf31", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782407084, "uuid": "85d86725-13b0-4163-b517-175e483620f8", "comment": "Malware payload (Prometei)", "value": "1b281e5bcb9a40ecbfdac55c5ce0bb93f905c4e8de4b13b8a166cb1bff24d2a35d60139cc0250c729cc4863ad5b4fe50", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782407084, "uuid": "138fbd70-3cde-4aa4-9671-daf86d85a0ec", "value": "T1EAF0A9B6A5280AB0785D88181CAA4999150227FB88D81A293CDF90E43F3032272E1B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782407084, "uuid": "0ce6ec12-744b-4373-95bb-e99e26302a7b", "value": "12:kha6xnMFhW/oamL3Ccokyd/Rvxq1eU1guqyK:k4ewQo3+Syd/RvM1PuuqyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782407084, "uuid": "5c6da8b5-fea6-4754-84e7-1e1055f604fc", "value": 474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782407084, "uuid": "61401815-b4e7-492b-8072-f6612af2edf9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782407084, "uuid": "badacd64-9caf-4431-a24d-ed9ac772b422", "value": "8e7395ed4110a27c717f63cd7e039b19939c87c9283710108ebc38946f4fbf98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce534608-707d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782382105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382105, "uuid": "9633684f-7cf1-4296-9f80-a62149edae05", "comment": "Malware payload", "value": "7a0babf120b85399ee76027f73bbe5f0", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382105, "uuid": "330eff0e-9def-4643-a79f-8791f32834e2", "comment": "Malware payload", "value": "8f2606bb191cdc91c840f0207f056f2247e21815518fe0a66c9dc708b72fc10a", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382105, "uuid": "8d4a8fea-6333-4f8a-ae58-23be95b6d629", "comment": "Malware payload", "value": "7fef2312039d18960ea44a643f54cc55ed8549d0", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382105, "uuid": "ce978983-dfcd-4a04-a3ee-e5b5930418e5", "comment": "Malware payload", "value": "1496a4a40c42101a072d445220a1fb2a73812d94ea699528db7707927ec7db2d4109992d4dc85e9744ced73ed6258ab8", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382105, "uuid": "a28577ac-629a-405d-9c2a-681c65526f23", "value": "T1713422695EF6AF155E6748C2EEFE6A4523022F455CD43374735FAAF260CB1E6C0082D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382105, "uuid": "8e919f64-3527-45e8-ac91-d0c8193a75ad", "value": "6144:y7y5YqeOM1qJLBlYbo4Ts4IDODYlEX3rj6Lnqp41pn3:y7y5YPqLl2o4TP36jnn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782382105, "uuid": "a6aa2753-6c50-4672-83a4-826aa9012afa", "value": 239264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782382105, "uuid": "eb213261-8013-458b-b854-dc5cfa3a9667", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382105, "uuid": "63c1004f-c00d-4cd9-b1d1-bdd4b4f3900f", "value": "Safe Trading_DEX Platform.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333a6c67-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390435, "uuid": "46e58175-5aac-4e2c-8789-73204fd37a77", "comment": "Malware payload (CoinMiner)", "value": "32a09ed1e719a39805d854a368ba9ef6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390435, "uuid": "58ae946d-cb10-41db-88d0-16f7b7d18dba", "comment": "Malware payload (CoinMiner)", "value": "8fc455e31efe2cbb2ccffb27169f67e54d2535ecc71aa070f0d26817d0aca480", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390435, "uuid": "01b98a7b-be9c-4bfa-85a1-74c0df1911af", "comment": "Malware payload (CoinMiner)", "value": "4a16937299536c6290f250d489759b1df321a0d2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390435, "uuid": "0e6765fe-ab8b-4f74-a107-4627c2a7c311", "comment": "Malware payload (CoinMiner)", "value": "15b471d0dc1913cec54e393996c76563d34daf0ac2d0a6558bc485fbd1edc48bef1f844d9b3fdc100f64b28135f9feed", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390435, "uuid": "85abc9d1-5177-4b7c-8de9-dc8a8c36c156", "value": "T147F533E12D4054BDDBA348B693EE2F518B3F25960750B8CB17D3E5512F26AC2AA37C60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390435, "uuid": "4ab85e76-c29e-4be1-83f4-9da984e951c2", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390435, "uuid": "7473d4eb-ffbf-4ddc-8d83-0a04f49c7e5a", "value": "49152:Jzjw+gRIIHKcQ6jiOcPk6Voq8T+vzouAzorT1GUkyrl:Jzjw3+2KcQScPfVoazouAkP8UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390435, "uuid": "c78ee332-c373-4d2f-9599-da400baf54c0", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390435, "uuid": "b32ed6cf-73a7-44e9-8956-ed69ce0bef5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390435, "uuid": "484d93e1-ab67-43e6-af37-2f2753bbc24f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995b2b6d-704f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782362260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782362260, "uuid": "ca7029f6-1e27-47de-b2c1-140b045b2899", "comment": "Malware payload (Vidar)", "value": "9c167edb9c4ecd0de1e5cd5fe59a54db", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782362260, "uuid": "26504475-a6e7-4214-bbc9-61b5d86f5268", "comment": "Malware payload (Vidar)", "value": "9007698a67964ef5f647ae478ad2b4d6e6b940428ebb86ef22b8d746fd6b8d0a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782362260, "uuid": "a54d6639-a6f5-4662-b700-ee7c3c264fef", "comment": "Malware payload (Vidar)", "value": "d06361025008b4124a371aa7980c3890a577dcdc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782362260, "uuid": "eed868ca-97f3-4c3f-a061-255b5cca8fa1", "comment": "Malware payload (Vidar)", "value": "aa5c20c7d5b43db5b16b359d170e272d0e76e77128278efd6983b6f0fc1d2fc705e57ae94ec37894d5cc9807612ca840", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782362260, "uuid": "58e76f20-52a5-4d39-8c8c-4a976f6b4a40", "value": "T14B06AD077C908D79C0E4A77289B62262B7BCB8054B3617D32E61BA792F7B7C15937B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782362260, "uuid": "a2743c4b-39aa-459e-864d-1544e11b2ec1", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782362260, "uuid": "181c7c12-aee8-4a1b-8be0-b6f69c38a032", "value": "49152:uoEaDilDwa+9qeBRnBaOh0YnYZ+M66CduznYixj:uofIS7ntwtXzYixj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782362260, "uuid": "6d14fb3a-e03c-4061-8ee2-ff172cc273b7", "value": 3708720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782362260, "uuid": "394f66cf-6854-4e80-b7ba-78d260bc7510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782362260, "uuid": "7bda2919-146c-42d8-85f3-1eea5e5ba590", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73703ae-705f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782369209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782369209, "uuid": "420c97e8-2767-4fb8-aa8b-e1fb75af7979", "comment": "Malware payload (CoinMiner)", "value": "538bea099f31396d164d5a76a9f1e897", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782369209, "uuid": "2adf951c-c32b-4210-8eac-db9f237df3c1", "comment": "Malware payload (CoinMiner)", "value": "9213b2fbce84b1f8a824d6475831100538944bac794e12fc542d733b3b2201eb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782369209, "uuid": "32f98567-4ed2-4cf8-ab63-8640ad7a0033", "comment": "Malware payload (CoinMiner)", "value": "a2e9f76ae1b7919dd667cb6f29656f31afb1e2db", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782369209, "uuid": "c4f7aee7-38e6-44cb-af02-6bca07e29b29", "comment": "Malware payload (CoinMiner)", "value": "15f0d0f8eaa7b79cb6685a4f014e5080cbd3a709460754045ca5b1d140cfd932d49200daded71232616e0df87fd76410", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782369209, "uuid": "0369b1f0-e715-4dc8-897c-de70fadba6ee", "value": "T13C963362B8603BE7ECE8573A91E4210853B6FA0E32526FE4BF5834E54947E0F573E449", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782369209, "uuid": "76fcbaee-375c-4c71-94ed-b972245e4d88", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782369209, "uuid": "3ca615bd-95e5-4250-87bb-77899c9556fb", "value": "98304:U2A8DirexYcVkkSIFls6UATsIDzDL1N2di6m0SNAkQom1tQMCqT08u1fhKPOPK2c:JA8DxMkrFxTNN2dHm0SuLbhM1fkJ09v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782369209, "uuid": "c3a6bb26-1005-410b-9292-e52f32ec552d", "value": 8669592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782369209, "uuid": "ab00070b-66d9-47dd-a522-30a96cc851b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782369209, "uuid": "a152d167-1b08-45c1-8d6d-4a0943126660", "value": "SecuriteInfo.com.Variant.Packed.Themida.21.77125212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7ed042-70c1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782411362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411362, "uuid": "b2f0e62d-9052-4940-b7fa-cb189b246b86", "comment": "Malware payload (CoinMiner)", "value": "9165758bed0c42edf44ef0fbf4fda346", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411362, "uuid": "1976caf7-6f6c-46cb-a8d4-82ba58333dc6", "comment": "Malware payload (CoinMiner)", "value": "928cbf57e9ff5904a4d612017a47a99fd97efb3d468ece1b81b5a82017f549fd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411362, "uuid": "86e5bcaa-46d1-4374-9ac6-a987cb33ee05", "comment": "Malware payload (CoinMiner)", "value": "b236ecdb4b32b9ee49db6b9f4b2d141299375094", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411362, "uuid": "08ac318e-9a46-47e5-b954-1fb343ffe40d", "comment": "Malware payload (CoinMiner)", "value": "2745202f7a582c2c667c4ff3b15281e0f3b955d8407801ab087dff02ff1f571c10ac2f325f432565bb31f5d28280edb0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411362, "uuid": "f8264600-5d33-47a9-9365-afe335393837", "value": "T1F664390A77608FE4E274C13006F74B96A6FE11A656F24985D33DEE207E9038C6A5FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411362, "uuid": "b12905e3-e9ba-4b73-8288-984f6e8a98c9", "value": "6144:OoUwfwcdIiuUybOHrQO53mXy1fJyo8DQui7IcpAwiGNH+VKC:OoiBOcC1DsLHSH+Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782411362, "uuid": "3a8ccda5-af7e-44fd-8d66-4cdf8cf5ad4d", "value": 333388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782411362, "uuid": "89a9b1eb-0cbd-41e5-bd39-709b2342dd5d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411362, "uuid": "671a6b2e-6d0b-4d7d-9baa-95365fa7dc48", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ce8bdc-70a7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782400206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400206, "uuid": "1666cd67-2d8a-4fc4-8d91-3c10a6479a98", "comment": "Malware payload (NanoCore)", "value": "632237a7536db7d9c6b29b28ba189c9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400206, "uuid": "6efa56e9-d41f-4242-8846-5910ab02d09a", "comment": "Malware payload (NanoCore)", "value": "93696af402e19dfc858f5867e56e9dd5ddfa4f88df05bbb68cb482ca2c21a79b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400206, "uuid": "0f4858ca-d3e4-4fb6-9b5f-6cf523d726d9", "comment": "Malware payload (NanoCore)", "value": "e14d37249fc6b1af05e402b4e551d8aace58e7a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782400206, "uuid": "fa7565b8-c1b1-4ff1-860c-ce2f47d0d5f6", "comment": "Malware payload (NanoCore)", "value": "92a2c8767cbfa150d2055e36780ccc52c5e3f460c49007d548264e2b5cc82d51527045b524e3f2f2858e9f2c3d633739", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782400206, "uuid": "15912c3e-4bc6-4419-9d3f-2b27d4a39260", "value": "T1C814D0563BA84A2FE2DE8579712212139379C2E7E8C3F3DE28E411B64F567E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782400206, "uuid": "41a56f14-5b2f-41e0-8bd6-c2fb561b23b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782400206, "uuid": "174b7c3e-bd26-4277-a1d9-241f079b3199", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIvesC6wwBLsjAIZnB/nFgMbszv:sLV6Bta6dtJmakIM5j+LsjAcW/zhIRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782400206, "uuid": "1a6ae566-8300-4cfd-8402-7244ededbde5", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782400206, "uuid": "8b332022-968f-4ec1-acea-faf4e91a7820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782400206, "uuid": "5e9e3a41-4fb5-4ff2-982b-aa803a51ff85", "value": "eneftio.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359e0bad-70d2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782418357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782418357, "uuid": "19cdaf05-80bd-44e6-a32e-67f4b1906558", "comment": "Malware payload", "value": "113123469d3594321c0ca472efe13aac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782418357, "uuid": "4046a336-9817-4390-b71c-479562369227", "comment": "Malware payload", "value": "938d5d3054da170715410084aef8fc7d029a4adf6e622b4245619ec0cc3bddf2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782418357, "uuid": "9259adb3-a004-45ce-b7bb-cd927d2c67b8", "comment": "Malware payload", "value": "fad24862e6de9fdd9e5472d59a98eee94c992991", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782418357, "uuid": "5a365f52-5835-4435-8ee8-76993619262c", "comment": "Malware payload", "value": "5fd331897bc8166aac2827b6fde013c7e39eef13a17bf61260fe61062d9e768a550b69c665f52d1dde4252d500d81a07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782418357, "uuid": "64a66d7d-7db4-41bc-8fb8-27d92e4665b2", "value": "T1DE24E7076B918EF7C89FCD3306B6860124CEF45725A4772B7374DA2CBA0A64F5993CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782418357, "uuid": "4ed691e0-d046-4d24-8f68-68bbab993680", "value": "6144:CO7O7xAECmDIG5RiIzAiQE6v0XnG0l7EyBYmwWZB0:eAECSNzav0XnG0l7EyBYmwWZB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782418357, "uuid": "c77cac90-6a40-4538-bcbc-f53cc6545a06", "value": 214721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782418357, "uuid": "fd2813ee-05d6-4ddf-a0a3-9d8b96ab8450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782418357, "uuid": "496db4ee-e5cc-48c0-8944-931391070ee6", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6f9d90-70c7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782413831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413831, "uuid": "1e6b220d-eb6e-41ce-bd48-9c331644363c", "comment": "Malware payload", "value": "84c4f4a0c4330043a21b6c05ae6588b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413831, "uuid": "bbeecef0-1b58-493c-8623-94418d0f3347", "comment": "Malware payload", "value": "944ae2de320ce233ded6c95103cb8cc9b2f6f3c3bb69bd3a4b5a2d61053fd883", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413831, "uuid": "da48a482-1214-4d26-8c77-77edad80cefc", "comment": "Malware payload", "value": "4a2f3d3da0c96866bc9d83c1d9348b96669c06e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413831, "uuid": "5d4dee6c-3c62-4766-a993-716530049a10", "comment": "Malware payload", "value": "9e22007222192f1aff9d6f474fca681ca9a095850fd81a5fdc92a6601993674d169b28e9b20b6afbe5e6f419bbca776f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413831, "uuid": "801edea5-c3af-4929-aa6a-a3ecede8f120", "value": "T12E244A81318C7F5EE2D72D3E8542951AAC1CCF547882ED2110FAFA8719BB6DB0F3A545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413831, "uuid": "5a7be115-7077-4165-8519-ddb23181a072", "value": "3072:9oxr4Widi9jNqY2F9fL2IGbY7yfXZNbXOOgKbS/6QNQjX4/nV1v8owZ+goMv:l7diJEY2zSfLbXfgKefNQjo/vv8FZeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782413831, "uuid": "01e37f40-d88b-4392-9900-c4f44bc6bf0e", "value": 226144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782413831, "uuid": "6321c673-f4cd-4bf5-9200-6f8f98cd452d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413831, "uuid": "fdb57c8c-e126-463b-9c10-24bdcb5ac6bd", "value": "kworkerd-scsi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd455cf7-70c1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782411310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411310, "uuid": "e5464b92-67d4-4713-b21e-06a07342c438", "comment": "Malware payload (Mirai)", "value": "e54e4f355702c62fc0c3c9cda82a899d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411310, "uuid": "3df032b5-5b1a-4466-8601-39839e56004e", "comment": "Malware payload (Mirai)", "value": "945a8a72e9d8f20b3a50146dddda94fee3c632c8b57dd95cef02c24683b17d6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411310, "uuid": "706040bd-799a-43b4-8502-1af98f6c25ed", "comment": "Malware payload (Mirai)", "value": "2be9e265ad5b760e92ccc39ebfabb9c32c4531b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411310, "uuid": "75e40581-3aae-4de6-8c8d-0eed3b9c7fa8", "comment": "Malware payload (Mirai)", "value": "c01eec6ba45e1082f910ff6e1dff556f64d95879e91929162c3d106fc2b326af10def1257abb7b95041b0b69e8c2f25a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411310, "uuid": "2139aa21-ec71-439f-91a1-eb1826c86b50", "value": "T15304F846F951CE13C6C612BBFF5D828D372677A8D2EA3103BD255F2C378685A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411310, "uuid": "0f8ce723-1b02-4b40-bc9a-5f5b1a49c262", "value": "3072:CPSGpjsc0TQ4A6IlBKXtK4ZkIjj2x7TL7SOc:CP5ASMXk4Zhjj2RH7SOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782411310, "uuid": "6ec7dc22-7dec-4515-b2b0-88236282b019", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782411310, "uuid": "c024379c-6260-4e3f-8da9-1e0dd8d7bd2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411310, "uuid": "8d4c97a9-3c3a-4baa-957f-3577847a331d", "value": "onie_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6867a1f5-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390954, "uuid": "cbcb809a-86a6-4965-a78a-b2fa9d5284ad", "comment": "Malware payload (CoinMiner)", "value": "ef85ff913bdbaf39347ef2768ae8632b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390954, "uuid": "ed4dc8a7-5825-47e4-aa54-3feb1373795d", "comment": "Malware payload (CoinMiner)", "value": "946cb371cd41764484013c0b85638d9157b947a4378d81c395b6461f594c5eb3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390954, "uuid": "75326797-8b6d-4424-a733-e9f5845370fb", "comment": "Malware payload (CoinMiner)", "value": "bca8fc65db5a3cc18a6bdbdaee42569a642da1de", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390954, "uuid": "4fa97f47-436b-48a5-9a3b-731303cb76c7", "comment": "Malware payload (CoinMiner)", "value": "40d0969bf9583af926a83acae6caa247ebbc966cbd3a51d1910416b1da800f6082a8ec7429a98a10868f9d60398d0fd1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390954, "uuid": "197f1d40-db97-4286-84ca-0df10de04126", "value": "T1D1F533D9945434FCEAEE8E3271AA5F66353E79591F21E8C712E161203BB37CB23A0705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390954, "uuid": "16ef7d0c-1100-4643-9eb0-edc4777eb0eb", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390954, "uuid": "b25ab41b-bc17-4c4e-a793-44952a963466", "value": "98304:qycSNFi+WW1mmU8sq+2g3sf3FQHWNZ5rijv:0ST6WC12YsfyHWNZ5mjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390954, "uuid": "7b369752-76cd-4616-b87e-908e5fe8d1c0", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390954, "uuid": "673dab23-0d9b-4fd0-8f7b-def6b500c194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390954, "uuid": "8af16976-2526-44ae-a653-69becb092769", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb404f2-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390966, "uuid": "64eb1145-d76c-411f-9da1-592bc738de10", "comment": "Malware payload (CoinMiner)", "value": "8da34ec68b4dad99467ce20c6696d097", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390966, "uuid": "c05c37a9-5568-4cb0-bf06-ea4eb88405b6", "comment": "Malware payload (CoinMiner)", "value": "94dadfc956c7affead3690c011e4bffd29ecadb8ef328c0548adf6bae35fa3f0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390966, "uuid": "ad867730-cec2-470f-be7d-b1fd448e2fea", "comment": "Malware payload (CoinMiner)", "value": "820b2cf69083bfa39a722aea463229b19bb9b128", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390966, "uuid": "79984706-463e-4538-8b10-131752fab9bc", "comment": "Malware payload (CoinMiner)", "value": "417bce5f72421d2844fe9c0322af8bf086be8477ab40e34c18dc3d1d9357f30c3c7483d88efdf1795705b6aece43de96", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390966, "uuid": "2ff6c458-811e-4f3e-afd6-118c543cf885", "value": "T1ACF533842D9070FDDD5AA5B08A7DBF5576362A120F074CCF26EAB5D00E2E7C3A532D92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390966, "uuid": "1f9962da-6d9d-4749-823a-4d6672dd95ab", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390966, "uuid": "4d8e2bd9-9550-4b2c-8280-8ff2563ecdfd", "value": "98304:7AvEjsRZ2x3o92LMreO1H2KCUIS9RrmeyPcHZHK:LjeZQBUZbZXCeDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390966, "uuid": "410ee3d5-991d-4756-a769-b38fc936d860", "value": 3449832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390966, "uuid": "a6f10032-20d2-48e5-8ef6-39a4f04b46ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390966, "uuid": "bf854b5e-332b-4b81-83dd-2effe69f22e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b3aa56-70a2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782398058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398058, "uuid": "169d5e4e-747d-4882-a506-dbac417d745f", "comment": "Malware payload", "value": "507124ce4e35b167cb5f363c96e64fa1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398058, "uuid": "8f772557-1112-4736-93c4-71b61bf552df", "comment": "Malware payload", "value": "95ddfce9053832a8327c7bf6fee469b20f16f8d95274959a0508f8a29bc9304d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398058, "uuid": "48029571-8cd8-4e38-8c09-3037b9e1f59c", "comment": "Malware payload", "value": "1e11ad9b957a589c8137119a3e54632eda709b9e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398058, "uuid": "ec0ae0f3-a85a-40a0-86fd-2083477b6a6d", "comment": "Malware payload", "value": "30ab6aa25b0da59130acb307a22416c3788805bc6b01aa487219cd2fa039dc770e601ce1d880e37c24c8c0d372865478", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398058, "uuid": "db6aaf97-d3c1-4458-b423-176e9d4cc7e4", "value": "T143136C6526953C25AE99883B5C7F2F0CBDA983E2304491DDBF8A3CF18C55A9CE31871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398058, "uuid": "77d5cd70-66c1-4507-a959-41a49386785c", "value": "768:xxr9NyXsZztC69GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:XHusZeco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782398058, "uuid": "ef4a0410-0da1-4eff-a7e0-6d7941cbeb95", "value": 45517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782398058, "uuid": "d10ab561-8e7c-4985-8275-68055e0f0dd8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398058, "uuid": "d5a9d2bb-1464-413d-ba70-a1887fefef3e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e253ca0a-70c4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782412633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412633, "uuid": "695b9e41-84e2-417d-adc5-dc8998243f79", "comment": "Malware payload (Mirai)", "value": "ec07df513a5bb8ebc3049b806d6fcab9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412633, "uuid": "aa3e07c8-8583-4638-b688-931b6436244c", "comment": "Malware payload (Mirai)", "value": "980628101858de6ec446ccb20d501f5a57b1d1af9a3b9dd64ec5d95c1277b504", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412633, "uuid": "df3f7bf9-387b-4ad0-bf8c-f60c55c69c7b", "comment": "Malware payload (Mirai)", "value": "5ec6ac0a70b4fc53f4679960a77c1c76e91a8548", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412633, "uuid": "5c2a0150-279f-4939-843b-9be80978a84a", "comment": "Malware payload (Mirai)", "value": "d8780f58f7eee52b3e0c1fe7714e82b135e5c1eb7aa813d85b8497e86d371f5250f36c47b6a8dd3e22997218bccb67ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412633, "uuid": "25741d2c-9db4-4b5b-80d3-3abca2881f0b", "value": "T128B30A45F8519B17C6C612BBFF5E438D7B2A0758E3EE720399256F20378B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412633, "uuid": "31792500-ced0-45a6-ab3a-fc9eabc792d3", "value": "1536:ZbD58zpsNjUTQR2+r09Gu4VmUuiTTm9gwhycXO0Fzz0/Rlvl/Cwywf7Guq61+p9n:JqtqjuQRZu4rbG97Ikn0JZM7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782412633, "uuid": "fc8d625c-4a6c-4e3e-9e02-07f4a174c725", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782412633, "uuid": "95b1febb-39f2-46b8-b9e7-7ba34011ed7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412633, "uuid": "ea84c3a9-0a72-4e3b-bbd6-bbbec54dfdeb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61085fac-70ca-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782414993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414993, "uuid": "ac40ad46-f6ea-4497-be0c-1979f0a77a8b", "comment": "Malware payload (RemusStealer)", "value": "b0e76e240485ff142c9e9ae7dcdbd57f", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414993, "uuid": "f29a0bb4-8345-453b-930b-84fef3606481", "comment": "Malware payload (RemusStealer)", "value": "98632669b75fcc8e0e4f98eeeb20e0944ccf51f73d0c92b811354bd9e62f5212", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414993, "uuid": "4ed15a8a-8ada-4f78-aec5-76df4a51389c", "comment": "Malware payload (RemusStealer)", "value": "26e9c0f891feb0d8d26839686c5612cfc35d1da5", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414993, "uuid": "31b80847-db11-4316-ac77-1b2ec84c82a6", "comment": "Malware payload (RemusStealer)", "value": "ba7a366b3761616351d5a0f75ff4734f5a519eca1b2f4e34f064b8cda6103bfbe11bee3d59459989bdc6d6eb697218d1", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414993, "uuid": "1c750348-0673-4d13-b370-2e3e432b915e", "value": "T199136C557B9A0685DC3EC134DA6E9733EDB2F080F13C0A6F8B60E95BAF620536574E06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414993, "uuid": "e15f23c9-3b9f-4a18-840b-e06632a0cb37", "value": "0fc056682becaa7195437e989cfbae90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414993, "uuid": "b12a26ec-a10d-49ce-8232-8a0f5b79a676", "value": "768:+z9UJElgiV+/TVYwgvxVWpm/SBSnD0/ThpjWL97qKmi9zSLYqzbZ2EzyF:OUElgc+hYnvxZ/WoDUThpChFmi9zsYqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782414993, "uuid": "b33b5354-c07f-4d91-a254-8390531f39d7", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782414993, "uuid": "8e4b7620-eef0-4ab6-90ab-301003bc3a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414993, "uuid": "7c45fbbc-bfce-4f36-b0b6-66358275ee62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bb5e67-70b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782407665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782407665, "uuid": "46789989-a88f-4c11-a4c8-932fb14cafed", "comment": "Malware payload", "value": "82a96b5d287218786ab2c15418c040a1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782407665, "uuid": "6b187b11-ff33-4a68-8fb1-03b64fab6baf", "comment": "Malware payload", "value": "9a947b76c991bf54235a968b8b370ff8afcfab980161662518f084a8cd0b1f7b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782407665, "uuid": "a2c86f39-032f-46a9-93ff-a0e291f315de", "comment": "Malware payload", "value": "bc810ef56e837a0e0c41ebaedece9ed96d45eba5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782407665, "uuid": "416f8156-8e9c-42e9-b878-e56d39326523", "comment": "Malware payload", "value": "4339444f3aa65c1774e8ce9853c0b4a1575f8616fc176f27a8930997d57920649521153f8ac6dd750bae88b4b0309fa2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782407665, "uuid": "31bdfbd5-3c0f-43c1-975f-0edb9a8fa096", "value": "T1F5E62287F784E92BC43780B249BE1626558B4C168A8397433D15764C6CBBAD83F99FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782407665, "uuid": "28c0209c-39c8-4788-af5a-176131b6e717", "value": "196608:2jhnXXiLRsdE4EPhmDmS2X+CZeWZ9BCmD76YOAYYhh1lTiRY1fU4SGs4B:SlCLWd4ZS2+C0W5buWYYhLFUqDSGs4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782407665, "uuid": "6cba04ad-18fb-4f56-a591-9f85f95fef7b", "value": 14213612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782407665, "uuid": "a93077e3-72db-4cd7-ab30-27eedde8946c", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782407665, "uuid": "668c1155-71e9-40a3-877b-d23e005d9b4c", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfa8c83-709b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782395017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395017, "uuid": "17c3d221-e32d-4eda-9c74-e502a2d4b11f", "comment": "Malware payload", "value": "46789e943644ce51c5fcc56fd1d832bf", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395017, "uuid": "f109f2a3-5c67-400e-b4ca-07178ce48e78", "comment": "Malware payload", "value": "9ac8e23346425b2eb89788f7ee7b65d192698057379e27c31c0c48c6de429c4b", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395017, "uuid": "176132c0-f174-4389-8403-a878412b1057", "comment": "Malware payload", "value": "647154a6c5beedf714016e94f0fb61558acad92a", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395017, "uuid": "d56fc784-0796-4131-a63d-8299ebdc0ecc", "comment": "Malware payload", "value": "7785b95f7fb565c8cae25d6ac9f6127247a068a412f21cb17127f9077d46604b946f84f89ff5bd35aacc9a64fdb866b8", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395017, "uuid": "a11fabea-0f30-4a53-ae73-d7e610854f90", "value": "T18764086BD76F5C00D2309AFEE903BA951EEC92322E2CF6D589614DF678DC2417987093", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395017, "uuid": "61a49924-3118-4dcf-8984-4474ec08887f", "value": "83465c59d24b1d105b65fdb603771c7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395017, "uuid": "d5230856-65e1-4ae8-9b19-a8d0d059a7b7", "value": "6144:DDDqeNSV/0me2y1ZJtqygS+mC0A8888V888888f8888888888888888888888885:DDDq+SpxSJgS+IA8888V888888f8888B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782395017, "uuid": "19c64080-c2cc-41fc-baed-e60e02cc394e", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782395017, "uuid": "79d92291-3236-4282-9840-35deaf5e8206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395017, "uuid": "78d95d7c-9a8d-4a86-aef0-cc6b8691dff2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cc5679-7051-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782363113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782363113, "uuid": "35a1a851-7c15-4b2c-ae56-93c918ffd4d0", "comment": "Malware payload (Vidar)", "value": "cf4468705b9eec5c9b791b0be310462f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782363113, "uuid": "e4c131a6-ab6b-4da7-af5a-38a012f17dfa", "comment": "Malware payload (Vidar)", "value": "9b1717eb154011b52aa24e4d6848976a9aafff2665f3171265aa767d5951be6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782363113, "uuid": "7e4e0c15-9a19-4df8-9e0e-ba0d6a7ecfc8", "comment": "Malware payload (Vidar)", "value": "8208754335f380fb46057a3ca92f44da409cd2ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782363113, "uuid": "7ad6b5c1-e1e9-455f-83d6-b1410f001ed1", "comment": "Malware payload (Vidar)", "value": "8a3e09839b4a287f474f1e22de30f63ae229ff7a650ec9fb0dde68529e124269c97760cabef990e873e8c97089fb4235", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782363113, "uuid": "5c0b84eb-2d09-44d9-981a-b8d9eae7974a", "value": "T180D5AE07BCD418F9D8AA673A8DB661863B74B8090F7A27C32D9076792F327D19C36744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782363113, "uuid": "5d71ff88-33d8-46a0-91ac-29a66069cfa0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782363113, "uuid": "0438664f-bd63-455d-84d2-7743861564c2", "value": "49152:qD9cnaV3fqEsyTsrCpBKH2OX2NdaQoODDGm9Dl7xoms4Ex4w:qDVgXsBVOmaQoOmmzYDxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782363113, "uuid": "d3b99e0c-9bca-41d0-8251-6097809c23d6", "value": 2963320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782363113, "uuid": "d98f559e-95ad-4b9c-8b2d-063eb4674219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782363113, "uuid": "0e3e0d96-6111-4334-8b7b-f3ad6ccdd744", "value": "Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bba58e-70a0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782397040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397040, "uuid": "9cedfde8-3887-4736-b0a3-25fc0f9a3d91", "comment": "Malware payload (Mirai)", "value": "83da708da7b45af4d1b9ed78aff9cbf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397040, "uuid": "471e9780-47f3-483c-b678-a3c033b33ffd", "comment": "Malware payload (Mirai)", "value": "9b41f59c1a7bf49685ffd3bb3c9198b250a7786cc5572a152ea9db8c03f57563", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397040, "uuid": "501dd70a-2c14-48e7-a65e-f1dbe85459e1", "comment": "Malware payload (Mirai)", "value": "2f6e83b5859c76ca1c3693f279cb7b65d376816d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397040, "uuid": "4f92356a-f2ce-4739-a7e3-c069f42dcf87", "comment": "Malware payload (Mirai)", "value": "1e15310deb664ada1637518fe8158a9d179caf4c29748e970d3dee7b9070caea549891fd6cfedfbe6eb598e241b81539", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397040, "uuid": "86c31cfc-13ef-4223-9f06-0c1d4339e0d9", "value": "T1EA043901B30C4947D1632EB42E3FA7D193EFE9E12AA4BA45750E9B8D81B1D331589ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397040, "uuid": "b6e398fd-14d0-4def-8e53-b1fccad20d9e", "value": "3072:B3FlLWQoqzWrHid6INv8ndcxwBjiXE3YlLhruEu:ZFl6q6rCdnN8ndcxwBjiXEIl9rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782397040, "uuid": "75493685-a169-4496-925a-70436bf74678", "value": 178044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782397040, "uuid": "6081a539-5999-4c65-94f3-6d79b143070c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397040, "uuid": "c0d8f8df-a144-43d4-93fb-a303cca387c8", "value": "onie_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3c8db1-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370722, "uuid": "24d8d5f5-ad65-44b6-9f27-49568343c62d", "comment": "Malware payload", "value": "d41ed67f9ef8ed75ff6523997d8ee6d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370722, "uuid": "2ac211f9-20b9-4112-9f41-e01e63e5746f", "comment": "Malware payload", "value": "9cfaae3cce7b4d47dc25ea7dbbe3503b48663bdf9884c0181d239dcf7ba9907d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370722, "uuid": "c101f896-f1b6-45a5-9853-b93be02bb3ff", "comment": "Malware payload", "value": "8000d3ee67ffb8ba25252460d76fe57877811b90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370722, "uuid": "809f615b-a9b2-4f00-8767-45d4a3a0df54", "comment": "Malware payload", "value": "e8acaa59ef34b758accc290b70538e049d54cbbab6346cee37434bae6209f1c68833eca1c5109adcfd553a545ecdff8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370722, "uuid": "e4fab8af-a041-49de-98cb-37d738360db3", "value": "T1E7560797B9D24993C4E43637B8BE80C433635EBA9B9752566D05FA383EBE1D90E34304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370722, "uuid": "66ebb67e-31cf-40e7-893d-b982b38e4811", "value": "49152:NS6eHpnrncisLTeoheRLygwzE1CD4aK2OZ2qjg5Ev:4xBaqiL7K2OZp2Ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370722, "uuid": "7378b6a7-14dd-4647-bb9f-67e3ca816ad7", "value": 6226068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370722, "uuid": "e1e1b14d-4742-43ce-9924-55c27ac8dc57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370722, "uuid": "238b91d4-7b4e-44d4-aefa-0e3cb2a777e1", "value": "bioset0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4262105f-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370704, "uuid": "eac952bb-f794-40e0-968b-0b95b556138f", "comment": "Malware payload", "value": "f77a41bb8ec2950b60eb054efa751198", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370704, "uuid": "9fa907e0-49c3-4ccb-be5f-c0f1632e34c6", "comment": "Malware payload", "value": "9dc93f50c0af0732b4a78a54c1ec4f6277835b4912b53b1c9334e7c54f32782a", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370704, "uuid": "5535189f-245f-4bc7-b696-a8dcfb62e30a", "comment": "Malware payload", "value": "09662efb5aeca7c203c12737effecead1f53eab5", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370704, "uuid": "a83a06bd-0ad5-4a91-9f33-86bc6729ea96", "comment": "Malware payload", "value": "0ca2c0e3fafa3868d8f39df871c51e6f89c5be809cec2cd8d2a4b537aa142e78e6620851acbca2f2bb05524624e35c44", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370704, "uuid": "5dbf10dd-78fc-44d9-999f-b188c4a8b22d", "value": "T1E9753329C960F895D269203D65A8CEA659A84AC7393F32F07C0C5346A7FCC5DF8C99C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370704, "uuid": "045b6708-277c-4d69-bc45-612ed8d1e51d", "value": "49152:CqD8S7YCY2wPDpFScjJ3dssWQAjDk0LeXtrsXJL:zD88ZkFScdeDQAjnesB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370704, "uuid": "ada64541-aed9-45b0-b9c3-51e85b635963", "value": 1677260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370704, "uuid": "6ec45ab7-8483-4118-bbe2-15022a7ba3b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370704, "uuid": "6bbd97c0-b024-441f-9c3a-89da8adf788b", "value": "devfreq_wq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4859cdc0-7066-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AdaptixC2)", "timestamp": 1782372002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782372002, "uuid": "81641fc2-44ff-4422-84ed-5a428a9562bc", "comment": "Malware payload (AdaptixC2)", "value": "2aafc1c9d4ac9a9e99597e9253955e21", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782372002, "uuid": "9ef9e9d7-d57b-4638-bfb9-f87833bac6cd", "comment": "Malware payload (AdaptixC2)", "value": "9e070ea8c8eca0af2975e9c4fc7282a06e71cdd49347b064605d862206593af2", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782372002, "uuid": "61ed5c9e-94c7-4d72-adf1-cc11f0971981", "comment": "Malware payload (AdaptixC2)", "value": "a29c1c75713386be6c02e1b819b6c37dc7e9e7b3", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782372002, "uuid": "2fba2f5b-0177-4cfb-9a25-910565de6b36", "comment": "Malware payload (AdaptixC2)", "value": "360eba7cb1ac26ff6169e917a839cedddf77c90c92cba21afda565234992ca45f2a316c850de023390e991d63c2f7660", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782372002, "uuid": "61542e95-d12b-4158-8e88-9009e8f2d966", "value": "T187F76C16B7905555E27F933885BB8606E372BC29037183CF92A4B2782F73BD11D3AB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782372002, "uuid": "ee7384b1-2b7c-46a6-b9d1-d16dbb8d9687", "value": "24576:UbH/vBhb8kYZeb3bSBXHgxSygqH6/LAPRjaPJsb4FUPhPmyIg6dcSjA5zvNLMj3H:Ub/J58kYZeb3bWXAI01Aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782372002, "uuid": "58c7fd0a-f9db-4a67-901a-283986c30da8", "value": 71303168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782372002, "uuid": "033350aa-ea30-4069-8405-37249fa87d86", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782372002, "uuid": "80680fe1-ebf1-4068-9c1f-610c430c0b15", "value": "Gerber and BOM files.vhdx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39b6536-7074-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782378276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378276, "uuid": "e3dd4bfa-7e24-430d-8fe2-aa15e197ed43", "comment": "Malware payload (Vidar)", "value": "3df8ef81dc48c642aa5a6fb0a7a3d56a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378276, "uuid": "32c1bd47-d3a9-467b-bb8d-04d547cb882d", "comment": "Malware payload (Vidar)", "value": "a38a3d2fbfa94a870ad2a716356e3d4f09dd4e31edce3d4e9c5de543e4454ac2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378276, "uuid": "a248a0b4-2968-4a8a-a598-9083bc36a183", "comment": "Malware payload (Vidar)", "value": "a250ffa45a7e64b8c958c93fc18a467ceaf06f6b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378276, "uuid": "c509eda4-4ff9-4b2e-bf73-8bc5b2f519fd", "comment": "Malware payload (Vidar)", "value": "73e9c435e95522b7dc32e6d4e924f3af3f84e775103527ebd450e692907f2804b9553f1f12e4e5e245c8ab23ca786fcb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378276, "uuid": "f00e0799-28d2-444c-a9fc-4ca5ef549772", "value": "T143D58C0BBCD548E9C9AAAB314AB21182BB75BD580F3623D31E81B33C2E357D15D79385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378276, "uuid": "b6541e70-c643-4648-83a4-770b74baf48b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378276, "uuid": "8dbb8e44-3910-4d2e-8a86-b9a839ec1bcd", "value": "49152:VOu3sby6urGys8wKxY/o33G8OT7E81sYP41R:VOXW/ck6T7h1sYPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782378276, "uuid": "57bc14ba-f7ae-4c30-8ad6-44a176c070d7", "value": 2989440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782378276, "uuid": "e65ed901-469f-417e-84c3-ea58307400c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378276, "uuid": "a46b7a2f-d7e3-4c1a-9c51-4226567fe3ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6271f4-70c9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782414695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414695, "uuid": "fe458c38-8ab4-4da4-88bc-cf4b5c98e833", "comment": "Malware payload (Mirai)", "value": "9dedc7eee5d312e53a74b127dc840e0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414695, "uuid": "fd042075-a406-4be1-9afe-47b571a11ce4", "comment": "Malware payload (Mirai)", "value": "a567215239d03fed7ef0ab094d523ad30280461996a17cc56be444580b02d8ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414695, "uuid": "88d4325e-2ecd-4e75-848d-b7af9cf98f89", "comment": "Malware payload (Mirai)", "value": "7d304e6cc4437bd50225c6580566445a367c8174", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414695, "uuid": "bc0ab3ba-0bb6-4b2b-9802-47719eda1a71", "comment": "Malware payload (Mirai)", "value": "f5ad510ca8af3b6e9c04370d024200874307b409429c70517dc295a1889c3182cf7f12c2b5a12a79fc183ffbe1bdadb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414695, "uuid": "0344c7e0-8712-4867-9e31-a0e29c305965", "value": "T166A35C31BE79581BC4C4A63A32E74771F5F6478624B88A2F7C214E4DBF1066032A77B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414695, "uuid": "34be8bc5-1b47-4a13-b79b-5e6933b15faa", "value": "1536:YXitHb74fsGPv2o4yhOyhP2moyU3QVZ+go+55shtppySm:ci574fF3F4qePyiw+goIsbBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782414695, "uuid": "4f9aaeef-52e3-490a-9678-eb8b64cf6c34", "value": 99800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782414695, "uuid": "860b9b84-4fe2-4edc-b935-d7c2f8b78fc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414695, "uuid": "96ad7d3a-121c-4d55-ae4e-07d4a9bdf95f", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b54ada1-7055-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782364733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364733, "uuid": "b9511c84-68f5-4de2-a782-341b01bf8a11", "comment": "Malware payload (ValleyRAT)", "value": "7dec659ecec8d9ff214b5af9f0e54d38", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364733, "uuid": "e5e92d40-7479-430a-89f9-005e1a1f47e3", "comment": "Malware payload (ValleyRAT)", "value": "a58321399f8aa6098a602e0336e4e3e4910412fae67f35baacceb90cf93625bc", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364733, "uuid": "fc1f86d1-f1f6-4b38-b033-e185fb81bd59", "comment": "Malware payload (ValleyRAT)", "value": "deca2a324fd48fbb33a39ee4845e5b05f694ff88", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782364733, "uuid": "559ec769-2335-41d2-9274-c1e1ee5cd96c", "comment": "Malware payload (ValleyRAT)", "value": "8aacddebe0e173f454cac6afc63b2075df6236ac3a4dd5b05cf42aa5a070a8b95430b42c44d0deed9eb5be4b89e7b5f4", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364733, "uuid": "5c3d7c99-2a4b-45b8-ade8-84df6b82e96c", "value": "T150C6F14FF884EB3BCDECA2FA9EB345E543729C00A647910F628C765A5DC373C1A46259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364733, "uuid": "9395cc50-f79d-4db7-8465-094eb7ab6e18", "value": "372a8bd3ba4968b455522de45accd556", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364733, "uuid": "f4aae9af-00c9-4b41-94b7-f0c2fb2c967f", "value": "49152:Ko+sb6Le1BtKRFXVBjcxIa179ZEiYkp31KpFX+Kv24ub:H6Zvbjm7k18MBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782364733, "uuid": "f6cd4c40-468a-4acc-a8ea-090b09bafe70", "value": 11697664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782364733, "uuid": "d9d2d8f6-b4b7-49b7-8f7c-714767457d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782364733, "uuid": "86a74312-b23f-46bb-9b57-50ec57d7c68f", "value": "StallStepe1.9.8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca56136-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391149, "uuid": "d11a607f-4b69-40d7-ab20-afa86f47de25", "comment": "Malware payload (CoinMiner)", "value": "c666ed1b15cca96e76c8657d260f25ac", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391149, "uuid": "a8bfdcc6-3e97-45e0-ae35-3b02de2403b4", "comment": "Malware payload (CoinMiner)", "value": "a63e488f5742245f1436035ba1ddc4f81c74b6678d3014f265eca541b15a88e1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391149, "uuid": "21866289-ce99-427f-a1f4-fe7c2392d90c", "comment": "Malware payload (CoinMiner)", "value": "23e8c6bd0de11a29f46f805a709177e2d27de7db", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391149, "uuid": "0ddf8d46-c7ef-49e2-87c6-566e6d7ecfaf", "comment": "Malware payload (CoinMiner)", "value": "8d15dd16231940128f97200d3e453f3cd667610727d6f768fddf8ff9762780f99bcc3bd76d830192a5463577800d4eb5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391149, "uuid": "3de272e6-c759-483f-955e-bb501902b6a1", "value": "T136F533A133603CBCD59B877156E46FB2BA7D31028F21ADD356E269271E27FC61C61E08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391149, "uuid": "89d660e4-6d60-4622-aca6-0b0be8d89868", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391149, "uuid": "90fb3f6c-533b-41fe-8122-5ea7114992da", "value": "98304:Lr2jDLo5kspUbNoVWtbMXjo6wf9OvdSmY:Lk3VsSbN0gb6EclbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391149, "uuid": "63653109-3eac-41cd-b30a-6fbf203ad99c", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391149, "uuid": "7048449f-1c1f-4f72-9ca3-b71bbd0269ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391149, "uuid": "d0fcbfb2-3cf7-4d95-903e-177c4d8262bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe41e677-7041-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782356416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782356416, "uuid": "dd201ccb-0897-4f9d-a3b7-3d7933353e8d", "comment": "Malware payload", "value": "353d831ea59f2a9a29fc339bbd432e72", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782356416, "uuid": "34423ccd-0c5e-4d26-a447-3fa296e2f768", "comment": "Malware payload", "value": "a8484c9b65270cb49da643faf17994959a035be72203eb9b4f9e90feb37f75e7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782356416, "uuid": "65099e86-5ca9-4217-b6c1-bc276e70065d", "comment": "Malware payload", "value": "04c8fa06daa7279db6f09f7a17123c83540ade3e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782356416, "uuid": "24594a1f-cdc5-4224-82c6-f11470f38ee4", "comment": "Malware payload", "value": "d5b4793e70c82334efbe20cf81ec46a9fcafc8beca68f5ba2e3c1ee2ef2795cdac5d67b339816a648fe50ac3a5dddd68", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782356416, "uuid": "a75f9af3-49b7-45ae-b85e-299c3b6d7df4", "value": "T14C137D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782356416, "uuid": "34d5c6bd-53cb-4737-b23d-26dd696463f1", "value": "768:4XRWNGxV89GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:slxbco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782356416, "uuid": "58712c30-b6a2-4582-9e26-3ed1698a0317", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782356416, "uuid": "065afdc6-2cd6-4485-958b-e80cf42bdee6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782356416, "uuid": "5ac137e2-7042-4ea0-9b81-403c8bb9a50b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a830748-702d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782347471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347471, "uuid": "85bec0ab-265f-4085-9259-c77614b6885b", "comment": "Malware payload", "value": "0ae8ab8570544b8d7724d2207c85a77b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347471, "uuid": "63512e40-ec83-4b12-be12-57be7af9ea13", "comment": "Malware payload", "value": "a852f8958a507f7823fed1a0610df893b90758affeee2196fb9bddadbac06344", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347471, "uuid": "92e457f7-0033-4ba8-8b36-afd6fa0b3b29", "comment": "Malware payload", "value": "5a6688c9ae2e0afd3f545616b4c43742ada9940b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347471, "uuid": "aeaa297d-fda9-4920-a01b-ee8464e0bc82", "comment": "Malware payload", "value": "8fbe40d61751875eddcfb1004ca709065de5b40b64c9051ea821538791edb84c0452c0d731bd858b9b0225c838ae18ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782347471, "uuid": "0479abd9-c107-4662-a492-1afdccdfe170", "value": "T10695F757F49590E4C0EEE174C726A213BEA13499473837E36FA186F11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782347471, "uuid": "74329d81-03c8-480c-afcf-fc8d453643f2", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzBt:cqYUQuVDtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782347471, "uuid": "540e1dc5-02ef-483f-9486-e62d322305e7", "value": 2031616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782347471, "uuid": "97686f26-d2c2-431f-8473-822bde2bbac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782347471, "uuid": "41911776-6776-4aff-a536-3f6212921747", "value": "a852f8958a507f7823fed1a0610df893b90758affeee2196fb9bddadbac06344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c16f753-7029-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782345917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782345917, "uuid": "54a98a7b-f1d0-4b3d-893d-abd07762cab4", "comment": "Malware payload (Mirai)", "value": "6127527a67b5a43b28172321e7b33f2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782345917, "uuid": "b4b6da19-0385-4018-bcd3-72a4209883a1", "comment": "Malware payload (Mirai)", "value": "a880b428d160b7e38557c282c58387db908c982d905259a17d12c29bc2cae1a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782345917, "uuid": "4d158c86-047b-476f-82fa-d660f0c72d6f", "comment": "Malware payload (Mirai)", "value": "66ff02cda753d804f46c860e7ec0d029f466543c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782345917, "uuid": "df6fe1f0-5b73-4e98-8881-a7ea682f1bb1", "comment": "Malware payload (Mirai)", "value": "d7cc03bca238b057c9d5aa082e76795c5e45aa4448538536dd57ba1bbb1a89196347efef43fa1b48f68d245e1e7d017f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782345917, "uuid": "ae03531d-fa39-4046-befd-e0c323db2939", "value": "T1BD733A4678E2CA56CAC5727ABA1E918C331113F8C2DB3303CD15AF797BC695A0E7B584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782345917, "uuid": "99e3aa59-2f84-445b-b7f0-abfa2d3be247", "value": "1536:wtQpCAlZaBRj4jLe2AzHvi9RgVG3W4cFxutfKpgORORs7FFWw:wtQpCAlZi54BArKkGG4q4fKpPd7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782345917, "uuid": "06e6c7b0-b403-4860-87e7-c1c5125d8dd8", "value": 74892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782345917, "uuid": "aff23aaf-4a70-4f03-addd-3919a0fe1520", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782345917, "uuid": "8c9a3b3a-ad63-4453-a5e1-f20c6e351bd3", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a19a95-7093-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391265, "uuid": "8a59e5af-fc89-48b1-a04a-4754440928c4", "comment": "Malware payload (CoinMiner)", "value": "7d3b985fa4df0c0037807e337dc970fd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391265, "uuid": "be74684f-9b51-4ec7-8b56-e5b126079843", "comment": "Malware payload (CoinMiner)", "value": "a8936a401395781773004cb920cd89f02200f2a4ee25a1b241e593b1d3f544d3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391265, "uuid": "2735b6a5-2b7a-4f87-ae36-d7bb48388911", "comment": "Malware payload (CoinMiner)", "value": "cb2badc43d22cb7770ce6aa1131b7b316d4f9ad3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391265, "uuid": "b8aebc07-755e-4bcf-ac8d-c341d1ab4444", "comment": "Malware payload (CoinMiner)", "value": "dea24be3dcc727769c3de0d83947f86263c31b73577437719e2b31d98a233e1f1274a0a131c0e45d2c2005b78f05c100", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391265, "uuid": "6196227d-e5a8-41fd-a02d-39eab375edc1", "value": "T1F0F533AC0584E0B8CAB10434A6AB2F44793E624907F7ADCF0799F9F53DA37D56E39184", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391265, "uuid": "d2f5e4c0-7563-4351-aa8c-7a6556cc317a", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391265, "uuid": "91a58ec5-67df-44d1-8c9f-8420fbf90c37", "value": "98304:aONnx9O4YUCTiV12h71P1cP2xtgEWNtp6KfKQ+3a9R:f9H5L0R1P1ce0fkKfKlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391265, "uuid": "aba47360-438c-4d1f-bb94-9f1f9b4560e8", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391265, "uuid": "0db83894-4b9b-4973-9349-d663cbb432a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391265, "uuid": "da0b8c9a-ac21-4b44-8dfa-6129473150c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7278cf68-702d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782347592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347592, "uuid": "9803bcd1-e31a-40c8-99f1-0c02b8a0f840", "comment": "Malware payload (Mirai)", "value": "e7b613a6234566db92597eade91a135c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347592, "uuid": "5d532f1f-70b0-4be4-a1df-a0c67490afc2", "comment": "Malware payload (Mirai)", "value": "aa14067a93d55af1624194f22ea30de722bbc81e133c5919be4129b4deca91d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347592, "uuid": "1abcb851-b122-45b0-8510-075ccfed4b54", "comment": "Malware payload (Mirai)", "value": "be2627c6270a4065cdcb476439c328a8bafdc1f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782347592, "uuid": "7a08721c-6646-4dc0-ac7e-11670cfc46b3", "comment": "Malware payload (Mirai)", "value": "ed51a10041a60b365996e5fa64674985dea5a6f25bef3e8b54802105958dc03cbcd56a1f70ab8c61ac2041bea3557f8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782347592, "uuid": "03cc39c7-6bb8-4c1b-b0bf-c13cb5c5a370", "value": "T10163AE97C43B2E40D586A6B1A0F5CE79C743D50193430EB72A9AD67A9487CCD724F3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782347592, "uuid": "baec6bae-77b9-43fb-b910-2c5591a9359b", "value": "768:LNYF5wDho80IcIzeBiCrWf9BNDJs3EWvgoyTGGRHno79oiAX9ICiCWdu:t7zeiMW3T+EWv9yTfm7yiYICiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782347592, "uuid": "fe90fcec-8883-4419-a28e-b0de30b82a69", "value": 68536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782347592, "uuid": "a8152321-125d-48f3-b577-12e2a03367af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782347592, "uuid": "42eae507-ebee-484f-ba97-0e37e6e1fb69", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59329fb2-7072-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782377185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782377185, "uuid": "3d23bef3-45ae-4fc3-88d6-db3056462538", "comment": "Malware payload", "value": "a9625dc5a2b6927099e7d4e72864ed4c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TA416", "colour": "#501B1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782377185, "uuid": "eabc13ea-fee4-4aca-90f5-029f3a9d4b5f", "comment": "Malware payload", "value": "aabccc0a59245de52469e0daaa5300fec91d66c86d98d4dee3df09776ed4751e", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TA416", "colour": "#501B1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782377185, "uuid": "e6440afc-cc78-4df3-a32a-4088f9612a4a", "comment": "Malware payload", "value": "6bce6658601a01756d3d48a32ff0e0bc8e28c05b", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TA416", "colour": "#501B1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782377185, "uuid": "8557fbb6-3d8b-4886-8017-e4feee346d36", "comment": "Malware payload", "value": "6d49ca7bf1b32f33b9dcdbfa8c3a573102e7060dcf6ac55a26948beea9081848c127860dfe9774dc5697540b0adbd0b6", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TA416", "colour": "#501B1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782377185, "uuid": "02cabb9f-4698-4347-9e4d-4802372ff364", "value": "T1FEF35C007046FE66C2AE467C25F05A775B3D7EF18A21595B23634FBEC620AC1DF18A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782377185, "uuid": "d98796f1-5e5d-480f-b320-b93f81a30542", "value": "73472121f26496e06177b63fad3acac5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782377185, "uuid": "9b314d01-ce2e-4e0e-9c26-ec5651cafa27", "value": "3072:C7QtIApoVca+N7sZ7OIArU6n4sVRQu0T0hCufA27A+21VcwuL68Ol:IUIAp7ah7O9rU4XVRQu0T0hCgHA+2Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782377185, "uuid": "ad79d864-1632-4a00-9950-acf23ea864a3", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782377185, "uuid": "97b215b0-2a24-495d-93eb-f011b7336de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782377185, "uuid": "21805b8d-5d5c-49b3-9de5-638d8e6dd051", "value": "a9625dc5a2b6927099e7d4e72864ed4c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24936429-705c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782367647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782367647, "uuid": "75d2a1fa-4aa3-4d4c-890f-7e2d10d82ab3", "comment": "Malware payload (Vidar)", "value": "8ba608a4387e67dfd407e07bf04c83f2", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782367647, "uuid": "6ce3fe71-224f-48a8-83a1-73c7fc5cd676", "comment": "Malware payload (Vidar)", "value": "ac1a4d8a2c2bf91b75c4c173424b4b142ef29aa7356ee9e05f043e4faeab94dd", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782367647, "uuid": "c5470d3e-c4f7-43cb-a341-7b8d4003767b", "comment": "Malware payload (Vidar)", "value": "f88feab7ef25e79712839093fdfe3f4dad207da5", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782367647, "uuid": "78155601-0d49-4bb9-a71d-bfb77b5dae9b", "comment": "Malware payload (Vidar)", "value": "5f0eccc4d8e9ccf7bb787640f38a76906c681d8784e2132d322c8fc094a0b0612522b9bfdc58871d2d0687fe9c029ac9", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782367647, "uuid": "aa3960e0-1464-4a4a-b1ce-46e4974c49dd", "value": "T1B2E5AE1B7C9048F9D8AA573998B661857B78BC050B7613CB2E94B3782F723D0BD79B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782367647, "uuid": "c98b746b-d7d3-4275-9df0-3f7d692c832a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782367647, "uuid": "e4c1ce2c-0f2e-405c-a2ec-10903979ed0a", "value": "24576:02W3Vs3m4e+xeJDIEWiX9TMt9Q9j+otBclY3ilEEsWy3+SXtxzBele5rK2mM48FM:02Wls24e9JsENBM+zqpa3543", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782367647, "uuid": "79c75ce2-e3b3-4924-91cd-47ce78661ddc", "value": 3142144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782367647, "uuid": "af848da8-5ba6-472f-9395-cf2b3f2ff807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782367647, "uuid": "256c6f58-0417-4fa9-9b90-9f283d0ff72c", "value": "setup-1.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e0d8da-7037-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782352032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352032, "uuid": "651354bc-fcb2-437b-8d26-57093f9345dd", "comment": "Malware payload (Mirai)", "value": "bb8c275a6914d61313f9091df86e01bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352032, "uuid": "4334459a-d11d-42e6-97df-8c4b68a86c32", "comment": "Malware payload (Mirai)", "value": "ac4de25e87b96bd85e9b50e1688cbb6ccef9de8beaac552180fe0547586dc968", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352032, "uuid": "42266fd5-9a81-494e-aa73-856b24ec9205", "comment": "Malware payload (Mirai)", "value": "c50c99fc179517cdb605d8af09f283e5b4662e48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782352032, "uuid": "5d88e4b6-9670-48b1-8ae8-ddf54465821d", "comment": "Malware payload (Mirai)", "value": "060e9e18d4d2527bfc9e4f3c8c971a6feb031dfe851af7b8e419695b4317b2d466dcae59e386eedc2480cea193029bed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782352032, "uuid": "ff638455-0e1d-4092-b28a-ae27c50890c9", "value": "T116734A876411DEADFC0FB67A89174E05F539E7808F520E33A3B2BC678C560958E6BE11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782352032, "uuid": "80886bbb-0a68-4d41-ba63-173202b87df8", "value": "1536:MT+yqzisf5dVYFKsBcIqmgMsKcwUwBcAnA9Dg4fS+bEVdMh8XmzqK9k3Lr9v6s/g:MCyqzisf5deEsBcIqmgMsKcwUwBcAnAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782352032, "uuid": "5abc2c87-7e11-4993-a613-05113b22a7ab", "value": 80144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782352032, "uuid": "9d79d294-8122-4694-b9c4-a289d901124b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782352032, "uuid": "baa3c320-b9f5-4459-848d-23af735ef165", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075d7e52-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390791, "uuid": "123ea862-7912-47aa-bf74-590877a9feb1", "comment": "Malware payload (CoinMiner)", "value": "805a1412233ed58144381ecd904e10be", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390791, "uuid": "4e027580-e16e-4d24-9854-4aa33c0bf179", "comment": "Malware payload (CoinMiner)", "value": "ad78fecd0f39e1c15214d0f9ad5b0bb77d93705ec95ef8da8b3270dab8410f3c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390791, "uuid": "56b405b8-7dc6-4301-a7d7-37d72e9d842f", "comment": "Malware payload (CoinMiner)", "value": "556b1f03384bd5e94d1af8f973ce958c8a20099f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390791, "uuid": "85b195a6-5e70-44f7-9f89-b35442b4db01", "comment": "Malware payload (CoinMiner)", "value": "d87d65319c2d878bc981966544fdf066f63af3415a3ab7fe950d1b968e5238d084b03e68d2e7039b7e03f4f849c321bd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390791, "uuid": "c28f9a91-7eba-4b12-8982-5d82acbcccfa", "value": "T138F533DA9A8DA1FCD5849834CB728936341A3EBB1BE2A4E776D0C5106775FC05E7C8B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390791, "uuid": "072ce489-75b5-4d78-8414-ca1683297e4c", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390791, "uuid": "0f84a968-6ad3-435a-bc04-81364eb1acee", "value": "49152:0hsMySJNAtCL78RWPPSk2OY5zp29EDaBwuXhPdQf6ipjzN7Uf1Ktu9oq4PB:0hs275o512eWi4QysdINb92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390791, "uuid": "15eae7e2-d2ab-432f-b0ce-5882f74e0e52", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390791, "uuid": "3038ee9d-b6ed-4a4c-8ce3-7c9b80b79f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390791, "uuid": "444f5752-8e0c-435b-8690-80728c3922a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bddcdab-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370747, "uuid": "27ca1f9e-5049-475d-8e1a-e8b4f097215b", "comment": "Malware payload", "value": "49b88d9c3933a8c27816f2ee7885ccfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370747, "uuid": "65823367-3945-4e51-b39b-aca8df89e504", "comment": "Malware payload", "value": "ade50b5fefb7900c9928ac98aa7538112a39f8188776d6b5b01310f7edfad8e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370747, "uuid": "17f03aa7-3e59-48f2-b811-f44938254a45", "comment": "Malware payload", "value": "fdfa1c89633061301618c828bd297e2d42cfc57b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370747, "uuid": "f6141d53-b5af-4d29-a3ef-1cfff4cc3f59", "comment": "Malware payload", "value": "0760e52480f82d3642c613d30bdfc7252de696524b4f3ade89874eabcb24f6b0d57590b964f5df681b77cef859f7ed7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370747, "uuid": "bd1c65f7-9ca7-4212-913e-3f13857bffff", "value": "T1C9560797B8D24943C4E83677B8BD81C432635EBA9B8A52566D04FE3C3EBE5D90E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370747, "uuid": "0c0a649f-bffc-40f2-a272-0a50c45ebfe9", "value": "49152:l4Lpien/eD+XmdcFovn0BuzzPxGjE53D+y6vL8ASFVQQg5Ev:l4UvDC6x3D+U8Ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370747, "uuid": "fcb6160b-c7bf-425a-b58a-908badb6ca7a", "value": 6160532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370747, "uuid": "b9472a40-1dde-49aa-a56e-f2031da8e090", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370747, "uuid": "0a014646-fd0e-4112-84ef-3fae0ca5d8ea", "value": "jbd2_sda1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c32156e-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390477, "uuid": "1c5eb09f-7f5d-496d-852e-f26c2ace44c3", "comment": "Malware payload (CoinMiner)", "value": "db1c710f7f5576ec0308a1815c3883bd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390477, "uuid": "22dc454e-9ac2-4ad5-b514-99e3e436ae87", "comment": "Malware payload (CoinMiner)", "value": "ae6e65d00f1bb515ff1fb8f049afc360161fa38260e0bf1329c2dde072d70a67", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390477, "uuid": "cff9ed63-985a-4fd8-ae17-88513116c6ae", "comment": "Malware payload (CoinMiner)", "value": "48157e75813d38bedbb74ede75ae2a9add5c45ea", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390477, "uuid": "d370e7d2-7332-4075-93a1-4c141ec611a9", "comment": "Malware payload (CoinMiner)", "value": "1137d2ee24b6ebdcf4287a35b6cde3da341d0ab263cf05f05c71e91ea8521cf4d10b928d0c74a4d2a2828606664b711f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390477, "uuid": "fd83435a-4441-49ba-bcea-ce102764707e", "value": "T11DF533C925D630E8CD5DDD355B19BBFBF45A72626F122AC704AA6B304933BDC0A32D42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390477, "uuid": "4fea517b-023d-4ce3-a7d8-08174057d76b", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390477, "uuid": "97545c16-b752-4e07-aea9-abb1601a11b4", "value": "98304:PzOHXxHVz54cZun6TXZIroI2LZr1mzFWz:aPt4j6TXZIGMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390477, "uuid": "52087084-bb5e-4b95-bb28-1d9e81872133", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390477, "uuid": "156b5347-1600-4846-8959-eec38a91bba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390477, "uuid": "800cf78d-d5b4-4a8d-9cbd-c571a06cae86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c99688-70e2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782425554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782425554, "uuid": "0475d63d-49ff-4e9b-bfe9-3438dc0c0c98", "comment": "Malware payload (Mirai)", "value": "085183fb4b9b79b6fc45a58c78bbcde1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782425554, "uuid": "ebd6a3c9-e090-45a8-bc55-0f6374b701b7", "comment": "Malware payload (Mirai)", "value": "af46ef9ec0e2095be44fa101c3109cc7a98aa82977dc4fabf5ee37bdabea0dd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782425554, "uuid": "7943922c-ee9b-452b-8c03-3e432cd69cbc", "comment": "Malware payload (Mirai)", "value": "170122e8d6b4133be9fa88c7bae9701bee0dfb6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782425554, "uuid": "9c10330d-3198-4464-b5a7-31e79dd403b8", "comment": "Malware payload (Mirai)", "value": "9dc31670aac229ed77e5f8907474899b1c2ac683281fc2ad9823da05c12cc937430d8715e0c713ebecf61c2c70241e9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782425554, "uuid": "0e0f66ca-9c76-4554-a4a3-086356ece76a", "value": "T166144B43EE890EDFC45BCDF086AE436B29E7659F49D1F1F5943C8C48385928A45E3A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782425554, "uuid": "223f8903-0a57-46ae-a39f-6925f5cdd2f7", "value": "6144:D7aIQgYKhvlhRoKmER/3zlVzhxkhI/qI:aUlhRoIThKhI/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782425554, "uuid": "a32441a4-b07a-45b5-a395-debc075e4e29", "value": 208652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782425554, "uuid": "6bc6fdf2-a473-4b3f-97f1-5c82002d0d60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782425554, "uuid": "a46759f2-0396-4220-900a-4775ffbff36c", "value": "data_mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0c8e6d-7099-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782394133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782394133, "uuid": "6f8d95cd-eb05-4f1e-81b5-6cdbc36f8a22", "comment": "Malware payload", "value": "6e25279e1cf3f9aace9665bbbce638e6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782394133, "uuid": "442af0d4-c0d3-4da1-93a9-dc63cd9eac2d", "comment": "Malware payload", "value": "aff7ce89f34db37f91be6a3f1f3ac9dd43fbee4902a8652323f50676cba22e7f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782394133, "uuid": "a06959fa-b98c-4e0c-9056-432d07f059a1", "comment": "Malware payload", "value": "59138a25033ff869d57bd7d4c4c61e0bf7949c38", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782394133, "uuid": "096c0a28-b82e-4212-a443-d55e8fb70ae6", "comment": "Malware payload", "value": "68eea054e2247eb554d8e1d4f8c2595eab8eef07daf659cd570037b58aa66a86bd4ecd9f8777a180bf2be5d031731b5f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782394133, "uuid": "52def633-9197-4e22-bd36-7da74ed1ac6e", "value": "T17D8532389B7B8005B6638B745A9439C6917E26A203DF7E851BB31DDD0B52B0278B173F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782394133, "uuid": "ce2ddc6e-778e-4f8f-8441-a79d29e9f8ef", "value": "3072:UEZj47+Y2UlcRkSYBBP8YHXE/WXrppYQ26HMnjO66FtBqUXiMRepuxn9FAxfavXU:LW7YQjupspnoUfURlvSVjGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782394133, "uuid": "ae3472f3-5f23-4adc-82c5-4eab13fd2f6d", "value": 1795268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782394133, "uuid": "881a5243-3380-4e57-b3aa-c99e00f64742", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782394133, "uuid": "79629018-827d-4299-bc9a-a0dc528a77d5", "value": "output_jtbivnr1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed638f3a-708c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782388600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782388600, "uuid": "4b3c9d84-e919-41cb-a273-dfe6593f7881", "comment": "Malware payload (Mirai)", "value": "4d1ebb7dc9996a10052d34e59460dfb2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782388600, "uuid": "59ecc1d9-76c3-45da-aadf-c32e19e55a2c", "comment": "Malware payload (Mirai)", "value": "b25f2efe97508480d4cdd9aadd98ffe795494bc640b2897e0e901cf30d63f84b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782388600, "uuid": "d7674cc7-ac15-4ce6-a9ad-a2d56c47d60d", "comment": "Malware payload (Mirai)", "value": "55e0756713edfb7faafab8eb58264428dba0c27a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782388600, "uuid": "ad6304ad-5045-4177-bada-28b7162f3120", "comment": "Malware payload (Mirai)", "value": "f65ef9a13998d83d0527891fc4d193c43e44bfd9a094308630900b2470ca2a43533dcbdd8d35defd1f5fffb927098e8b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782388600, "uuid": "baa4f254-9a25-4156-921f-787aa6f9c73d", "value": "T18E3181C91085B17B6DBBEA2375F589053280989BB4D9BE1CDCE8B8E584CCE14F4C0746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782388600, "uuid": "6370c04a-4fec-4834-b101-f7e90797725d", "value": "48:vpuVUphHUpBO/KWUpsyXAUp7rUpmfUpFDUpxzUpULUptDn:v6UvUnWU9AURUoUTUnUGU7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782388600, "uuid": "ced4ebc4-9a9e-4b48-8d38-b4f2b6c5241a", "value": 1653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782388600, "uuid": "eb2e83d0-75a0-43c5-8844-2034721e6b63", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782388600, "uuid": "71fa22af-e768-4bc2-ae99-450a6f567ccc", "value": "sensi.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b2ce94-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782390944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390944, "uuid": "43a29170-3159-4325-9b31-eb22e9421e09", "comment": "Malware payload", "value": "9bea9065522e50da762cbf01b5db29b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390944, "uuid": "4f121680-5fe1-4444-b329-13a703e45fbb", "comment": "Malware payload", "value": "b2fc3d0c0b510fd1181f5aa5ac521d77373f19b55d2b56fc34701f5ff12e5542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390944, "uuid": "9fd06924-e0f6-4a99-9c31-2370f784eb7f", "comment": "Malware payload", "value": "49c368b8df1a35caed136bf143b79dcc29089ac0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390944, "uuid": "38ed68ef-237a-49b7-a131-a79fbf1e7282", "comment": "Malware payload", "value": "2f90711f602f938b8e5489327bb3a55be3cc03fe1619c5415d55d924f6633cf9f815964f51309626751679640c0ffd80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390944, "uuid": "c1d629eb-438b-4ed8-9598-7baaa5dff645", "value": "T1AF03F806D7A350B8C46CC2B5D23791266FEF38540B50BADF27A13A38BD717D4A538E61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390944, "uuid": "74b83ef6-8f92-4e2d-994d-d7d3420a9710", "value": "b33b952b1371ec8f206dcb0a159f4ed1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390944, "uuid": "d4fe1334-03f5-47b4-9b12-67a3f5767858", "value": "768:sNdRaRYQQapjtboE+8VHzok+S3BQ8lVfy/SvT9w94DbF3dN68Ok80GAAAAAAASwL:ydRaRYjIpbN+8VHzZTlVfy6vhxpi8ywL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390944, "uuid": "d98e4f94-0e33-4e7d-9416-bb63738d6841", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390944, "uuid": "89c4d58b-b871-4e03-b252-5035986bae71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390944, "uuid": "d0f731ec-cfb9-49ca-8616-798b3eb9e36b", "value": "framebrokerservice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d23304-706a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782373990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782373990, "uuid": "a12e0387-b196-4822-8cc2-3341aa2eb1b3", "comment": "Malware payload (AgentTesla)", "value": "8e584b7f95ee67a337c103260f122413", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782373990, "uuid": "be5983e3-fe53-46a4-8404-d8d5b332a392", "comment": "Malware payload (AgentTesla)", "value": "b481b6034d399f7f85877662838d4cd461a8ef5ae694b2cd44fcd9614b8842fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782373990, "uuid": "bdf3e402-ad5f-4d85-a824-edf8c641ff72", "comment": "Malware payload (AgentTesla)", "value": "d0e187f73008bdce2ff5a40312cb32d13ed0d69c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782373990, "uuid": "ab946c47-97cb-4a43-9840-a03bd4355fd7", "comment": "Malware payload (AgentTesla)", "value": "f5c449954a181ab6e9fc44028f91ca83f0cbce40210e8651c51090a4150f3a11ef24513fe8ed81b5840e39eac47f5713", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782373990, "uuid": "546b9394-b396-4a7c-b963-b339b7a16e91", "value": "T1B52401046760D05BE95585B0C97BAEF81EE0AD22DEA0875B23D47F0D7939BC1DC2A329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782373990, "uuid": "b2bbdc38-8747-45e7-9c17-e4ada49c5704", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782373990, "uuid": "28934f52-14c0-4853-87e7-427eaad172f0", "value": "6144:RMm4CCBM3hU/hFaslnT4gHo9ROhUvUmoJRp5na6u:RMwNRMhFaslnTrlhUcmU5at", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782373990, "uuid": "6f5973c3-3ce5-4e41-a387-057cbe8aad8f", "value": 229744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782373990, "uuid": "772dca03-06b9-4ad3-b2fc-6ee61f1aef8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782373990, "uuid": "f3c0d2db-bee4-49d1-ad3d-521af4ba868b", "value": "MCPO-0178-0179.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c93b662-70b5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782405913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405913, "uuid": "4a676a3f-b1cf-4281-97d2-78b606d879bc", "comment": "Malware payload", "value": "8ab83dc8cd4d1bafa5ee60dea52f15c4", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405913, "uuid": "76983701-66e1-4522-89d4-4ab286f670e0", "comment": "Malware payload", "value": "b6badf6e275161491286932e8054ac9b3406e3339e159b3c3b6cea312df49376", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405913, "uuid": "8b6b160e-3f7e-4681-b624-94e40d4805e4", "comment": "Malware payload", "value": "ee179d3b635889ca69781f89884ff5a00caf3ca9", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782405913, "uuid": "6b06459e-0b46-4aa8-92a2-38b3b3420a18", "comment": "Malware payload", "value": "ea085a333e9dba8e8a096fe9c1179b123375f9bb620fdef310d9c42828fc469c5d0a0a764d6b24692a280a5d79e9a794", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405913, "uuid": "078bfda2-1a7d-4bda-882e-3f38068da294", "value": "T10C06337F258BEA5F92EB0003717CBA39A31966BB7C60DD4603D9A1647F04DB84F78846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405913, "uuid": "f64fea5a-136f-4865-a6a1-5ca9192a3f21", "value": "98304:9gm2BcZATgC2/LMaf3UjWA5vLR3CFI6Ogi7mvpoM:9gnKm/2/LMaf3UP5vuI6SmvWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782405913, "uuid": "a9cd7431-610b-4043-9e7f-fab687c6afeb", "value": 3814023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782405913, "uuid": "db36b87d-0c28-4abf-96a9-df92385d81e1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782405913, "uuid": "f565a40c-0a6a-44e4-8964-ea58f792b2f5", "value": "Binance_Research.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12fd8fbb-7080-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782383080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782383080, "uuid": "7b70014f-9575-4f17-a8e7-2490949d43e0", "comment": "Malware payload", "value": "6d63836741356e512bed76c4aab076fc", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782383080, "uuid": "deda8f43-e33d-4c45-af2e-79d7ab02243c", "comment": "Malware payload", "value": "b708cee39b700ce2aa16b89134b7c5d0a3a8d16445ecbf970121e984ecb5cd3a", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782383080, "uuid": "87269517-7a29-4753-8362-5e26f0b7bd26", "comment": "Malware payload", "value": "f940485f5b933f3ec4388d4f72106f49372e95aa", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782383080, "uuid": "c9452bd2-7f02-444d-9f25-023a6c741b35", "comment": "Malware payload", "value": "c2482d9ca1b9dab457bdc10329e5c0b4c8c6b8c760996b22484ae75cc7103cabb6b01359aa4533f138f47c129d49645a", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782383080, "uuid": "9f7aa556-080c-45f6-90d4-a0401023fa71", "value": "T1F1419095D11079B9D1F02D8C0B240FB8F205D6EB59D27BE9B28128F6DC057A8B26BB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782383080, "uuid": "06a1db4e-8cc3-4198-96a4-cdc40d07a3f4", "value": "48:YcLp0u+/u+uC/EuPu+Cuyr8e/lg2yuCyuFU+n3Rn3PnxuCcVH9WuO34uKt/OjIja:p+GHC/F2+DkeUwBnhn/nACcVd/O3xKtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782383080, "uuid": "a1fd0829-ca60-46c9-8225-db7b525c0cf1", "value": 2220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782383080, "uuid": "33c6c0d2-b061-4ae2-920a-ae91131130ae", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782383080, "uuid": "1e4ce68d-aa2a-4074-9529-f00b3d972c89", "value": "config.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773b12c6-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390549, "uuid": "5740486f-57f2-4aad-a1f3-909b9ac447c9", "comment": "Malware payload (CoinMiner)", "value": "303e4d07247fa4e5685473e2bbacfe38", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390549, "uuid": "f35e18bf-6b17-495a-8bc3-f89e536582a6", "comment": "Malware payload (CoinMiner)", "value": "b78a156ab33beb6fd8b0bf5283b9a9c67af2d42bc544ac04023185ab1eff5e73", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390549, "uuid": "17f19643-cbde-4021-94b1-7a3fdc111908", "comment": "Malware payload (CoinMiner)", "value": "6ad7d8ad7ac77c7fbdad465d94f644e5833c11b2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390549, "uuid": "f216cb31-0ff7-4aa9-84d7-481717e1b636", "comment": "Malware payload (CoinMiner)", "value": "d69c2405e030858cdedbbb6414a3e287111e8bcbea0074464ec9fadaba817029b3fb4264ba2226adf92d8e91a8a6b02f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390549, "uuid": "f48f71ed-c550-43e9-9c38-063f4f2db3ed", "value": "T130F533CA166150F8F8B6C5B4AF02CF52986A34F7AF49F0E7288563903DB45ED6C36D90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390549, "uuid": "d3e7d69a-74d5-4d5b-b617-f815be893f1c", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390549, "uuid": "ccd6db42-6b68-4ac8-81a0-9d19055fda0e", "value": "49152:uNgufrgWGycE+4myS5G+fN34CVnjCYqd8Rcat0nQcBvchOjukxQ:uNgufZ+4DcG8dZsYwHJQKPj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390549, "uuid": "b2199199-5a9c-4508-9d97-d77596f6e911", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390549, "uuid": "2d61d42d-188e-447d-8da0-73aa817d778b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390549, "uuid": "6f2a33fc-c94a-4918-bbad-4ed5f07c9ad0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436c885f-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "3c70d292-6f7b-4168-b3f1-fa06ecb1fa70", "comment": "Malware payload", "value": "59fab119a8a9d51de588a6f0e0ee6784", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "94c55895-a64d-4017-9a1e-f60dfbc9f34b", "comment": "Malware payload", "value": "b7eb2971bd85907c6d2e9cafc3a71c8767410443bbda4dcc986fdc272c03954e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "7b30bff8-e8ab-46db-a405-dbfbb2a3c83e", "comment": "Malware payload", "value": "ac66695582f40cf8e5318b79a5ab1330688b2df8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "22674602-106a-41a9-a3d4-b6d9c2bc362d", "comment": "Malware payload", "value": "5ad6dd3e40cc0113ddcbb4cc71efa40325ebd7c897e3ecaefd1cd1a3c95f72508f65e5e348c58679e1495a58efb8c36a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "a43d39af-8fa0-4a71-b7da-494ec21cb8a2", "value": "T16A95330B025CA762E857F06AC536136ECFAA6C9B44B8320CB714CA2C178DC7977BD5E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "2a29eba0-2aca-45e1-867f-2efc8e07664d", "value": "49152:ANCpSVzW7SRI+AklmfxvXUXnyByRFe0cOxs88CqoIhd8:EqSVzWMIQ4VEiBwe8CCAha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370706, "uuid": "f09e2ca5-9e53-40ea-a7aa-0104c56f7b7d", "value": 1995288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370706, "uuid": "8f95e1cb-9526-4161-abe1-2dceab9cb5ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "532bb61c-30df-40c3-804c-cc3b3a6d9e53", "value": "kworker_u8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85761fd3-70c9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782414625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414625, "uuid": "a9b4488c-8819-44a3-8329-63dbbd1fab67", "comment": "Malware payload", "value": "142fec413e0481edb035253640390294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414625, "uuid": "938505f9-b4d8-48f4-a4e4-241d0dccc820", "comment": "Malware payload", "value": "b825fd216c3dad93fb43b89378623901f9f1cfa99eac5acce081c5e00c1107a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414625, "uuid": "05b29bcc-ca63-4816-913c-7a3c01d7b619", "comment": "Malware payload", "value": "b8714f08cf82eb82250bc7f261028d77255a5a0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414625, "uuid": "52bf779f-b053-430d-a386-1d43c2eec99d", "comment": "Malware payload", "value": "ed715050bd11f9e03f5684c457a7e5c58ccbfe9b621158db77d268d7d0adb3f287d3025091b654e584a1b1cf10003a1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414625, "uuid": "7f8c5a16-37ed-4524-b062-9bbd8209f394", "value": "T1AE08335F37B9D017C921497B72E61A716E80A20FE474181E0FC53A9827E91CE45FAEB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414625, "uuid": "c31b1703-9cb4-4536-b3df-c3dbaabbfdfa", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414625, "uuid": "6589e296-9099-4bae-9dd0-3d3549333e9f", "value": "1572864:Lt9IKPkws+8krdAVcw+WDmzBXGa4mYKtSw+vOFlP7:LUKbj8kruVYhXGa47KXFlP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782414625, "uuid": "40edf625-9fb3-4a5b-97da-6a12bd7d096f", "value": 77454385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782414625, "uuid": "589eedc7-e00f-4f38-b2b6-1fc6b73f16e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414625, "uuid": "a8f78e70-8d11-48cb-b13b-ac1c795aaa25", "value": "Natsuiro Lesson.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78dbc001-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370795, "uuid": "1d077d9f-47fd-4de8-9344-93dea54c6409", "comment": "Malware payload", "value": "c95fea08041caf2b31dcbd7e423b35d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370795, "uuid": "151aaa1d-cf06-4552-b7bd-d3bd69d64957", "comment": "Malware payload", "value": "bafbe7595e43dde49ae34963e59ca5d76e953a46f848d02d02eed6b2c8ff7595", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370795, "uuid": "83d95e5a-5043-4ee0-a034-dfef37261254", "comment": "Malware payload", "value": "87097c051df72a3cb7b56eccdda01794a9f51840", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370795, "uuid": "6816d9e1-4c5f-4506-975c-7020ee6d8ed6", "comment": "Malware payload", "value": "820a65c4e6a556b32102667ffcdcabf396dd50b9136089e84c5b02d0e2b95bf4422fe56ffc72b6e450d9ece8825ab799", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370795, "uuid": "377a0a68-892b-4ee0-b263-a25295df236b", "value": "T176566B55FC1D7462DAC976752F7652843239BC484F82C7232A18BB7CAAF2358CF63261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370795, "uuid": "0cb0ec28-65fe-4b3b-85d0-e6e4e5a16429", "value": "49152:7y0McJBVqFk1MzRy077r/RGatEx4BCejWPcMd35ES:7hMcJBCIGRyg7r/0atIs3MjES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370795, "uuid": "76b7e997-ec1f-40b2-9e73-3aabe9c69612", "value": 5898388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370795, "uuid": "ac37046e-2510-45a6-82fd-c30b93b5e5b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370795, "uuid": "2f49afa2-cae6-45d4-9313-68bc85621393", "value": "rcuop_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f8d107-70c7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782413906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413906, "uuid": "62d522b6-94af-4d2d-8083-e1707a900129", "comment": "Malware payload", "value": "2fe76ffad31bc6945809f5a734b86da9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413906, "uuid": "f4293908-fbc0-47a9-8eab-bf5104c0f34d", "comment": "Malware payload", "value": "bb885bf6e5cf58dfa576c8bdd006f80c779ae33a446fc152652eac71ed8db27d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413906, "uuid": "cd6cc02a-da9f-486f-a86a-bcae740e9616", "comment": "Malware payload", "value": "ca5c0bd1177893eeb4af6ec9bd35704f1a654558", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413906, "uuid": "442c6812-9d4b-42fe-a022-a1e095c21105", "comment": "Malware payload", "value": "01438bd45f858e903bb83c96caae024ba37c1293801014117c98eb44bf459821120246b9c0a09a98eea02db741dba7c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413906, "uuid": "67825b72-0387-4773-875f-b3154ca8adab", "value": "T183B31252E1F9DC1BEF6A84B209478DDD629C875F3F4EA62120078D90951199FBB9C8C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413906, "uuid": "8f39963e-c306-4b91-99be-94c74c58e9ea", "value": "3072:cWyeZBk9QDxaSRcNrhMC/S265494u+qgwM4h:PZBkox3a7MCs40g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782413906, "uuid": "418107e5-51e3-4412-8d22-14eae60f0601", "value": 110728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782413906, "uuid": "ff53db39-9eb1-4a29-94d4-ceda655cac74", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413906, "uuid": "444e6bf4-aef0-49de-8571-990d7a0ee9c7", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c78f4de-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390612, "uuid": "bb9f6447-199b-45b9-beec-49805dc6c237", "comment": "Malware payload (CoinMiner)", "value": "25d89bb632271696eb7f9a0fccc19847", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390612, "uuid": "4146706f-8d7b-4451-8a3c-5644bbd1d302", "comment": "Malware payload (CoinMiner)", "value": "bc92812448658c397f3ecf4c6475dc3de7ba80eb04c4f9a2ea67221bd8556176", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390612, "uuid": "33ffa22b-516c-4be5-a648-3ea3f63caf30", "comment": "Malware payload (CoinMiner)", "value": "7027e15cc88013c8756ac321fc843f9cef13d8d5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390612, "uuid": "1b844a9e-98e5-4cfc-8de7-951ab499c051", "comment": "Malware payload (CoinMiner)", "value": "dd88bd1b12fd0cd110418e5b70ecb541ae907b780ead0ce1ca242875a4f324e54c69574910642aec2808c170e104cc86", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390612, "uuid": "ccacb50b-1544-42af-b573-f9c211bc1e6e", "value": "T123F533ECE85330ECC5BDD1314BAA3799697D3AAA4B050E9F15C5F09029232D2BE72DD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390612, "uuid": "96e451d9-5de4-4eeb-b7e3-c9de8aea10c7", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390612, "uuid": "a88f3c07-9910-47ff-b805-bb2d0285795b", "value": "49152:jps3kxh3tnvFfqOE+JNtByulzaPDPsi9h+gwoluRLSqnMWd:jpJxh9vFFE+/t0UuPY4+ghluRLSqnMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390612, "uuid": "50a5dbf8-c7c4-4326-87b3-9b197e74dcb1", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390612, "uuid": "c97075a9-1ae9-4b26-8d6d-817f6fd37119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390612, "uuid": "ab1a2c2f-c766-4b3a-a2ed-78bec1f0c200", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0880dae6-70b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782407543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782407543, "uuid": "bd9124cc-c958-4d71-b34c-7b7c6df913d6", "comment": "Malware payload (Prometei)", "value": "9edeedc420b8250bf7112eaddc58bc4d", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782407543, "uuid": "fd2a1bff-90ca-4dad-aa5e-c25db4055651", "comment": "Malware payload (Prometei)", "value": "bcc130d7635ef1ef7350d3135bf3e4abb606dce75f1972636144f96b12839425", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782407543, "uuid": "c22cd3df-f3af-4ebe-958a-2da49d010ced", "comment": "Malware payload (Prometei)", "value": "9c73089f126b71e0df9a4321183547b876dd3a85", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782407543, "uuid": "7176ef66-5c10-493e-97b4-83f14c21bd19", "comment": "Malware payload (Prometei)", "value": "b443275991635c16574f8fb180759e9002dfab19c1dc23f068d4c115cca5a4d45311dd31f7409d614264e155121bdbe6", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782407543, "uuid": "65d77eb9-9463-45ed-a791-b598ffe30267", "value": "T186316EF92B841A717CA3DD03376D0A843184B9FA8CC99F28B4EF78E4708EF487540642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782407543, "uuid": "a32d5373-a034-4220-b56a-adaa3e00fc5e", "value": "24:MDEPYDlxULDPgCNI7KksD7nlCDBg82WJDLDYDRpLWFDCPcDAvT:M74L9JAtHnsuF1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782407543, "uuid": "a1131294-1917-464d-9771-47fd37c96fb0", "value": 1828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782407543, "uuid": "c3aab3af-8b0f-4341-8302-3b67f134e158", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782407543, "uuid": "2cd3d34c-93f7-453d-bb14-e976a8778a5f", "value": "bcc130d7635ef1ef7350d3135bf3e4abb606dce75f1972636144f96b12839425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4390906e-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "dc09ce76-9640-4c01-a560-f313784d95b5", "comment": "Malware payload", "value": "bbe80e65c0a9050f256da6814f914b69", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "fc704847-c9ee-4ad8-b9ba-81a8d17a7928", "comment": "Malware payload", "value": "bcf93371d0262f4fc54070454494feba12a62b6679e7a12f77bf6d7cecf24682", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "664811e4-2466-46dc-b588-7e07f2aff663", "comment": "Malware payload", "value": "5ff702aa8324371791081ac0350e0bcd1dced1f3", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "68b11c7c-44dd-46e0-b5e0-495941f4781b", "comment": "Malware payload", "value": "f6c00c5266434b6fbe6c3df1c31e05f80f455fab8c35024055e71b88b5522e14168f4e3fb946f6f5e6675f86682cd0fa", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "a00da47c-8510-4c77-8550-6cead58d46b7", "value": "T163853332362281EC89D48F03D9A5813B7416A43FCEAF2F5CB721073D5AD347A72955AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "036ca978-e123-4739-a5a0-b25fecf5bc4d", "value": "49152:qADFAu3vQ5XjPeFJZeM8NnsrxfrLNJFN89z9l7ycdEmcE:q6+7FeFPeCDfsz9l7ycEmcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370706, "uuid": "85b32830-d1e1-4297-9aaa-43408a0edb53", "value": 1737828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370706, "uuid": "6f806b32-1858-4a67-b887-4a515404c441", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "84136a0c-06cd-4dce-8205-d098685f4707", "value": "kblockd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47e6dcd-70ba-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782408261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782408261, "uuid": "76977110-24d6-4099-b05c-e6a512e5a7c1", "comment": "Malware payload", "value": "0ed2a300744c3576d4f9e4033fb88ee4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782408261, "uuid": "0fde6e8f-6adc-4108-83c4-2307bd06b096", "comment": "Malware payload", "value": "be918dabceb2b4c3b5897299ba5e0ed43de4dfb9058ece60ee71fc2e6856c149", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782408261, "uuid": "f05ce7cd-5f83-4edd-86e8-501a5dbd5950", "comment": "Malware payload", "value": "15b25f2ac2b8f11e4842ba59854135661de94f90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782408261, "uuid": "b553929a-0adf-498e-8b40-33e6b9995667", "comment": "Malware payload", "value": "bcf76bf080ba3a350e2af03dea443df550846cecd9254c9c6b10819103d0271bf3fdbfb4ab9a6ada1f43bc63b3aa1bd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782408261, "uuid": "8689e78e-0ce9-4165-a268-e2f0b40cec32", "value": "T115834B1FB5920D7DC0C1C93087ABC9226631B464D732563F365097B83DA6B589F3DE26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782408261, "uuid": "303f02db-2c93-4055-9a86-03ad74afcab8", "value": "1536:+flcoNKRZf20KVgdwuklWM2UlkdOEb12ysWG7A9:+9JNKRE4A2f0ysWG7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782408261, "uuid": "546a3de5-9589-4b15-bf10-f8c711f05aa5", "value": 81992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782408261, "uuid": "3b8a5d3f-d3ab-456b-94fe-77c709d9bdbd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782408261, "uuid": "4aad2e9a-e660-4816-a788-f6329a18db52", "value": "cnc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55c7f5a-70b1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782404371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782404371, "uuid": "377983eb-94bc-4fc6-941d-c032da9b319a", "comment": "Malware payload (Mirai)", "value": "4381757003251f1a2216418625981626", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782404371, "uuid": "c70f3de6-95b9-4777-aa4b-fdfa6a5decf4", "comment": "Malware payload (Mirai)", "value": "bf551654165f7b642287c328c261bacf392bd0eb543b7751e44d69263814397a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782404371, "uuid": "26959537-892a-4227-9169-aaa1353ae06c", "comment": "Malware payload (Mirai)", "value": "234906608f1db3aa41edb3063aaa42ec6b91397b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782404371, "uuid": "6f0175cc-4409-4761-b86a-dabbcb3cc43b", "comment": "Malware payload (Mirai)", "value": "5e291e77b0e2a5171a65593824294d62dfb68f1414668bbe851c2d59b728b2df53a639102d8c36e0cacd0aebda9798c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782404371, "uuid": "ffc61b1b-0d6e-4fe4-83d1-d305446c18b9", "value": "T173636C89FB83C4F6E84705B1653B9B728733D5391059EA82C36DB832DC62A52D71B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782404371, "uuid": "bcb37713-afe4-4c35-93b5-0a4142147914", "value": "768:0xRFULYxeDZ4kkscYf1rJHj/9Feb8oewufg86K8K9NigqzYTSfLXBRaAdpjkgKIF:GRAYxEVDrrJHpue/fg3EupkTSjb8gK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782404371, "uuid": "1c6b65f8-5262-4a5e-aa7e-1740c00db22b", "value": 71784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782404371, "uuid": "d76b59b3-cea3-4ecb-a3f0-9031a9126b3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782404371, "uuid": "02605153-c7d1-4cfe-8649-b79c7ad4ae90", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344f2598-7093-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391296, "uuid": "127a48ff-0b69-4c55-beeb-cdd1e1e8beb4", "comment": "Malware payload (CoinMiner)", "value": "ad19964d16858afba780be897f2cead7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391296, "uuid": "b3bf6e56-6109-4a22-9cef-6468a285aeab", "comment": "Malware payload (CoinMiner)", "value": "c12b2a94593fead09896badb4bf2efc4144c69a7c63ab68b2250ae5b639f77a3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391296, "uuid": "07c571ec-f0ff-4809-ba33-3818c3b9aadb", "comment": "Malware payload (CoinMiner)", "value": "089d93eb384a4dfe0685b43fb7072ef838a9cfac", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391296, "uuid": "ceb67436-5262-4034-aba5-7752064dc720", "comment": "Malware payload (CoinMiner)", "value": "c33c47221405df119aaf991b9d6098077cced91d2b47912154ef388ffb5a33ae7a584ba7f510340d06b240df20e29bfb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391296, "uuid": "0b6eda4d-c474-43cb-8732-3e20d8f7d903", "value": "T146F533818080A9BCF462857506972F4757F971124B290CCBFEE3BEB835BA9C6BE31D51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391296, "uuid": "b9364b4c-7e83-406e-a3a7-a16a44d150f2", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391296, "uuid": "04ee8353-8743-4391-8d6e-cb794ecd3351", "value": "49152:rn4qjSMwZnBb3536vuNEGyAubMwLPHJfzTxb40s8uaZ1vOAGLBeOud18fAInSXnp:rn4q2MYBb5nNDBuPPHJGyOzVeF1O07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391296, "uuid": "754529f5-5828-4ff0-b89d-323962de622d", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391296, "uuid": "85d95bb2-0f96-43dc-ab06-3d0c9ff168cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391296, "uuid": "51c2d5ef-1def-4b93-aafb-5b5f4f116212", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d760a4-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370703, "uuid": "c7a6b680-ce05-494f-80a1-57171e7bf015", "comment": "Malware payload", "value": "c7c4ce01c566737e4765dcbb34494017", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370703, "uuid": "f9acb2b1-528e-439d-8ee5-5412b62f53df", "comment": "Malware payload", "value": "c163ea23e0ba19412a7ff8d4ebf30dc1fa9ef113e83424aba27aae7995b9ba98", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370703, "uuid": "fb8e687e-b47a-4719-9c16-576a582ae60d", "comment": "Malware payload", "value": "d6fb6bcabdc35ff00bf1148fced547f40d20d2b3", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370703, "uuid": "8ec28931-db31-45df-8ac2-173405142d8d", "comment": "Malware payload", "value": "205491633c2dd224f083750790d2475aa90ff8fb76cfc65162ee299438f6e87710b6b256c139965cf7d2cede4a735850", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370703, "uuid": "ac56f364-1485-4bd0-a70c-1392c1cc2454", "value": "T1788533789EA3C584F3302E39A77B6DC44DAC3E22585EC592DB844A78B5C9DFF5921308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370703, "uuid": "f241b2ba-b53e-48be-80f7-9cbf1b07ad89", "value": "24576:KyAnGeHb+8sluqiEKvHqyAnomRgFRHRIa7o2aIGnd4gpMIx0QNIl6xg1ZigBDh:KyG/b+8sl0r4PRulRMNIGd44HTgHVVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370703, "uuid": "35a0005d-4f9c-4b90-8df7-35939ca2160c", "value": 1741088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370703, "uuid": "c73e7b69-dcd3-4323-a6c1-fc8e12780791", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370703, "uuid": "19356923-1a07-4d75-af7a-7774febfd03d", "value": "bioset0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4294dd32-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370704, "uuid": "65e01fc6-418a-453d-80ca-69d99b314784", "comment": "Malware payload", "value": "d4abb3e1052b873c7ddc9c081b50c2d0", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370704, "uuid": "17845412-34f6-4a20-ad69-87c5ff05c7d4", "comment": "Malware payload", "value": "c17f203beeec7fb4d2ea1337be50d4aed221cbbdc29a7828b37b15e46de281be", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370704, "uuid": "79fa6727-ef1c-4d28-812b-2e01c80f783e", "comment": "Malware payload", "value": "229ca2ecdf76da4329eb941b77abe233de0b8951", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370704, "uuid": "9491f596-8f4a-420a-bf83-a706bfaa3767", "comment": "Malware payload", "value": "b0718a13b544e1e3076885cec6b8377c2bf564143c55fc798f2973a268549c43d0bc859dc41683f77c48d599d9e4373f", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370704, "uuid": "adc78b41-9e0a-4e22-a7cc-7025dbf70315", "value": "T1B18533CE27D2F7DAF121BA34A835067F50EA04C2F5230DB6060D74A07659FBF68BA159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370704, "uuid": "4e9c160a-633b-43b4-9fa4-885ba7e0888b", "value": "49152:D477GpZXl6fPyMBsxcx9iFlfHJnWW8IOxiAuMQetFmTNEAN:fXl6f6MiyDiFD4XkEBmTlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370704, "uuid": "a4646ca1-7ec3-462c-b699-582252b08dcc", "value": 1716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370704, "uuid": "4c88aa11-e964-48bd-be2d-9bf177e8614c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370704, "uuid": "b1f616da-a464-4f48-a6b2-b4a443a4876b", "value": "ecryptfsd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0820ce76-70bd-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782409261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782409261, "uuid": "6756d02e-f23a-42c8-821e-dc36081ab099", "comment": "Malware payload", "value": "075640cbc85cd0350c2c1b9f61e65b04", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Datzbro", "colour": "#5C16B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782409261, "uuid": "7dc87393-3637-46cd-9d16-2444bf7a71cf", "comment": "Malware payload", "value": "c2477212ecf6e63eabf5ebef7581a1a7d878542f016c1f4ac43b3ac1e24b3c14", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Datzbro", "colour": "#5C16B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782409261, "uuid": "2dc0ef38-f06e-4eea-95b6-f06b38adc000", "comment": "Malware payload", "value": "77bf9b6f294b70677bf7a334acad681c23e91e9b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Datzbro", "colour": "#5C16B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782409261, "uuid": "1684cab2-cafe-4649-9278-997389249d08", "comment": "Malware payload", "value": "afee6aed6ed0dfb4b70918f643017eae9a8bc421ef627a8deace0da26c7ae475026e288a1e549130f38d460cc7f49a47", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Datzbro", "colour": "#5C16B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782409261, "uuid": "551c0e4d-3314-4550-95ce-926723f1e63f", "value": "T18196E0C6FB88992BC4F753368A3552A651474C168B83DFC75A48763C18BB6D00F9AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782409261, "uuid": "f096beb7-eb41-4de6-bc48-40850c2d0756", "value": "196608:LfWpm51QIPKyY5XIiz/hdeTkivziuVUWHDprkyk929qQC49:LAjIPrLETeNvzNVUW+HLk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782409261, "uuid": "e3e61c36-06f9-422b-9a28-1af41cdabdc0", "value": 9167733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782409261, "uuid": "bc91124d-885d-44fb-9ae4-4cd05cfdaf2e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782409261, "uuid": "45140174-2994-4dfc-8204-88fa4c5d3045", "value": "c2477212ecf6e63eabf5ebef7581a1a7d878542f016c1f4ac43b3ac1e24b3c14.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75684ffb-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370789, "uuid": "8b3b93fc-debc-4b61-ba12-2a8ad8caab49", "comment": "Malware payload", "value": "6a38953063bd9ffe0d7dae2e2b75d36b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370789, "uuid": "2bee8eda-d649-46ff-a5a8-07ea69f2bbab", "comment": "Malware payload", "value": "c326e8ee8b15d0aabaf9103011cc3c14dcbe77d2622534fd3621c5b8bb53901b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370789, "uuid": "6478701e-860a-4d3b-bef7-534dd1218c80", "comment": "Malware payload", "value": "6e552e82fc032193154a6f42ecb827cd82290e2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370789, "uuid": "2829544b-41b7-40b6-ae5f-02634936b11d", "comment": "Malware payload", "value": "ec7eb2e978f64176db08fe19a24c86ce91f86c58ec2a458fdf9aabe744ee9c28c0efa64e4cce1cc975e9e8b77eb39880", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370789, "uuid": "b586fe2a-af8f-42a3-ab8c-c53e20c9142e", "value": "T1D5560857B8D24983C4E83A77B8BE81C433631EB99B8652566D05FE3C3ABE5D90E34314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370789, "uuid": "2c5f845a-7aaa-4694-a457-65953f90c5a6", "value": "49152:F/93P8dhKE5wxxsE/RCNOfLiepg8T4/DCNCqDlPdwdg5EQ:J931xCGrO8lPdwsEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370789, "uuid": "67c3f199-fa3e-4f79-9526-fe8d925756ad", "value": 6160532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370789, "uuid": "bf65ccf8-9176-4f47-8b41-0b155f3d736c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370789, "uuid": "2e408cb8-1e49-4e32-9d77-5b6ee334a8c8", "value": "kblockd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50607a14-70a7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782399933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399933, "uuid": "9397aaff-87b9-42aa-a2de-09fdbde8f144", "comment": "Malware payload (Mirai)", "value": "4f98bf80ace3ef62228fa5c83e7a5e2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399933, "uuid": "2ce714aa-bd83-4dff-89a5-a4f708749aea", "comment": "Malware payload (Mirai)", "value": "c40edf10bbca8dfa95bbbe649d788ef1532df78f13b97293d54663985c4be873", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399933, "uuid": "8de8d555-9dee-403a-8618-ac850ee8566f", "comment": "Malware payload (Mirai)", "value": "3516ca01e28355e58b958ba6a4c550f8db2f4d81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782399933, "uuid": "59de9a5e-ba95-4e4d-9e2e-92959c9dd010", "comment": "Malware payload (Mirai)", "value": "a6e94640ffa30fead07729a26212ad46ee4c0d82bc587ba0a1de6beb4a1b7f2b3955d8a1edbb19a0da60eee4e641a705", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782399933, "uuid": "f168ac06-df83-45db-a9d7-e77bc03011d7", "value": "T1BE933A55BC82AB86C6C21577FF1E438D371623DCD2DA7203F9195F5E368B46A0E2B182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782399933, "uuid": "de8e264c-f9f6-4c74-8890-32b630f14528", "value": "1536:tUsGvEPqvwZ/P3xfRzE3TNb4NOzNQfkPSw0E/FwVV8jvW5Fx1WdMzviV7zoyQvtl:TPqvy/P3xfa3Gca8PSwH/CDIkFx1WdMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782399933, "uuid": "6d52542f-8cdb-4e8f-9c6b-329304e739f7", "value": 96708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782399933, "uuid": "18c6fc1a-49a1-489d-a67f-19b68f219ad5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782399933, "uuid": "973c1ff7-7484-4cbe-a459-badc46275ff2", "value": "G7VG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a098b5-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390441, "uuid": "da4cd393-563e-4e7a-ac93-9fbfaeb539dc", "comment": "Malware payload (CoinMiner)", "value": "1784d3f41e8a5314c54d7fb86d24805a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390441, "uuid": "613317d3-3ce2-43ea-9c13-c5b0c1b0c461", "comment": "Malware payload (CoinMiner)", "value": "c4fabfcf75a6745956013a61656e620c485d9f39b286b4c7e3b099fe1bba652a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390441, "uuid": "113b200f-8bbc-44f3-a511-b833ddc3309b", "comment": "Malware payload (CoinMiner)", "value": "e2469892028d96c480063baf099e4d57bf5dcd01", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390441, "uuid": "faec69e1-dc82-4b26-a112-500dcd855ba2", "comment": "Malware payload (CoinMiner)", "value": "94222f6b1587ddc0b8656d0887ba91fa713bc4602037e6fb7d811f1778e38e657a9a148429b52ef4103536885e17b186", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390441, "uuid": "62115ada-86c1-4782-bcd6-d1312e2f0bd8", "value": "T184F5335516D033FDE52B047186AA2B05AF28BE900B2159DFB3F675753723EC2BA31E18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390441, "uuid": "0d7ea99e-4c53-4c00-80f8-b320b1fd6654", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390441, "uuid": "9bac26bb-2f2f-4ec2-afd2-41013f33287a", "value": "49152:cHqYDZTNNtQ80/d/G1pqxmKUe3KBQ0GsIfGc+F4LffCHthB3kqE5JhA1Y:cHqYDFHw6isUGXFgI85Jh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390441, "uuid": "d8c70bae-3a9e-4cc9-8dc1-95d54bef691a", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390441, "uuid": "be263a59-e9f2-4043-9ebd-9ff2fa8b870a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390441, "uuid": "2e19d0e6-ffc1-4505-a935-f7524cfb0682", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62809a13-7032-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782349712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782349712, "uuid": "c5f1e2f4-66f1-4dd3-a324-8a595c8419a1", "comment": "Malware payload (Mirai)", "value": "97a8fcbbb01601ad7b6d754f6fb1c077", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782349712, "uuid": "96bb6a83-bc60-4d9a-b51b-5d515dd8f273", "comment": "Malware payload (Mirai)", "value": "c686e9d277411bee3f43666fe898cddb7cdf55971b576eb1c30b45f820cd67f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782349712, "uuid": "84130a22-f05d-4e49-94df-bdebadf37fa5", "comment": "Malware payload (Mirai)", "value": "84f90e6253db3897101d0902b35569b6796f9326", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782349712, "uuid": "c37a9325-67f3-4c98-9c1f-0213a265fdcc", "comment": "Malware payload (Mirai)", "value": "d8bc85a228ef83307102287740999c1443cba5292440007951506fb6074f8093240f6013d39762d29d280e16ab58955c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782349712, "uuid": "6b489d33-a00a-45f4-9134-2d467665fed1", "value": "T19B633B85EA83E4F0EC0515B029B3F7372A32E4650124B94BE779E77BAC12772E54678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782349712, "uuid": "61f1de99-e51a-4726-abb6-600755a873c2", "value": "1536:8XXdyuq2jmilBnk7tYnqPIUlK2he6hvhljhPFpgqMeqIn8N:aNyuRm2VDvwjlFpbMRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782349712, "uuid": "b2c96122-3561-4620-a293-614ba6c6c4f2", "value": 70608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782349712, "uuid": "94917544-b4bd-41e7-b8d6-229f66b2a45e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782349712, "uuid": "861006fd-fe7b-43b7-a0e2-b09d231d8884", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee743fb3-70c9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782414801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414801, "uuid": "bc33694c-cc6e-42b2-833b-7c2e1f51e1d0", "comment": "Malware payload (Mirai)", "value": "7566ce480dd9c8a896110ec8ab4eb425", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414801, "uuid": "9879ab26-83fe-4543-961b-0fe6770242c9", "comment": "Malware payload (Mirai)", "value": "cb61d51c47053e2e4ba9ed588a59dfe7ecdc7ddc280e5bd86d2c85cc136537ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414801, "uuid": "f0f9ff5f-56b0-49a5-be40-97f4bf6f31e3", "comment": "Malware payload (Mirai)", "value": "2bbcdcbc7e4e75d6cb1345282be8547fea177f4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414801, "uuid": "b048f481-10e9-4e95-9af0-49a8a82ccfd5", "comment": "Malware payload (Mirai)", "value": "a60f2c7701986cc2c410fcfe504ccf1ce4a0027d85ed533515d40edaced1b76396a5d4274515ff4d0dba4cf2d70390bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414801, "uuid": "0a087d44-0d02-4c80-b18f-803f489e78f3", "value": "T14E043A07AA418A53D4D72779BAAF8245333397A4D3D733069828AFF43F8379A0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414801, "uuid": "e441f297-0321-4aab-9a82-efa80241f1fc", "value": "3072:elYjL8XJDkhP7TpnMaTfgqGfHyEO2WAMhnH+8KsDoXM/9hNB3:eyjL8XJD47TRMaTfgqGfSEhOH+8KpM/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782414801, "uuid": "546d7445-d944-4287-a8e8-b6e56cfd4ea2", "value": 181126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782414801, "uuid": "386495db-0bc4-4ba5-a345-d3c68ed012a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414801, "uuid": "a8f572ce-6689-4e2c-a88e-839764624973", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a20b0f-70e7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782427569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782427569, "uuid": "31f7ca0b-1464-4d42-b925-9ba40c179c1f", "comment": "Malware payload (Mirai)", "value": "5ae5eed6deeb97b6d0990d35680dc7d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782427569, "uuid": "fd8668d9-06e5-44e1-9303-2d131c463bca", "comment": "Malware payload (Mirai)", "value": "cbfa7a258edd1c5fd2bae5c9fc07b2af7c1f7b846a086e5b842fb67e10c3ddf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782427569, "uuid": "bd664077-9eb0-4bab-852d-2040dcd356a1", "comment": "Malware payload (Mirai)", "value": "c0521df724c92fb6e7e5c23b877df25c05aab5f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782427569, "uuid": "cb4c3d77-814a-490b-a10e-9a1cac0016c5", "comment": "Malware payload (Mirai)", "value": "0562921badf4c6e8c2b0004eb114ebcf9399bae899026ec68a81e0f81e3f3d01036b4cb974215a32dbe122562145b0e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782427569, "uuid": "af6c3477-c038-44e8-ae8f-2cda70f9ed57", "value": "T1E9938E00B70C0E53C5736D74293F2BD1C396E99122B5E6492A1E6B4FD1F2E728686EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782427569, "uuid": "4cec5648-7e16-4a95-acc4-c71e2f243d4d", "value": "1536:954pBpEYGPby/vM6r06/JwRSuRH8XClgxRIhfhNmQhrIsqAHxO+2fiBCYqNT/:98X1kmgxP2aB9g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782427569, "uuid": "9dd01e8b-f213-4739-8dda-268d89a3d78b", "value": 92896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782427569, "uuid": "4cd9e0c2-dc01-4ed6-8f25-6a6baf1b590f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782427569, "uuid": "2650a149-41c3-4aa1-99a7-affdb7c475bf", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6db9393-70ca-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782415245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782415245, "uuid": "8f067738-1a62-44f5-9e6c-692038dcee06", "comment": "Malware payload (Mirai)", "value": "8a27e28a4cc1893905004202a671689b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782415245, "uuid": "8f71cc88-7ee0-4676-bb9a-283da5d60f4e", "comment": "Malware payload (Mirai)", "value": "cc0daf1698d001cea803ca9e6a98c9b6904daf9e66744acbbc3eb019146b4c8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782415245, "uuid": "9551f93c-5ec6-4c25-a91a-801da5bc309a", "comment": "Malware payload (Mirai)", "value": "c428a10e71f7ea0e90e1d5057876bb013cf11efb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782415245, "uuid": "c810ef9d-1573-4552-8698-be809ec5e6a1", "comment": "Malware payload (Mirai)", "value": "725c74368ce682f87f36d9379f2fffa40d089f6ff5a7785deb98bf126d92ada2a113522b19f8bf75ed878e3571fd9129", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782415245, "uuid": "7e83cf42-a492-4827-8ef7-3c70f9a5797c", "value": "T1B604170AB8C0C4FDC4D5C1784ABEF536EA31B19D2638724B3784AF2E1E4DE605B2DA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782415245, "uuid": "7c6acb4f-cc01-445e-9730-ca8287b574e3", "value": "3072:MxGVyOnsAbff+cYQ5Xbf4uKkdc/YPD88GEew3istRct:MUVyOnsAbem/Absfct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782415245, "uuid": "3cee10f0-accd-4278-9ae7-05954e8e4ea9", "value": 185608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782415245, "uuid": "eb5facee-d47f-4df7-82c8-0fd02868aa1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782415245, "uuid": "e79c2b5a-4251-475e-bd19-caf581a76dd1", "value": "onie_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004f37de-70a3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782398081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398081, "uuid": "b8c2ca85-2e4c-4850-b2ef-08154a640f00", "comment": "Malware payload (CoinMiner)", "value": "619588f5ad6700c29bf02297921e69ae", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398081, "uuid": "335bc96f-cc16-4630-bbec-1c345786254a", "comment": "Malware payload (CoinMiner)", "value": "cc75abb03271fb561de885e1295dfe6e677a89e625a8ea65763866980c92ac05", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398081, "uuid": "a882fb69-d559-4346-96d7-748bcf32a957", "comment": "Malware payload (CoinMiner)", "value": "c606752685a166929a22ff98bccacbb533a7a2d7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782398081, "uuid": "56612fd9-697c-435c-8f85-a66f1848dab4", "comment": "Malware payload (CoinMiner)", "value": "3a39aee88bbed166cb235f7aacd326c5610575b68892c3897b4e28719a13832e83aad3c1b85653832c1f655e4c2bd86d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398081, "uuid": "c5d9beb4-65b8-4d70-b12f-47dd42f8bd8a", "value": "T16A64390A77608FE4E274C13006F74B96A6FE21A666F24985D33DEE107E9034C6A5FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398081, "uuid": "b9247d89-5544-4c40-a52c-5d81782203ec", "value": "6144:2CyoxVT6Y4iOpHiwU7g47PT+HC6wO4XD80fyX5zPQNcNp04Z:EovwUT0Zv/Bvp0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782398081, "uuid": "d44a81b6-5998-4a3f-8b1f-c5e01accdbff", "value": 332844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782398081, "uuid": "6c5484d9-68e9-4fc4-b1ac-cf5023193b49", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782398081, "uuid": "5724c8b7-7e19-4f5c-940a-521fc349e752", "value": "kworkerd-netns-rt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff85915-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390752, "uuid": "be561cab-1d01-435f-8745-7b536d44666b", "comment": "Malware payload (CoinMiner)", "value": "c0d397d9e7844f2b27d6bc867ce9703a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390752, "uuid": "b8cbc374-1737-461e-9632-dad901654a72", "comment": "Malware payload (CoinMiner)", "value": "cd1b7d2dab1da7da0eba682c4b499282cf0c3bab37c2bdab8825af002bc7fd8d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390752, "uuid": "91643123-5162-4d6e-97ff-53ff9aa59a56", "comment": "Malware payload (CoinMiner)", "value": "b66e457ed95265b1e9aeec75e52384d02d8d95ee", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390752, "uuid": "98fc91b9-35b2-4c57-a727-d24b4f44f7bb", "comment": "Malware payload (CoinMiner)", "value": "2c13388771c23aa4f093cb667340708bd7bb89bf9a437a4b7e7ba9053845c343fbc1cf9f88bd705c8f683aadf2b672aa", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390752, "uuid": "4b7f8360-166e-4055-a586-f56c427b42b6", "value": "T189F533D3AAC615FDE6824C3AC39B6F319125B43A6B267CC70BE55F211725EC39930D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390752, "uuid": "72ceabe2-7886-4dfb-8a22-680658ea0a6a", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390752, "uuid": "ffd52184-2f10-4ac7-b0be-f85f7bba6318", "value": "49152:nztbHqFTJeWd46MUtmXFEdmBexbu7XbOMEWDpxFOD21DMSg7dfPc79wZ8D5pF:nzt+MlF1BexbMTBbGPc79w6Dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390752, "uuid": "68748146-b639-4fc2-aa84-57546b9c015c", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390752, "uuid": "284c0b0a-f30f-4c75-ae42-b96464aadb19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390752, "uuid": "01e9d58d-edfe-4e79-82ec-d4379f411c96", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0dacd6-70c5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782412705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412705, "uuid": "2ab0e725-f081-470b-8150-9c89b323fd2d", "comment": "Malware payload (Mirai)", "value": "83e64c1f15cc6d5e4e6b135fac385c61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412705, "uuid": "2c4424fe-166f-4328-baaa-0b7970be7850", "comment": "Malware payload (Mirai)", "value": "cd8417cae10ff30ec35d440d73c092add62339ceea90583425b7e29dcf5580b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412705, "uuid": "8eab3c70-5c61-43c6-9d6a-3630f2cacfe9", "comment": "Malware payload (Mirai)", "value": "1b74e96633b92d24a06bb28cd220bc1665e58e43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412705, "uuid": "4f40d8f5-c567-41e5-bc49-7f33b1e6c1bc", "comment": "Malware payload (Mirai)", "value": "2c8b7a63c0b8758a6acfa5bcbb8735ab904e8e3137eff3f9c71a3627c500d33d09d3266b3d1fd1aff02fefeed16d49db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412705, "uuid": "11b9d261-24fb-4f37-978a-1316acd84c7f", "value": "T1B704F956F881DB12D5C111B9FE1D518E332327B8E2DE7212BD246F287B8A86F0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412705, "uuid": "205ca459-08b8-4c2c-bc93-a5c1c10bcd3a", "value": "3072:7wyX3apDdn6DstZUvf3H4XN8UDJ7Rau93yi7wIk5Q/gPC9uvB3Q:Gxdn6DKZc/4XKUDJlayv7k5QgMuJ3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782412705, "uuid": "90b116b4-cc49-4657-a029-72cf0dc6956c", "value": 188348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782412705, "uuid": "b8201fa1-3037-4557-81cb-a43afc09e89d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412705, "uuid": "11d2f057-6c29-4fed-97b8-428c8010df84", "value": "onie_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec19601c-70c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782412220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412220, "uuid": "7ae235bf-d0fc-4482-b5aa-b5f9714c5a2b", "comment": "Malware payload (Mirai)", "value": "38be105ccab029c0027dc4c88f81f09d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412220, "uuid": "726863a2-57d9-4f40-8d04-5fa164dcd032", "comment": "Malware payload (Mirai)", "value": "cf49a9471f196aaa26d91933415e2e1207a67de0a8d24abc4dcd81b9e5e7ad9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412220, "uuid": "c6e67916-4fb5-4c32-b629-d98c3e2ac3cd", "comment": "Malware payload (Mirai)", "value": "34d2b27e07ce92e24f65290dcb66d79e6cf1d17c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412220, "uuid": "7518fc85-e3d6-4a45-9130-d31fb713ca3f", "comment": "Malware payload (Mirai)", "value": "d0f9a5b301e8cf1cd01966b6b9249e511d234f1ad4e7b4ac0ba0745b2c0c6d75c7a9860d4b99fc4e40c14024795593ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412220, "uuid": "e37bc8d1-06b7-45fe-a993-5e718ef45ea7", "value": "T1D3F38C87B71A9CA3CC910AF94BCB5B8C5BB351128F6BC7D62D0C66351EA69CD4D0B381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412220, "uuid": "7bf2d51c-a73c-41cd-b211-259d5d9d83cf", "value": "3072:uN6FRIOPClpQcXDw2TU1/ELsG7gy/w9qJ6frYvBUmQUU:uH02Tmys9q4OUmQUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782412220, "uuid": "ddd46af5-e095-4a28-8906-fd8e532047d0", "value": 161916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782412220, "uuid": "c15e009c-82ea-4667-a11b-dba348231301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412220, "uuid": "adf89385-1994-4725-b606-1a05d805fe5d", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c8d52e-70c8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782414082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414082, "uuid": "ddb1c991-33a3-4f8c-aa66-aa52d7a05b1b", "comment": "Malware payload (Mirai)", "value": "da572f8784b57c9a2093c6c3f75b5904", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414082, "uuid": "4cbf0ff3-7c78-488f-b061-4871597db166", "comment": "Malware payload (Mirai)", "value": "d0f5cafd9fb6a363a8b97c84a3546f601a4ba10d49cdd7dae418288caec6940b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414082, "uuid": "f8435b7a-baec-4ab7-a8f9-116715e55efb", "comment": "Malware payload (Mirai)", "value": "a6128331636ba2f0753991760702343902ef3572", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414082, "uuid": "de43b2b3-84be-480a-adc1-2e229e8da616", "comment": "Malware payload (Mirai)", "value": "949687c3acd991fb01a19bd3ded3c708a47e87fc7e7d58457e810acc6a5147a49c9c3b1e287658ee1c780cf18884959a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414082, "uuid": "b42869b1-942a-49de-b4de-a2ed198cd430", "value": "T13DD31845AA56CAF3D4C31FB602A746620633EC291F2BDF45E32DBCB44F4A5C8F116668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414082, "uuid": "8efb4162-d0dd-4a3f-889a-5050b8be1ab7", "value": "3072:hlPt3iZzJUQGH3Jr4v+RylYvbUGSGsb0AyL8sYSuF:hlPQyH5r4vghvbUGSGsb0AyL8sYSuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782414082, "uuid": "0b36ca14-a109-4284-8535-3df6f5e88dd1", "value": 140986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782414082, "uuid": "d7ba7d70-671b-47d9-b05a-36832b491f8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414082, "uuid": "12a651b3-867c-46bb-8dd1-af35dd17591e", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421feed5-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390460, "uuid": "8768c495-b164-42a3-b630-a86961b01214", "comment": "Malware payload (CoinMiner)", "value": "142f7ff0f06bc597c7eb5904a4bdeeb8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390460, "uuid": "7ff90a47-2063-4798-8966-a8a2775749b1", "comment": "Malware payload (CoinMiner)", "value": "d1518d0bd89529e64e3e4e8a433b988c99334b2c3ebdbdf85de312addaa8bbbf", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390460, "uuid": "e6db9eda-4983-4da1-a8bd-03d782352563", "comment": "Malware payload (CoinMiner)", "value": "5c49266edcc4865fb0491de8a8b9ff09f751a13e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390460, "uuid": "b86ce067-cc0d-43c5-9161-2cbc52e44cb8", "comment": "Malware payload (CoinMiner)", "value": "1a4761c5537b81a6ad558e71aa35036b896e79f601c3c22570e3206d54e041a6a1c3c52f02d513925db7bd03861b4fb1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390460, "uuid": "161cc6ee-8fb0-4a04-88a8-c6761483b953", "value": "T14BF533521183DCBDD9A2893D99E28E358577B010672214DF32E7686C8D29FF1BF38E49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390460, "uuid": "6a5f66a6-d368-4642-a4c8-55f99722db77", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390460, "uuid": "a9261cb0-372c-4475-aeaf-072723dfc5fa", "value": "49152:dY6ycEm+9UzmyqJpXURqQ4KjeBp6MYbbgTZ/gP00SjJNtSK3K+zB/FIqC:dY9m+6z57XLm6MYbkhB0SVKQIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390460, "uuid": "d56b9ac7-8a42-4c2c-8648-2ab4b939d563", "value": 3449832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390460, "uuid": "0670eeb5-deee-4e12-a25a-d87d8e9aa9dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390460, "uuid": "6e849620-68f2-478b-a0cf-b5ca4434f68f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce53b52a-70a1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782397567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397567, "uuid": "3878cc20-f7af-4344-90ef-81f4af5fcf2b", "comment": "Malware payload (CoinMiner)", "value": "ef50c8bcf6d3963e375b1eca20a0e7c3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397567, "uuid": "22a2a72a-30b1-46d6-8158-00016ed859ac", "comment": "Malware payload (CoinMiner)", "value": "d15426ed22583652ffb79af4456f0211143abec7f66420c4e0f6eb13b2a975ea", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397567, "uuid": "84ff672f-506e-4537-bdc1-108159dae18f", "comment": "Malware payload (CoinMiner)", "value": "fac559fb0538301b95e5866ceab53d4fe106c3ba", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782397567, "uuid": "f6e01428-2b06-4501-ad3a-c955842083a7", "comment": "Malware payload (CoinMiner)", "value": "c4f775708780648bf8eacb1f5389d346863165a929dfe489a716dbe27aa59472965c88c04d6cbf41291d10a3fca978c3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397567, "uuid": "4b12ec3e-0d28-401f-b51f-b35c392c4f78", "value": "T16164291BA7608FF4E275C13006F74BD6A6FE25A256E24489E33CED207A9074C685FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397567, "uuid": "d41cf274-8407-4c71-b363-76d7e4dbf051", "value": "6144:nMoRhCwBiiBKPx4f6taLubk8kvBT/QIk4WNbw2N65:MoyPxUZrelB65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782397567, "uuid": "da990442-644a-4ddd-9b11-3f0ef1ee37c9", "value": 331868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782397567, "uuid": "737cc394-00ad-4ed3-898f-bf2c93934e48", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782397567, "uuid": "896b8978-3110-4840-98dc-f122a4bc07aa", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5803a3b-70b5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782406089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782406089, "uuid": "5da4c5d7-e4b8-4d84-bd73-964f67eaf75f", "comment": "Malware payload (Prometei)", "value": "c9f77caf5bdf4df9a63f8858ed9b41d2", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782406089, "uuid": "4b390a88-e3ad-4932-99a6-d5a3783ec1ae", "comment": "Malware payload (Prometei)", "value": "d1670db20be1da30e35c4220409078e9631a3319ce934a03a8c5866d118cf00e", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782406089, "uuid": "492281fd-0e45-4d3a-9430-e549983708bb", "comment": "Malware payload (Prometei)", "value": "9f7b819881007983afdd64d970316d8ced8d34b0", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782406089, "uuid": "9ab3a1da-2f07-43a8-9cf8-ec0acc06813c", "comment": "Malware payload (Prometei)", "value": "c007bf8bf9427685c62f7959734c22b2c81d5c2e81af7d9d1e66a61eae6f5b91dd3bc7b466cf33c964fa59cd16168938", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782406089, "uuid": "6489efc2-d303-4ff7-9fce-852c3ae3c217", "value": "T19AA423B4F9229E9F6DD76DB91B24831DE181C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782406089, "uuid": "67ef2394-f457-4fbf-8c46-94dc7d112010", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdU:Fs6pyCC/Ya2hpi6T6N4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782406089, "uuid": "3dba2683-d79b-437a-88b6-93e9782aea83", "value": 449074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782406089, "uuid": "6820f834-bc1e-430f-900a-1341b6a93b76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782406089, "uuid": "fce86dc5-8e16-457c-9bbd-97c91e6786ac", "value": "d1670db20be1da30e35c4220409078e9631a3319ce934a03a8c5866d118cf00e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8512233e-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391002, "uuid": "b0be936e-0dd4-446d-b100-eff876c08371", "comment": "Malware payload (CoinMiner)", "value": "d6799104c80839099fa8a7957326a30e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391002, "uuid": "ba69ad54-67c8-40cc-a5f1-344a770527c4", "comment": "Malware payload (CoinMiner)", "value": "d31744fa54b637061ccdf4de0ceb9110cdef375f5a812ca71522a2e41eb50fab", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391002, "uuid": "a3abf759-8d67-4d4a-b772-29822e7b5c32", "comment": "Malware payload (CoinMiner)", "value": "ca75dd8e9d9930b8c09d739fc1616537b55f6f69", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391002, "uuid": "98a6c070-7517-45b3-80d0-5d474b631538", "comment": "Malware payload (CoinMiner)", "value": "de7d4112e85e747d48a05c2d4f2af60a0ef3d8068f51c7583703fd7df2f49d1102a98f4cf8470171f01a89fbeee60f1d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391002, "uuid": "7bac52b4-a28d-4f13-9847-fb07cb91f7ec", "value": "T137F5239078C071F8E5A7FF7183B27F26523E71621B116CDF99E124906D3A6C2F67284A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391002, "uuid": "8025b223-7b37-425e-be9c-b529439c4d34", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391002, "uuid": "470c59e5-0a64-482b-bc95-f48eca434939", "value": "98304:Ao4FOKOXDEikChUUcLCUPoPw1B6XLg5Xrrm/JM:Aloh5kswCLOXrruM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391002, "uuid": "688d74b2-77fd-4e52-a0cd-48de725456e6", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391002, "uuid": "2b9d32c1-99cb-40e0-9179-29003973863f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391002, "uuid": "1cc8debe-dc6c-474e-9e70-ec91693518b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eead74e-706e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782375342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782375342, "uuid": "98735557-79a6-4c2c-9f91-0a3ef9e4836d", "comment": "Malware payload (WannaCry)", "value": "fa94e3c046c382492715a9dcbc2eab36", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782375342, "uuid": "df970cf8-78eb-4971-8371-703c094edd25", "comment": "Malware payload (WannaCry)", "value": "d3ca561473774b431ad7fd0563acb20bb87b46f42efe6300c183f784abb1c6b2", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782375342, "uuid": "e6dc7b40-2898-4aef-964e-6e9e2a8b0688", "comment": "Malware payload (WannaCry)", "value": "87c2839472a5e0ef9e5697722ba94d6891e28578", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782375342, "uuid": "983a2f7d-9679-49b0-9631-9b33c8d4fb17", "comment": "Malware payload (WannaCry)", "value": "69f7a2b820fe1174f6d0241ce8d715313146506079265fe92a7107a768edb75eae993da7080b11136f6039c9b9274dc2", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782375342, "uuid": "f94ec997-2ba5-4a50-9854-16585e468ffc", "value": "T14936239932B881FCD106157580F78E12B3B37CAA17FE5B0F9B408A3A1D53B95B760B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782375342, "uuid": "7db0b8de-a9e3-415d-a3e1-5b7a02316459", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782375342, "uuid": "174fb720-a1f1-439d-81b8-811196af0062", "value": "49152:jnsnHqMSPbcBVj/vNRRSqTdX1HkQo6SAARdhnv:DMHqPoBh1RRSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782375342, "uuid": "5e195df9-0ec7-4f83-8cab-e4bdcba75768", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782375342, "uuid": "5d65257e-7390-4764-b40f-51da1af0ac98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782375342, "uuid": "412ba8bd-6894-47f9-a5e2-82c085af9678", "value": "d3ca561473774b431ad7fd0563acb20bb87b46f42efe6300c183f784abb1c6b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158d85d1-705a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782366763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366763, "uuid": "0eacbb06-0374-492b-bebe-8cba5316f6c7", "comment": "Malware payload (PureLogsStealer)", "value": "c94ec89260474b6b29db3147ae60a633", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366763, "uuid": "592338ea-706d-4875-9f41-cf680f2888a2", "comment": "Malware payload (PureLogsStealer)", "value": "d483519637f670022a8e862bfbb12247abe0d31abd3f048cfe9ff559ac9dd1c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366763, "uuid": "06ae5af7-6b74-43ab-a7a0-073188bfb9e3", "comment": "Malware payload (PureLogsStealer)", "value": "dc7c4be5cdd1c74837098845bf01d252379a996f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366763, "uuid": "32302582-6f7d-4cec-bf5b-ae3d8143d719", "comment": "Malware payload (PureLogsStealer)", "value": "22d8c8afffb64176f28978f41ce9762ce4814970a34efbf6d3524d5ecc6271a460e60676c1c6ba428fed3e437efa0f5f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366763, "uuid": "1143e478-fbea-4535-8637-6634f7a71ea1", "value": "T10775E5FCCCFBC265F3BBF99947D9362567777723312C75A042818A8902296C169C622E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366763, "uuid": "b51d798f-64c1-411c-aae9-44625f49bb03", "value": "3072:nyjagFS8TBcjh0OxLYocRwr6lHWdbBz5MNyDZqHbZg2tmaf5jiwBGOySWZkDisjo:uFGSAs9wTXXq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782366763, "uuid": "6ac21001-8425-463e-b1ac-f396ee0ea104", "value": 1619064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782366763, "uuid": "c5a66b81-7fcc-4d11-8b50-c41008ca1ad8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366763, "uuid": "1cf43a86-c211-4aee-9f87-e7e27dbc9126", "value": "PYMNT_34ef6dd9-b064-480-99d0-cba2511f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874b5be0-709c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782395301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395301, "uuid": "fd699921-53c8-409b-8d37-cca3fff2bdf0", "comment": "Malware payload (CoinMiner)", "value": "8bdcdbd618ff1732e626360a2dcb3b3a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395301, "uuid": "ce50b850-cf57-453c-bd85-4693380b1478", "comment": "Malware payload (CoinMiner)", "value": "d4da33ae42d743389d919ba21c3d75c3e3759e40633786504861fdf74dfbf5ab", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395301, "uuid": "75f41fd7-2eec-4971-b1b0-307728f32e79", "comment": "Malware payload (CoinMiner)", "value": "d69e89224e514f5a18a56168b6df0f66f8b9bcb8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395301, "uuid": "17bddd08-47bf-4cce-b826-a5331c0b4889", "comment": "Malware payload (CoinMiner)", "value": "b0d51acd5646835b20ec31f67714f0fd8299026897314b5db66a1064feaa510357bad25567f648d66e65c5698622d96c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395301, "uuid": "eae693ec-5a9e-4988-9792-78a03d0b1f1a", "value": "T150B3128EA40ACC94E29E5CF898719BFCB2991A44EF01FCC817F52FC0052667DC5A5DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395301, "uuid": "28e8583a-ea35-4d82-bea7-9950b45bfb41", "value": "3072:zkL3tIaTG7QzWLH4/89Dny72tmqf5E68phIzNcF3jeg+ey4u+qgwk4Y:A/G8zWLHm8Jyatlf5EyzNETB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782395301, "uuid": "e8272d00-529e-450d-b855-b9d923965e5c", "value": 110608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782395301, "uuid": "8d296e3a-1978-47b3-9c00-f0a097ec5851", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395301, "uuid": "03ce1306-2bc8-4eab-922f-d8d99399c71a", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19e1857-70c4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782412632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412632, "uuid": "9fc18bc9-eb82-49b5-8d32-0b694859aa4a", "comment": "Malware payload (Mirai)", "value": "7284b541d6e339db7bf07e17b40f1bdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412632, "uuid": "c34320c4-d0f7-4e8d-b4ab-b262925dbaf7", "comment": "Malware payload (Mirai)", "value": "d50816c72d4fb6be6aa8e42606f4a5716c704d9b370c5861904a17af180a9ef5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412632, "uuid": "0283c53b-0f98-4713-bcfe-e43f85cfac50", "comment": "Malware payload (Mirai)", "value": "b085308162b0ce503a237ea1b202a40bce4e90b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412632, "uuid": "3b3b407a-a584-405b-994c-dfcf9bcd8d25", "comment": "Malware payload (Mirai)", "value": "7b8f8798de2055caa446108c02e528ae622f91f5ee1090c11ffb6337a724b66c44fa93848d7413380aa1359843bae4a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412632, "uuid": "4c0e8fba-901c-4702-a02a-0ea078b37267", "value": "T1F373F84AF9819F02D4D731BAFF9F414933136FA8E3F972019924AF6423869DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412632, "uuid": "adf67f2f-2b22-4871-bbd8-fd6e656ba37d", "value": "1536:Dhnr596HYqgKRq88MzlPyCagPanJlhmca5ulXUPiAspdqHJxYQg9cCi:JD6H1gKJdzl7agPanJlhm9pspdoJx7Ci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782412632, "uuid": "a76ea2d1-b2e8-4ab7-a73b-85bbd889ee4f", "value": 74804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782412632, "uuid": "e1547fdc-4016-4501-aac4-e3723683d46e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412632, "uuid": "e273b8c7-9bec-4d09-9335-0084053f2f00", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3dc718-70c5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782412923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412923, "uuid": "70235e38-a229-45a9-b931-c0e12d1c7396", "comment": "Malware payload (Prometei)", "value": "785c2c51f2678560545d8308e6e1d8ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412923, "uuid": "2b12012b-04b5-4cbd-a517-c3d56c2f7851", "comment": "Malware payload (Prometei)", "value": "d5527f194b8b0fc0d5f08e212f7bcd94348b3e7effae648f08af765ff0f83a29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412923, "uuid": "9faed9fe-2073-4c9e-9e92-d48fe79abe4b", "comment": "Malware payload (Prometei)", "value": "8077d059f62af8438ad56b197f42b4549d739b77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412923, "uuid": "8e583178-b868-4cb6-95ad-dfce27f52998", "comment": "Malware payload (Prometei)", "value": "adf5a3a388cb5b1c23ab24da4a297b2e76829cc913318babba735d83f34e472f11c1c84a3a4fe5785cb6158c13167718", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412923, "uuid": "d8635fb7-0a3c-4b7f-a3d8-34f43fef6d1c", "value": "T14F37DF77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412923, "uuid": "999ee715-782f-46bc-a14f-869b57418d9a", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ8:cqYUQuVDt0TZEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782412923, "uuid": "e350c5ca-c4b1-400e-8f64-b12006eb72c3", "value": 24412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782412923, "uuid": "960b18a7-3c1f-47d9-b30c-5670bbaeb0af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412923, "uuid": "0c6d1afa-3ab3-47aa-b4b4-8abcf2e6f7b3", "value": "d5527f194b8b0fc0d5f08e212f7bcd94348b3e7effae648f08af765ff0f83a29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5838e9e0-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390497, "uuid": "445f7031-bb76-4a1c-a104-5db13602d251", "comment": "Malware payload (CoinMiner)", "value": "9a7a03f400f70df4492a7e5617c0ff15", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390497, "uuid": "1ee83665-51e5-4294-933b-c3fe77c4dc07", "comment": "Malware payload (CoinMiner)", "value": "d727c634a81811e5a557dfcffb92e033862b636785410a81cf717046a91e0d19", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390497, "uuid": "c67582a6-d4b6-4d47-9d79-0f0f142f1a2a", "comment": "Malware payload (CoinMiner)", "value": "137a69e52a5aa8b62fe239de42d0aee214d9f6d6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390497, "uuid": "bdaeeddf-019b-4ede-acfe-05a34c9640e2", "comment": "Malware payload (CoinMiner)", "value": "04fba0a928cb2fe2d491b1a679eb1d8e6ead202aec348f8353abf49450a350a1aa23d79b7b19981b06da2ede9a2c31f2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390497, "uuid": "a4ae6969-5616-4c08-967b-9d6fffb316b4", "value": "T119F53382697034FCD969C331A7AE2F7471A976100B0168EB50DB70A0257FBDBBA36F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390497, "uuid": "bffb9119-d06b-4539-9db5-b27d276f563a", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390497, "uuid": "61af1f4e-cbed-4c88-8eb2-ee5486798ead", "value": "98304:hzlmm8C/ov5C37dy8JyX2idQzHNLyyKHEU:aSov437HJyz+HNuyAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390497, "uuid": "067332c6-99a0-4b8e-b5d4-146a5a32dedc", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390497, "uuid": "82b53c36-3718-424a-a775-7cd9c2a131d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390497, "uuid": "50a79c82-3df3-489f-bc2b-df617efba2ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f5e397-70c9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782414513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414513, "uuid": "7054f687-8772-4a6e-8174-6989ac824a35", "comment": "Malware payload", "value": "0af9afea08f6a375551c95835b340f63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414513, "uuid": "dabc5697-6680-4289-9b26-f9efcadc3f28", "comment": "Malware payload", "value": "d8fc0a8f98aa0af5edf98dd20ce54f40baa9a4020fd62c61cd203a416cd4daa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414513, "uuid": "ae834219-bf12-4ead-bfa7-d810da47d566", "comment": "Malware payload", "value": "ff81c902b07b6f09f93a67c3f7619463bd47a172", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782414513, "uuid": "24342a9d-b452-463a-836e-ce2d58952528", "comment": "Malware payload", "value": "d054f941d060eab036a8d72539abaf889d1cd1be30ba734c9781e8bafb9ace8fe6cdb1715af9065c4c720455636411f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414513, "uuid": "231164cf-a6aa-45a4-8e3d-e165b39c9763", "value": "T120C3E509BF710EF7D8AFCD3315B80702349C5B5622A93BB6B974D418BB4664F16D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414513, "uuid": "2bd1b3e0-90ac-46d8-a0b5-967540eb83e3", "value": "1536:Lne5JNOXp89olEjwufR8c95vlbpmFcoNRugIXZOTylIGm7+ZH9oN1a+sKqb:Ln2N8lEjwJobpmao6O2lI57+Ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782414513, "uuid": "c3a17945-95c5-4771-b77d-77ac258d809e", "value": 126096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782414513, "uuid": "478f9318-a230-441e-a854-599aad197340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782414513, "uuid": "2a6742d0-8740-4c04-bddc-6c466ba9d7d2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9afe464-7085-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782385507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782385507, "uuid": "fed856dd-0629-434d-9ddb-1bdabe17cf71", "comment": "Malware payload", "value": "e537b5caac44a1123076b8ade7515c8d", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782385507, "uuid": "d2fade79-2c70-45af-9d1d-df2656f8c76e", "comment": "Malware payload", "value": "da4e7957f8c6275c1430edb88da6de381e1ece6201974d0f78df3578be267fc1", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782385507, "uuid": "36b93461-6a15-4227-96fa-acf8cfc51dd4", "comment": "Malware payload", "value": "99a70972e4b2ea15759f3b4bd457c1c3c6cda941", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782385507, "uuid": "b8c6c0fa-17f1-40e8-b3da-4f6aaa78b77f", "comment": "Malware payload", "value": "7374a1052789f199145d5dc9af26508c3537e28e8ab5231877adb9125e63ae9ce2d196c018a3b8f85529100d3db58abf", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782385507, "uuid": "a668aa47-1846-4f39-b1a9-354218444d1e", "value": "T19BB533513DFE8B348B01A0DC21DEE7A919D43A81D2FFE50E254B62AFDD541B87EC45A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782385507, "uuid": "d3d53e15-ec2e-494f-b338-e9e88abb2ac5", "value": "49152:D7qHEUsDXkPCwZdG+oaOhbThWXfE7e6fB1FZDWuJyVrulc3THRfd:DZVDUPCcdE9TAXM9fB1Dquyrulixfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782385507, "uuid": "db1e1b0a-3002-4dfe-bd82-6653c16c006c", "value": 2460613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782385507, "uuid": "47e54598-d000-4e2c-804d-35edf27cc417", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782385507, "uuid": "3c99b497-3326-40e8-9bd4-0b320b287b6b", "value": "CRYPTO_TRADE_VISUAL_PACK_EXCLUSIVE_MARKET_ANALYSIS_AND_TRADING_SHOWCASE.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b45de8e-70c1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782411011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411011, "uuid": "b0b426a2-aefb-470e-8524-914f9ce2ca53", "comment": "Malware payload (Mirai)", "value": "39f18dd58a50a9f550e78d28ab881485", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411011, "uuid": "fae9517d-f4a3-49d0-85c1-8279e4d1b38e", "comment": "Malware payload (Mirai)", "value": "daf0b23d8967eb5dd2174cede13653ecf12f66cc7745b66b15eaee11c3683797", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411011, "uuid": "ab1ca15a-5e9d-44dc-8cf7-f9566b63c9e2", "comment": "Malware payload (Mirai)", "value": "eef7359bc0d9153bbb9631402c24817f23ed4016", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411011, "uuid": "265b3f7d-c433-48db-a363-0cc177e23e50", "comment": "Malware payload (Mirai)", "value": "b366495bcea2b3037176fe0e7a3f9dd6220ece68d80b4de5b21432d986103329ad9037c4d8f6516fbabf0e3db96027db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411011, "uuid": "5c9963f9-f46d-4947-82a4-ef47f9b4cf13", "value": "T114D36EC8F683D0F6E95205702837EF329A32F5B92B39DA42F7785B3D9C61401D90AA5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411011, "uuid": "67b5ce79-969a-4227-ae62-d9691841656b", "value": "1536:TgLeAZOfGoDKLek3J0vTYsqVqrz3J62N2zUA8jRbzrS36hJoYlbM8a:5AZO+Ab+0vTYsq8nJr2Z8dm3lYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782411011, "uuid": "cc74b17a-510e-439e-b3a9-42ef38bfbaee", "value": 135340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782411011, "uuid": "4a1c5d6d-b144-4f26-ae07-2ea1b53c6d2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411011, "uuid": "6c1dc471-5842-4f08-9323-f1749b00df78", "value": "onie_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c78a78-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370708, "uuid": "fd93e9e1-7cfd-4927-bd5c-4ecc5792bb8e", "comment": "Malware payload", "value": "0cd02ddaff6de76209cbb9a7450d8a7d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370708, "uuid": "6c409ba2-d1f0-4296-9083-29d446ea58e5", "comment": "Malware payload", "value": "db1c0f72367535f4a52bcad28a5bf9a0d18ba092225b98d22b9b48ea1cdc4005", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370708, "uuid": "869c9ebc-5208-483a-a288-0fd558196351", "comment": "Malware payload", "value": "e072316bc6a433449cc1d264aefe7be32d7d1975", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370708, "uuid": "cc9c6143-440b-490f-a096-f319f2a3c5b2", "comment": "Malware payload", "value": "e02b2b56f8b1334e6305fcac45faf5e08dbac2c95370f9d218960111307ebe1b676146a4d1a0bf3b19314a582799db2a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370708, "uuid": "e7012006-9284-4174-85c9-c4c0e5714f6f", "value": "T1FB661712BF89DE5BD2A821358EB7C23833D53D04C1B060369616F71D1EBE2A49D6BDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370708, "uuid": "3626110e-4e47-4025-89eb-3e8c6de6f61d", "value": "49152:zZ2RqPF7179vN+5XgQNOYyL+6bivtCHHEt5EK:p1eItOvtCnEjEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370708, "uuid": "810687e0-3c23-4fb4-851c-5ee9c842c79e", "value": 6815892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370708, "uuid": "895dbc8f-cbbf-4d34-8df9-43875566e3cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370708, "uuid": "f6e5c10e-c945-49ed-bca4-5610a9748c63", "value": "xfsaild_sda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5035116-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391190, "uuid": "b83324f5-71f4-4404-b44e-f6b20bf4546c", "comment": "Malware payload (CoinMiner)", "value": "9f286fc8152bfc5e2f3d51b10f5775b3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391190, "uuid": "0de388e7-433d-4668-a0ac-c4a4131c407b", "comment": "Malware payload (CoinMiner)", "value": "dd9eb55d35232b79b8fd3105f96c320d9b68e75cecb148d8b628b2c26c9bda44", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391190, "uuid": "dce8e907-362d-4ef0-a531-006b4d328ea5", "comment": "Malware payload (CoinMiner)", "value": "578ed6e6ba3c1b0a6e1601d1da3b0159f7498d63", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391190, "uuid": "bc2d5ea4-69e6-4f30-8e4f-bffeea73992c", "comment": "Malware payload (CoinMiner)", "value": "ef7664962ad985b4ab87c78cf442bb8d41ae05ce0200bd40d67e71bcd21782e7ef8222e83938be4daf19df0dff88d75e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391190, "uuid": "f0e99979-11bc-448e-9517-4f181ac5d9c5", "value": "T16AF5338A7A7059BCE3AB6E7503CCAF128415B5050B6179E366F24B063726DC273B7D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391190, "uuid": "67d5add5-9cd1-4093-a5aa-aa74da6ac97c", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391190, "uuid": "e85aa9c4-5c02-4da9-ba65-c7c44e2dc1ca", "value": "49152:7NloTf71SUSky256SxXvNCG08kkhVbwp+sRNQpSv9rFAU7LLdkPEDqE/:7NlA1SoICvNoc9wpzR9FqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391190, "uuid": "df6d1e69-57fd-4dc3-970c-530186f89336", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391190, "uuid": "84c96a4d-f75d-444b-9056-b52033953c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391190, "uuid": "06cf416b-ae92-44bd-958c-400de1b68d64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536f9169-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390919, "uuid": "abab91c8-6cd1-4b37-b391-df0e080fa648", "comment": "Malware payload (CoinMiner)", "value": "072a01e30d89dd72021e33b33f97a2df", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390919, "uuid": "5506d9de-b3db-4bef-bfaa-bd5e8e9cd420", "comment": "Malware payload (CoinMiner)", "value": "de79e908320bd93cfe500e4904bc39e57c01e8f84f6e23ab80fc05874145e862", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390919, "uuid": "696c7ff2-5db2-4a21-8d15-cba0c41bf52e", "comment": "Malware payload (CoinMiner)", "value": "6641862075949a4e2d62cae17035d4525b3caaa1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390919, "uuid": "6d2191cb-ca1f-4df7-9b7d-bcf0d2ab53ac", "comment": "Malware payload (CoinMiner)", "value": "a6d7ae0e020ff36cc548bb795146e2e1295e8a192236b2bc84a5ee50de2f77984e1c1ead802543f67b77f3c3e67a9d98", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390919, "uuid": "9b537890-fbff-407a-bbe1-21d91106cdd4", "value": "T188F53398EC5270F4CCA5CAB8E1A70F646E3D11A0526579FF2DF8B4A4180CAC654B98FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390919, "uuid": "0b6b3010-6daf-4c97-ba97-d35268232c79", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390919, "uuid": "555d6d54-a721-4a36-904d-4d82aa2bb03b", "value": "49152:OVIgwa0zOPqENIBsXObwXjsW2/QukBRDJyxA1fR4Qas8b7+Cwe4fjOv0F379:OVXL0QqEeB3+Ar/QHRFyxA1x9BT2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390919, "uuid": "7e945664-1e25-4cba-a225-846a8eb9c3d1", "value": 3449832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390919, "uuid": "3e166a67-cd22-440c-b461-27d46f860f28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390919, "uuid": "14308977-850d-4dfb-983d-afb0cf3619a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89262d89-70c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782412054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412054, "uuid": "1fd097b9-8d85-47be-8894-e76c96c75e1f", "comment": "Malware payload (Mirai)", "value": "1d47fa3c80d2fa0d541d329b350b309d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412054, "uuid": "66816b14-4bdf-4b1d-8215-3e26c3d6fc35", "comment": "Malware payload (Mirai)", "value": "decb182a4acd5d57baa312dde32690d2e94df4708141ec7673480f0aa891fa0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412054, "uuid": "31a318a3-c886-4149-b70d-9033cba993f3", "comment": "Malware payload (Mirai)", "value": "a269aca1d96756f8b5c3609810422ae8c2429919", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782412054, "uuid": "4b101e61-0011-4f75-9b42-1f8116d3f876", "comment": "Malware payload (Mirai)", "value": "f4f7f785569234725c725cba9cd5718b357276078f2f09d3b5cfdf98db03c9cb8ff2df98cd17bc90293bf9b14d1ab4d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412054, "uuid": "f2582bae-e066-45fa-9d4e-c07ee2a39023", "value": "T118933A06B8D2CA12C6C562BABB5F818C331653F8D2EB3203DD159F747BC695A0E7B584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412054, "uuid": "ebb83397-7a33-4e24-87b0-5d8aa549bb4a", "value": "1536:jTwpiATNXlKClDqh8VVAo4Fyin6lprut7lsc3RWMdVpst1Q4HtyqTYW05T1:jTwpiATNVKCshIVAoiyi6ze7lsSRdVpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782412054, "uuid": "a89bce0e-3cee-47e9-bd21-4a922497ef1f", "value": 91592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782412054, "uuid": "57a91c3f-8565-45e6-aae0-ac7a5e50145e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782412054, "uuid": "cc9405bf-17a3-4cf8-b96e-ad476cc16fd2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a64fce-707d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782382114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382114, "uuid": "db157290-a331-4a94-b15d-dfb0b8c8b577", "comment": "Malware payload", "value": "138f80c4766b005e112121dd73e0f4e0", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382114, "uuid": "27620fec-2e80-48a6-935a-091b41cf40ea", "comment": "Malware payload", "value": "df94a7d12864bad56975f6d186c5ab39f1574630eca4ea15e48292020d66c41c", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382114, "uuid": "d417b7d4-70da-468a-bdaa-b88735e65df4", "comment": "Malware payload", "value": "5d58f2a36faa62d4107dc268b784eb427ee6bac0", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382114, "uuid": "9e49f305-7791-40e9-bc34-fb1793e38605", "comment": "Malware payload", "value": "5d2b1a6e887c059dacbfb1cfe6d1ed4b6d533e8752546a841ba25a45f4edb1b56d202905c39adfff7b20a45ec0ffa220", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382114, "uuid": "ea9b4979-3cf6-4e99-971a-87bdba111978", "value": "T113A30290D834E1FE5239BE0C6169F6219BFE5B032232AF356D38DA7EA445F6411215E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382114, "uuid": "06648a39-cbec-4030-894e-a56b77affc92", "value": "1536:z0bBFEaNcInl7YAwlQHJ92AMBjlsvlL2D+I989UNog/XGghlL6MCt63TQ6/8JOGT:eNcPAwOX4SlL2+5yGweM06TcOGIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782382114, "uuid": "1ff3b8b0-0648-4d01-afe7-a72319254eba", "value": 99260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782382114, "uuid": "2e11b42f-e6d4-4b4e-ab06-b8cbd79f6b4a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382114, "uuid": "fed722df-7b32-4243-bdf0-404c57caa016", "value": "DecentraShieldDocs.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b156de7c-7064-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782371319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371319, "uuid": "dc63e3f2-f69f-4afe-bcef-5c0fe5f12191", "comment": "Malware payload (Mirai)", "value": "2dc2c9a4f8c27d27c811108faf88230c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371319, "uuid": "5d97a8d2-4354-4598-aba9-fe8e02503a35", "comment": "Malware payload (Mirai)", "value": "e03fbacdc66169bf4878b966deaec8214965270b8d9c7650e5847f88b5a1ff9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371319, "uuid": "02bef21a-678a-4e8a-b8af-0d1860e6c3f8", "comment": "Malware payload (Mirai)", "value": "999424692bab6190dcf6be3e2c1313ed721d1d3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782371319, "uuid": "a7b4450e-9535-47da-bd9f-ed0459287431", "comment": "Malware payload (Mirai)", "value": "0f263d0ef7abb507a1c377ce0b5cf2109f80dc6160a7460d21aa5ea5323b4f5c0a5d2d4243ef6ec720d55743141c0457", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371319, "uuid": "83208c38-ebf8-41db-a1a0-2c4cbf9b8e49", "value": "T1FCA68CB3905324D8E1A889B4D51416527DBC3C8B5738A3C7BAC471F65BBABE48E39730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371319, "uuid": "ecf1dec6-f3e4-4f6a-9408-6522d164bd5a", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQL:cqYUQuVDt0TZEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782371319, "uuid": "9dbfe70f-1b02-4ef6-8d76-c0f34bd8f9cc", "value": 10354688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782371319, "uuid": "6c2e85ae-982d-432d-8668-cecc200514a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782371319, "uuid": "c33014cf-97b9-444c-8fb8-bf081b389675", "value": "e03fbacdc66169bf4878b966deaec8214965270b8d9c7650e5847f88b5a1ff9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6259e189-70ed-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782430028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782430028, "uuid": "e22a3acf-f142-4b69-ae7d-732de5aaf523", "comment": "Malware payload", "value": "48c26649c61c99b349d2915ad9692402", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782430028, "uuid": "45d8bfb4-eccc-4ba7-8c88-ae0ded71119b", "comment": "Malware payload", "value": "e0f4ca7215cfe5ec12545606916be2f45bc326d8217d3b11d44d79e0eebd9d7c", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782430028, "uuid": "9f2b8348-5593-4aa5-890b-125a66434b83", "comment": "Malware payload", "value": "8e776cd4aa2804c5f05b745b7e6eaabb3dcf5cf4", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782430028, "uuid": "6b24f32a-445b-45ef-a9d0-ff5aeb54c860", "comment": "Malware payload", "value": "71852898a773085c6414751d390c8932558ba60ceee7a92e1660d1f4f5ed6e36450554144e1d95536169c1f700c370be", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782430028, "uuid": "4b766143-2894-4dda-a125-b3bc4cd3aea1", "value": "T1C776011BBCA504F6D06A97328972A6423B71BC450F3163C32DA1B67C2FB32E59CB9754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782430028, "uuid": "ba28490c-ea6f-4c3b-a356-934942a26dd4", "value": "9b763104e1c7e7b7334a1e9ed4235cd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782430028, "uuid": "b6a77683-c5a3-4bc2-b723-91d197c6d65a", "value": "98304:jfoTTEcaJHjAW6o6wChEhkRETlnd4L8ptjsFFyNdOoVgoO6S+KxuA8g:jOgcmAW56wC2Sy4EjsFpoVgoOZ+Kgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782430028, "uuid": "5ac1f50e-b59d-461c-b229-96fcdb1fc31f", "value": 7311981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782430028, "uuid": "bb0c8c3e-f13f-42b8-b0b2-8df541c7bc20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782430028, "uuid": "2351465e-8b86-46ae-bb0a-5311ef4500dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615cfca1-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1782390942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390942, "uuid": "19ac478b-80f1-4159-b51e-d4ad890c2399", "comment": "Malware payload (SnakeKeylogger)", "value": "aff07f8140574442927d34a359166861", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390942, "uuid": "9b7cba88-8300-457b-b7f2-bd959a3b5157", "comment": "Malware payload (SnakeKeylogger)", "value": "e101122360c065faa194cb0ccb4348713235b63ac87183cdebeee4f7cba3bcac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390942, "uuid": "e45cf293-212a-4f91-80fe-767de2611d4b", "comment": "Malware payload (SnakeKeylogger)", "value": "3f3b27b83ac3d41d84338b6b3729f05f92c18314", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390942, "uuid": "d293bf4e-30b0-4063-ade4-6f13b64b73aa", "comment": "Malware payload (SnakeKeylogger)", "value": "be22d00922d4d196da53218031e14dac38db8246a7483bd391a4b47bd810418af513f8603d85ca2f2b9f53692ff567f1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390942, "uuid": "84af2771-6f7c-4404-b4bc-3c83fd7a1370", "value": "T16D75F20149C47FE4CB9E5A2D90BE260DD3A10ECF955669CEF723BD46FFA3A0442161B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390942, "uuid": "1981074e-4826-4c9e-847f-818f40372212", "value": "24576:AiT/QbcBAiWnBhe43M2xsp0zUp0zsTaVqb+M5cLLQYsKMgHsczUypxPB:pQ5DMmlsTaVHQYag/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390942, "uuid": "8009b611-7484-4424-8127-d0ce554200b0", "value": 1576320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390942, "uuid": "ac3c8b46-0c97-42a8-a3a0-d8b856542da9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390942, "uuid": "dde4c7d3-8992-4c82-8a44-a4eb5c858212", "value": "AW PO-REG #1529_052026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9ce3af-70c1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782411287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411287, "uuid": "59e67525-e7e3-4b2b-9f1d-f17a7d5b0e9b", "comment": "Malware payload (CoinMiner)", "value": "d381c55b74f1679f0b8c1ceb39d11e6a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411287, "uuid": "08e8df65-8582-4fa0-8d0f-9b1c5bb1b77c", "comment": "Malware payload (CoinMiner)", "value": "e297203d6a4a85af9cce3140a8baecdb02a2c52789b5a3b8b6ca8708371bb39f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411287, "uuid": "621fb201-2c4d-48ce-8feb-aab71bbd3f5a", "comment": "Malware payload (CoinMiner)", "value": "d47c96d0873127bd3235869fa441f95ab5e8bc01", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411287, "uuid": "5e6a6a00-9b5f-401d-8f34-e25461f9ada0", "comment": "Malware payload (CoinMiner)", "value": "44d6b2f95592b05d614f1fc9ec5792a35da35084b7e87560f59943895969c49bf3a7bc08fd28d343d2132ab0ee8004b1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411287, "uuid": "538654af-097d-4595-80bc-af43c3b7e0b1", "value": "T1AF3429A9BC409B52C6D427BAFA5D839933134FB4C3DE3506CD241F2936EB55F0A3A582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411287, "uuid": "2107246a-7735-4a47-9b64-8256b65e19a6", "value": "6144:PUUL8nguNxD8EhjswcRnrG6cBC85k1pVhnQKHPwZv:RL8ng6xjXuni6cE1pXyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782411287, "uuid": "1ab76ebf-ec6f-4901-83ed-567440f03ab5", "value": 231244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782411287, "uuid": "9ac9181f-0486-4a33-afff-969e36aed9a1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411287, "uuid": "f3bf939b-cde1-4de4-ba13-42c90e29e46b", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711e4d22-7076-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782378943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378943, "uuid": "37dbecfb-f317-400d-a523-7c0aaba803cb", "comment": "Malware payload (WannaCry)", "value": "12b5b59530529b5b000e85bf364b9de7", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378943, "uuid": "2c617519-effd-4898-8234-d629beccd99a", "comment": "Malware payload (WannaCry)", "value": "e597fbda1571b0debb7c8b82a374e761d7db21eea06ec6f3f7f998d29522e314", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378943, "uuid": "24489068-9d38-4cc9-a551-49283bc5b14e", "comment": "Malware payload (WannaCry)", "value": "ca462b80ab100ad333e7e860ddd75f1bd4ada675", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378943, "uuid": "e121fdb3-4727-47b3-bef0-14b775c06532", "comment": "Malware payload (WannaCry)", "value": "0ae5972cc81343bf4a50f7dc0f00a7aacb9feb5b02ebb623f737334d2b2dd284454be26bbde07d81c6d8d08d2bfa27ed", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378943, "uuid": "f773ebef-975c-489e-8708-aac4661c50e6", "value": "T1E2363304635C91BCF096057488A34E29F7B37C6997798B0F5798C62A0F637D2AFE4B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378943, "uuid": "fe3cbf7b-3d89-499e-8f5a-fd18ad1d5a40", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378943, "uuid": "b119f900-1716-4b5b-8e5e-204b8dc219fd", "value": "49152:jnYnjQqR6kQo6SAARdhnvxJM0H9PAMEcaEau3R8yAH1plAH:DI8qR6k36SAEdhvxWa9P593R8yAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782378943, "uuid": "4857374d-ff95-487e-a6ba-ad42d6f88343", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782378943, "uuid": "c97a7dfc-0c73-43b6-b48b-e53a888b62ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378943, "uuid": "8bfe5217-98bc-485a-9da2-3569783fd9de", "value": "e597fbda1571b0debb7c8b82a374e761d7db21eea06ec6f3f7f998d29522e314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e8fe76-70b5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782406147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782406147, "uuid": "117aca91-7db3-40ae-aa12-4e9abb637b26", "comment": "Malware payload (Prometei)", "value": "c198fc93402c7a6e5665111bfb6435ac", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782406147, "uuid": "9e98663f-4a4b-470a-a021-8cc7ef92dad3", "comment": "Malware payload (Prometei)", "value": "e62e3db06935e2d8cabb668212d86978d6ba43f6a677518e9aae44c77998e88e", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782406147, "uuid": "fa36b6ac-066a-41b3-bbfa-a16c685d8d1a", "comment": "Malware payload (Prometei)", "value": "c07eda9e4046b9ab69e8f2fb9e04d92c69044658", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782406147, "uuid": "1f974a49-cb28-4d4b-b159-300d213a3dfe", "comment": "Malware payload (Prometei)", "value": "60bdfa676611d8cbf162c3878a7c18f4f06fb675522d1c9d449c81960762dc9fedc701da697fdc662e1558ade0c39ded", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782406147, "uuid": "44eb09c1-40c4-4a85-843a-507d96d5e77a", "value": "T1DCA423B4F9219E9F6DD769B91B24831DE082C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782406147, "uuid": "6b30797a-c95a-4e86-8fbb-caf57717e2ac", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdN:Fs6pyCC/Ya2hpi6T6N4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782406147, "uuid": "072961f9-7312-4186-a273-adfb07e66393", "value": 449078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782406147, "uuid": "b06dbdcd-d19d-4c07-93d2-1d082edfe262", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782406147, "uuid": "6fea9e00-e43c-4246-9170-7423168d33bf", "value": "e62e3db06935e2d8cabb668212d86978d6ba43f6a677518e9aae44c77998e88e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b1e013-70c0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782410658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782410658, "uuid": "c249764a-b48c-4324-88d0-3dd68e0fdff4", "comment": "Malware payload", "value": "6d61be2cd7fb01289b2f40b38a61eed8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782410658, "uuid": "6cf40b19-5e44-43bf-8b39-f8fe49e51891", "comment": "Malware payload", "value": "e6ce3b15a94bc1bef1585cc8d8b6ed09f124ef8a4a81b1e6c329b17db0e51012", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782410658, "uuid": "60356656-396c-48a2-8b6a-3afb64ffa992", "comment": "Malware payload", "value": "1091f01971c5e59f5f70bd5e3a1c1a35a2c06e90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782410658, "uuid": "7cca209d-fde2-4d23-90e6-c48ae915d6f8", "comment": "Malware payload", "value": "833481c391dac885f0acf1f2315256dc7ffe443113a2c6b1757cafdaaf1e05a7a66b0d7eaaca32e3286e8869c6afa028", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782410658, "uuid": "8388535a-2c21-4c09-b958-462aa7844e6b", "value": "T1FA836BE9E683E4F1DD5215F011BBE7367672D4360024EB47FB58AB7AEC13A22A50538C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782410658, "uuid": "1a2abdf1-a580-4fb8-a439-8651087d2852", "value": "1536:0H/YRnBa4rUFJQ7I44nWaXQNFhL6hg/hxjh2yRAcPM9vmD6QB1LkrcP:MGnBPrUnP44NovZPCck5m97LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782410658, "uuid": "c7f84fc1-4b39-4ad6-ae72-815669cab154", "value": 83184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782410658, "uuid": "56eb135c-18db-4522-9a04-af16bf403098", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782410658, "uuid": "4e399b72-f12c-4366-966a-fdfd560610c0", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bff25ff-7074-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782377914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782377914, "uuid": "93851a97-9a60-498f-89a6-818d0ce441ab", "comment": "Malware payload", "value": "7e5aadefaaa00d62d7f1d71095627c14", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782377914, "uuid": "fc2a1f6f-702e-4545-a165-c61a2ca79225", "comment": "Malware payload", "value": "e6d3a52f44ffda39c2bcdba871f256fccd1605d9a2aeb8ae41ed1f88d3fa783e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782377914, "uuid": "fe2933d0-935a-4e44-a032-54b531ba0301", "comment": "Malware payload", "value": "47e9997781b3cce7d4a44344c2835c1c5f58ae45", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782377914, "uuid": "fe7f7fdc-af98-44d5-90b3-7156e96e2ccc", "comment": "Malware payload", "value": "891b6b3fd9248b5b032ec7a18cfda154044cd8e4f25734d6b9761d3481e6858e7a5561d0ef738b05b5059bb4445c3cd5", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782377914, "uuid": "760c359e-7661-4bc1-9cf2-e12bb6fd645d", "value": "T1BDB02BF709A710CE3349D200504040471463140D40450050A158C2A50884121D047D57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782377914, "uuid": "106fb0bb-1aae-4580-931b-e0af591bd7df", "value": "3:jKMFIK8kYrUAjWLWQv5Vcu1VFnGJhDTeERfQhTu2:jKMFIJ4Yw5fPFnU/f4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782377914, "uuid": "73124ebc-b59c-42dd-aeed-51d910b0c708", "value": 128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782377914, "uuid": "b376de11-5920-401f-a8e3-76565e3cde32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782377914, "uuid": "5ec8ed75-d317-4452-a4ef-a329d5e0644a", "value": "stage.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1a012b-70b6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782406446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782406446, "uuid": "56517323-440f-46d4-b53c-241591474790", "comment": "Malware payload (Mirai)", "value": "456bcc9b672516555f20f5eb8950b86d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782406446, "uuid": "af0759c6-0157-4ca7-bd9c-5290eb18a6ce", "comment": "Malware payload (Mirai)", "value": "e79cdaca77eecfa7a942c5392bdd9fd8dd238343b0ba0cc7fd7a79da1eeff450", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782406446, "uuid": "03d43184-a60b-4878-83bd-c0ebb8d83c9b", "comment": "Malware payload (Mirai)", "value": "24128753ffd333b734c2fd78adf79bd33a9f2f50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782406446, "uuid": "59671788-0dce-4b16-84b7-3501763be74a", "comment": "Malware payload (Mirai)", "value": "114d5b8744fee5e1db42c405fb0546ad16747950c1ceceb2bf039a058f9b2cdc2591de81d84637971e2cc28c4f80a842", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782406446, "uuid": "79f24b8c-2c2c-4dc0-b143-b86f2e5fd4b7", "value": "T14E731956FC92CA1BC5D01375BEADD69D3322B3F4C6DA3213FD204B6C368650E1E2A981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782406446, "uuid": "9fc9b0be-2b92-41a5-896b-10e17a2e70e9", "value": "1536:WLH8ZGIYG5qFGyD5rrUpGCGL7POsBVP+Gb84huerR:WLHkGOBiQBsvP+Gg4hfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782406446, "uuid": "98ac2452-0200-4b4b-a01e-4aca4c51d95a", "value": 76376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782406446, "uuid": "117c20d3-740b-444e-96bc-23561c01a7aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782406446, "uuid": "1db7cdae-312e-4532-b640-5e809a56a433", "value": "onie_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832842b6-70ac-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782402166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402166, "uuid": "d5c5d18e-d583-40be-b2e7-48915693cd95", "comment": "Malware payload", "value": "f8aa850def7d5243da16623e3936dd1a", "object_relation": "md5", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402166, "uuid": "ec879061-234a-44ea-8166-a1886fa240e1", "comment": "Malware payload", "value": "e7d1b6daaf0c89f0e72c48c159a6d83a50666263611cb28109194f2625ab982f", "object_relation": "sha256", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402166, "uuid": "793870ee-813a-4a07-a88c-bd42c8498b07", "comment": "Malware payload", "value": "d0404849ccb4de4997e987d95584a93509eadbdc", "object_relation": "sha1", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782402166, "uuid": "cff30060-468f-44a7-a49c-5bf0ed72984f", "comment": "Malware payload", "value": "9bc0b23a6ec710741536d019ae107b1b1aec558e6ece4051289dec74073298775b0470022e34dccd6400efa053902689", "object_relation": "sha3-384", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782402166, "uuid": "06c695af-eb83-448f-baeb-bf3e4e7b5ea4", "value": "T10EE29A364AFBB164021B5B8D9917C056D38A4216613F90C8B69DF4EDBABF2D061D0CEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782402166, "uuid": "84a74021-6c07-4ad2-a7f3-d26cdd0f183c", "value": "384:N7pSbr1wlF+4yX2GxwH1XtJ/ZLmSdg10fJ1G:N0r1QF+4ymua1Xv/ZJgk1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782402166, "uuid": "cf188b91-1802-45e5-826f-64b9fbd652b7", "value": 31142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782402166, "uuid": "bf7fc768-a59f-41c8-82d0-21eaffc48de1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782402166, "uuid": "fe9f4e26-61d0-43ce-a47b-d691d73efb54", "value": "sj98xe4.applescript", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dcf7c4-7080-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782383427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782383427, "uuid": "ee90a86f-904e-4ebf-9dbf-4c56c1c2ba68", "comment": "Malware payload (AsyncRAT)", "value": "4d3c70b6d0b59653e7866f0f29e87fd6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782383427, "uuid": "260609d2-755b-4954-9a0c-b6ec4ea17c4c", "comment": "Malware payload (AsyncRAT)", "value": "e831c62f2cd0906e11e5c666a203a5ca7ffe5c34af599f45e37db397058d95f5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782383427, "uuid": "e53efb94-9f4c-4e2a-abfa-5cb0a7573e1c", "comment": "Malware payload (AsyncRAT)", "value": "a6645ec6fddae1998d5aa7b01ca7edffcf139e33", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782383427, "uuid": "c8200c9c-907d-425d-8934-891cac5992dc", "comment": "Malware payload (AsyncRAT)", "value": "0c87667962219ac9dc958945a750b2c309ca82f147b181e07ea148d02a8ef418eb1bca101933318653869044c5d0e28a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782383427, "uuid": "dfbbd824-3172-4a6e-9cf0-a6e7f8053ff3", "value": "T1F09543358FA16B4A5801F7A4186B2802E8BAB338F771DD2CB56E50C51A71DDE9060F7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782383427, "uuid": "647a1a7a-9b15-4c74-8665-0dec4c506886", "value": "1536:kr+ZathVlYZVszzlS9mcnK9oulXmOMXiAwyGhu7oHZW4:kJ1Se9RlXlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782383427, "uuid": "7ee86cf5-0e6f-4c98-a50a-1001820a78c0", "value": 1894860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782383427, "uuid": "74aab2c0-b9cf-4429-8812-a5c21f7952ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782383427, "uuid": "ea999f7d-b884-4c62-b7a5-3a8bc58b8acd", "value": "RFQ-VIS_DGS_PR_202606015.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e0a8a7-7093-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391277, "uuid": "303e5f36-d9ad-465a-bb26-39484a8a026f", "comment": "Malware payload (CoinMiner)", "value": "6e9c7c732727236b82948c939557e019", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391277, "uuid": "9efe7511-dfe8-41b0-a1a9-bc752e0cab5e", "comment": "Malware payload (CoinMiner)", "value": "e85141b23c76fe7b5b6cd7a7a6e4e3ccc444f8b7515e7883f64e1b91423997d8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391277, "uuid": "f80d7102-f9ff-47b8-8c27-8b39aaf37812", "comment": "Malware payload (CoinMiner)", "value": "8cf247a166e94f8dd40c9aa87368c5de227eefce", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391277, "uuid": "21aea2b9-23a9-461d-b7fe-6696eb08d6f5", "comment": "Malware payload (CoinMiner)", "value": "8f58123a32feb6f6885e76c484bd7608561fbf5dff95b1dc3e8ed0477f22d7f229aa546a1b136d5eab70e2fe7f9f9251", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391277, "uuid": "a2c047f4-d2c8-4eed-aba7-08d748b6dacf", "value": "T12DF5339A958182BEEDDE0875C6BA7F7C7F2E72211F1246C641F4A47033736D79C2086A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391277, "uuid": "d8325c02-29ce-4abe-93ee-9be881ca006f", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391277, "uuid": "d9428581-275b-4d1b-9efa-da07816989f2", "value": "49152:/X2sZ9J9gkqV34lxxHYWEBKgZSZVWuvN1Rc5ZQTpCuoc5T8NDfwQxtz:/X2Yr9gkqV3EYPUVWub4+NCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391277, "uuid": "d9787b31-d978-4ae4-b033-4aa3a42c94ab", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391277, "uuid": "19223b55-1d4b-4aa5-b37a-1ef19fba3f94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391277, "uuid": "98dacefa-c211-4ea6-84de-09b062c6b760", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07342ba0-7093-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782391220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391220, "uuid": "93de8a22-bfa2-489d-9f12-27dc29a8507d", "comment": "Malware payload (CoinMiner)", "value": "75b7480830830bb47e35db46bbb4cf73", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391220, "uuid": "35d9dcfe-5149-4614-9944-3122485c33dd", "comment": "Malware payload (CoinMiner)", "value": "e89aa9bec3284f837e7d338d5069842df245a0f9919617865b8a2eea480e3dd9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391220, "uuid": "7fe81b16-6168-4d84-a5c1-a609871b647d", "comment": "Malware payload (CoinMiner)", "value": "5aa3f6654bca4eddac7a3055696d0363275f6e13", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782391220, "uuid": "977bdd9f-dad0-4b81-89dc-e7bdde4f0d89", "comment": "Malware payload (CoinMiner)", "value": "6ef206eef152e00339f0284c2010ab2622733328437176b8d617eca2d71b09c61c1045723d446963a1c6c14104fe0e08", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391220, "uuid": "cbcc1195-64e0-4600-ac8f-9963eef76238", "value": "T1B5F533A6F6B2A4FCEA991E3807AB6F35683C24F541052AFB41F761502534BC1E4D6CF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391220, "uuid": "d635a291-d381-4b3b-b5b3-ac71549304e4", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391220, "uuid": "904115f5-6873-40c5-b029-14b981dd1b31", "value": "49152:aX2kJjUD11wjg6n2iYHtle78Q5TXxifcTfnGUOQXTT2WYzXF0Jih8Ttd1Wq:aX2kVE1wUZtRKGUPTS0Js8z1Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782391220, "uuid": "a56b0d0c-e517-47ba-af3b-0d7a0f7e31a4", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782391220, "uuid": "359c2ff3-2a79-4e31-b372-4290c39b9f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782391220, "uuid": "df72921d-9440-4335-a1f3-18f80b21ce66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a122f06b-7076-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782379023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782379023, "uuid": "acd64850-b026-4b16-afb3-b15023c06f5e", "comment": "Malware payload", "value": "3fc7a215149b84c51b9869ca4ee6f796", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782379023, "uuid": "981ce066-cfc5-4374-bd4a-96262511949e", "comment": "Malware payload", "value": "e8a061067a41b47aeaf71d261027d3c21a5b6606bfb04e03381f3e5bfad7ef5a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782379023, "uuid": "4d49d806-d756-4528-9b1d-951f676c89a3", "comment": "Malware payload", "value": "bb2da5ff8a0ab1c796058ff0309763cdd40ec8d7", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782379023, "uuid": "68bfbb29-cdd6-4e45-9494-6c1683c40525", "comment": "Malware payload", "value": "75f10389b66f03ede7ab04e7ae80aac10adb14030198f554b7b35661ccff633827f5ac286cc3589235c535aa30d59962", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782379023, "uuid": "b8561f5d-494f-493d-a9d4-9ccad5d007bc", "value": "T1BB11DC07D0A47C60C476ACB5D32DD5DDB7F6865027203F490B46CD2E3CF5852B85D485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782379023, "uuid": "a842a062-b7b0-4da5-8725-dbe6f415ef33", "value": "24:98yEZmBew3FG6vuhZOn/k5EmkVKgSpBx9MJAINhIxtptEZmihal:984B93ABhZe8umkVsBx9MTNh6pfQal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782379023, "uuid": "79341da6-b720-4547-84e9-94f46f583a35", "value": 1078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782379023, "uuid": "bf908de0-45b4-419c-83fb-f685f56da21f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782379023, "uuid": "8c3ab077-cc64-4103-b571-b0899fa896c3", "value": "Complaint-Case-File-Access.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513f6254-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370729, "uuid": "88f6328a-3796-41fb-983c-5aa7f644da44", "comment": "Malware payload", "value": "9a1d3a45c39c88315dc3165b604c6570", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370729, "uuid": "3fdd236e-c972-4942-beef-451540c72b23", "comment": "Malware payload", "value": "e8d60f4ff83096dcad6fc6e1c381192f82df9ed91c64feb86506a45c805a455a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370729, "uuid": "8149aa8a-63f2-42e7-ab81-7aac6ee52328", "comment": "Malware payload", "value": "681d5cce3a5fb63003327ef41ae251c49b6d7b14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370729, "uuid": "d9559526-c73d-4623-b742-dfc4fe39a49a", "comment": "Malware payload", "value": "f6ce6981197975901884e43ac85fc4ba7b7198d72e9ad9bcda0671eeff34c718e2869cc529716dfaeac0c548cc4280be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370729, "uuid": "1659f063-5500-4d96-b907-75a4c2b52fb2", "value": "T12A565A81FB48A126D94A0A324CB30B70B3916D85C1F48D6F5709F72F45B26F6AA4FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370729, "uuid": "07684f3b-84a3-474f-abd8-fae3c3515353", "value": "98304:uEZewtrnU0RSaJodCkMbA+4q8L9pG2v5nEjEE:9tLx/kr+qNnfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370729, "uuid": "818c0a04-9497-411a-8074-4ce0d31bc34f", "value": 6094996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370729, "uuid": "9f3d9fb3-19dc-4b94-93d4-45db45b6fd73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370729, "uuid": "f010f7d0-88f1-42a8-8762-becd26fafaef", "value": "devfreq_wq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25a5d6d-70c2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782411748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411748, "uuid": "a7daf282-de46-454e-897f-c87e88cb7991", "comment": "Malware payload (Mirai)", "value": "fa34f9ebef99562e42a4962345938b85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411748, "uuid": "1020da38-f491-4660-a727-510f3c4abf88", "comment": "Malware payload (Mirai)", "value": "e96fd3047b20982dff4afc43059839153df1808e291c7f0bc699fcb8ebaab0e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411748, "uuid": "cbca686b-44b3-46c9-88b7-f5c7dedba563", "comment": "Malware payload (Mirai)", "value": "3556fabcc239011c0b98c6397510f5cf68392371", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411748, "uuid": "f7d70d0a-c514-409a-8600-7bf226f877e5", "comment": "Malware payload (Mirai)", "value": "e0e418b03167e57721f2cc66826ecab0abd528ed2de244360c0c71119a4081553f1285b8caf6da524de45f651268ea44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411748, "uuid": "03354ecf-ec61-473c-9d57-9e7471aa70da", "value": "T114144A5AFB8D5ECBD18283398DAB5B312337F4A95B0793272A09927D7D9E74CCE91000", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411748, "uuid": "8e7d1469-261b-40bb-9bcd-c00bcb3cc1a0", "value": "3072:0uih1xdih90FLQgvUEQxvWa/7Ozk+azb1:0uaFZFnQZXDOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782411748, "uuid": "8ee5047c-7957-47ff-906f-ae7abf7568ca", "value": 207136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782411748, "uuid": "e8418f5a-d100-40b0-966d-22af50829128", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411748, "uuid": "38134a40-502b-4ebb-9524-94bd579e4dde", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56449783-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370737, "uuid": "6a0f0bd8-dbd8-4608-bd49-b7e282ef85e5", "comment": "Malware payload", "value": "33ebc6a68331ae5b0d6c397742facd81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370737, "uuid": "e37bb918-d5b1-476b-8394-1f2517fefea1", "comment": "Malware payload", "value": "ea1f896bd5a204a0719e75c1d2b8ff4e515908cbfd2f22196c7cf4204ac96e63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370737, "uuid": "85d465f4-5b7d-46fe-9790-189d07b925bd", "comment": "Malware payload", "value": "81bc617c0c19dd4e1f97012089866ab58020c180", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370737, "uuid": "f2a3e54f-f7a8-4480-9088-549ac1f252ee", "comment": "Malware payload", "value": "13f5395f7a5b25344c01efaf127ed81a95958aa40cb1f4be518be7a75de6f6aaa73d0eef89356df0ce5bbbc542fcc23d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370737, "uuid": "a977543b-851d-419e-b17c-3dbc53d6fee8", "value": "T1E966F809AC843BFAC06C4B7454EAC95622B05D144AF14A7622A5FBE9FC772797F07C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370737, "uuid": "a828a222-7023-4d3c-9281-49bd68d2339b", "value": "49152:YuAbITvx4rUbEYrOVhAnFrVqmKcsALIqtG7gdZg5Ef:YOBrOVinF58EKEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370737, "uuid": "abfade61-d842-46a0-a1b3-30be6e1adf86", "value": 6946995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370737, "uuid": "11003395-9873-4259-9011-a4ea69faf187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370737, "uuid": "012d001a-f247-4775-99e0-79ffcaa8f31e", "value": "ecryptfsd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b0af56-707d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782382116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382116, "uuid": "7bbf3738-1de4-4d87-97c8-3c1107c7ab98", "comment": "Malware payload (Vidar)", "value": "95bfdd5f0c977262c042dd7bcde28000", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382116, "uuid": "74841c09-25cd-40cb-8ddf-04f55329e721", "comment": "Malware payload (Vidar)", "value": "ea692f472d83dad2b4a58e1c22890265fc3abfe193dfa99368a19549896c58af", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382116, "uuid": "d8c36483-f50c-40bd-a887-1eb3a758421e", "comment": "Malware payload (Vidar)", "value": "833d746cf655ed2bed99d975545a3a28881bc7be", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782382116, "uuid": "51cbf31f-3db4-45ca-a076-4a4afe2e6867", "comment": "Malware payload (Vidar)", "value": "b183961d48e6a9d7f3324f998442d1afe402b5bd145f422ec22adc4f611cfa758b3a76c9a9965af050adba4b8de3919d", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382116, "uuid": "3346f55a-119b-456c-bcb3-ba2039859a36", "value": "T129B5F0C78A861DC7CDC11838AC6B4F745A31C89AF816CA139B32A7BD9FC77948C1A54D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382116, "uuid": "98259107-f2d6-49e9-a08b-9396b379e93c", "value": "24576:tOmNi5/DJ6hzybfT/abb7raMboIES7dnpA4vOaMe/NQI21AuhKSXguQmu+K:smNi5/EhzyrcvuKom7dnf9MefWhKSX1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782382116, "uuid": "22bf2d3e-f490-4567-a0ae-9f8c751b7b21", "value": 2445192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782382116, "uuid": "c6865ef9-1248-4ce2-8a5c-c6e949bcd18a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782382116, "uuid": "f828d7a1-7d44-4b7a-b41d-1ca059a9898d", "value": "setup-1.5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139563d8-70d6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782420017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782420017, "uuid": "8b0275f0-b5ca-46be-aa1e-c8218c0da624", "comment": "Malware payload (Mirai)", "value": "0b9b8b8a6831419dc3c7aacac493a8c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782420017, "uuid": "9a766faa-aea7-4d2b-99a0-0ee4becf1920", "comment": "Malware payload (Mirai)", "value": "ec32ee9f654e4817249df530db663c775b81e11868c7c087888eb49f5e7485dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782420017, "uuid": "38105680-3d0c-4d93-ab03-548299364974", "comment": "Malware payload (Mirai)", "value": "9d696bcb94b143d5e0a107b02db18d8513b8319f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782420017, "uuid": "e584aadc-e547-4278-9d3e-5b52a19e3ebe", "comment": "Malware payload (Mirai)", "value": "1d2d309d5a42ad29f2393a619c3bb61b8bcf8c0c2d2c555ab7a3d4aa534ad7b955cb3f052da8a1b91dacfe2119fcec06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782420017, "uuid": "a8d82ccc-1c9a-4eef-a05f-33af0045e3f2", "value": "T18AC30A527D428F13C6C321F6BBAE42983B136B7CD7EA3102A9247F51278B8DA0E76551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782420017, "uuid": "450f33a3-f158-442c-a408-9d31046ca63b", "value": "3072:zyX2r10wXgDWs0hmQJYwZvr4v3q8sNBE6O:AwXgDIhFYwZT4ftsNBE6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782420017, "uuid": "3aa30370-ee27-40e8-836d-538fd5ba7cfd", "value": 124544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782420017, "uuid": "525ee02e-31db-43ca-99ea-a91bed7bf419", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782420017, "uuid": "1842b3d3-2c3f-42c9-85ec-fb7a955eb052", "value": "data_arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ff014d-706e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782375570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782375570, "uuid": "a0a01b47-0c91-4a11-ac13-9c7c8d0c8c4a", "comment": "Malware payload (PureLogsStealer)", "value": "6737c77e8ee4db7099c297210c7ebd01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782375570, "uuid": "ba71ec53-f158-4bb3-9131-095495f6f6b4", "comment": "Malware payload (PureLogsStealer)", "value": "ec7ea6a2febb44c94dc09f3d1a66ea49af94e61f2a4a330dfa9e24e7b776b0f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782375570, "uuid": "c329b9d0-f0b7-4867-968d-ae81be74a7a8", "comment": "Malware payload (PureLogsStealer)", "value": "14daabf98de18aff4e2392266d6f7e982b1c979e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782375570, "uuid": "598a36fc-a788-4a43-8e76-12ae24393797", "comment": "Malware payload (PureLogsStealer)", "value": "d97189d464d70e0dd9296a424cf529480861d4d21fc48d6001a2e65de39dfa58da2e2edc4ee240687f8c258aa12c79c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782375570, "uuid": "9bdf058c-644b-4a54-9c66-8ed8a37058d9", "value": "T1E97512586259DB01DDE64FF2D935D2F523612DCAE826C3875EE6BEDB39357002E003A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782375570, "uuid": "11959f7d-ad35-4463-aaa6-aed51c0cc70e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782375570, "uuid": "580f19fa-9a53-4c73-9521-55fc57b13676", "value": "49152:HzL17RKfePGkEhc8bymg0WUdFA2djD538:HzL17RKf6tE7ymgKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782375570, "uuid": "9e060cad-e3e6-4f62-8584-9ffb79f16a6b", "value": 1662976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782375570, "uuid": "3f32b904-1d6c-4b2b-9e6d-d6358785b390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782375570, "uuid": "30b7421e-fd13-4739-bddc-15da4bbf3da2", "value": "6737c77e8ee4db7099c297210c7ebd01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d759d0-7075-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782378330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378330, "uuid": "df591b12-9d13-4893-b2c3-8337a205c2c6", "comment": "Malware payload", "value": "80b2f736bcf2eafceee63300b249c689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378330, "uuid": "fb35f66e-b9f0-426a-a4ae-13c5e12a15bc", "comment": "Malware payload", "value": "ed3c75b9f7442b153ccef15d29d1ae72e4a2907c0749a2bee9a6d719622e285e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378330, "uuid": "26257aac-fadf-4412-ab62-7bff88d8e92f", "comment": "Malware payload", "value": "b43743538632de23dd423398b6021cb3a1e178d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378330, "uuid": "0f275ff9-40d7-4fec-84af-108f508591bd", "comment": "Malware payload", "value": "ef37a4dd5a8d2962abd2f9824570581fb25e606a440df6ea0d74884c9d6e50c2fa4296e85a227e9b14380186db4c2ef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378330, "uuid": "095f2d17-be33-4f01-938d-d3b4235b8519", "value": "T153F733984F80BCABF85DC1329AD09D14E9BB285D3D81965B13E408753E7B7C845BEE32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378330, "uuid": "5cc37f85-e166-4d9b-9a75-1664b76de8f2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378330, "uuid": "295669b5-3f01-4c76-96f6-fed3fd20cac4", "value": "1572864:BqrTIA7X7+vWlM9ojCrD4WWJvKSc/JUNngPhu0oZIiZVKhP:4ZaelKbDSc/iFgkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782378330, "uuid": "eebe0d9e-55f6-479a-b428-b7029d3bc394", "value": 74505906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782378330, "uuid": "4b966547-8603-4e5a-b091-9fef14a46ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378330, "uuid": "e3d7fe9b-a924-4b1c-a952-a75d62d27988", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0fb12be-707b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782381170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381170, "uuid": "b6f71c59-0e36-4444-92f3-f8e9a1ae4af2", "comment": "Malware payload", "value": "ca081612b4092f3b26b9194a9904694a", "object_relation": "md5", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381170, "uuid": "82edb929-98a0-4b92-8629-c6c9d83191e1", "comment": "Malware payload", "value": "ed6d1e8d9644806b391da2fec1464e554bb6d6ba0b020c407864820533e6ff26", "object_relation": "sha256", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381170, "uuid": "a5c3c0df-e33c-4272-b9e6-b6af40fe0b88", "comment": "Malware payload", "value": "4df7d2902dd798f15babc166ccd2a5a5b73a3b4c", "object_relation": "sha1", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381170, "uuid": "fc5d35b4-61cd-4d67-8a5b-718cf01f194f", "comment": "Malware payload", "value": "ca8e25459336068039bf7b0ce84ae8254f4198e3ef2b5ff5977174f5292a3ab0b2cf33bd71cc446d29523f7ab75e16b6", "object_relation": "sha3-384", "Tag": [ { "name": "Crafted8088", "colour": "#079D50", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381170, "uuid": "aaa2c76a-759b-4865-81ca-18423a08c247", "value": "T125A523925C79508F06E88ECF391765E3D2AC861025D1FA16AE08E66CB0961D0FF3DFD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381170, "uuid": "7b369118-59bf-4d85-8309-5678b8a04d51", "value": "49152:rz45zUAz45zPr75zDrvrofHrOj4DfrbGg:7NDsvbXGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782381170, "uuid": "2496a7e7-8a87-4f1b-9b9f-e90908d2c4e0", "value": 2137864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782381170, "uuid": "76a1379b-c8af-43c2-9565-16ba3945415b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381170, "uuid": "b34db9e1-ceda-4c97-b995-7b18846a11d8", "value": "bitcoin vs real estate.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d472de78-7075-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782378680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378680, "uuid": "27a89b10-2732-44d4-a84c-2c4ec1dce922", "comment": "Malware payload (AgentTesla)", "value": "b4c0f95547af870c6be56bb44d3bd656", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378680, "uuid": "cc9496e7-0319-49b4-8fb6-20c91337a6ea", "comment": "Malware payload (AgentTesla)", "value": "ee35b5d05f07596576285d90c29ad6932191adadcb840fb8310a12559f7605fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378680, "uuid": "e05dd495-6f08-4a2b-8726-5e3a4a4c29f4", "comment": "Malware payload (AgentTesla)", "value": "40b97221e8e5ba866941144d7ad3939a3ef70913", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782378680, "uuid": "18b89629-d963-4e9c-9a6d-8efd4a05c10b", "comment": "Malware payload (AgentTesla)", "value": "e8a7859fb23cc49720fb4be7d76195286c8673e227d709824e37ab0c107b58fc4d9d53ed72129fe6debf2568f1e2a731", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378680, "uuid": "83f9b1c6-3029-4ec2-b197-3f45e624f153", "value": "T1B375E31EEC61806FEA73CFA559979AC2BDE1EE533118DC4091D653418102EA6FE8273F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378680, "uuid": "6e57d7b5-4979-406a-be13-44d98e99f90d", "value": "49152:29Fw2gyqeWRcKlrZOD+hs4WF1PQnL+/KkhnckDHYYEwwztA0czEBfBI6zWAckWO5:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782378680, "uuid": "43794c98-15c8-4fc0-9584-72d040b9e827", "value": 1630192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782378680, "uuid": "1283749a-7b1f-468e-8fb6-229a3c833a7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782378680, "uuid": "8429a987-d052-4428-9d97-8528ff35b8a1", "value": "PO250000Corbela.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43826ef5-70c1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782411078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411078, "uuid": "2cddce09-ff2c-4d11-b7c8-8476cb16d077", "comment": "Malware payload (CoinMiner)", "value": "15047b5dc6be781346041c8744367deb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411078, "uuid": "1a87e2f3-dfe4-4eaa-997b-0744a47a5723", "comment": "Malware payload (CoinMiner)", "value": "ef801a4aaaadbcedd44a8d3568467769854752886ff63db6c4490618d2e76335", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411078, "uuid": "ad42fed3-5d71-4967-b6fb-d649c3e5e1d2", "comment": "Malware payload (CoinMiner)", "value": "d3e411e9afc74385df92f0fe8a297c8a168d83d7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411078, "uuid": "c9178714-b1f7-47ff-813c-b3c84c22b37b", "comment": "Malware payload (CoinMiner)", "value": "e3965501724f60b0c8b1ea7b1310f48c04ad1fd5fd6f1df864431b47eb5b31c5fc68a47c6981663a76f49794b5104469", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411078, "uuid": "5d47f9a0-0479-4774-89bb-ec8e91e7719a", "value": "T121345B0AE612E5F0F5A75932018EC37B5A70ED344162D9A6FF4B3EB1EC71505AE1A32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411078, "uuid": "09f7be5d-47a0-4f2d-97b6-e929dd418d0e", "value": "6144:XvBPd31jsIept4BCLeifaK87k5pYC8C9gt6Zz0j5qhc:XvrlsIeptCCaifN8ypo4eOz0j4hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782411078, "uuid": "ff599e07-87a5-46fc-93fe-55094b99aefc", "value": 239032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782411078, "uuid": "a3b91128-67f5-46d2-b0cd-f5d5b1e261dd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411078, "uuid": "16b15634-0301-469f-a18d-497695666523", "value": "kworkerd-cgroup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2cb0b5-70c7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782413833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413833, "uuid": "b4919f88-cae2-426e-89d9-528555dea96e", "comment": "Malware payload (Mirai)", "value": "78dede070df0c27fd2eed8ca158f4146", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413833, "uuid": "f25b0dc4-c6af-45e3-8ebe-392d9be1c461", "comment": "Malware payload (Mirai)", "value": "f034743cf554fdecd23286d2532ac63546c9dbf316f40b1f2ece6a709e07e9d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413833, "uuid": "4cd93012-f4e3-41ba-8b4e-5a57d56b6cc0", "comment": "Malware payload (Mirai)", "value": "011573d01c269847140aa1d35e248c2b63c8c10d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782413833, "uuid": "fd68ff42-8b10-4f55-81ed-7041efba3507", "comment": "Malware payload (Mirai)", "value": "86b649bebe86f843e8f756dcb0aae665a0921dfe3e6afaf6846206a72be47e791978cb9718c35e33a96450514492d588", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413833, "uuid": "3549abca-f64f-4e95-8a8e-d0c8f54c12c4", "value": "T135D32A07A952C953D5C217B9BA9F91583323AB74C3D73302D918BFB83F8369A0E7A511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413833, "uuid": "4fb1b7e8-8c58-4a81-8b0d-f38ec8e2db61", "value": "3072:tyl1upRW6Z3UVa1p+MYV4sD4Lv8HDNwc0e:tk1upRWuUVaGMYqv8Hn0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782413833, "uuid": "20173a6e-650a-44d0-aa8d-a3483e7087ba", "value": 142264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782413833, "uuid": "388a216a-22c9-49f9-bfb6-335fa087addd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782413833, "uuid": "5ab9b94a-22c7-4435-b5c0-eb9bfd30fac4", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6511f93-704e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782361986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782361986, "uuid": "49fd9d27-2b0a-4fb5-991f-ebf756a4d077", "comment": "Malware payload (Vidar)", "value": "33f940fc07c36a2309cc994192f706a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782361986, "uuid": "03df32ab-7779-44b3-b32d-00b8d134946a", "comment": "Malware payload (Vidar)", "value": "f1a895267514b8b63673820a534724b1b9ad41b314be2aa1c458512f0d75a8d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782361986, "uuid": "591d2b02-566d-4abf-8d34-18bd9316be09", "comment": "Malware payload (Vidar)", "value": "488337c138f299e899a72237558b935abb9bc26c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782361986, "uuid": "2c2d68c2-b352-4eb0-bd16-23a49058567a", "comment": "Malware payload (Vidar)", "value": "1cff4467974ba520a6dc28212f37876c4cc91159326786a7aefd85e2ab5d813b0ba742b6ab8a531f7d31f8a3256a9ec6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782361986, "uuid": "01050404-dbd7-40da-96e1-0ff9724104e5", "value": "T1E7D58D0BACD009FAD49AE732497A11927B75BD991B31A3C71ED0B2382EB73D08D36745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782361986, "uuid": "10341f18-5775-458a-8130-5e3fcf6b72fc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782361986, "uuid": "69d40bf2-bf5c-414d-901c-46e17553f488", "value": "49152:ySU0to2U/Rw/Eqw8PUDwyADBD1qVK4hoIcY4pA:yS0xvefyAlMVK4OIcYIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782361986, "uuid": "e5d83947-b9d6-4ec2-b22a-1b1d3d6408c5", "value": 2973552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782361986, "uuid": "ed69825c-adab-4b7b-bef9-e9c6397b626f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782361986, "uuid": "fd7ece52-c688-4a4f-9f57-e1968ce0594b", "value": "menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be274d53-70c1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782411284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411284, "uuid": "47073b22-1b53-4dad-8956-8ab5d7dc41a9", "comment": "Malware payload (CoinMiner)", "value": "1c850747af64c2fce14cf350189ee414", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411284, "uuid": "4f05f93a-022a-468f-8e83-43f76c358de5", "comment": "Malware payload (CoinMiner)", "value": "f27727014a77dac40eabb635f5d083be89378b0dbd29a444acda68e8a43756f2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411284, "uuid": "0d3130b3-3119-4caa-b84c-fc67308addc4", "comment": "Malware payload (CoinMiner)", "value": "3c9d7a9c6cecf4bd72d17a36515e3a675df1657f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411284, "uuid": "ea8b0932-65db-4ab1-9b27-eac356d92653", "comment": "Malware payload (CoinMiner)", "value": "9535f199ddd4aeddeb35c7de1dd3745f07e736edb683961d125d15f78cd7f6d4220a3ac7ec21efcf7179235f6fb5f458", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411284, "uuid": "5ed8fab5-0c6f-48b7-a635-32118844da7f", "value": "T131644A4EDF750FBFC5AECE3016AE121715DE884A52FA673B61BCCD08B196A0416E3C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411284, "uuid": "56313709-be65-4135-993a-89c4e0c7372d", "value": "6144:Esorky8ZiJ+i2FnN6FTxooedun994zGMz3inOoCUNHYk:1or1EE0cDSGMzSOoCoHYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782411284, "uuid": "bf3a1ee7-e0f3-4356-98d7-d0302c0e5b14", "value": 334844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782411284, "uuid": "4d04fc45-9171-4c80-8d02-8fc2c21bcdc0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411284, "uuid": "6bd00c05-50a2-4f2e-a643-044c19394d72", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43694634-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "0d7977d4-a97f-4af0-af81-03ae208ab04a", "comment": "Malware payload", "value": "24b2cf4958f0d5115a905c871c0f8744", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "aaed7087-cbc8-4a62-926c-07471b20123f", "comment": "Malware payload", "value": "f2b0d20495aa3ee323bd4d92f71fd29582ca286b939d5ea12bf685dedc4ba0b1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "5509ae68-0d13-4dfa-9bda-3b4f28550310", "comment": "Malware payload", "value": "2ab08603cb4575b17a27355f128967f52b65adc1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370706, "uuid": "870b3b2d-b2ec-4ecd-8c80-366d6ecfddf4", "comment": "Malware payload", "value": "03b2be0d908ab85fbb0280d25bbeaff4cd62ec08f7e03a7e319e45bc2f3d384665e2329ff9b3aa611744231f5e4e5ff5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "23997e9a-e0a0-41f6-a858-318f894af969", "value": "T1B866F6C1E991D24AC63D6D31EFE6EFD8E26B2F315C885A4AC9C8F73E18B314580B5560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "925e9a46-57f9-41c9-9475-d27e1cb6c3da", "value": "49152:1aZ4U8rbfmg8dQd9iMFVn1xBXG57H/xEYAt7fakW3bE+8ddgIc4wNRRcRLp6RLHZ:1aZ4U8rbfIC1PL/IMRtaLnDjEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370706, "uuid": "2fd96877-536c-4223-8297-f84916654e3d", "value": 6553748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370706, "uuid": "33318a72-cced-480d-8567-66c778f98995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370706, "uuid": "cee8af33-8521-4797-9bbb-b73fe9a469a5", "value": "edac_polld", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16762deb-707b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782380938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782380938, "uuid": "8248fb25-2f91-49dd-a9df-53406e365872", "comment": "Malware payload", "value": "ce39c21fa5fb4c3615bb3c6a6b4f9d7a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782380938, "uuid": "b2f69771-2229-4f45-a31c-eade882252f5", "comment": "Malware payload", "value": "f2db8c59456958ba56639e46e9e51cd1a44b46f2e337f3c557ccb15fc6638d86", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782380938, "uuid": "f0e2f0a4-7252-4aaf-99f8-2e38f631ce23", "comment": "Malware payload", "value": "ff6de2c078468cc97240df63e3f85077327540a4", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782380938, "uuid": "1c0263c4-fe6f-49ea-a6cd-1b1d49554bb9", "comment": "Malware payload", "value": "fb5760dccc1f9acc56cb07c68ad7919f535b1b40126704e8493e2b7f3f572060abae3ee12f65817b73be8890947846fd", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782380938, "uuid": "82673f67-4296-4738-8a6e-8d3a3fe78fe5", "value": "T1CE214C2415E40619F3719D375879E2024EB57506AC369E5D0156668C1C61D10BDA2F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782380938, "uuid": "9e2e4d66-4bfd-4344-b01d-731e54718579", "value": "12:81fuKRZRT8Mlb+UE4WCfok4UBUhjgcliu5gct+UcITBdaY:8kKDEmfok4UBxc09ct+/wBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782380938, "uuid": "17c8c107-86f9-44e5-9a5b-46b9be29a4c1", "value": 1369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782380938, "uuid": "d1e2de9e-fe4a-4cf5-9efd-b15749de788f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782380938, "uuid": "c4a3bdf5-a444-4700-9ea8-94e957af6a91", "value": "ce39c21fa5fb4c3615bb3c6a6b4f9d7a.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2c7a9b-70c2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782411818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411818, "uuid": "02e50fed-8b71-424b-87c9-4cd180db7303", "comment": "Malware payload (CoinMiner)", "value": "972696694dbff568cf791aea1243bdb8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411818, "uuid": "ecf659bd-4ea3-4634-83e8-99a812c42dd1", "comment": "Malware payload (CoinMiner)", "value": "f54a8b51f2d6ed2953a1d9edb19da1c7e44a6e53bb610a24bc7195c6bdc18825", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411818, "uuid": "90f7c87d-0012-4a11-8b2b-b4d01517ad1f", "comment": "Malware payload (CoinMiner)", "value": "f395270f7a7a1f58952ff05b916eab6095c9bb56", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782411818, "uuid": "f9226d79-2dd2-4bc3-ba8e-227b884da585", "comment": "Malware payload (CoinMiner)", "value": "aed5258992321866194faf2bb4bb818ee40b6e2434f54294fda49b4655955d71dbd9b1a626d11357443b398c7b4b31b6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411818, "uuid": "5ab631d9-9b15-4053-ad3a-ae690d51335f", "value": "T133A312B37A00DEE1EED954BEC80A02D5536DDEDE59F770522C215FC0A8B689613DD043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411818, "uuid": "3f5039cd-e360-481a-838d-292599ad438e", "value": "3072:fGqmHWGwaE+vw2VqKgapesT4ae3VPC+eYi3C:+KpD2IKgMeJFVHeYqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782411818, "uuid": "e2f42daf-92bd-4e7f-8e19-0b06ea337aea", "value": 101912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782411818, "uuid": "b951f2a7-e096-43b7-b025-35431c478bce", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782411818, "uuid": "7c8eddf5-5593-48d6-8cdb-d376f06e10bb", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4479b03f-7063-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782370707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370707, "uuid": "546f9d8b-694f-4839-818b-7ce41d8abf39", "comment": "Malware payload", "value": "e9a7db1565fb59eb79d951e085eb0d97", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370707, "uuid": "89841867-14f5-49f3-b393-72ba2bded357", "comment": "Malware payload", "value": "f7997553aa387a725f8b7c5f04528380a0f9f92d8b848e4523df5c391104ac2e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370707, "uuid": "f338062f-8728-485d-a037-fd61610acbd1", "comment": "Malware payload", "value": "0a130283fbae21be0882f6acba8ec956cc038c76", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782370707, "uuid": "656eab95-d45c-4c30-8665-19f1a54f3d1b", "comment": "Malware payload", "value": "ecc2fe0c0d417dfa1c258a7447b2eabf6d12c36e80107156b7626af418982276eabc6519541931f8fb770c66845763e3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370707, "uuid": "5c5bf350-98b3-4a8a-9167-9c94af939c89", "value": "T1FD66F855BDC22B66C1DC03B444FE626662643E454BA5072323E4F7E83A7773CAF5A88C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370707, "uuid": "b6659b77-8685-4cab-92f2-2f7cbff7ac67", "value": "49152:m1f4EvcI0TNQAuGorWqrZZiucOYS4+Lb8Dg5Eh:mB10ISNQAuBe0ZEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782370707, "uuid": "04598376-1e46-4110-8277-fb9d97acd0b7", "value": 6815892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782370707, "uuid": "4ceb8a98-6163-46fb-817f-0fea99c9b779", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782370707, "uuid": "59c4d5f4-1576-434e-ae5e-fc7e23ca2304", "value": "scsi_tmf_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff1f9ed-704c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782360821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782360821, "uuid": "5a5c5d3a-efce-4cb9-b359-fcac82749e40", "comment": "Malware payload (WannaCry)", "value": "0cf51f129a326966775ecf5d2ac11fdd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782360821, "uuid": "28ed2276-01a4-43ef-8c0c-438093a5087e", "comment": "Malware payload (WannaCry)", "value": "f8f951f3a2fa091e6e77ad02f39a28ce1bc2b317ddff3546e3103f6172101443", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782360821, "uuid": "444bc704-f89e-4b0f-a6c2-e64ede9868e8", "comment": "Malware payload (WannaCry)", "value": "926260a6d371ed2afde82ea9ff01ad36515aab45", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782360821, "uuid": "e6f63808-368a-463e-a401-11662871b9cc", "comment": "Malware payload (WannaCry)", "value": "c6c41b1247b02a4c6c7609d9272ecf962823de3573686a1bad727b8516486e4c09e20961c81dd22351683e9e522ebeec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782360821, "uuid": "f7e7e1cd-adab-4256-aa0f-4ee3ceceeb1a", "value": "T1CA3682E73544CC68FCF8C938DA5D06D8BD71AA09E1D6412B0660851D2D2F1F7AAFEB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782360821, "uuid": "77da4d04-656d-47f0-81f7-0c3d7f49b6df", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782360821, "uuid": "0de201d6-e75a-408e-b27f-67b263de0bab", "value": "6144:yE9l9yNqIYVTH5DgSg8ajldktM0XXrs2QhE:ywbLgPluxQhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782360821, "uuid": "c0421580-c24f-47db-8df1-2e4c72b4867b", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782360821, "uuid": "d8c07d50-9369-42c9-9407-6cc109003bf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782360821, "uuid": "3bbc23a3-b83b-42d9-9eb0-0ad5c9663be1", "value": "f8f951f3a2fa091e6e77ad02f39a28ce1bc2b317ddff3546e3103f6172101443.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6e06c9-70bc-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782408998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782408998, "uuid": "b8e40a67-b0b3-4efa-a476-017c0112e87f", "comment": "Malware payload", "value": "023ec2bcfcb3480eeb68726671ff1ce8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Oblivion", "colour": "#43159C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782408998, "uuid": "dd6b34ba-61fa-419a-bf88-b614ece91d0b", "comment": "Malware payload", "value": "fa2a7e4f080ce26715e69732901e80ef2d44f0666fa25c41ee52da9e7c2c4388", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Oblivion", "colour": "#43159C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782408998, "uuid": "144f5666-0af4-46ff-8d7d-8b0c47536b0a", "comment": "Malware payload", "value": "95c0d163fa2e3eadfb08cb6e5eaa0f8993ef601c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Oblivion", "colour": "#43159C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782408998, "uuid": "abe3a3fd-bae0-4c05-bc8f-13d73d29665e", "comment": "Malware payload", "value": "0228372d1ac6faec4305856c02e6f0133933088c2f3ed7d10d334de976d45a28c97483416382680803fe56ce9e5189d4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Oblivion", "colour": "#43159C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782408998, "uuid": "a807317f-d684-4288-a14e-8489664cdf62", "value": "T1601533D7A7A2DAB7C20BB77D03C8C37BE730558A82AD952BA154D8725C3147EBF00654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782408998, "uuid": "4d3d566f-2da8-4932-9225-b60fcbcfb27c", "value": "12288:jGLT/7gLM2n3qUUu8MM+QAM+tPi/chqk3L3K7AGXrJIW0rS0uhfmXytl2o3q0AwZ:4/FDu8MM+QArPhqsLaUoqnrS79XLGHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782408998, "uuid": "2efdcf15-466b-4717-8996-327134fbbdf8", "value": 955714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782408998, "uuid": "ce7e6cd5-2564-4718-a2dc-b80cf800fa48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782408998, "uuid": "54b6060e-20b0-4673-a6ca-0d21d60f021f", "value": "khrum.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976c482b-709c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782395328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395328, "uuid": "30717c8e-372d-4234-89a4-ef9943f74704", "comment": "Malware payload (CoinMiner)", "value": "d522da585866d893f42c5c30467f9646", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395328, "uuid": "1caa37eb-6be3-43f6-924c-2bda8354c1fa", "comment": "Malware payload (CoinMiner)", "value": "fa2c2003123da6be943073eecd42749b847a6837ab34db769a39de567d5f64f9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395328, "uuid": "57081840-16e3-4330-9888-1c53ae70eae4", "comment": "Malware payload (CoinMiner)", "value": "95dcfae5d40a459014da27ea3015e41f1985cf7e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395328, "uuid": "963a2a8f-00b1-4143-9ba3-4cf83f0cf6ea", "comment": "Malware payload (CoinMiner)", "value": "493346ad4eba738f3af5c5d65369c66bb0d1be49516b5918e9407ee04c9b23b965532ec6e49eb4ab158df107fff9884b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395328, "uuid": "d2d75b66-3d9a-4c20-b884-7935df2be8cb", "value": "T197644B02FF445A43C5411FB15D7B07B6A3AD48916CA9E03D9D0BBF2506B38BAA5DF388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395328, "uuid": "f91a4c4c-53bb-4a33-b201-fb0e06bb626c", "value": "6144:1RQN8ILX9ADBy7G6vGSJD+hJ72YGRJqSx2LMJHIRSs5z/tqb1DZOf:3acy7GkHRuYG219Of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782395328, "uuid": "66e2891a-689a-4a36-a989-13f7c4656b14", "value": 329172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782395328, "uuid": "5dc9a16c-69c4-47bc-95ef-16ad3b143735", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395328, "uuid": "02270ae9-6ef8-4803-b56c-36e90afe9e3e", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fab135d-70b0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (KongTuke)", "timestamp": 1782403717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782403717, "uuid": "d072ae19-e568-4b01-98c3-d57dd6968fb8", "comment": "Malware payload (KongTuke)", "value": "3b464bb70a362b1eecfc051b96cf2451", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782403717, "uuid": "6fd9c85a-44e1-453a-94a1-22c47f557539", "comment": "Malware payload (KongTuke)", "value": "faf76865b481cc285fd20958c2059e5c92ce244ca1297b015bdb2f8a0a558f6b", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782403717, "uuid": "e9294c21-ab9f-4618-98e9-2cbb14660a8e", "comment": "Malware payload (KongTuke)", "value": "0888e8f28a16b0e62ad84469b3a3afde02569427", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782403717, "uuid": "f81bda46-b172-45a5-ae76-690b6108ae68", "comment": "Malware payload (KongTuke)", "value": "9d5cbacaba28e47bef2549111670e86323fbc0ff6db38973faa7b956495466972bc8dcad028081660cc6333f624d85ac", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782403717, "uuid": "160003c5-bf10-4d5e-a013-a5f5905465d5", "value": "T1E8835AD6BF0D4FBA03F294A361E881918FA284E4FE6E8705E0CFC855545C899F5876CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782403717, "uuid": "638ed387-416b-4944-b0fc-2dce4e6b2b9b", "value": "768:Y0GrLwNwqkrzJ34+wlBw5gvCsTkEAc37YoQvFUT:Y3zJ3nGBVgEi+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782403717, "uuid": "afddd494-733e-48be-badd-865f8f5b1416", "value": 83036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782403717, "uuid": "2507ef26-8dea-4624-8a1b-84172e66996d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782403717, "uuid": "0ecb8ce7-bead-4b0f-a9a0-f945b3c63b85", "value": "black", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a53d575-7091-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390528, "uuid": "f967ac0a-2d23-4112-ace0-303356e93c93", "comment": "Malware payload (CoinMiner)", "value": "720d4bce674dd06565b68942a704b683", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390528, "uuid": "1d20f8c6-c727-44a5-a8be-a6d056e5fedc", "comment": "Malware payload (CoinMiner)", "value": "fb1e649118f2f86cb22147f0ccca53b4a75598619ed80afddd5a25a5563515d2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390528, "uuid": "5347b22f-d9df-4f97-9378-0b33dc9e77f3", "comment": "Malware payload (CoinMiner)", "value": "67747489ef893a25a166c2ca08b1bdd3d6a66774", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390528, "uuid": "9d0ebbcc-b49f-4195-88d3-42aea41d410a", "comment": "Malware payload (CoinMiner)", "value": "148d1458ec76619527b945c6da32456dd34fdfd642e675b8b8f7ed325212bb259a54cf7c6ad16cc184dc2be25dd49c73", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390528, "uuid": "88263fb0-f482-43aa-818f-39034cca3ecd", "value": "T10DF5335F827746BDCD9644F06C7F0B867E2A7244834986C316DAB1B62E53BE7E072B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390528, "uuid": "3229be91-78e1-43f3-a002-f1203fd57bb5", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390528, "uuid": "3ec4a517-fbb6-4ca2-b29d-155ae2565c05", "value": "49152:3PzsUHjtJTnq0+tTLhoXn0H3tSDvQL7tYZTea3WkqOMyOeHofOrnYFSbcAiSNYZF:3Pz3U9vL7tyDYFSzFeZNwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390528, "uuid": "8347c773-fe27-427e-aae4-ccddd84e2436", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390528, "uuid": "c1aaf6a0-7cde-46ae-8692-8e18d7dfb1fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390528, "uuid": "262a368f-c501-44f9-8f83-07dc969f0cf2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b72f978-70d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782417642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782417642, "uuid": "aa7c56b7-66c9-4d04-aad9-ac3ca63f0253", "comment": "Malware payload", "value": "b634779963c7f73b0ff26790077ed54b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782417642, "uuid": "d061a35e-2b1d-4e09-85f1-888be199d98c", "comment": "Malware payload", "value": "fb1f408e089ca5346d31e07ab1d821b1b19f1488ed8eaad587f421e2d3689fa4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782417642, "uuid": "4964f040-7d25-4d0c-a27e-990b9304cc1f", "comment": "Malware payload", "value": "bfe56a660faa112a2bb34d0dfb2d63bfb177e4d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782417642, "uuid": "41c7a7b5-ab93-48cd-89c2-7322d40613fb", "comment": "Malware payload", "value": "4424cf150576b30f51308e343e471dd029ea1f5a8dead93db7ab283f7229cebe2449fd92c80d2cc305eaa986192e8c91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782417642, "uuid": "0253e305-df41-475d-ad65-eaf3bebc528d", "value": "T13BA31201574ACE15CD3CB6321BC4C1C779B79A7BEA7B9EA22D6D1D0D18C2E1D6258F02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782417642, "uuid": "cade1b84-51ba-4fd3-b000-14b2d77c7ea5", "value": "3072:Y8qwk3C1Y1J5GEfzfJzsDt/AsgPocV5B/ThUC8R8fL:nq932YrfzfVW1+Dz/Tx8R8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782417642, "uuid": "926a6e62-d29a-439a-8190-4efb7672ec61", "value": 105376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782417642, "uuid": "891879dd-5a0d-4316-9dfe-131f1845f0a1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782417642, "uuid": "6eb94b49-f4af-435f-bf93-c2cef0078fd8", "value": "kworkerd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e52e72a-70ab-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782401621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401621, "uuid": "f155e33b-3c47-47ea-8093-c857f9a36048", "comment": "Malware payload (CoinMiner)", "value": "4b789152b989ee1adc568c23bc6fb165", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401621, "uuid": "6d947442-ef76-48db-b368-8da44f4a652b", "comment": "Malware payload (CoinMiner)", "value": "fba75c45e1fa45a2603493f36027f192efdd18283f5ae1d13de39d2d38f092c1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401621, "uuid": "404d76a3-febb-46df-b2cd-1d2db7799bf3", "comment": "Malware payload (CoinMiner)", "value": "d7f20ac3201e2b61bc9874fc92d9b08cb75f5945", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782401621, "uuid": "ca97991d-3ebd-44f8-a298-2f278d5a3399", "comment": "Malware payload (CoinMiner)", "value": "273a40c070dcce1a30699212e186a09c5d1d261f894923ecb7360d6ab26d001494c0e059db1af86befb5501c29f2dced", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401621, "uuid": "b58306cf-b5a2-4129-b83d-d004ae3b8c21", "value": "T1973429A5BC80DB66C6E427BAFB5D429933134F74C3DD3105CD245F2936EB95B0A3A282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401621, "uuid": "163935b1-806e-4091-adb3-fedd0901c1d3", "value": "6144:D5Swzrlndga/kY0N/r7dv9Gryw5JVeiB2D0IZ2Q:vzVqa/kY0N/r7dy5DkBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782401621, "uuid": "0f8ba150-e996-4c61-868d-105ac096b9f6", "value": 235336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782401621, "uuid": "debd4b7d-b443-4b90-afd4-52e2e6122930", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782401621, "uuid": "03f41345-74a8-4c58-843f-8e37b1d180af", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd2dff4-7092-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782390805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390805, "uuid": "e0c67b23-c69b-41f7-9473-2e45d300b10c", "comment": "Malware payload (CoinMiner)", "value": "023907a32ebf06ff02ca41f9f6ec89b8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390805, "uuid": "89251762-da8f-4be6-8ab9-028c523cadc8", "comment": "Malware payload (CoinMiner)", "value": "fbface75828c2fdc3533b818268f5b8e680f65662953ff83d30240e78ff8d36b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390805, "uuid": "027c02a9-a559-45a4-a2b7-2a7c23d51c12", "comment": "Malware payload (CoinMiner)", "value": "8da7d85415a203888a8997ad5d04386ea2aa47f7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782390805, "uuid": "3a6aad96-8e0d-4476-9e9a-5188fffa89f0", "comment": "Malware payload (CoinMiner)", "value": "9ea8b476fef2f3ffb7aa39ce295fbeed233da1af3ebd7cc609476529a4dadd5ad3a099e5f985305edef6e5e49ba53a5b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390805, "uuid": "fe5afef6-1a2d-4d07-b0c4-f1d44eb263d1", "value": "T15EF533AEE40A25BCC3FA84784581FF70793BB4961F1014EB7392DA2028575CF5A52FAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390805, "uuid": "3d2bfeb0-d18e-4403-b12e-a8cadf6ac4b1", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390805, "uuid": "7a32a1bb-f710-4f3e-9429-49c5777a8fb0", "value": "49152:STbSAUgJGCgrm9DdfzCd3QZfFPxl4qQ0ozDzh+Ye31ohS5M3ce/lQUiHxvf:STbSASYdQqxDQTt+ZoTUHxvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782390805, "uuid": "da79da5b-8ff6-4e37-8a83-128bcecaee64", "value": 3449320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782390805, "uuid": "dd21fe3f-a437-4a03-b17c-c9cfdfa4a9f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782390805, "uuid": "112bbbc4-8fb4-4969-b6bc-32af694f9271", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39844676-7087-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782386151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782386151, "uuid": "8f359cb1-e43a-4ae0-9c70-74b9e04b4700", "comment": "Malware payload (WannaCry)", "value": "35db0ed31de09aef583803786e4d710e", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782386151, "uuid": "04974df0-26e2-490a-a742-53612329fb85", "comment": "Malware payload (WannaCry)", "value": "fc7a60c88a82b47f9590bb64fb48ed57cf8f52908f5b55a8af83def45647856d", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782386151, "uuid": "a6661a54-b752-492a-b598-a84789966c03", "comment": "Malware payload (WannaCry)", "value": "040e9834b6d79171723402a904e8d0b0afaed34b", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782386151, "uuid": "c1fba2c6-6b74-4b0c-bf98-0a60d7b39ea2", "comment": "Malware payload (WannaCry)", "value": "b67ecf42edd7217d4924ec8f7bab12e031144690c92ae2dbe51f7f129145a0523a2259b487b7cc18764d70dc430de639", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782386151, "uuid": "f3cc82e5-ed3e-4e83-82ac-1c9bc917db3a", "value": "T1C93623D18918D5FBD7BE3A75E4A49C2826A17C6E6FE4022DF24849D18EE7FE4D041F08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782386151, "uuid": "0c3afe87-59f5-49d9-96d1-eec0ff290aaf", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782386151, "uuid": "dff0c08d-b4ea-472f-992b-90f501fe200d", "value": "98304:DyDqPoBhz1aRxcSUDkEQv9Snm1tnr7DRbxyE1CaX+G4Q8F:DyDqPe1CxcxkEQv9Snm1tnr7DRbxyE1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782386151, "uuid": "b0551515-758f-4d8d-8d26-50a5bd39676f", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782386151, "uuid": "05523af8-ff1a-44e8-bbb7-c7851dc71717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782386151, "uuid": "7732406b-0803-4c9a-ba0b-6b601a7d7707", "value": "fc7a60c88a82b47f9590bb64fb48ed57cf8f52908f5b55a8af83def45647856d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c59c74-707c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782381412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381412, "uuid": "6d7a98b9-7ebf-480a-a919-41d93a288f88", "comment": "Malware payload (SilentNet)", "value": "1430009c187ee3828ff5d67a2cc8f159", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381412, "uuid": "f97a5d95-18bb-4b70-8e53-58edb52188db", "comment": "Malware payload (SilentNet)", "value": "fc89374aa1434a80290d3e5389e0f3a7436e790f52bac9c7acfc62bcb89384f6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381412, "uuid": "f85d9d35-cbde-416a-aa16-f607d1e4390f", "comment": "Malware payload (SilentNet)", "value": "712207f3ff9931984b744c8b25875785e5173124", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782381412, "uuid": "85b4da76-e9d1-4134-b049-fe6742a547dd", "comment": "Malware payload (SilentNet)", "value": "604ecd60728c9cf802e653761c551b0ff4857802d323f89059c4d918ee6049e5022a85b1d088ab72129e7946b1885d89", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381412, "uuid": "603f641c-eeea-45e8-bb73-cfdd9b601c44", "value": "T14D831226B857909EC3132C39FA0CA7B37B4D5BE6E913792B99F2520A45B0E0D80C17DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381412, "uuid": "f2992dd4-f993-431f-9c20-dcb5bf5006a1", "value": "1536:xJ8OQLkKBTrwp11yHIytJpPODXVZDFNNyxqHdYTdYkm58KU48:xJ8OQLknP1yHIQtoVZDFus0748", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782381412, "uuid": "ae309ded-8588-47ac-bed7-30af3fe5c913", "value": 88582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782381412, "uuid": "b134667b-36c2-475a-955b-6ecdff4fb2c1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782381412, "uuid": "d1a9b13d-ae56-47b3-8a7d-b54d339de2e6", "value": "Meteor-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb792910-7059-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782366639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366639, "uuid": "281f485e-c9d0-4fab-8e32-31ff905d5806", "comment": "Malware payload (Formbook)", "value": "48566bb0d21597cb5e0dc195e4e29f24", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366639, "uuid": "d041952e-d2eb-4b0e-8cf8-18010f85aa68", "comment": "Malware payload (Formbook)", "value": "fdcb54b77eee41b99bca3a98cf772aed3be6b448f32f38dd4ee2daa954dc911a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366639, "uuid": "838585dc-4d82-4f9b-94bd-4838c6e97e80", "comment": "Malware payload (Formbook)", "value": "0e1610be3ba07ee23e78d1040fb7b9b142389273", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782366639, "uuid": "06e61e1e-74c4-4f13-9b43-0d1606f6a3ac", "comment": "Malware payload (Formbook)", "value": "e4f932f5a997d937f72b279b4ac2868a81d054c189344ba9b7b8fe82f2f756002def6056e2b6f0ab6d91b96ad8bb7114", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366639, "uuid": "7d619eec-ee6c-46b8-8d35-78ac5a695f1f", "value": "T12B6321A2F9641E588BDC47D1B4C7F083F30699565250F899E31530AF81CEA6CB727CAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366639, "uuid": "37678423-7209-41c0-aac4-c3008ad203f3", "value": "768:pnb1tLo5dA647cyFbFlowBqX3T9bfO3+lYpWsv+fYASWQEopU5E:JIj2hS5/a+yKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782366639, "uuid": "6cf03d9d-4cf0-4065-86f1-0fdf84ad2f7f", "value": 73369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782366639, "uuid": "e41b8d1e-687b-4201-9524-592d5e3bd06c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782366639, "uuid": "afefe379-8327-49d0-b3e2-30808644fdb2", "value": "Doc 24.06.26.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de9d926-702a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782346161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782346161, "uuid": "c10c12ef-8312-477b-9bc4-cc3bbd808c33", "comment": "Malware payload (Mirai)", "value": "6f55551b1f467d4304f30e4dbe051166", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782346161, "uuid": "db119af5-df59-4fb8-aec0-2f03209f4576", "comment": "Malware payload (Mirai)", "value": "fe08f7fddb6b9bf9757d47f6fb1f1b82a54490e10db140b7d8fbb11b3baaa6a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782346161, "uuid": "2b920d05-0a23-40a2-a10c-be19ee67c589", "comment": "Malware payload (Mirai)", "value": "e78651daaeccee639cae89032288d37adf4d1e74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782346161, "uuid": "951b9593-fe80-48c6-b153-ad1811a45b9e", "comment": "Malware payload (Mirai)", "value": "0251c4f6a7b2a86677e9f255909af5d32a6a3f52ecfdadd15af7965cb4307216afde88a0be7d074b0d156ee70f0c2264", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782346161, "uuid": "57130805-c002-48e9-bd79-5bfc16e59e01", "value": "T19CF38C87B3265C97CC910AFA4BD75B8C5BB351418F6BC7D63D0C66380E6AACD9D0A381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782346161, "uuid": "e39d46c0-e5b7-4482-84a3-391a273ef5f1", "value": "3072:CeG6FQAwvRNjiBsUpoegiLqFrvhkyFm2cK:RG6aRpia0bqMyFm2cK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782346161, "uuid": "5d94930f-39be-4731-92af-a00418edc925", "value": 160968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782346161, "uuid": "5c246285-d793-47a8-819a-eb741cc7036e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782346161, "uuid": "7bc94aac-7ff9-4362-890e-454765d872ab", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b6f480-709c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782395431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395431, "uuid": "9affb4c7-f6c2-4894-8d3f-03e4c3b12a6c", "comment": "Malware payload", "value": "5f24aa029c16247b915fbab9b0dc60f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395431, "uuid": "8f498fe4-0e71-4fc4-9a90-db66e3168f80", "comment": "Malware payload", "value": "ffc42d1e02a187a39ce83e1566963becca5cda678cfb6699c48d5af69a35f998", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395431, "uuid": "62a553f7-d21d-4c4a-9d0f-57b1a24a0656", "comment": "Malware payload", "value": "91ffe9c3322746ac195760057dee7f4c0b340553", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782395431, "uuid": "1f217d9a-a8f3-48cd-b663-8604a90f659d", "comment": "Malware payload", "value": "c965c2ea1371695ba89a089730ec334ef54f175957620ff81ae0fa4c006e17727db77aa3be073ac63ddbf415a6a4afba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395431, "uuid": "8e4ff57a-61f7-407f-a36d-dcbc1f65d231", "value": "T1FD246B81358C7F5EE2A72D3DC5029A1AAC0CCF147842ED2250F9FA4719BBADB1F3A545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395431, "uuid": "36d11009-7d4e-4beb-9f2c-33b3b72a1c3f", "value": "6144:lmaMeP60YYzrGaRG04XXKHI7sOk/Lvry1Zd8:lLMePb3iaxfAd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782395431, "uuid": "a21ea0f8-4620-453c-9bb7-82544d308e50", "value": 226148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782395431, "uuid": "3fdc7f4d-598a-4b06-a24c-84a8d90c9b4c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782395431, "uuid": "d9ae9e02-e3e4-4e3b-bf58-79d3bc542fe3", "value": "kworkerd-scsi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }