{ "Event": { "published": true, "date": "2024-02-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-02-11", "timestamp": 1707696181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "946b6344-4062-4b9b-a59e-15f7502691bd", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554d7e84-c903-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707672664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672664, "uuid": "dca6f01a-6e89-4f94-87ba-8335b966c289", "comment": "Malware payload", "value": "6fe8f07c3e195ac1c2f555c3e03c3f17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672664, "uuid": "264db75a-170b-44fc-90f4-9656964e459e", "comment": "Malware payload", "value": "004e13e13d13f9b34936031e9b6cb082664580ec5a6b1f8aca0ea41c43daa6aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672664, "uuid": "a7c1c375-8d7d-456d-bd2a-045db53146d4", "comment": "Malware payload", "value": "6fc19f75edc78c114b341b02a34669b7b11885cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672664, "uuid": "b8d3d90b-09e7-4286-abfe-1974b9720771", "comment": "Malware payload", "value": "82435817c97812a1bb15ab9eca248181bca592005626ef9ca5c544e9a4a14357795ba40b3e78264a5a461299637fe72c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672664, "uuid": "6291c255-8f49-462a-be5b-23942c724578", "value": "T1C7434B3BA67980A8C86BD13942472F34B7B5F694032057EF169678AD0EE27F45D397C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672664, "uuid": "b2408605-3afb-42db-814b-b847e279c421", "value": "e3be12dc954003450a3f3609b49e89a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672664, "uuid": "d4e5a015-212f-480f-937f-7d9adc181072", "value": "768:tSRvs2XC/MGDIyBej8MLFKwYqmopG1L3PKmIxo3eG1Q1EFWu0:Ut74S8MLFLqoaL3PKmIxGBQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707672664, "uuid": "804a607c-1a9a-41f5-83f8-6cb0bede6a01", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707672664, "uuid": "a657984f-98fe-456b-a615-fbcb6d3b67f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672664, "uuid": "31a93b17-bb59-4494-97c3-34bf49354e8d", "value": "SecuriteInfo.com.Variant.Zusy.530212.20355.26249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a76b02-c8e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707658893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658893, "uuid": "39bc9650-a265-4856-b82d-84cee97256ef", "comment": "Malware payload (Mirai)", "value": "6c83e17f053f6aca3eb1bf259ad239d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658893, "uuid": "d5bb7bdb-d0bd-4a6a-ba45-c3dbc49ff893", "comment": "Malware payload (Mirai)", "value": "008cad0eb5ed1a7769d86f87c95b822de4a692a707d76e489c8f68517ed7b291", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658893, "uuid": "3bc2c37e-3724-4d88-b707-2b8501ec3202", "comment": "Malware payload (Mirai)", "value": "09ec5c99bfa73ea7a0367cb3b9f16d1e23c691b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658893, "uuid": "2b032a7a-73a2-46fe-a60e-a416a1ebef7a", "comment": "Malware payload (Mirai)", "value": "7a36a3f765f4928d7ebdc2105d4b3f1af6756c2adc050b86937de618f104d6bcc5d30532c1b6b1eca73ad130f6779b36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658893, "uuid": "01004fce-0ed3-4aed-98dd-52294ed54984", "value": "T198632B95F8818B21C5D51379F92D168D372227F8E3DE72139E205F603B8A96B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658893, "uuid": "452533fc-7feb-4682-8f50-89d0723a94da", "value": "1536:hgnQFJAnXUV+5jneFjYGJ4ZVximMQoMBiFRf0a8K+Ja10zt:JAXUV+xn+jYGJ4sRf0a8K+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658893, "uuid": "6d80053b-54b3-4c05-b3e9-1f26c3581624", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658893, "uuid": "1f8c551d-ac96-4500-94a7-4f6f6c18d8ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658893, "uuid": "ef463a74-e43e-43a3-b087-92e864ab7eab", "value": "6c83e17f053f6aca3eb1bf259ad239d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdd6cbb-c8ec-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707662691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662691, "uuid": "05ef5b43-1d01-43fb-82b7-cfcdf6e10324", "comment": "Malware payload", "value": "eba2536c9fcc5ef3e490b7fa2ffc9a45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662691, "uuid": "e3149d82-715f-4c9a-b928-0efb71927b90", "comment": "Malware payload", "value": "0223d85eaf5cd5b188e61e9c99b62a9b5cfba4c5d2ed13576858b40327451ae7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662691, "uuid": "cc6392bc-12b3-4e99-b8a4-204aaf5b7ad2", "comment": "Malware payload", "value": "5291bdcbbef4835fd63facffa0fd86881d9e054c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662691, "uuid": "e06df43e-c28e-4d3a-b93d-5fef84a9fed7", "comment": "Malware payload", "value": "e656c56dd11a7de4f683ae3145c46b8c026c2c85fd95b78b4389c56d5f0a0f2086681b2b9857a133637c305153a542e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662691, "uuid": "d4ce9071-f20e-4049-92c9-7c9d176f5ddb", "value": "T1A3F733924D0428A9D7369BF8B06DA67BEEFB46B413DC248C21CE235AE563354D353732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662691, "uuid": "a09c87b1-6174-4cd9-a0cd-231dd736a10a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662691, "uuid": "1b4963c5-7369-4969-a559-97bc3558d74c", "value": "1572864:2jddGv+xpU8juU0gnvID4NsehQ5A5GjnvyIgZGQVD7:qGvv86UDvzsehQCe9gZx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707662691, "uuid": "9d2a531f-94b6-4d98-8530-9e5c787ae992", "value": 71442300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707662691, "uuid": "eaa40c3b-0177-42cd-9822-2c643ecdef0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662691, "uuid": "abd89848-7a9e-4764-ae1e-60d7931655d8", "value": "Sky Beta .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2c138c-c918-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707681828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681828, "uuid": "6b303bff-c4e3-4868-b947-670292d8d40d", "comment": "Malware payload", "value": "5d235d6267336aa51184b28d6d0ac6dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681828, "uuid": "c3652f72-2a2c-4f8d-b257-7157068e0420", "comment": "Malware payload", "value": "02f3ac30922571d3ea08c4207dfb7073d0a30cbc67b5627b4a66a56311e09ff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681828, "uuid": "e1f87ff1-4930-450d-9c7e-eef87b0d4267", "comment": "Malware payload", "value": "0a750a852a566dbf2ccbda66a11332784da26d7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681828, "uuid": "f94180e3-f039-49b2-bf1b-dc5f25e272b4", "comment": "Malware payload", "value": "19c3d349a420a38c31a3d779e7052d3dd980cd3244127e1349c96e780b6f17e336e4be14191370df125a979fab251f34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681828, "uuid": "b330b726-95a1-4d7d-a71a-7677590a6b16", "value": "T110F71216F341A1AFC837C2B29D391C10FA319D9686175153B02B36EEAEFD8C2DF12695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681828, "uuid": "9be705f2-b5bf-4521-8698-3edc81e995b1", "value": "382a4d7b99200ee7e9686d1f1cde0258", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681828, "uuid": "61af46d3-3e74-47a9-baa6-720243a727d5", "value": "786432:y+jLAJNIndudu80sv1vJ1HoA5AKF7zR/t6tKF+iSpl5gtD8Ko2d:Dj0JNmHPs9VAMzttZmpl+twId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707681828, "uuid": "4a08f47c-f22d-4e67-9d16-0a36b7234131", "value": 70985000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707681828, "uuid": "b42a2bab-73e7-4e6f-b32f-4af30d7777c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681828, "uuid": "9b9dc260-3ee3-405e-b93c-7cbb29fa350a", "value": "CraxsRat01~Rip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31593557-c905-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707673463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673463, "uuid": "613f73bb-c236-49ec-b130-d6344fe0f1d8", "comment": "Malware payload (Mirai)", "value": "84e486f117e6003baefba58f13965750", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673463, "uuid": "10f4bfcb-243f-444c-88d4-cdd470331b03", "comment": "Malware payload (Mirai)", "value": "03a6ead41534e8832d31d06f802c1309aa0e39b3e8c27ae0b45c81d97d477a13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673463, "uuid": "f18ca14d-87fe-4e51-abda-1bc766cdfa72", "comment": "Malware payload (Mirai)", "value": "628286faf4395d287c67872020f7e247a1258139", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673463, "uuid": "be090224-ceab-46d4-a8ef-855e54a9abce", "comment": "Malware payload (Mirai)", "value": "fb013632387d5f665c7d8e27fcec3702ecd57008ac0efe6c2f76a08abb44f4a3ef627324e10031ff80a9ab7b9c012f1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673463, "uuid": "8de46bef-0913-4772-88f2-4f022ce48886", "value": "T1DC734A32B9751E2BC4D4B87A21F70760F2F5074A24A8CA1E7D720E8EBF6464062577F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673463, "uuid": "a6b49073-dac8-48c0-98da-81afb9668f70", "value": "1536:vAwsSInBlLdG7xfBceIeRP5NQlplM5zwHtW/C:42mpoZBcmfWpl8sc/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707673463, "uuid": "1a1fca53-1038-4382-837b-7569de05b548", "value": 80016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707673463, "uuid": "41a5b205-0796-4548-9e51-cfb7f3593ef6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673463, "uuid": "13a12b14-395d-4c06-bee2-d254a78cdab1", "value": "84e486f117e6003baefba58f13965750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e067d13f-c87f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707616204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616204, "uuid": "1be841a1-b2cc-4580-91dd-57f0e78e99e5", "comment": "Malware payload (Mirai)", "value": "06b7be4d2654b6fb8955cbe7ef47c9ca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616204, "uuid": "76520636-41ff-4488-ae00-91050ad5edd4", "comment": "Malware payload (Mirai)", "value": "04506e7241ac99bb6303dec9e732fa492e57bf61e36ae6952ffae6d6d28ce8f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616204, "uuid": "34fec3fc-c62f-431d-ae09-8767a2902e80", "comment": "Malware payload (Mirai)", "value": "c42d2690fbdaf8ef4caaa2aaa414dbafc550f0c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616204, "uuid": "a19eb3c0-0d85-4829-b1cd-401ddfdff4f6", "comment": "Malware payload (Mirai)", "value": "35b76a703f34df81ec86ee5c3c262a02b5c0a3882e327dcb1131db715e141fae15e058553bfaf2c11bd4c93f5d0ab6d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616204, "uuid": "0188ce43-15b9-4326-ade7-1f041524c01c", "value": "T1342308C8E443D9F9DC5A09742036FB2BDBB2F6BA232DDE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616204, "uuid": "cd7525bb-2616-4d85-8dd7-59bfcdbc8560", "value": "1536:6nJRT4QPfZfW5XTOeY3DvehAG+1pa/4Qw7bn2iFe:Gv4QPfZfW5XTOeoezG0AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616204, "uuid": "5fec2cc5-8250-49f2-ad2a-61a958b08aa3", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616204, "uuid": "36b5091f-1901-4cad-8398-ff69f3767ead", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616204, "uuid": "cfc0d1a8-2dbe-4264-bc22-c30072e386f3", "value": "amachlenix.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5ee603-c894-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707624920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707624920, "uuid": "daa9b9aa-e2f5-4cf0-8d96-6d80d96a5c07", "comment": "Malware payload (RedLineStealer)", "value": "17e4647572d5755c4f07f2ceecdaf11a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707624920, "uuid": "b6f64faa-5b9c-4d7d-a4d9-438473a6fd79", "comment": "Malware payload (RedLineStealer)", "value": "04575cd4a4ef5347718ceea706854ba33c867378b865a9d9c7fff16b666d4307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707624920, "uuid": "e1759087-d01a-4738-af2a-76a736f93c40", "comment": "Malware payload (RedLineStealer)", "value": "7a6e22249325b9c3bbc11c30b172997ce79a01b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707624920, "uuid": "a96fa760-8b9f-4db4-97e3-41fccfd27630", "comment": "Malware payload (RedLineStealer)", "value": "9012f4a2f743af91a2b63db57bcb5f426242cfd24ec9608eac74510a9a0207c7a22bfa9e5908d9e591c3a593ff90acd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707624920, "uuid": "bef5a554-d46d-496a-96bd-db82e15d92d0", "value": "T1FFA48C0AB6E28F00EBC50975C8A7893893F6E552B533E31F3E4428673C523F5956A2DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707624920, "uuid": "7774119c-e68a-408d-918f-7d9e5e4cb8cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707624920, "uuid": "6ce2e1e4-ea27-4337-9fe9-489a68741523", "value": "12288:ISsxGETPB372BslW/RQc17THyvAmgelYa:ISsgEjB37EsWRQc17eAelf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707624920, "uuid": "2aa0c153-2040-4c13-8517-7841e6910965", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707624920, "uuid": "0edeaeba-34b1-45a8-8e2e-d2a12bcaf5dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707624920, "uuid": "a94fb12c-9e31-47aa-abfe-a2ffa1ab1628", "value": "17e4647572d5755c4f07f2ceecdaf11a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e41f44c-c926-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707687631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687631, "uuid": "d0812f09-bf15-42de-a227-a7e6c6f1df27", "comment": "Malware payload (Mirai)", "value": "3c05ccb405f97a082506c327b7534d49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687631, "uuid": "7e1eb3f0-fe6d-4d56-8ad5-a8e3f16e6ae7", "comment": "Malware payload (Mirai)", "value": "060b1961c8eb58215c9a2dd247b9889f3f6614bd8c5dac7d6ccfed9d0a63efed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687631, "uuid": "c82cf239-1a74-431f-bbdf-520db0987a8a", "comment": "Malware payload (Mirai)", "value": "d92ecabefe96fdbb50022cb5cfa7a09e8a2968e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687631, "uuid": "763cc19f-5a00-4d46-bf7f-abe8e6adbd2d", "comment": "Malware payload (Mirai)", "value": "f1047440ccfbc2a2a278ce80c21f1a982af67965b383eddd97c1089e8b5ca94277ddb78acaccce9affddc1616b8c868b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687631, "uuid": "246090fb-c2d7-4817-94d9-d3780c13262e", "value": "T12F53E7C1BC41A629C7E01777F9AF559E3300A7C9E1DA72178C240BA47A8B94F0D57F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687631, "uuid": "abfdf4a4-253a-4417-b56e-8f72751667ed", "value": "1536:jffgHhV2gKLExnNrnDKbsUl33eZto9aocnK:jffgHhV2aGF3w9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707687631, "uuid": "f34a1640-96f2-4eeb-8ca5-57069d182a3c", "value": 64832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707687631, "uuid": "d91e66fa-d838-4ba1-8c25-706363748b38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687631, "uuid": "156923e8-11a0-4a9a-83fb-2b4203fb92b5", "value": "3c05ccb405f97a082506c327b7534d49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6aca24-c8a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707630482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630482, "uuid": "7fa9aa83-e72e-4e06-bb74-eeb0e52d572e", "comment": "Malware payload (Gafgyt)", "value": "c29b4890fb98ef89e4179a3d124922dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630482, "uuid": "15717f5c-6292-4c63-959e-ce9e0546ac03", "comment": "Malware payload (Gafgyt)", "value": "064dd410597147ad075459df1bd0ec0023384041995ef0ff16a16dcbc6986749", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630482, "uuid": "3eab5e58-3ad5-4b5c-b951-f0251500f2c8", "comment": "Malware payload (Gafgyt)", "value": "a474fb850870b056573fed027c48211031725459", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630482, "uuid": "d3b9dd5d-750c-4bf1-a0f7-236abf76a7e9", "comment": "Malware payload (Gafgyt)", "value": "0c01a59fc76a0191d7451052ae59eb7f602da00c1985b1706791c3b9b49d2305b5be25083845fb419ab05ee65452d6d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630482, "uuid": "8f858239-de20-4098-a722-797850bbce60", "value": "T1D94302E9A0497946FC9F24FE156C23E5998AF4D2635EA74C32228CC9323939F754E42C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630482, "uuid": "cf364140-1377-4b39-8f24-71d1e05c21c9", "value": "1536:lGXhFaMBkwezxLNEB5YUxgY9zJtalB+nzHB:0FaMBtILiBh18al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630482, "uuid": "2a98df8c-da20-42e6-bf12-da58e80a28bb", "value": 58240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630482, "uuid": "75619b7c-beec-4710-bcbf-4a54678968b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630482, "uuid": "ab43b986-c57d-4d77-8c71-d0c86fa26345", "value": "c29b4890fb98ef89e4179a3d124922dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332c51b6-c8a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707630516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630516, "uuid": "cbe9a62c-d447-4ecf-815f-a71bea648cb0", "comment": "Malware payload (Gafgyt)", "value": "e723925e2f3e386f6a0caaa7f6945b79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630516, "uuid": "3f3532c6-e0c7-4f0a-b3d3-13e7b6041935", "comment": "Malware payload (Gafgyt)", "value": "068550e2f5e01e075beed041e4c802d13c30866b11e6347de0c7a7969942e7bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630516, "uuid": "75d78ed4-a356-4f6b-b5ba-01f3b8d144b5", "comment": "Malware payload (Gafgyt)", "value": "ec382d1af200ccf56a243b01d5e463ecbfb3e9a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630516, "uuid": "2c378f40-9f9c-4d36-b511-81bf92772119", "comment": "Malware payload (Gafgyt)", "value": "3377ede3b5e4557e0e4da8a023663f22dc7ca57ed6556ae4c2e79e12bed1f58d62e991703dc4cc99c993c8d341344b77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630516, "uuid": "2b4735d6-9b51-4fc3-a7da-da6a8cfeecd0", "value": "T126731239989AD5B2C9445C3A66E1CCEF5B0019BC4DBCB1B50059CDCDA1AE7081DFEB93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630516, "uuid": "b552f267-e847-4447-86a7-2c0e35db9f35", "value": "1536:Hr8QeryQWXc4MtydGfadFGc0yvp0yCIHWILaqAHbu+tv2+Pc8rMTs+oh5NFf:vqyQWX0ZydWyzf2ILaqGBvhc8rl5NFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630516, "uuid": "d72485e1-a092-40de-987c-9e8f469e6fb4", "value": 78440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630516, "uuid": "665ce232-0e2a-4b4a-8b5b-3aa6fcb8c190", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630516, "uuid": "d412129a-80b2-4b02-ae0c-95b19a3332db", "value": "e723925e2f3e386f6a0caaa7f6945b79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c50dcb-c91f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707684607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684607, "uuid": "abdfe423-9e32-4481-8460-c71c1af29b1e", "comment": "Malware payload (Mirai)", "value": "48d0b7090ef21dd4f5a4fe2629196c68", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684607, "uuid": "39658c00-046d-4968-9b08-e201b63b53d2", "comment": "Malware payload (Mirai)", "value": "07df07af32ce0c419d3573a34460ffe7d2566a617c7f5cc164cbe74d3b7d3308", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684607, "uuid": "2c138592-0854-49b9-b93e-ec81ab32e59a", "comment": "Malware payload (Mirai)", "value": "f90e287b34f5ff4df9749f995482e49d3cc2b022", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684607, "uuid": "52035981-8381-4e34-87f6-d18c48da0075", "comment": "Malware payload (Mirai)", "value": "ba82811f104a7256d131e22c4a4686e9e0b7326d9a5f1dbabffc16d94b8be6af046b6a412bebf6a49b923c1dc63d0511", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707684607, "uuid": "a1a3cbfd-f324-4965-bfb8-6b71f95a6804", "value": "T17E833981BC41A622C7D21677FE5F018E371553D8E2EA32079C255FA03BCBD5B0D6BA4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707684607, "uuid": "d14e3b75-15b6-4bbc-bb3d-58a5dcea5f6a", "value": "1536:j01gPv9OCDGQvZUsKmqx33eZtU5vWmjPNeiiW/cHvgi:j01gPv9sdx3wgjPNF1cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707684607, "uuid": "25500f09-d18b-41e7-8ef8-e37d546125a7", "value": 88408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707684607, "uuid": "2a637eae-ddc3-4482-b0d2-242767c0aa92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707684607, "uuid": "53a18626-f196-4b05-8cec-7b8a2bd22ce7", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e40eed-c880-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707616527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616527, "uuid": "a6e4c99e-6e89-429a-afad-5616f3dd7b34", "comment": "Malware payload (DCRat)", "value": "03fd9c7c9d838f3e7d4a2e42c317b6be", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616527, "uuid": "b69fce19-4668-4d74-9e9d-a9fdb3043882", "comment": "Malware payload (DCRat)", "value": "0842c1cd11517bdde54e9143f4a1dc9c4a1ac387ae96f972f65d5b49337648cc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616527, "uuid": "a75681d1-8223-4c67-954b-ebf251a746c7", "comment": "Malware payload (DCRat)", "value": "66976024383f4557cd20089d9621c63cbe69ef1f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616527, "uuid": "6db725cb-45ad-467d-9e4c-0539bed7781e", "comment": "Malware payload (DCRat)", "value": "1350e0d55c76324bfae2f8da1401fe63d71222724e203fd6d165554c41a746678f815df57fb6c6ac95385d0a77594bdd", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616527, "uuid": "7e80e5c4-fea1-472e-81f6-cd266066c086", "value": "T156959D027E40CAA1F0295533D2EF01044BB4AD2617B6DB1B79BA372D16623D27D1EADF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616527, "uuid": "29fc5b87-393b-47b6-9f50-b2769444d280", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616527, "uuid": "2aa27e23-c9aa-4372-a603-c67f78fc0708", "value": "49152:tbA3D8ThjyY3Bh5m7Uqbs3Ed/v1/hTTBxjkndCV/WY:tbpThjyY3soqbsUX1/t3jknYV/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616527, "uuid": "d065ff55-c15c-4c60-8609-0cc502811af0", "value": 1985203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616527, "uuid": "8750271d-3399-4744-939b-c17921b03214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616527, "uuid": "434cdc7f-1154-4d03-8622-ef015f3f9f0d", "value": "03fd9c7c9d838f3e7d4a2e42c317b6be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69baecdd-c925-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707687301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687301, "uuid": "aaa96112-d9dd-490f-b4da-fe969bf43da5", "comment": "Malware payload (Mirai)", "value": "dff4911c9ef8b6e488de97f6fceca593", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687301, "uuid": "9aebd479-3445-469a-b4da-5c5b0bcc96e3", "comment": "Malware payload (Mirai)", "value": "087f3f1181ec6f8648a4f1627c5e3f97b285206cf522ac8b6d0d171d7ea368fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687301, "uuid": "c83c0e37-e8a0-4c0c-89b7-bc21655167eb", "comment": "Malware payload (Mirai)", "value": "f6d89d47617986cd1f95751fccbf5c5cbad5ff22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687301, "uuid": "ad195bcf-84e5-4e01-8150-4de9750a6847", "comment": "Malware payload (Mirai)", "value": "e861192f578c5a79f2fdb6ee1dc0f130022d71b1646dbf18f214461879f07883cf8bde6d03c4299130b9f875c7116e4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687301, "uuid": "304ced28-b0dd-452d-98c1-fb209b7516f5", "value": "T135A32A86BC419A11C6C10677FE2F118E331257ECE2DE73138D245B607BCB81B0E6BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687301, "uuid": "5b7c6ec3-96b7-4cc8-9052-eaa0e411aed6", "value": "1536:uxnkY3RS4sAjoGiIANTThKcGd5zVMN6zCPJadO5b8MVicvwR8KRz/5bYi:83c4MGET10hMEORaGvwR8KRz/xF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707687301, "uuid": "236452a4-0253-4e13-819a-2765f780b766", "value": 99468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707687301, "uuid": "cd474b32-c525-4c01-92a5-581105e89849", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687301, "uuid": "ee3a7ef9-6a3e-4db0-bfc4-c1499ec2c176", "value": "dff4911c9ef8b6e488de97f6fceca593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc508af-c8a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707630452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630452, "uuid": "441cf8d7-93de-4731-9904-2c7ce7a91684", "comment": "Malware payload (Gafgyt)", "value": "85806c0723c3f00a66e6cc22601eded2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630452, "uuid": "cf10bc0f-6ad2-4595-99b1-35a6005578ad", "comment": "Malware payload (Gafgyt)", "value": "1006d7bdeb612525282ff388cf03950889a0028577c6440aebfa7f82f3d13e25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630452, "uuid": "a9780af8-53a7-4221-9114-90b1de5c5490", "comment": "Malware payload (Gafgyt)", "value": "86a61a4b0cc3eeaf4cb3f37aa001b4d352082d04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630452, "uuid": "cf45125c-9fb4-42e1-9976-3b7d681de2ff", "comment": "Malware payload (Gafgyt)", "value": "bd03d5fa05756aedec29a3085a398b3ac4acd76865122850be6eed9d0a1c53b2271407db9ce9ceb8a368fa2a1db1d916", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630452, "uuid": "5b72c113-724d-40a5-a7ca-dfd5b785cc3b", "value": "T191045C365AD24F7BC286BA7859BE6E301734D8990F9FAE6A117457B0428F5CC700FD28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630452, "uuid": "38f10685-7bda-407c-9458-07c0af7fc401", "value": "3072:o4II66Uyx2NcHLWZsF0eBWWAowkuP66cQSnaD1CedegKKwcJu6:o4F66nx2NcHLGuNBEkuS8JCedegKKwc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630452, "uuid": "f4ac5b31-138a-4b71-9e70-beaa41ea7f82", "value": 176165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630452, "uuid": "11509a06-961c-4723-b80f-6906a20de8cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630452, "uuid": "c7250fa8-57a1-40a3-bbd6-bc4f9dd3ad0a", "value": "85806c0723c3f00a66e6cc22601eded2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f37d88-c920-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707685141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707685141, "uuid": "79c81759-cd6b-4d86-9716-15960873886a", "comment": "Malware payload (Mirai)", "value": "5f983a94507abae4f188054b7b2e55ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707685141, "uuid": "73fc5b4a-0aa4-4b83-a702-ab6dd2365c6b", "comment": "Malware payload (Mirai)", "value": "10686a12b7241a0836db6501a130ab67c7b38dbd583ccd39c9e655096695932e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707685141, "uuid": "8b6baf2a-9319-4861-b127-c1adc412423e", "comment": "Malware payload (Mirai)", "value": "801b0f681971ef167dfbc6d5d5d32fc07228241d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707685141, "uuid": "ac052530-d7f4-4aa6-911f-be6c6c7fc6de", "comment": "Malware payload (Mirai)", "value": "258a6e58c92d0c2650a07888d0b0abc2b9d826ab961b55398871f41dcb6c5bc04b12e4bc9a2ef90bd0f97dc3a60d3494", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707685141, "uuid": "a4b0b4e1-258a-4d3e-9ccb-2c1c02d67b95", "value": "T11FF2D1317220496BE7E5C8B4E7E007677EB346CAB1919E1C37D97483CF426B66C918E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707685141, "uuid": "5fad0067-32c7-4174-956c-8257e89a3f45", "value": "768:90EQrTzqfaGaoWSfwu8tobYY5iSUnfpPEz+Qulu7BJgGlzDpbuR1JwH:90HrTzqhaoWSou8tDYYZqS6VJu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707685141, "uuid": "a848e72a-f4e7-4d1b-aaa1-e86e20515500", "value": 34940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707685141, "uuid": "c5e9b0d7-8f4d-4fee-a8af-dcc2fc44ad4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707685141, "uuid": "6d78068d-afc2-49b7-9fdf-4340060f0304", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3116c633-c880-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707616340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616340, "uuid": "799280b5-cfce-49b0-9305-971d8cfa4286", "comment": "Malware payload (Mirai)", "value": "dd98595d5e03f5ecedd69ba4c3229dda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616340, "uuid": "b945b5df-15fc-4920-a760-ca1fad53c2c6", "comment": "Malware payload (Mirai)", "value": "107faafdfa59a434e8b0bd20e5e2e68c6b313ef872b0c949962de53e402d6084", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616340, "uuid": "f88f56ed-5d8b-4353-8883-356e2931c90b", "comment": "Malware payload (Mirai)", "value": "7a6dabbda972d075230774fc9a26b45379a51775", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616340, "uuid": "450cc4f9-2a9e-485c-8463-f00954d6650c", "comment": "Malware payload (Mirai)", "value": "730e32248d852c3a3a171b30ad5ef0334501fd1a9c1b24145229b0ef9a3df2efdacf48b4b5a6a6d3de5bda77f20814b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616340, "uuid": "476681b8-8f3e-4fab-9e15-9c48f4d471d1", "value": "T10863951E7E268FBCFBAA863987B78E16564833C637D1C181D16CD6012D6024E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616340, "uuid": "722540a7-87fd-4f12-92b6-7ec1ec0d198a", "value": "1536:YfaPVPXyGxOaXQp4H8fIJgnIP1um/zPMXU:/BRXusWIP1umrP8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616340, "uuid": "7522a184-d2c7-4808-9c48-bfa9f6fe8a91", "value": 72020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616340, "uuid": "56704031-3380-486f-894f-50fda457153e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616340, "uuid": "750cc9d9-fee5-4b2a-ae57-94b1309d999b", "value": "dd98595d5e03f5ecedd69ba4c3229dda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f509811-c8a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707630510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630510, "uuid": "147734d7-4f03-491c-9a9d-332f9601a29c", "comment": "Malware payload (Gafgyt)", "value": "576831f290a53594504788d1b37000f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630510, "uuid": "bde21bc2-d87d-4fc8-be06-e68a56e46e86", "comment": "Malware payload (Gafgyt)", "value": "1097b5dc4d7c20fd2cdd3cb8171a55d82d25ccb2942d2a27ab4290dc02f1b2f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630510, "uuid": "b9cc2ac1-54d5-4fac-8611-4d11634ae3e3", "comment": "Malware payload (Gafgyt)", "value": "76669c941bc563490efb58e9c7b6613f2ec1ccf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630510, "uuid": "33c142ea-1ee4-4a00-9896-d0f064a3c200", "comment": "Malware payload (Gafgyt)", "value": "7eb70fb36cefe6463c90741accf9c6ef6a9ac93677fb6f8d0faf118e0daf2a70eeae924b2cd047bc8973efc0b6a069b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630510, "uuid": "374cac09-d8a5-42dc-9d9b-2d55c36b434c", "value": "T1E1530270CF1784BCCAA037F5AF58074D5FB21B7C8A6E356A2698AF1458943DB7289143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630510, "uuid": "4f285586-b08f-4583-bd65-2789d3ccf3cc", "value": "1536:c58pFZUc4jUfmYg8XMmSmhLGda4JBBy0beO4gDvwbxCP:c58p3fmr8XMmHhLGdXpyVOTcbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630510, "uuid": "ff10f012-0880-4a42-be73-7993c15d7b7a", "value": 65488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630510, "uuid": "2ecf01dc-639e-4e09-9653-6482b6527767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630510, "uuid": "6d7cdfe3-a4de-437a-ab76-4adb6264dafe", "value": "576831f290a53594504788d1b37000f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a01412-c905-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707673448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673448, "uuid": "62f93981-eefd-4692-9123-21dad7b3da90", "comment": "Malware payload (Mirai)", "value": "2bea5c7e92b616de8677d7587e152066", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673448, "uuid": "c8b84cc5-0b6d-4cb9-8db1-fc5af9fae240", "comment": "Malware payload (Mirai)", "value": "112a6d015cee6d905c88020ff03f57442041be6fd77f6222215473aa4ca03950", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673448, "uuid": "9983e9db-4bbc-47f4-92dc-a54a575ae946", "comment": "Malware payload (Mirai)", "value": "601aa5a603b57df83e45bd9738943be1809e473d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673448, "uuid": "621dff55-1e12-4f35-8dfb-58f443151009", "comment": "Malware payload (Mirai)", "value": "3f8633464a448504a25bf5b5d1811144b2089ed180b5506c324729a1fe1c25837571c57e83c4e7296d84ebf846473e60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673448, "uuid": "fe4ef395-4abc-4aac-a7d7-a818fffe4e59", "value": "T17203E0B0B90E447894F7083BC83683C332323F68557A656E62681756E7D6BC1A77CA73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673448, "uuid": "83f3fae1-9f02-46ee-9f2e-1ec2fba0d49f", "value": "768:7hoMTjoHlyjWeGFvU0jmXYMrnGMFHUsnbusgRGOQw/sVcUThwyq3UIru:7TjBjLG60PM7BFROGvxThw1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707673448, "uuid": "379c620c-4325-4491-99e2-ed02bb91f7fc", "value": 39356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707673448, "uuid": "1b0c895b-1529-4159-8e98-7505ba71aaea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673448, "uuid": "c4996138-7cb7-448f-991b-30efd05f2e6f", "value": "2bea5c7e92b616de8677d7587e152066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3168cf7-c8c3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707645388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645388, "uuid": "6cdb7c58-67ab-4940-b501-7dd8680ace74", "comment": "Malware payload (Mirai)", "value": "7121f8e59c279c72674393f58efff262", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645388, "uuid": "be11a751-93ff-44dc-b0a4-fbab97299270", "comment": "Malware payload (Mirai)", "value": "11cc1af1c1755a7bd284028dd981a0e651aaaa1e4d16c07f4ca7028e3f5699b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645388, "uuid": "5b0da1e7-f565-44be-8d4a-3286e6bc7ac3", "comment": "Malware payload (Mirai)", "value": "5deffbf28b96dc9427831211b3b992227c3c7761", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645388, "uuid": "93d9ef80-9caa-4132-be09-899863d6c536", "comment": "Malware payload (Mirai)", "value": "47e1c479c9e641fa77ab9399d099c23a5e891cad88d9cbbcc6c6d9f4aaf4f465488d57c084284ab4499462cde3ac4714", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645388, "uuid": "8fee6149-1014-4994-924c-89acb7d2f63c", "value": "T161E33AC7F800DEFEF80AE33648570905B630B7E105925A372297797BED3A1991937E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645388, "uuid": "cf173d6d-860e-45b2-a28e-19cce1a6d7d9", "value": "3072:DcyZogG6CLR72QYzA6NdYNSVrjbilLmj9z/yvviNe:Dcy0yQgAeYN3LmjVyv6Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707645388, "uuid": "706ac685-0059-4b95-bc70-8b69efdce8c3", "value": 154592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707645388, "uuid": "fdf2a735-6b3a-400f-8121-e12ab2b7be6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645388, "uuid": "8d7b0af7-e853-4d10-952e-ea1de428481f", "value": "7121f8e59c279c72674393f58efff262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4192bc-c8bb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707641918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641918, "uuid": "65764c7f-1aa3-4e59-8808-d814a962c95a", "comment": "Malware payload (Mirai)", "value": "324551f0c1892f747c47e8855cf7b95d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641918, "uuid": "fef86c93-1035-4846-8ce5-5ce3eecac49e", "comment": "Malware payload (Mirai)", "value": "11de7d3cabb21d68702b74f5057ba7118cd6545df5c21873ac677556dc40a367", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641918, "uuid": "07903c50-1cda-40f1-ac4b-18721d2112c2", "comment": "Malware payload (Mirai)", "value": "560069a9c94bce7ddb43f82fb73339ca6cf5980a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641918, "uuid": "67a67a6b-c827-4283-9e2b-c3f32df20123", "comment": "Malware payload (Mirai)", "value": "232bf4e62beb92bb09d1dc577834acaf26a38f4c7f2647b545ef229f8b23a7635cd48648316a8422799528eb737ebf69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641918, "uuid": "3f29932f-d97e-49ed-8107-b9ed9fa3819d", "value": "T1B0E33AC7F800DEFEF80AE33648570905B630B7E105925A372297797BED3A1991937E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641918, "uuid": "d06b1bd8-c7c6-4cba-9684-c247f29465c8", "value": "3072:DcyZQgG6CLR72QYzA6NdYNSVrjbilLmj9z/yvviEe:DcygyQgAeYN3LmjVyv6Ee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707641918, "uuid": "0e6d3208-a9b2-4c27-8afc-a4b611228949", "value": 154592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707641918, "uuid": "84015d07-abce-4ceb-85f5-ae30a005ccdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641918, "uuid": "38680075-a36a-494b-860c-703b5dc95e74", "value": "324551f0c1892f747c47e8855cf7b95d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f3c108-c90a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707675826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675826, "uuid": "7955e44b-accc-42a2-93d2-e6c8b73eaf8f", "comment": "Malware payload", "value": "676c5efe2dd5efd736d177950899013c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675826, "uuid": "91042e33-c379-4cdf-b1c0-a933ebd4c0af", "comment": "Malware payload", "value": "1561edfef7a4549466f790bc4cf86c1ff1cb74604621e63388674ab1ed94e09a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675826, "uuid": "bd07a754-2374-4a47-a4a9-932b31203aef", "comment": "Malware payload", "value": "c7e29bc0f7a209bdadf96911e88a31e05e6f3280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675826, "uuid": "2ef9c854-ba99-470a-9eb7-ba7aa79dd9f2", "comment": "Malware payload", "value": "1bdaef2dba8f47690bbcf7f0ed10a7c72f8c51640b21bb29ffab1f051123e56eefff5b14b357bad658203ab0e93d4fc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675826, "uuid": "0320cd2f-aa79-4fe2-b8ad-f720d6fdc6f6", "value": "T13247333BB31C643EC5AA073206B3DB908A3BBA61E54A8D1E43F4494DDF3A4A11F3B555", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675826, "uuid": "d7bf8a58-a1b4-4799-b83e-392facf18eed", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675826, "uuid": "32eda4c2-d19a-4c2e-961b-91aff084dc77", "value": "393216:xbbmHFpFgyHkLQFWaTj5++V3RWSbK2UDAV7QedEoe/LzO/qfo/GwgwaenAgw3of:xuHFpf5FUw3RWr2UUIX/LCywuwseANG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707675826, "uuid": "674829dd-635c-4a24-bf9d-73c66e056ac1", "value": 24731728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707675826, "uuid": "9cc26a42-8057-4a1c-9f87-02fa2ce67a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675826, "uuid": "faf283f9-d364-4ed7-ad72-c7f0c3033d06", "value": "SecuriteInfo.com.Program.Keylogger.249.4826.24335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de4cffc-c8bc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707642238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642238, "uuid": "602ce8d8-7f50-4615-8e12-21e36052c12c", "comment": "Malware payload (Mirai)", "value": "e1d3c49a5b6f2480608dd318a3cd7ef1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642238, "uuid": "c35045df-ba9f-43af-93b9-9acda25fed85", "comment": "Malware payload (Mirai)", "value": "172ecd2ed9f56c27d915edda6dffebda627b2f7de3ed79254e06a9e5da3b8567", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642238, "uuid": "9ea87d1f-f72f-442b-a8a9-b0087136acc7", "comment": "Malware payload (Mirai)", "value": "f92669e583579768317ff90fe812e31dd9ac25a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642238, "uuid": "040b09ee-9ef3-44cf-9698-0d6079e8459b", "comment": "Malware payload (Mirai)", "value": "3f0451f697eeb169588f4ee9548c0d14a81bb62bc6e5e7c76a0aeab3c3bdb0f35cb3b899f7b51fd5c0183ad179043cd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707642238, "uuid": "3cd04f14-5a4a-4d80-a18c-f8520f369349", "value": "T1A8F31A46EB404B13C0962BB9FADF42513323AB5497EB73059528ABF43F8679E4F23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707642238, "uuid": "781589c4-a7e5-4d88-b68d-c2605b59554c", "value": "3072:QYa2eFdHlkQaNcTZeZz/oMsCXPtW/szDDohM/RXpsBQl:HeFt2QaNcTZ6zwy1W/cshM/R2al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707642238, "uuid": "2d400764-01c7-4575-8391-d8c7e0f8cca7", "value": 168092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707642238, "uuid": "6fed4c6f-2388-4cb9-ada8-607e5b70e88a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707642238, "uuid": "f2be9915-2a7f-4fc3-a3d0-b9da4c4911ed", "value": "e1d3c49a5b6f2480608dd318a3cd7ef1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffa4a82-c8e1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707657999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657999, "uuid": "91f8c5ec-f745-48e7-b4bb-663814156aa2", "comment": "Malware payload (AgentTesla)", "value": "a2744a18a34724215d4a3e0274203dd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657999, "uuid": "ad2aa6b7-bfe8-4eeb-874c-19e37b69d33d", "comment": "Malware payload (AgentTesla)", "value": "17ebaf866f5bec6d103149f0d03d022181988f0eb7bd3737de97c91a30c53a33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657999, "uuid": "99a326a8-e75d-4338-bf83-02c734c2256f", "comment": "Malware payload (AgentTesla)", "value": "29a9af6a60bf90d7d2334a39432eca096b8472d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657999, "uuid": "db68c0b8-3c94-4abe-9dfc-4b02ddb9a781", "comment": "Malware payload (AgentTesla)", "value": "58360f114a69a3eba34b470a0239e3e06293b2b5df2d0f2e90be670b153bac8981cb10d98e6cb4b9e10a5a8c0bbef71a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657999, "uuid": "f4799832-20ca-44fa-8293-d51a5d3a09c3", "value": "T1E2D42351A2F8E739C719ABF7C8A004312BBAE1197C62EA6DCCFA54F70D53B504950B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657999, "uuid": "1306843d-af54-4a8a-ab84-a41ffa7e6b62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657999, "uuid": "2128ebfe-8e97-4b8a-a19d-88cbb82db0d2", "value": "12288:MZ5+xEd60NfydfCy9px+3IH6ggI7qiir4rbSqAPsTEUz3O2JN+Exo5yP7vnOmgSH:EcxcNEdfC+YYHXgI740rbSqpTDz/OEiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707657999, "uuid": "96f50786-b508-4d1d-b2c7-6861678e598e", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707657999, "uuid": "49154632-ea88-4d6c-afbb-501976d7b268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657999, "uuid": "49634dd9-22a1-4eae-aafc-f49838d64802", "value": "PO#15032016-A001.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74eac9b7-c931-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707692474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707692474, "uuid": "8c3bd31b-e3ea-4f49-ac09-f5c14f0499ac", "comment": "Malware payload", "value": "3dbe4ac28b0a380239d273eaff23ace9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707692474, "uuid": "85a347bf-4da6-4f4a-887f-06a3b9fd4526", "comment": "Malware payload", "value": "18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707692474, "uuid": "8604b101-13d1-4115-b6e4-f4a1f4fc143f", "comment": "Malware payload", "value": "ede55de16d4e99f85215ae96bbae4c1a79c893f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707692474, "uuid": "53363ba6-1b62-493f-80ad-3a09354c5866", "comment": "Malware payload", "value": "0dcaabba38557996889e7ddd166bef0d44c8fcfa34d0c87ef1895b6b981b09f805044d102df32c15f59863c58625dda0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707692474, "uuid": "82a41e58-30d0-4eec-b04a-401df9e7c82a", "value": "T192E53322F7C3C9B1F5474030544DAA986EF77C710A3A99CF33917A3B9D602506629BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707692474, "uuid": "b2e13b21-d2a4-4270-86e1-ebea5cbdd956", "value": "650d799fecbe5d1ea9ae005edd6c87d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707692474, "uuid": "5edc0bc5-afe3-4d88-9b2d-5acb0ce32c4b", "value": "98304:IIpr4aPO5QTdjkYR9tNDrMoyUH5va0bRthYcjmV:IArTd1rH5va0bRsci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707692474, "uuid": "1e58ae98-fe46-4212-9c58-5b51f7d7d827", "value": 3310592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707692474, "uuid": "d2a37cd0-c431-46e6-b817-b3abfcdab588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707692474, "uuid": "37e7b336-cca2-406f-9b6c-5287cd709717", "value": "4GXEFDKOENCK4K48P2QHT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75326310-c8d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707650814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650814, "uuid": "509930be-b976-4bf3-9ec1-d1ab25460a26", "comment": "Malware payload (Mirai)", "value": "1ddbce2b25f6cbd57fef8c27c2354f6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650814, "uuid": "0bc008af-46bb-41c9-8123-43b516840762", "comment": "Malware payload (Mirai)", "value": "1c682ae10518a6a8b20c9faba6f965f744d173f1d45e6a8e0cb8825abb152d81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650814, "uuid": "590ce9c0-2090-4541-97b8-4af2e4a4062d", "comment": "Malware payload (Mirai)", "value": "8ea59f447f0c0193bc56d7522680be260c28ed42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650814, "uuid": "03aee9cb-86c7-4408-b852-759898ddfbca", "comment": "Malware payload (Mirai)", "value": "9c860cd39a506105d9c3919bcb78e7df125550ed3811fc554e0916d563162873aed2de6e8d68e73bc28e10270b641c70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650814, "uuid": "eee60ba2-d63f-40a5-8c8d-439cd3635d1c", "value": "T1BB21FC09F3896D5FEDA72078542B022B74307A4AE4138112B3669E3F7E3B1D4121A18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650814, "uuid": "29d90385-36a2-4910-90b7-64a2eee47929", "value": "24:3kZdSAa8DzSWPpbP78Pwy74+CiUTHk2hHCeD8ECAfGSpiox9tNQWTNT1Z7V:0jSApP3hb/mST3hiK8DAfUWQwNhlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650814, "uuid": "4c2304f9-a9cc-4752-800f-e8eade1d4630", "value": 1240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650814, "uuid": "4dc5b688-4697-43db-845c-15c5d1b3d695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650814, "uuid": "16456ae1-c5c5-4c8a-9fc1-83ed583c74f1", "value": "1ddbce2b25f6cbd57fef8c27c2354f6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ac3112-c925-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707687322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687322, "uuid": "a2fe73f7-108e-4ac6-af7f-5944c36a5330", "comment": "Malware payload (Mirai)", "value": "a2caa1139fce7ce17299a5957ed46812", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687322, "uuid": "d095a710-cf98-422f-876c-6c212215399f", "comment": "Malware payload (Mirai)", "value": "1c801506d658f1915e08e8b6cc10aa63726ae95b54b374f4f6b18b5dfda07900", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687322, "uuid": "d01c2995-eb01-4ccc-9db4-82275cd148bd", "comment": "Malware payload (Mirai)", "value": "e0bd3cc4edf42e251ed64ed67e046884ae85413c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687322, "uuid": "8e0a0863-51cb-4895-90f8-a9fce08d6375", "comment": "Malware payload (Mirai)", "value": "f7ab18380eaab73553c103ebaa541c4a725cbafc9a1f1bb94eac9edce738f2adf6c09eacba9cc2d95462cfe2da4ad4cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687322, "uuid": "76bef37c-41ea-4240-92a4-7e8c56ec6204", "value": "T184B3B40ABF611FF7E8ABDD3745EA1B09249D510B21A87B75B930D818F25B60F19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687322, "uuid": "6226dc36-6b05-4c29-b6ef-5c23f5bc0575", "value": "1536:sAcC99ax1OOEEXaVZnMiNj7GYyGmFPCQvGgscOYgtZ8Tm:sZC99axQObGMiBjgscO9om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707687322, "uuid": "28f6793a-bfdd-4efd-83b8-190c35869586", "value": 108964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707687322, "uuid": "c5d38178-8a11-4d65-a22a-385bf9967750", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687322, "uuid": "33568040-aece-453a-9b99-7fc6504e3fea", "value": "a2caa1139fce7ce17299a5957ed46812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2bc1b7-c8c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1707644764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644764, "uuid": "274d97c5-ca23-483c-a8d6-081fb438acbc", "comment": "Malware payload (CoinMiner)", "value": "e9adf3fcd6efd04ad2d9fcbb0c652a5d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644764, "uuid": "74316321-c986-4e40-b65c-1b71002f1637", "comment": "Malware payload (CoinMiner)", "value": "1e97aba3bea70cedc575c7a181f1782ba7d8a3bd5859960bd46ea3a0663a95a2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644764, "uuid": "f2243e52-dce9-4628-891a-10ec58fbc2fa", "comment": "Malware payload (CoinMiner)", "value": "bfe3f7167266c6e17572e801394517513d4b7501", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644764, "uuid": "5efccc64-8634-40c7-9c7b-81f1eb590016", "comment": "Malware payload (CoinMiner)", "value": "51e9760fccd8aa8fae877d451d2d278462f3e39552da17da57295c7166b32b8c9c6ec25aacf38745830a53c8e4e39e6a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707644764, "uuid": "c1c80c2c-fece-4551-bf76-994596d00541", "value": "T1FBC53388D6A7AD8CE474EA7FDA1B9CED1E043128979638D7CF5E539152320E434FCA60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707644764, "uuid": "d570fce5-3a6e-44e3-a8a6-9d4cd52a12e3", "value": "5d68de0544abec4f6be91e05245b348d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707644764, "uuid": "cd067afb-644b-41f3-95fc-1ae489e4638c", "value": "49152:gIKFUNRNKPOYWuqQL6Z7uwfR7bMFjTrt244RMq30x10mtN2R/DHqajWwPCXbiD:gI2UN7Km8AqQs7g442I0x10mtNgHjWwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707644764, "uuid": "e510773a-67f0-440b-a658-4ebddecf8eea", "value": 2596352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707644764, "uuid": "1c2407d2-c9c8-4a93-b9be-9dbd6ccd6318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707644764, "uuid": "5729fb23-d6b7-449c-a45e-c2abc06da1b7", "value": "e9adf3fcd6efd04ad2d9fcbb0c652a5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cef5ea-c879-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707613359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613359, "uuid": "c54c5c4b-8827-4e01-8f63-9184f79dc0a3", "comment": "Malware payload (Mirai)", "value": "76b3a2df6763858b742c9162154e2b3f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613359, "uuid": "4b00d80a-4fc4-4f7e-a1a8-19ee8244e856", "comment": "Malware payload (Mirai)", "value": "1fcb9dd1865984ff120f404b489c16c3ab983deba999b9e1a6de91bb7a6bf2e1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613359, "uuid": "f89f98ac-9b61-4328-ae92-a1a08229841d", "comment": "Malware payload (Mirai)", "value": "d16f7055d6fa0b3d2b9fe10002850a4c58eba77f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613359, "uuid": "7649e32e-14d3-4be1-8fe7-ab93859d9047", "comment": "Malware payload (Mirai)", "value": "5aa0b5445bf28170422abd52c1ad7f7bd86ad56d0a069dfe9faa562c803453cd0975a259ab429428408345b4c5a93b23", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613359, "uuid": "c80afe4d-770b-4004-b9f2-4c7862fafb38", "value": "T1A1633907B58180FDC099C2741B7BB63AC973747D127AB2EA37D8FA223D46D701E1A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613359, "uuid": "880844a6-d248-4c71-90f0-14ec5542045a", "value": "1536:6YeoNOKgFKogCOHzad5nNpNOsJmnlmlnuW8nPF70bEMsUnS:77NOzIogpm5nH0DnkEW8PDMsUnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707613359, "uuid": "97f694bf-1c62-4707-ae55-56b773a2d445", "value": 71968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707613359, "uuid": "037846d1-4256-420e-b71f-5ac42a05dc43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613359, "uuid": "e4c1caa0-4d4f-42e7-a50e-887d6649e28e", "value": "76b3a2df6763858b742c9162154e2b3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22778ce3-c8a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707630488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630488, "uuid": "ad707308-aa81-48ee-be0f-9e3ede4ae22f", "comment": "Malware payload (Gafgyt)", "value": "b093c5cb390a07651a5884df0de6757a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630488, "uuid": "b1a151ae-fdde-4320-91a1-fc8527d32123", "comment": "Malware payload (Gafgyt)", "value": "21fac71b5d5bc1fd0d13936258fe8798048302e4b915f96796d928e61f1fb31f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630488, "uuid": "5bf367bc-946a-4954-a1b9-7f3928047c0a", "comment": "Malware payload (Gafgyt)", "value": "9fa4a7ca00d90b94ca0f5fb4909b331a5ce1df4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630488, "uuid": "6e3763b6-7e27-4c3b-9004-5eee295707fc", "comment": "Malware payload (Gafgyt)", "value": "06e5b3990ff8c9e7efc7775637ac5985a083161b490e9c82ed103351fe6a78c0efbe14078faaee22e646762ecfd40793", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630488, "uuid": "7fb693d3-368d-4429-95b6-1968fef962bb", "value": "T1CC330264F74D4E98FF9366E14ECE12D27B3629AD564B6392D0A70F300F5AB08721E4D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630488, "uuid": "d8fcc717-18d8-4c3a-a27e-a734ed6fd45a", "value": "1536:MpL2XXzBAe98tCcE4u+qgw09uJwPpHr8Lq6cSxD23:S2XX9AeitjE4u+qgwv5XXI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630488, "uuid": "127e5b10-11bd-4471-b2b6-a45cc9adb491", "value": 52960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630488, "uuid": "d4c55aa0-0499-44ca-868a-4756fb1b65c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630488, "uuid": "da895e7c-79fd-4b05-82b7-d554d7e196b3", "value": "b093c5cb390a07651a5884df0de6757a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d7ad78-c8a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707630445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630445, "uuid": "5fc84413-f68a-4308-a3fc-c8465d411763", "comment": "Malware payload (Gafgyt)", "value": "4ca658a19ea8373947e18d6a793f7766", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630445, "uuid": "896bd664-c8d8-4dc4-99a9-f7b81d00be02", "comment": "Malware payload (Gafgyt)", "value": "22793bc8b9f5d9ec767ebdc468f28a41b649aa5dfb6a475312096769c97d281c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630445, "uuid": "507bd3ea-6405-40da-a497-c2802f4d708d", "comment": "Malware payload (Gafgyt)", "value": "576ed6ac13c6b2db829f9d19ad9b88212fe15365", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630445, "uuid": "41c9473c-91d7-4b25-b175-1b221a7a5599", "comment": "Malware payload (Gafgyt)", "value": "f03321fd9b3597f2905506d5ef107345793fae35113e3d651924b87591242e2062f2fa53d00602bde26c397c6899474f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630445, "uuid": "13c45c40-e98f-466d-b17f-0c45949795c5", "value": "T1F3F32956F900CFABE94692BA45E30B20FF70BBD11F62AA52631636A79D370D53D13E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630445, "uuid": "e4ff510b-3f89-4613-8a39-d533861a30ed", "value": "3072:GxZIUcHF4TPNqYN/CFy5ypmW363cayqwojqzb4jvoU8mIgegnpycJ3W:GwX4TPNqYE0ypj36XyqNu/4jsmIgegnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630445, "uuid": "f95902e0-0d24-4eda-afc2-6963942f11c0", "value": 164436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630445, "uuid": "bfefdb1a-ad6b-4648-b588-ecf273730e3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630445, "uuid": "9015a8ae-9cad-4e39-b834-87da340833f0", "value": "4ca658a19ea8373947e18d6a793f7766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b3d5cb-c8ec-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707662686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662686, "uuid": "853706b8-e4e0-42d6-9874-12cc4e9d262c", "comment": "Malware payload", "value": "f9fe2939c1446fb5656df0e26893212d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662686, "uuid": "9166dac1-03b9-4a5b-9cc0-d90644181964", "comment": "Malware payload", "value": "2462bab518fe5cebef008cb12b44065348f9173df6bf4d9f80dfda82869575d1", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662686, "uuid": "7e5cfcc3-94ec-4bc0-b053-9b5dfb6f7cf6", "comment": "Malware payload", "value": "701fa00c83c2b2f5fab9b19e50a7f36f153df78d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662686, "uuid": "2f88580a-3e8d-4b7a-b19f-8e82a1a19a0c", "comment": "Malware payload", "value": "09ea0cbe1dff11456b4295da8138e6b99de9c7007f777964e73f1aaac5b111408c64a02412695f77db33309a6ef2a9df", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662686, "uuid": "76a436f0-502e-47e7-b9fd-974b6ce8e8f6", "value": "T10DF733924D0428A9D7369BF8B06DA67BEEFB4AB413DC248C11CE235AE563354D353732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662686, "uuid": "41d7ec9b-f664-4c66-8ca2-3f6cd96971e4", "value": "1572864:jjddGv+xpU8juU0gnvID4NsehQ5A5GjnvyIgZGQVDk:XGvv86UDvzsehQCe9gZxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707662686, "uuid": "eb0fee90-68b5-4a0e-ae2e-c955ce3be39e", "value": 71442472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707662686, "uuid": "b2e2d1fa-f645-4d86-bc12-12002b450444", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662686, "uuid": "aba767fb-f193-4170-bda5-b8247e6366c6", "value": "Sky_Beta.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c60c43-c879-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1707613374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613374, "uuid": "de3f2c5c-e8ba-4817-8861-fdeb20979944", "comment": "Malware payload (Amadey)", "value": "ba8c5dc5ec763007a4af9cb06bef78ef", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613374, "uuid": "4725339b-c1c0-4ef2-b1b6-002abc877056", "comment": "Malware payload (Amadey)", "value": "26b468da8e91ddbb807a9f8c95e2bd3f01510cb9438d7ae6134d108900e06b88", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613374, "uuid": "cbfdbae0-91c7-46c6-aa42-b02a8f9a043c", "comment": "Malware payload (Amadey)", "value": "a50aaf51e7d5998a4cb7a4218f463b06fd005b5e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613374, "uuid": "b3643a9a-32b8-419a-bf65-4fdfc15a8ee8", "comment": "Malware payload (Amadey)", "value": "335d9dacf4fcc9497475dbca5f8a24138735dacfd6cfac3480fa28f6099ce5a830fcfdc82e2282c050862860828bbcaa", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613374, "uuid": "dfef2519-1e92-4fb7-ac3a-1e924eb95e33", "value": "T129557C0FA26541BCD4BBA1789A135947F775700603709AEB07E446AA3F53BF1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613374, "uuid": "a13729c7-8881-4f3b-89c6-38c4687cb031", "value": "3eb70f83441fc8632e81bd6eb89f424d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613374, "uuid": "a3739114-8c5b-4e94-98ba-7fed55106435", "value": "24576:EvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggX9+yC7:EsMPSYcS5wPi095Pbgm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707613374, "uuid": "ef5bf8ee-2541-4318-8547-7d4a8af69d11", "value": 1285632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707613374, "uuid": "3c06e606-0e4f-436c-a373-ba69779f5d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613374, "uuid": "4a658101-3b61-4231-93a1-bda81af51de5", "value": "ba8c5dc5ec763007a4af9cb06bef78ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157b4556-c8a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707630467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630467, "uuid": "136753cd-a429-4864-bb1b-a2c4293fba24", "comment": "Malware payload (Gafgyt)", "value": "e6c2e49e3080c72c49d8505c0aebcc71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630467, "uuid": "b3a03e24-bee0-4851-8da7-bcf8c7991a9a", "comment": "Malware payload (Gafgyt)", "value": "275446b3bbf51a54ebd4564976d06a072f62dc5edbb02c66f665a80261e08d56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630467, "uuid": "8866d425-e6a4-459e-bde2-b71cd11e9956", "comment": "Malware payload (Gafgyt)", "value": "6096fc24791b218a5ef1e99ab9c1c6f25acba178", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630467, "uuid": "c2453093-b624-4eeb-82a8-bf528410d42c", "comment": "Malware payload (Gafgyt)", "value": "fbce24b4b82515d9bcdf1ea4681982fd2fc8eaa293994fc8ce0b0931501de6a0ff60b4b242533c0dbcbe523d54c43110", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630467, "uuid": "9eb3c582-fbc9-4dbf-96b8-5cad268681f5", "value": "T1BC3301ECA24C8E6BC2AF597487E440F3B76A8D1C3E1DCD96F24A5B582303599334E9C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630467, "uuid": "20fe6d3c-c105-4e73-81c4-be151fbfb922", "value": "1536:UhloxGr2qjA2vNUKhW84K4u+qgw09hJwPpHr8LqQ7VyO5:Uhltr2qsCGKJ4u+qgwc5ZyO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630467, "uuid": "e2d3a336-3e8f-4ada-a169-fa8bdd76afbd", "value": 52944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630467, "uuid": "007342d3-a44a-4de9-a4fa-8561544d651f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630467, "uuid": "5f0e06a2-c0da-46ba-ab55-44ab775dd93e", "value": "e6c2e49e3080c72c49d8505c0aebcc71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c16d0ef-c8cf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707650449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650449, "uuid": "f6674df5-8d4a-42b9-a9c3-7bd3599be22f", "comment": "Malware payload (Mirai)", "value": "67f12abc00a219d1e522b8db4979f10a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650449, "uuid": "682af6d1-c861-4f62-b33a-522f9e54a424", "comment": "Malware payload (Mirai)", "value": "28b6f2ba28fb5781821f768d56a7c471bf23fab3af4b9849858770d92b1102d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650449, "uuid": "6979dcab-4299-402b-bc8d-bb9bc90be39d", "comment": "Malware payload (Mirai)", "value": "ad46c8dbb644bada8d85f2b5cc7608b6a498a3a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650449, "uuid": "c7e2a6ad-046b-4bfa-bfdf-f92f0952b739", "comment": "Malware payload (Mirai)", "value": "4f56cd7f78bfdcd5b2ff178391119031674add168dfaebf020877f8e379143eef435a09d30b09407a25658e61f6b5b17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650449, "uuid": "6ed25dda-940f-4a7c-8307-6dc5c9f81288", "value": "T1E1213243B5C59DA8CF18D73C8EB11750BB16D524C84BE3CE0F0C5BB5692F28C6994094", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650449, "uuid": "ce6b6517-30f3-4b77-a940-8ac522ecb64a", "value": "24:wCVm4llns9wdGtSnUpzzbBWpzmK+leKD5gDrmgjvGgkC7m172Nfu:wal/sOdxnUpzzbBWpzmK+3ODrmgjvGgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650449, "uuid": "a4813de3-ceab-4edb-8555-4d6eb39a2266", "value": 1192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650449, "uuid": "a3ea5fab-29f6-4126-9ac7-ba5c7c564f67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650449, "uuid": "40fe5cd4-6c06-45c5-a862-08224239db4a", "value": "67f12abc00a219d1e522b8db4979f10a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b3ee3e-c8a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707630432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630432, "uuid": "aad386e1-b838-455f-af41-f7c3f344e89d", "comment": "Malware payload (Gafgyt)", "value": "597392f115a74f62b4e3685bc8243619", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630432, "uuid": "b583b64f-f9fe-475e-99f5-bb4ad100838e", "comment": "Malware payload (Gafgyt)", "value": "298e32e4fe64f5bec9ad79ee7ee89ea73df721805df852db7f85973c457c658e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630432, "uuid": "342ef256-c375-4429-a129-98f61926c9b1", "comment": "Malware payload (Gafgyt)", "value": "4a5396b09d16cae64ef192f3e4432c2d18c592fe", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630432, "uuid": "7311ce1a-b1f8-47c9-ab5d-759b87125528", "comment": "Malware payload (Gafgyt)", "value": "7c6eaf8a2764c7f30b9012193cb739c7bf23a04c0478f1de1cf80359b89c407cc91cdd326549633a7ddc352f61a4a0a6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630432, "uuid": "064c8bf1-a97d-4d5b-9d0b-5e73d4421da1", "value": "T15E43014371B6B1B8F023067588199F22F5C09C3629BDB70790EA6BBE79EDBC4270E540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630432, "uuid": "74cec122-f510-4410-b9a2-b03787f87076", "value": "768:xa2XSd2SIrj/3WbUvpCsfi8wmfwYJWZTwhVxiRjAqx/J+Mhx0+fNOiCXaRHF55i/:A2SIPqURCt2WQO8gUjK/uAy7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630432, "uuid": "e5c50dcf-f56c-40c2-b960-1d47cc4982b4", "value": 57860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630432, "uuid": "e05426be-b207-4434-953d-316e4e4174c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630432, "uuid": "16840a12-63a6-4a6a-abb2-2b61c485372e", "value": "597392f115a74f62b4e3685bc8243619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16630c0-c87f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707616206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616206, "uuid": "cadfc49d-1423-40d0-9fbd-7407dc86acb1", "comment": "Malware payload (Mirai)", "value": "28ec7b62f2c47abb516aa702264173de", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616206, "uuid": "77c9253e-7ac9-4f50-9ca3-c25630020c09", "comment": "Malware payload (Mirai)", "value": "2f04c29cc8660d32e77fedbde21e9b2c3399c8dd80e66b74c0a7f05b34365a84", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616206, "uuid": "f427fd16-6fcb-4345-a881-3685504f5ac0", "comment": "Malware payload (Mirai)", "value": "bec3a7869fb7eb04653e10004684260991c72460", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616206, "uuid": "93fd3f8c-3c09-42ef-b9f4-9ec1a9b53c73", "comment": "Malware payload (Mirai)", "value": "779cd9c999d62aaa24fc9139817a61b4eab2de50b73c9aeac5d2e7c7350865c594017fd85ee4c1d652cb8a985e7f9089", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616206, "uuid": "b16ba3b6-f3d7-45ea-bcf3-8a7af67f5968", "value": "T1D3C35B42FA418F13C0D61779B6EF42493322A7A593DB73069A249FB43F8675F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616206, "uuid": "d62a96f1-3c2f-47ce-9556-e44bc016888f", "value": "3072:cowpuQyNSG7Ra1styK9flTQPHo1rScVM/9SAvjik:cowpuQyNSG1a1styKdlTuI1rSmM/9bvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616206, "uuid": "747a1474-86dc-4303-a709-d9db436c50cf", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616206, "uuid": "558c14cc-83b0-4d4d-a38c-502e62d4d3f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616206, "uuid": "6dd919e3-67f7-4182-afcb-261c3ae135c1", "value": "amachlenix.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5198e8-c914-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707680112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680112, "uuid": "3e330898-7883-43bb-a6cf-cadf82fd67a4", "comment": "Malware payload", "value": "06ebe0f6ff9c7cfcbb5c78c56e071ca0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680112, "uuid": "bec33921-33bd-4fbe-98ba-df5d4a238289", "comment": "Malware payload", "value": "2ff230d01fde2c518dd08ef8ecfe29681cf276c35a24dc09bc77d784efd31778", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680112, "uuid": "ba4fded4-de26-4e80-9f8f-357b1c6b6205", "comment": "Malware payload", "value": "5ec997e7169b07878b0aa87ac0a2176df1a2b719", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680112, "uuid": "096272d7-b3ac-466b-8328-1cf2b2487041", "comment": "Malware payload", "value": "272e861051af4c1f0d8958af2e793f9fbb90c5730f45dfd3e92ce932368eb21d357382e9a12b26ede49364348b9bd0f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680112, "uuid": "2524c266-a89e-4d24-b09c-cf51f86936d6", "value": "T1D5F202C186CB58D4CC64D37EA39F30D1E8B3A631210C72D19928FDBAEEB348B254559D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680112, "uuid": "535c46f5-5038-4743-8929-ae0e77d30971", "value": "768:XA3Px9VZw7EY+W7MUVzsINosaAF1cGRe11a6iGBdDKq:Q3PxFw7vl7MysINolA7RWiIdDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707680112, "uuid": "b4d12c70-3824-4626-8157-afbe0950717c", "value": 35432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707680112, "uuid": "c669a268-de33-4c62-9c18-2757172e6381", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680112, "uuid": "04b6994d-d063-4699-8b53-4c574bb8b1f8", "value": "SecuriteInfo.com.Linux.Siggen.9999.29240.30230", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27403886-c8a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707630496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630496, "uuid": "0e179d0c-9618-4cb7-852a-2a593f5ed20d", "comment": "Malware payload (Gafgyt)", "value": "6d8f0c50654c938af30ae88a14032c4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630496, "uuid": "d76b3728-82a3-457a-8498-bf84032f7119", "comment": "Malware payload (Gafgyt)", "value": "31bd3d6bb3ad5249ac404a4d9a4b905a8611b9f82f3f55892c987ad5c59c971d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630496, "uuid": "abed6dfd-8c4d-4dd7-9600-81a92fdf45aa", "comment": "Malware payload (Gafgyt)", "value": "33e84b653b4ed994537197874dd0e01612e09dec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630496, "uuid": "46cb41ed-314a-4bf9-bc2f-c7b65bd7973b", "comment": "Malware payload (Gafgyt)", "value": "b58d49f40c519d5d3909784fbee3e103ffdf82fb04a99d8fa269e19265ef0b571c53ee83a51c7864aa8d32c2d3558988", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630496, "uuid": "52b04e63-809d-496c-8637-7a86b1a51183", "value": "T10904E72F6B260B23C5C5107115E73332AFBAC7C834B8D6D75BE06CA96E165883C65BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630496, "uuid": "5db3c042-64c2-4a50-8362-264d06d48b15", "value": "3072:NMjiQyhHzD8ftfTQaJ3Ko8FzOSlBpJKXDQS9gGgbpycpWW:NMga4XFFbpcQS9gGgbpycpWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630496, "uuid": "e5e72201-a6be-4735-be0d-c43b5ac5b5ca", "value": 180204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630496, "uuid": "aab88131-f4d9-4a94-91f5-a0c6ff9da6b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630496, "uuid": "b43365bf-615a-40cf-99f3-0d6d410fac3b", "value": "6d8f0c50654c938af30ae88a14032c4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cecc5ca-c8e1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707658101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658101, "uuid": "3f86e07c-5626-4c3d-b27c-03516f8f97db", "comment": "Malware payload (Formbook)", "value": "c98524cd26805079bf4d149bf3c79fa4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658101, "uuid": "80785863-6677-49de-829f-fa73f1f8970b", "comment": "Malware payload (Formbook)", "value": "32462924b1f299b10b84dee93c0ebc876811da42dd74c6fa942c217172a26a3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658101, "uuid": "b8ea7480-887d-4742-baf7-892d906d5628", "comment": "Malware payload (Formbook)", "value": "4eea9d637f2c24dbcc21970436027a77660a0793", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658101, "uuid": "025d8066-51f1-4cf7-98f8-fea111a661a8", "comment": "Malware payload (Formbook)", "value": "b40ea0faab42007a228b0f7664e8576e70e4db35dfedf3ede360b94857e55d3fc6308f06529dc4674f12dc4c21175514", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658101, "uuid": "2fd5b637-4a53-4384-8293-cc7f1238103d", "value": "T17815229472F85319EC7B8FF5E9740652837A35A9A813E35C4D8522EB4E227C1CA07B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658101, "uuid": "42402c47-6a1a-4750-971f-47e0422a1eeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658101, "uuid": "e1f364b1-e797-4a29-b30e-e39fd26a3b6d", "value": "24576:WiO9cxBPgcy/IrkvhZz9Lnu4nKyHstOXd:WiOp/KiRsVtmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658101, "uuid": "7c019ad4-c540-4a21-8863-9bbd11506610", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658101, "uuid": "2ab6c06a-44dd-41a8-b48d-ad2565686cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658101, "uuid": "614c8f70-a933-4a24-8d3f-00464f2b3388", "value": "SHIPMENT NO-369555440.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383bb1f5-c8e1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707658013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658013, "uuid": "424cd1c3-7c88-4bdf-ab21-5cf6fb4e1ec6", "comment": "Malware payload", "value": "588e6cedefe819b5ec9a187d047994d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658013, "uuid": "6a17e522-b097-43c4-a495-2862cc534168", "comment": "Malware payload", "value": "32fdb74940a386a76cc8b319be690039847a49b3daa97600720d55f62e3ab7ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658013, "uuid": "3f186ce1-bda7-495d-ab44-1c623e01fafc", "comment": "Malware payload", "value": "17df9ebab38753585e7d48b72c5deb1dad8c3b5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658013, "uuid": "649ac6bf-ea18-4420-9994-9789fe1db722", "comment": "Malware payload", "value": "d5d425458e73e79177fca89287bd448d4f7f4d1886cff4b46cdbe157b88479200f66a287c43b7702ab1d16bc054bdc12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658013, "uuid": "cb84e087-55a3-4433-9a9e-ecc931ae24b5", "value": "T1ED537C6163AA9A3FDDDF0779A86260100338B253B283D79E9FDC405E1967BC04762BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658013, "uuid": "9c57f56d-35a7-4bc3-b159-cd07d8ed178d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658013, "uuid": "d68aca5a-2f04-4ccf-875b-c9e00ecdc384", "value": "1536:g7+EhewH91HBCnTniDH2psbesnWgqIpo:gBpHhCTQSsbemWPIpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658013, "uuid": "92f9813e-c74f-44f8-b568-54a2eba94243", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658013, "uuid": "95683c99-d5b8-4e3b-b967-e500880a8d65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658013, "uuid": "adcfe650-df87-47ab-b6c0-721ebd7c8dab", "value": "InvPIF7894321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112941f5-c8a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707630459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630459, "uuid": "452731ef-f722-428f-80c7-8ad5a6d56146", "comment": "Malware payload (Gafgyt)", "value": "69e4ba60ea41f1007c3cd1dba44b3fc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630459, "uuid": "87af9b5a-2c45-4452-87ba-b630391be226", "comment": "Malware payload (Gafgyt)", "value": "3442f86ac3b9011207621301a90ff86250ba6616ac32ad0a8f1bda86e3a6d133", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630459, "uuid": "908e7098-87b7-42a7-a9e8-0882aa4df4d1", "comment": "Malware payload (Gafgyt)", "value": "d751b9bcfb01f91763a35f5a16e4bc588ad5930f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630459, "uuid": "d256ed9a-78e5-47c0-ac29-15540eab0fc6", "comment": "Malware payload (Gafgyt)", "value": "225f0ba42d5e9afa385715884b179476dd633e390b082c8869b5baae90dc3910500b7a4bb41c7d20205cd995f4cf9e42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630459, "uuid": "62c4ba53-5585-4d09-a943-3ccc2d11410b", "value": "T1DD33F27693AD4ACCAACF4230053A39BCE8408526FD0D88FE87C9263975B6759F40A5DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630459, "uuid": "62d5ad8f-d49c-49c0-bb6e-59d988ff3ee4", "value": "1536:50QdLyU3jgiXG3bjHnouy8HyTr4uZv2ZE:5z9joLzoutw8K2ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630459, "uuid": "ba76e7a7-3a7b-4990-8edd-c00e75db32cb", "value": 54504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630459, "uuid": "ac355ebb-10f1-4542-8ad3-5cb8835926bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630459, "uuid": "db98aeb2-cd5e-45c0-a105-ff2f49e26fce", "value": "69e4ba60ea41f1007c3cd1dba44b3fc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcfec5ad-c903-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707672892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672892, "uuid": "2614b465-c5ae-4de1-84cc-f9737d7912c9", "comment": "Malware payload", "value": "14080a3e4e877be235f06509b2a4b6a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672892, "uuid": "1b7e66e6-88af-4667-9939-d720c871e9f4", "comment": "Malware payload", "value": "35c9df3a348ae805902a95ab8ad32a6d61ef85ca8249ae78f1077edd2429fe6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672892, "uuid": "950cf4fe-6ac7-425a-9607-2e2664214e36", "comment": "Malware payload", "value": "868866bd51f1ac744991c08eda6446222a0ccdae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672892, "uuid": "019e58a6-a69c-4d29-a163-48ea82c37db7", "comment": "Malware payload", "value": "a0344118a4dc5bcf5e050fd8ff7d8cba1554ee2ddc32de7b4a98a989be5d42e9994b6e11082e8748e7079a0b36f8c4c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672892, "uuid": "0da90e44-198a-464c-b69a-5860d42c4e7c", "value": "T193558D17B39211EDC06EC17887565211EA71BC440B30BADF17A8A7252E66FE06F3EF25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672892, "uuid": "5546632d-27ab-44c8-a4bb-33c5c70b5cad", "value": "69573714e11441683ea863c40a1c0d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672892, "uuid": "66d11450-427a-4945-9f6b-be95275a8b66", "value": "24576:LDSAXo7PwYZJcFn96EHbYF8paMB8QMy3+xDZKl5pn5p6PnXNfI/7tYvonWXsT:LDXOPFJK9bbYF8paMB8QMy3bHwPXNg/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707672892, "uuid": "5b6523c8-e5b8-494b-9178-ecf8a79514ea", "value": 1292584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707672892, "uuid": "690be529-e32d-4f35-9493-e8e163b76aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672892, "uuid": "0fcfd521-7f1d-494c-b432-80a2112fac18", "value": "putty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedce997-c8c3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707645380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645380, "uuid": "f84a5309-9fac-4afe-b945-ef8d80717a6f", "comment": "Malware payload (Mirai)", "value": "78bb5feef87a2a83623b1d34b29a62ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645380, "uuid": "11c7a8ba-5111-4b94-a627-5fff243b8ab9", "comment": "Malware payload (Mirai)", "value": "377ff63aed8929367fe0634b55d9230df07496cd8ef75de7741c94c0a726c08c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645380, "uuid": "c6b828df-81d4-4230-913a-83f66b37f699", "comment": "Malware payload (Mirai)", "value": "bbd7d57b2f7ea054d8ef2d4e3a74b3622f2b050e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645380, "uuid": "2e353c3b-61bc-4c3f-a6ac-5e68be66fb90", "comment": "Malware payload (Mirai)", "value": "d28e0d8854eb81a714b478b6691b4fcc0611d10e25d3ce5f22bef3a5cece9f97104fff9781dd673167283f8943fa27d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645380, "uuid": "9287cd72-7a04-4d0b-8756-7506a428d241", "value": "T19AD30845FC405F23C6D612BBFB5E428D3B2917E8D3EE720399256F21379A85B0D36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645380, "uuid": "f9874324-a92d-4e2b-8bd4-c0ecb6f30550", "value": "1536:zP8g2CSJG5mIOd34g1Ab0Y1jAFrZ4V/3ETVO5bTa6MFjpChUDDl0+wywVFN+S4d5:z0FGE14V1jI45ERO5bTKhpCyevQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707645380, "uuid": "7dea4b61-6058-44e0-a234-d1fcb6749300", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707645380, "uuid": "09f8a44e-984e-436f-b752-1c54469d6441", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645380, "uuid": "86d263a0-ebbc-4042-aa40-531426c58480", "value": "78bb5feef87a2a83623b1d34b29a62ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ba6df9-c90d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707676859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707676859, "uuid": "8fd2ec04-8f37-4fe8-a8e6-03db78ba218b", "comment": "Malware payload", "value": "50aef88ec0d6b973c6ed24936dcaed62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707676859, "uuid": "7b4b0ad4-d05f-4bf2-9d5c-aaad5e26012a", "comment": "Malware payload", "value": "384ec732200ab95c94c202f42b51e870f51735768888aaabc4e370de74e825e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707676859, "uuid": "0fd6bafd-52f0-4166-97b0-2ee768572d44", "comment": "Malware payload", "value": "d043e592251ddea5927d350c37abbca898db9ce9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707676859, "uuid": "b23b5bdd-bdf5-4ff1-8c75-ed9927905e4c", "comment": "Malware payload", "value": "6947970a8d334614ee6f070259677ec4cbcceba9a98e3a4469a39cf365cba587d91e662a87ae6b1f4b3bd8104c677bcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707676859, "uuid": "efe05e1b-af39-4656-ab24-fddd431aa68b", "value": "T1FB271A03E8D61494C8F5D2B489254272BB70789C0B7923DB2B61E7B42F327F49E7A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707676859, "uuid": "4a048ddd-6190-4ca7-8a0a-72f64cf086a7", "value": "196608:nL9FX745dAgW35zes3IaxOP3QEHdoshi/g1X0gp:L9O5IqVHdoshc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707676859, "uuid": "4a01373b-ae46-4fab-b6e8-82d908033b3c", "value": 20873216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707676859, "uuid": "a7a5f97b-8ce1-494e-ac15-b9e111deff0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707676859, "uuid": "0eaa98c1-dd41-4df4-95d8-f355f54d5d64", "value": "output.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153cd396-c8dc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707655806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655806, "uuid": "1821a6fd-e147-4f5e-9c1c-f76e0439dc09", "comment": "Malware payload (Mirai)", "value": "eb697b3919845e706eb8f47f3b6ec4ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655806, "uuid": "eaf17208-0a0b-4007-b9bf-616fbc1d91e8", "comment": "Malware payload (Mirai)", "value": "3ccc73bedf4d496394ffa533dbddb6ae193aec3189a8a998f804b8637cb8b983", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655806, "uuid": "caa5afa5-44ad-4363-959d-40f9a33352da", "comment": "Malware payload (Mirai)", "value": "abe21abcc6cea39de2402b3ae33c5c333484d7ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655806, "uuid": "e5a270b4-a239-4a90-bd59-790e7f6eac0e", "comment": "Malware payload (Mirai)", "value": "e6aae6b2e464826b6b92d43ea5c551dfd5bc3a843cbf47caa8a64a93af8b8731d959b62ca761db661d70c3d306f5af9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707655806, "uuid": "680f3fef-8ffb-48fb-b9b4-0e16b9290fe5", "value": "T100434AC4F143E9F5E84301741026EF37AF72F2EA115CDD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707655806, "uuid": "87ae384b-b0c5-4772-837b-e24c63584fed", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmcHDj5gk9vWnTI4eBH+4sToQLDLFv:Yn/EsW5qhSh6amQlWnU4GH+dNLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707655806, "uuid": "11924646-bb64-4b06-9964-08657cd22d3a", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707655806, "uuid": "602506e8-7eb5-491d-8c91-c6e1263728c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707655806, "uuid": "cc535fa8-86a7-4529-80a0-19c9753fae50", "value": "uYtea.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c004f1-c91f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707684605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684605, "uuid": "e81d8bcc-e815-4082-8574-b04989c178e4", "comment": "Malware payload", "value": "561c801ca4744eccfbaacd3bf7b882f8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684605, "uuid": "47613492-d101-4874-a28b-3c0ca92318c4", "comment": "Malware payload", "value": "3cd296778c20b10b848fea16ecbb022d3dc356590fd153b430505f5f3b638db9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684605, "uuid": "d0227b05-b663-423d-96d0-68923d9bc907", "comment": "Malware payload", "value": "27921ad1acbc6349a6e44be5fb9eda2a525a71ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684605, "uuid": "87be4fd3-a053-457d-93f6-d9b3c1083439", "comment": "Malware payload", "value": "177c5854af603a837b86449a3b1a9a1de9fca70b6613e6f40bb6501c48e8e4b2e1fc38ed37229046d6459331c770240f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707684605, "uuid": "b3646979-9066-4532-85fa-fae58f68a2e6", "value": "T183734BC5B5C3E9F4EC16093D307AABB24E72F53E6139EE97D3986423A942202D60635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707684605, "uuid": "6bd2917a-2075-4212-b107-2b58cd9b69a3", "value": "1536:GD8VBnK13Rg74kwVJStv0A6xAOHItu9qpGZp8GXPTbVhid/Sb:G0BKRRg74kWS90ATk4uIsj8G7ZUdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707684605, "uuid": "58d83d60-ac9c-4cb4-a72a-a15730d967ca", "value": 75120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707684605, "uuid": "b8547982-f166-4587-b9cb-751e7d010d72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707684605, "uuid": "c80f42c6-0e33-4be8-811b-61c5d4910d49", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e5e1f6-c879-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707613311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613311, "uuid": "9a5456b2-87e1-4319-b4fc-05db2649372e", "comment": "Malware payload (Mirai)", "value": "bb5ee5a08c2d74aa55a76a52a0e2af68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613311, "uuid": "73198df2-5b9a-4a8d-b364-75999e02c7ae", "comment": "Malware payload (Mirai)", "value": "3ceca27983222930da2fe97dc30c3b674dbfd72b8905d29602c1444b9bea6f2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613311, "uuid": "007234b4-8a35-4a6b-86b4-e0067c845770", "comment": "Malware payload (Mirai)", "value": "e0f35f0bbcc520afc6ec970afc55ae387c358107", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613311, "uuid": "55f9e9c3-d911-4eae-b955-3bdef40dd7ab", "comment": "Malware payload (Mirai)", "value": "26eaa740f07b0c07739f307f16565488f200b7691a2146924fbaeb0096dea5fb7aeaabc099c983fbb4b7abe3ad52dd57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613311, "uuid": "597dc3a4-4152-4424-bd6b-95e7a7612126", "value": "T1A9536BC5E983D8F6EC5604742077F7338A36E13E1129EE9BD798A932F841611E61739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613311, "uuid": "19a6f4fa-90b5-4e72-8189-a16e5f4b2566", "value": "1536:Ji6BIgV5FHFC8uguvTjWVWYedCNt8wyywwT1Z6SY:Ji6205FHrMvTAW0j8byZRZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707613311, "uuid": "8d5925cb-9f84-4e60-a6c1-bbd26de28c40", "value": 62896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707613311, "uuid": "72bbc465-8007-4a68-8970-11ff951ee75f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613311, "uuid": "3824e05b-6c8a-4ade-b001-cba7a362c210", "value": "bb5ee5a08c2d74aa55a76a52a0e2af68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc261658-c8bb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707641913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641913, "uuid": "14c8b959-3abf-4a4b-8983-673b3689c25f", "comment": "Malware payload (Mirai)", "value": "d10d2035b37c8d94a50d1f5b0206cf12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641913, "uuid": "5dbd8ddd-e124-4390-a985-633c27edc68d", "comment": "Malware payload (Mirai)", "value": "3fdc32c27655b693595112138802dfb04f226cbee25d1b9ca1b66be38c62aba8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641913, "uuid": "d121f308-649c-4763-98b1-7e8088eb41ac", "comment": "Malware payload (Mirai)", "value": "703d82738434243904f895114b47f4156658e695", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641913, "uuid": "2ad03d35-f4e8-47f3-8314-b52175d25d82", "comment": "Malware payload (Mirai)", "value": "6aab293c27d7d662f9297a9a9057a5e0ea810f28d0c95bfe679a42527b378cdc79bb671426a0d7955341ae3aff6cf1d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641913, "uuid": "4993154f-096d-4f50-845c-19f3fa76e67f", "value": "T179E31B56F8818B12D5C111BAFE1E128E37131B78E3DE72129D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641913, "uuid": "09ed96e9-40b2-4f9b-937f-c76662a1b705", "value": "3072:8RZLo13UL04ElrXueegwnaH3c9jbRCddN+Y6x:8R5o13wcrXJegmas3AdN+YY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707641913, "uuid": "22cc85b1-859f-4608-a48b-4e067b1206cd", "value": 148092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707641913, "uuid": "139ac250-ff91-4635-9fab-8a19b10da6db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641913, "uuid": "a9537a72-3ac8-471a-b514-91f5cedf7bd2", "value": "d10d2035b37c8d94a50d1f5b0206cf12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436c55b7-c880-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707616370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616370, "uuid": "f0d58ee3-b45b-4ca5-bc3a-ef81d53b3afa", "comment": "Malware payload (Mirai)", "value": "8ec931cf42a30f2d4c3f44e0b7b868c9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616370, "uuid": "8b380cd6-3de7-4105-b64a-95c4016de4b0", "comment": "Malware payload (Mirai)", "value": "40a76d772e76b261433c38fae5f525c984660c85c9881fc3d8a1d197b20b97d8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616370, "uuid": "e3ccae30-7eac-444d-8f42-b9c12e328733", "comment": "Malware payload (Mirai)", "value": "6caf51d45728c618815847e068eb8655f72eacdb", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616370, "uuid": "afe7c364-1cee-49fa-a4a1-f01e9379a9d1", "comment": "Malware payload (Mirai)", "value": "78f2b3e749a9d32507c1bc39321b1dc809e5736827884c931636ee1ecf8bf280aec2e1d574d73143b6656b3532d1c67d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616370, "uuid": "35d9e2a4-e499-4cbf-85cd-246f4f0929e6", "value": "T1C333F707F84285FDC556C13417BABA3AE83671EE133CB6A777E4BB222842E615D0DD48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616370, "uuid": "e16c2de0-122c-4557-be4e-77136a12afd4", "value": "1536:gfHlPDdJaEcLAeF9TUDWog1Hlcw/0QkiuVn4P:yHlPZMEcTFZ2A1HlcE0hVn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616370, "uuid": "309df2c3-9a38-4668-99d0-cfbadb84df82", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616370, "uuid": "92a79c93-d29b-4fc4-a5a0-c4eab93f6fb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616370, "uuid": "c0259a26-5921-4016-ab1c-a52b0f065e2c", "value": "8ec931cf42a30f2d4c3f44e0b7b868c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fcec8a-c8bc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707642248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642248, "uuid": "2c3aa438-1595-48c5-adf6-74f7e69e4ae3", "comment": "Malware payload (Mirai)", "value": "388c44f7fe0ceff5f6f67546fe0e5b6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642248, "uuid": "2912f3e1-66dd-43b9-9c1b-10a6576cbcba", "comment": "Malware payload (Mirai)", "value": "40c9e6f885c55fd590926f66bbb9a322c4fb2bf1012958632250b82d7fa2b0fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642248, "uuid": "054f0315-05e5-4bc3-ac3d-63be43510ea9", "comment": "Malware payload (Mirai)", "value": "eab06da20317fb72b748108492a9979eaf3c1986", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642248, "uuid": "0d57eb51-7295-425a-ac57-f66d777449fd", "comment": "Malware payload (Mirai)", "value": "abf6138788e63b29b58158a305a3fae8116587b6f389ba87ac599e4a113a196427b61157c3bcdbd3f4bdc3f7f3f95c19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707642248, "uuid": "5449ff8c-030b-4c05-9af1-5d27efe719b0", "value": "T120C32A05B30C0947D2633EF43B3B27E1D3EF9A8121E4F644255FAA8A92B1E325546DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707642248, "uuid": "c89188c0-2263-45ab-be7a-281ba1d1425d", "value": "1536:MM/aWzDtlvwccxpZvT1N6qhTRHgg/dbMTxhvArId+9W99EXqtPlkKrVfC:6WGccxH71xLggFbMwrLKrVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707642248, "uuid": "8aeda76b-dfcf-41ca-be01-333920e2e881", "value": 121720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707642248, "uuid": "fbabefab-591c-4ca7-8473-151cd6e06ce8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707642248, "uuid": "b33bc3b1-dbcb-4a01-8085-914039468509", "value": "388c44f7fe0ceff5f6f67546fe0e5b6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0288bde5-c881-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707616691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616691, "uuid": "945718b8-6eb1-4130-8a6f-d81975af66cf", "comment": "Malware payload (Mirai)", "value": "14ad1890459296d10bd580a16a0fa51f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616691, "uuid": "61bd16f5-a396-409e-88de-332b223ac1d3", "comment": "Malware payload (Mirai)", "value": "40d994fb7517075e42f620c800a621ddc4423d01bc2536dfe96f558614a65cfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616691, "uuid": "3f5091f0-71b4-42fc-9765-805a01f9106b", "comment": "Malware payload (Mirai)", "value": "d158751efae8f9d15c9e28931fc631b0a7e88190", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616691, "uuid": "7979caa3-b81a-46af-a1ba-0f799652b9a9", "comment": "Malware payload (Mirai)", "value": "b8746451759ddde672bf4d773c10a5300f71708effe8075ac432791563256cd056131f0c00b711809bdad0552f232f2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616691, "uuid": "c18664b3-4aac-4240-828d-23abd03f0f48", "value": "T1F9432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616691, "uuid": "e221e36c-159d-44d9-8b09-a9df3bb3637c", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFI8QKqgESnmC/xO+KpAw7:RqtmZPuutfbltZFBSJsBcfDSTFIABE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616691, "uuid": "afc806f1-bce6-4c6a-8787-53a6035205a0", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616691, "uuid": "5b054b52-7ac3-4517-a6bd-d8927e95454c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616691, "uuid": "897e4082-9e7c-427e-89ce-df1b24e6a6cf", "value": "14ad1890459296d10bd580a16a0fa51f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f91c29a-c904-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707673138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673138, "uuid": "f14c03cf-835f-4489-81e0-1b6067cac70c", "comment": "Malware payload (Mirai)", "value": "4105f2c2905284f128a6757b4cda86cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673138, "uuid": "961fa9b7-9567-463f-afdb-e73c69f8380c", "comment": "Malware payload (Mirai)", "value": "413f6ae2ea591c8aed836276fca58e2b1d0bcde3a49e77b5b754c21782fe0af1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673138, "uuid": "3db7e975-bcae-4e32-a081-720ed2edfbe1", "comment": "Malware payload (Mirai)", "value": "3f134913325aafa87a7b36e97f5e9e718a1610b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673138, "uuid": "59c4a6b6-b595-4b07-916b-f8e9448a849f", "comment": "Malware payload (Mirai)", "value": "e431d9c36fce28bebfeeb54e687d9669cb54e88f1c7264822b2f9e98c1f02823a590599cf6f3ea059d6329da99595eb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673138, "uuid": "372d1c45-2384-4770-8d8c-649b099df95b", "value": "T1C45301C264C96C6169A00C33913D315772CB0BF9F19BB62B0A06DB601DA6D0C3A5FDE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673138, "uuid": "57bd2145-253e-464d-ae0b-8c2bf300d7ac", "value": "1536:9/ogOs93N6BkMaELdLqo+8ASRRaEtyb3iGXI/afibh5nS+E:9/h9d6KMaENh9eEty54/afibXnlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707673138, "uuid": "6a55dd25-4c11-4792-be66-a921432610c8", "value": 61068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707673138, "uuid": "900ec966-aa7b-42d3-8744-bd2789aa2ed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673138, "uuid": "ceb746a3-6668-4b22-8d20-7fc6ea93da10", "value": "4105f2c2905284f128a6757b4cda86cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9e2ef1-c880-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707616359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616359, "uuid": "9796ad21-4e41-4bd3-b381-9c6cc0f2713c", "comment": "Malware payload (Mirai)", "value": "25b45e1e13f713332fe92e612d69d238", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616359, "uuid": "ff0ef150-9e7b-4e7f-8a34-fe4291eff287", "comment": "Malware payload (Mirai)", "value": "42dd610a3e9fca006a064121c62d6eae2eee7b0b7e04681f7fb8b4213bad151a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616359, "uuid": "56f6dc3e-8f88-4f5b-9faf-a5e1aa6a46ce", "comment": "Malware payload (Mirai)", "value": "2060373293de6cea938dde05f620d71b2ea8daa8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616359, "uuid": "964e70ab-0aee-446f-884d-054f32f03a63", "comment": "Malware payload (Mirai)", "value": "fc0f36e88203b92c491d3c4666fd14dbc63badc1b09e9a4398463241fd99cb33469fe35ee65bbc4883318789b90a1907", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616359, "uuid": "2d5e58eb-6bec-44a5-8a59-5293b9bbe6fe", "value": "T1CF630A96B8818E26C5D5037EF92D118E371227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616359, "uuid": "09f33941-cb12-44fe-9078-eb2581f3e822", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjzXr57uscvIGiojd70k7h:VqVMkWV8PPU9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616359, "uuid": "84fe9c30-3e32-4a1d-a397-3f66cf297ef3", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616359, "uuid": "c8645df6-8b23-4950-8833-6b86c9774814", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616359, "uuid": "c43ced1f-c5a4-4716-991d-c1f022dc5829", "value": "25b45e1e13f713332fe92e612d69d238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30495d40-c879-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707613332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613332, "uuid": "afbabfe4-d815-4516-903c-ccedac917367", "comment": "Malware payload (Mirai)", "value": "4f5e314239b307b72c44e8234c2d28e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613332, "uuid": "d62d4d0c-60af-4a96-930c-ed07c59a867c", "comment": "Malware payload (Mirai)", "value": "43ced1ac1918563d283c3247ab293fa3f3171af5eb646ecd3657efaeb83938d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613332, "uuid": "7c4e2bf0-2f29-44c5-afe5-276e4aaa0239", "comment": "Malware payload (Mirai)", "value": "a9bbd69879233b8f624e248a68a68250137e7f14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613332, "uuid": "97ac05fb-607d-4b37-bd52-10e32264e922", "comment": "Malware payload (Mirai)", "value": "39a646409636ac87dfc202831d98e8647b4a840fe2c436207b04da089de3ef8e652fda32b75aab0b9f939834bbcd239e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613332, "uuid": "0faaa598-fcc9-48d2-9f16-957aa92d7b95", "value": "T1DD634B02B31C0947D5635EF4393F2BE083AEEA9121E4F685755EEB868271E331586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613332, "uuid": "9c90b547-e892-40a7-b6eb-265b8f80500f", "value": "1536:qUOnxYgLpEfwwjEvZh0P/X4g7StlZwImwfiOcJCsj:d2dV9wwhh0X2vZwIHf5yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707613332, "uuid": "a099f641-29fa-4321-a068-b111f6b35eb9", "value": 72752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707613332, "uuid": "dff75fe4-3ad6-4d1e-95b0-194892cd409b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613332, "uuid": "390117e5-4755-4bd7-ac5e-52636b4763f2", "value": "4f5e314239b307b72c44e8234c2d28e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b561c0-c8c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707644749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644749, "uuid": "e356a63a-58b9-4860-88cb-3e3666ce0294", "comment": "Malware payload (Mirai)", "value": "33a7200b412c7a2f9c4cd33f020a6921", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644749, "uuid": "991a96d4-a446-4c2d-8759-763b9102205c", "comment": "Malware payload (Mirai)", "value": "46e7c6388f27886a5a3571d6ba7e36d1e1ff4eb04d06a94d1c22f80b6dec56a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644749, "uuid": "6524b3ce-377c-41d6-b238-6f89abb184b0", "comment": "Malware payload (Mirai)", "value": "17af121a0ae5dfa81570d0b4e8ee0a934e5f0b9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644749, "uuid": "0f1b406f-d267-43fb-9f5c-86d3a09b0600", "comment": "Malware payload (Mirai)", "value": "72376bac706818c2799aaa216785997606aff41637cb306066328afa33fb852ff45eea49fa3c789728b74929b1c1ddf8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707644749, "uuid": "8c458a29-b63f-4817-a47d-b2e72d6a931b", "value": "T193436CD4E643D8F5D80B1AB1113AF7375E31F1F92218EA93D364EA32BC53641E546A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707644749, "uuid": "e9cab54a-0bd7-4344-a4a4-1a2127a935e8", "value": "1536:uITW3WsRUK1ZgQohZGyS8cX7wGF5TTSlay:uIK3lRUK1ZgH/GySdXUaTUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707644749, "uuid": "e8115002-2ec9-4326-86d4-cba77e463d56", "value": 55504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707644749, "uuid": "f949f656-4ca0-44cf-822a-7233a284ab3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707644749, "uuid": "b4fe1be2-b87f-49a5-a167-b5e38ffe0b23", "value": "33a7200b412c7a2f9c4cd33f020a6921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a80787d-c8a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707630475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630475, "uuid": "0c783878-92eb-4f93-a452-6945d7c97a60", "comment": "Malware payload (Gafgyt)", "value": "79a6ff1e2df681a1c498e3f4f52613a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630475, "uuid": "7e27b55d-5557-4c53-a7de-18a71291c7d9", "comment": "Malware payload (Gafgyt)", "value": "47097f443abd95ac7cd0c192703cea14740a8c62e9b78243403c8b742ba4a60c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630475, "uuid": "531d0c22-ff4e-43ee-aaa2-111855c79ddf", "comment": "Malware payload (Gafgyt)", "value": "8d61c86701edeb0cad547403c197a3be9770ac9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630475, "uuid": "4e030892-3371-4029-a12a-22a95dddb4c4", "comment": "Malware payload (Gafgyt)", "value": "ed511e9a73cab67e55d80da161feee8bdaf52d4031c6bdd58eed2496022f682723dfc7d61202f7a3548a803658f4aa03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630475, "uuid": "bae85b7c-980b-4675-8cea-571d28526d86", "value": "T12543F2204467AEB0C2F10439AF68098AAF166EDC9697377532DC625C7EC228BDD659C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630475, "uuid": "1a962278-9fc4-4616-b843-491a0becdceb", "value": "1536:n5XlHj3rEZwUFGcpm1nTszF25itPQNiUlVMX:ZlbroZpm1YRZiuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630475, "uuid": "1f3d2c67-7002-4646-b572-2ba340ad2668", "value": 57196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630475, "uuid": "84d678f8-ca63-4299-bf54-3b017d91bc2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630475, "uuid": "b47c3ce7-a1e2-4a5d-8cf1-abc80e2f9757", "value": "79a6ff1e2df681a1c498e3f4f52613a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b40f44-c8dc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707655809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655809, "uuid": "ac3519a7-d6e3-4851-a166-479b0f6a2579", "comment": "Malware payload (Mirai)", "value": "f4f479e0b955e4b6b6f67c7932c8a370", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655809, "uuid": "75b3a1a9-ad7f-4220-837d-b8b53294fca3", "comment": "Malware payload (Mirai)", "value": "4790e1b213160ce03c9e005b378cf265d41ac5761855130eadc345639521c9c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655809, "uuid": "82d98bf6-7906-4fed-8874-e5dfcb81834c", "comment": "Malware payload (Mirai)", "value": "30842686c0678a96ee07f8747662e0c1d0700ea3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655809, "uuid": "5fbef196-c6fc-4d1e-97e6-603b0fcd4e78", "comment": "Malware payload (Mirai)", "value": "d31de60afc096ba9718859a325be01403a2eebb38afc141516724cf7c5ddac99fb2161d196e50c237c9db0fe2688993b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707655809, "uuid": "4ebe1a5d-4ed3-41d8-bcb6-6988f56e8d24", "value": "T1B4533A51B8819613C5D4137BF5BE428D3B2523E8E2DF3217AD222F513B8A82F1D67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707655809, "uuid": "bb5f6ff5-ff9c-416b-8e14-58184d3b4fe0", "value": "768:lniaia+vgGqxsOvlG/idybxA3fUBAVz0/SE9Bz62ocNMsaz+SychwJZY10UPZvBO:sai5v+tkRFgfUBez0/SoBJY6zJa10oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707655809, "uuid": "3f531540-ac6b-49e0-964b-16a3176b59e7", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707655809, "uuid": "59f4651b-4a4f-4047-9007-56b0831cc31e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707655809, "uuid": "f58a8d86-fab0-4f23-a05e-c96927c3e8ab", "value": "uYtea.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c881a3-c907-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707674417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707674417, "uuid": "d4d98e57-5548-4b4b-b371-dfca0684e35d", "comment": "Malware payload", "value": "1eef11e912ec086f8c9ce16257eb8bcc", "object_relation": "md5", "Tag": [ { "name": "pw-SoF$T3!!$2", "colour": "#0E0F1D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707674417, "uuid": "82ccc2c6-cfbd-47e0-a4c3-1d9370d7ab78", "comment": "Malware payload", "value": "47c93f0a295867a3140de9e1fd3bfeccdd02fb3bbc82b93ee7e3f8a759f585ab", "object_relation": "sha256", "Tag": [ { "name": "pw-SoF$T3!!$2", "colour": "#0E0F1D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707674417, "uuid": "37a1731e-031a-4366-bb58-6bf32f440995", "comment": "Malware payload", "value": "c2f48718abcfc2d7dc9cf64e669a8a86238d3e67", "object_relation": "sha1", "Tag": [ { "name": "pw-SoF$T3!!$2", "colour": "#0E0F1D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707674417, "uuid": "df2c15ae-5280-48ff-8407-594d9e5ec33e", "comment": "Malware payload", "value": "c82b2e2087a17047117563762e8e08158e3933aebd410daaa9a112c00f09f2fae23136be5c9cb4c88bc22f283ec75433", "object_relation": "sha3-384", "Tag": [ { "name": "pw-SoF$T3!!$2", "colour": "#0E0F1D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707674417, "uuid": "68834c74-34f2-4f7d-9e22-030340a2781e", "value": "T1908633E8562F40190940272A4F576BCF15178488BB600199AD97613A9CFDED3F3AE7FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707674417, "uuid": "994c0bc3-1012-400b-902e-fbc01def248a", "value": "196608:r3VQq12Ro+k2LcM6L7f9+mzWKhKSw901hyNcEIi+je0ydUp7/:rDoy+k2Jcf9+NqHyNcEIi+CSp7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707674417, "uuid": "2e21cf74-bdbd-4188-a5b6-c8a751547d33", "value": 8299694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707674417, "uuid": "6c7441c3-592d-4a71-8ecd-e495ed4cb2a6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707674417, "uuid": "38abe2a9-f653-402c-b81c-576e70da6ddd", "value": "Application65c9095380496.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd9bff9-c905-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707673454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673454, "uuid": "15c396d5-bd43-497f-b9c3-39ff39d7138e", "comment": "Malware payload (Mirai)", "value": "7604f9ccf0e615206f77f7438646c31d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673454, "uuid": "4b91c43c-cab7-4bcb-b099-87492335a96d", "comment": "Malware payload (Mirai)", "value": "48cd7492ee4b71bc4203dc06c6ed5e9b452fdee662ce21e6633ff07d4255fa72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673454, "uuid": "934c3be4-ed53-4ede-bf5d-085150344d2d", "comment": "Malware payload (Mirai)", "value": "a60064e5bb7906a1ff70882d8465b23ccf76552b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673454, "uuid": "a1172f1f-c4cb-4290-a717-48e5ac225a1a", "comment": "Malware payload (Mirai)", "value": "1c9004135a7aa74b35edda1f5a6d94afbde409ae45ed5792494636947c994d13db0013fce38fab8f4c8e01d66ef184e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673454, "uuid": "1c9c63b4-c462-45d8-a9b7-85352004d8c9", "value": "T161F2E161E90102B0C5E18C714BFD0A2573B70452B04BB4B767EC95AEBADF4D54FE291E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673454, "uuid": "f3cec910-f058-45de-ac8c-9edc19df309b", "value": "768:t/AX49kYDJ9GPnoAr9ttMW4UwTK/8nVxr1xQdTIVRR7o3UC:GPno+CWcjn31xImRR7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707673454, "uuid": "271a73cf-1f0d-4273-a8ce-fa5d39253d50", "value": 34536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707673454, "uuid": "e52d5f41-739c-4c53-94fe-253f807ab806", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673454, "uuid": "b8aea928-7b61-4068-9ce4-47165c1ce811", "value": "7604f9ccf0e615206f77f7438646c31d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdf4666-c894-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707625035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625035, "uuid": "161660d4-f694-4df1-b6e2-b81f34a2277c", "comment": "Malware payload (Mirai)", "value": "2ec1acbdeb24bcb69a981fbcaa99f798", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625035, "uuid": "523a4c65-cf1a-4bab-b1b1-5e20de6da603", "comment": "Malware payload (Mirai)", "value": "4969aa8bc22ddb92c0b45cea512e676d658aca806a11bbd13e6781853b8efae8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625035, "uuid": "6dced53f-a83a-407d-84e6-d3839853a733", "comment": "Malware payload (Mirai)", "value": "724e73ac85928cce62c1ab4bd543e6ddccdd36e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625035, "uuid": "93e3d824-c161-446e-b3d5-286e53e88c4e", "comment": "Malware payload (Mirai)", "value": "1fb7d65dc83ae072f14910be7138009b82b18d31a42b883fa6eb9dac7700883e8a384d1fe0fd4e3686217b4e2aabd1de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625035, "uuid": "656f1aec-9fce-467c-8eee-ea6a385541f3", "value": "T12DB2CF31649ABF72C2B0493795A8C9C3F2921FB8C17D702784648B64FADB49987F5283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625035, "uuid": "bfe08d67-e378-4206-8a9e-58a87ccbf7ea", "value": "384:DeJDmQsE1Jl6oFM4o8fus2vbVFgLaXsSWYeaMazjfUUH9hymdGUop5h5p:E3J5GTjYLa8Hxacys3Uoznp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707625035, "uuid": "109fb1b5-4d5e-4730-a858-07576950ed94", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707625035, "uuid": "ad35d822-a9e2-4bc6-a1d9-a34c60242de5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625035, "uuid": "54b3f4b4-4af0-484f-ab53-45659e0f5cd8", "value": "2ec1acbdeb24bcb69a981fbcaa99f798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4da5c2-c8d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707650852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650852, "uuid": "10f37cbb-d5af-43ae-9771-319d125ebabd", "comment": "Malware payload (Mirai)", "value": "2a1fc685ee5155a8b725bb0a58c8f1e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650852, "uuid": "bd1aa3a3-16a4-497f-b615-b4227e4deba1", "comment": "Malware payload (Mirai)", "value": "4a063926e67d1ad0e860c289f952bad41c90053659f38cf4e10bef10c4b9c2cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650852, "uuid": "5e3a3f4a-b8e5-4ee3-9b7a-0c60251bb821", "comment": "Malware payload (Mirai)", "value": "516e3b281d661a83ba52969ba5fa4be984d45f5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650852, "uuid": "6e08c5f8-04e8-46f1-b80d-875911b333eb", "comment": "Malware payload (Mirai)", "value": "52defec2817cdc91da9f899f105f8a61bc3aba78412dcade9d12b555fa23b14b24ea1397533b2c0725fbe392d9e6cf5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650852, "uuid": "4213cb43-1075-48ef-87a9-4181f70f1d41", "value": "T1BB312E9862D09EFCCC9491BEAD56031173789F80E0C733A3820C7715BD2AE7C9C27086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650852, "uuid": "5f4d9ac9-146b-4df4-89c5-da2f93cb54c0", "value": "24:lpKGpa7Urz/jlfdbcOXK1hUVev3gRGaJ9iMPBBuk2nlxrR+zHGS90t:/KGpa7UrLZ2/+JpBukulxrsHGS90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650852, "uuid": "4d5dc7a5-140a-4a9d-8963-8afd50ed4ddb", "value": 1448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650852, "uuid": "7d2f47ca-fabd-4a0f-b595-d3f422aaf212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650852, "uuid": "0ead7c8a-0dee-4543-b0d2-c131410b8e5f", "value": "2a1fc685ee5155a8b725bb0a58c8f1e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c9fee5-c880-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707616354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616354, "uuid": "14ca609d-deae-4540-ac0f-e523381cca3b", "comment": "Malware payload (Mirai)", "value": "31643b0eccbd70017c0b7edb1c05872a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616354, "uuid": "383363e8-7daa-417d-81e4-344b4e74aef7", "comment": "Malware payload (Mirai)", "value": "4b136566cb6678a3975fd121727033015f942be917d5b575cd6ca4ba0180813c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616354, "uuid": "c76574f0-b158-41a9-b299-9f40c494e21d", "comment": "Malware payload (Mirai)", "value": "1e59d6122d5fe61e6b7f45f146310761d9f81bf9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616354, "uuid": "44fce24c-308e-460c-aa95-a0f95111a8c8", "comment": "Malware payload (Mirai)", "value": "f0f867a004d4f3ec78d60929afe4ceaa7da52b29ec60605045f84c9b52c14d9228090e1abf55cb858e85574f0120bc07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616354, "uuid": "b0cd214a-de37-4c7f-b81a-cad0be5fe097", "value": "T14E330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616354, "uuid": "f9d30987-8c0e-43c8-842d-194dcac2a0c4", "value": "768:gduPBFnHooqR8qOCKq2+H4/te+TK806MMUVjzkfQXObHud2oGP:r/hqaJCeteqK806MHdkfQX6HuCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616354, "uuid": "708dc918-26bf-477a-9e97-42c4bbf50d92", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616354, "uuid": "72e45a7a-b0bd-4291-83e2-71824b38e9d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616354, "uuid": "b6398a2b-09d5-446e-8d6f-cd64899c9cf6", "value": "31643b0eccbd70017c0b7edb1c05872a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d7dfda-c8f7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707667426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707667426, "uuid": "d4a5be3a-45ed-4641-a96b-9259e7830dd6", "comment": "Malware payload", "value": "43745c33b1aab908429cf0d6b6f6c4c6", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707667426, "uuid": "bca2cc5b-177b-4191-995c-43b77451b43a", "comment": "Malware payload", "value": "4b6847c9595e439b9d9cff4c134964afa3ca0baad0374ad286ca6b5594a17ef2", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707667426, "uuid": "3929856a-cc4a-4ecd-b023-76099a2c3fe0", "comment": "Malware payload", "value": "d723322235dcafc5f2c3c2010ba19cbd72a15a89", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707667426, "uuid": "d7f14364-c55f-47d0-8a5a-a60a0dd64d62", "comment": "Malware payload", "value": "0e91da5eecf5e758684ce1a683f53e659fa153ea002777ef5cc5c8f429d41e2aae9f5e2a1abf0fe8c39309713c51f002", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707667426, "uuid": "82c5a16a-34c2-469f-bf3f-47f678ce6363", "value": "T14035234839452BC7C87826B89E66C2C92937FD108F5AA00B360DB39E7A737C51F5C4E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707667426, "uuid": "d86dd951-a3fe-4708-82a4-a318e52e9bb2", "value": "24576:Ailuac1/s3p83Pixd6RcidzAntmlJiFaDctLEDJ8masRzrPqRyMEj8:ub1/s3u3PixdBidzbSFaQidayz+RBEj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707667426, "uuid": "5081e779-2675-41e1-ae20-2b2628e29123", "value": 1123319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707667426, "uuid": "5a27a757-633f-4836-abf6-44c2caa26590", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707667426, "uuid": "00af3489-3f1c-4b50-a02a-fe7acc053540", "value": "43745c33b1aab908429cf0d6b6f6c4c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a047b0-c8e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707658897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658897, "uuid": "877e848e-f943-46fd-be1d-9dc4e141c575", "comment": "Malware payload (Mirai)", "value": "44aeec807e32fa9201352c24d67bd244", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658897, "uuid": "6f6fc511-abf7-4d2b-a01c-845f3b09a53e", "comment": "Malware payload (Mirai)", "value": "4bc2fa88cc1f01a1e7bbbe7dba8ab7f38de81a55059c77e9e85a308a6c8d3a2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658897, "uuid": "ee4c18c3-f69c-4e26-9d78-ca2532b2e076", "comment": "Malware payload (Mirai)", "value": "e7b4b2210bf69cca079235ebdcca56d4a03aabfe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658897, "uuid": "fc90f664-b355-4063-886d-510d28c3cd96", "comment": "Malware payload (Mirai)", "value": "0371c5a2987e2a2c4fcc83d3c075a9b42f4ad5538e1a7b8b9cd3b09d2c086f85f8f6075a12d01e1e28dce322ff474467", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658897, "uuid": "7b2de2bf-8424-4300-914e-b2fe0b5699e4", "value": "T1CC438EB4E42A9D54D0850174A8B48F750FA3F2C883621DF73BAA46B1540BEB9F60DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658897, "uuid": "297c6336-52fc-4aae-8cc9-74d06c95e80e", "value": "768:f3Dm+BLr3pN3b3xMmWQZ7YnYhJ2wGQDmhMOfqA1eCHo1Y4dbC2WwJZY10U:bm+JDpP/Z7VrGQDpA1eb1dbC2PJa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658897, "uuid": "a7db0507-f4e6-47d2-a9f4-05a498f9487d", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658897, "uuid": "b806bafe-2aea-4725-b67c-6d8667278b91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658897, "uuid": "83d9110c-e9d8-4b02-a7de-1da1f111a8ad", "value": "44aeec807e32fa9201352c24d67bd244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca98942-c917-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707681347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681347, "uuid": "d684ad37-ff9c-4841-a6b9-91964eca56c4", "comment": "Malware payload", "value": "70235a2e970484ea1260cc299f11084b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681347, "uuid": "612ab417-428e-42bd-96b7-2b14f9932b85", "comment": "Malware payload", "value": "4cb52b2b795e0c64fab3030908328c56f41fad623531e393a41646f470a4caea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681347, "uuid": "f798dcaa-9bd8-490b-9a02-f29d6b2a757e", "comment": "Malware payload", "value": "e6e19c53364241c4c5477ad8e42d303b4ce2e4d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681347, "uuid": "412b02c5-b6a2-4935-bea4-ae66ce2be7fb", "comment": "Malware payload", "value": "2a9468db0d5a4ef6322cda2fad0ffe9b94a12a7618235f9bfc55c81e4f95e54fd9069900835d15ea97b18e22be4ed58d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681347, "uuid": "843e5d25-b751-458b-8364-1b980755784b", "value": "T133F71316F341A1AFC837C2B29D391C10FA319D9686179153B02B36EDAEFD8C2DF12695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681347, "uuid": "b1904ba4-53d6-46a1-841c-3a9880a0e39d", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681347, "uuid": "74517a3c-ec5b-4629-9abd-92d53a262b25", "value": "786432:b+jLAJNIndudu80sv1vJ1HoA5AKF7zR/t6tKF+iSpl5gtD8Ko2d:ij0JNmHPs9VAMzttZmpl+twId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707681347, "uuid": "c715d0f2-29be-4454-b833-ad408364042c", "value": 71230976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707681347, "uuid": "61eb7107-1350-40e2-a8e6-ef9f53a46df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681347, "uuid": "978a5a22-4378-4732-a8ff-4114409d75f7", "value": "CraxsRat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863db891-c8d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707650842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650842, "uuid": "6d2c065b-d106-48f0-8d1b-344d147304c2", "comment": "Malware payload", "value": "2b1b848bd9f4dcaf1aa1a6d504a63ad6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650842, "uuid": "52dea0bf-45f8-4eaa-b011-1b8d31cd353b", "comment": "Malware payload", "value": "4d715f1ffecb020297fa7f6d4ea5420933abb6abce3db8dd7b179aa852b9029d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650842, "uuid": "c1dd40e0-e8bd-48d4-8cfe-068de879dd86", "comment": "Malware payload", "value": "9746bf8f1d5cb225f93c1659f3c8a58ad94d0647", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650842, "uuid": "552bec4a-d536-423c-9c75-ca9e58322c7a", "comment": "Malware payload", "value": "a04dfb64ad942e8f99dce93343355a6a02474709fda4ff1af6437cb7206b04f253b1c4d62b399a76d3f8105b0e3cfbd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650842, "uuid": "1d02c1e5-e912-4e80-b340-6c511f61b7a9", "value": "T133211400F2190C13E6D13D7073371B60ABBA8F03161D56089B9FE799D8B8C315A4E89C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650842, "uuid": "82775f0d-34f1-4f83-bbd0-b5fd52076f7b", "value": "24:3KopWS9nSWZ6S4/KSwISBd6oTKP5tAFl9CqzktqJAvy5gaaTo0YibZ6VF:wgZVbXGABXz2qKvy5gl/ZKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650842, "uuid": "b0336432-2bb9-4648-8ce3-27f680d4524a", "value": 1400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650842, "uuid": "53be673c-0f4f-4111-8422-dda03a59cb03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650842, "uuid": "d3372fad-81e2-4278-bdff-c363084a857e", "value": "2b1b848bd9f4dcaf1aa1a6d504a63ad6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342caff7-c905-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707673468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673468, "uuid": "1bf0998a-dec8-46d1-a498-c2de8f23ea2e", "comment": "Malware payload (Mirai)", "value": "9cdf2206ee405503b15d767b985a2a83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673468, "uuid": "adc45ba2-74e4-41f0-b13b-8a26a2799cd3", "comment": "Malware payload (Mirai)", "value": "4e33c605b5718be7229c98b0a5f8737a607d87b6f7e8fbac3ccfddf7a0c750c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673468, "uuid": "12f569ec-6d82-4378-816d-cde6c00a4439", "comment": "Malware payload (Mirai)", "value": "0e723d1bfe77479d514cacc1caaa84e6e45d45ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673468, "uuid": "43c6991f-9162-4d74-b728-284e330dc90f", "comment": "Malware payload (Mirai)", "value": "02b6239aa941065a33b22c3a06e5a6632ee941c0c9d7ab6b2849f3208d5ebb8a35062b0ed2c1396b2159dab2386f3395", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673468, "uuid": "d017e55c-c7f1-4009-aa05-4dc59f4105de", "value": "T105735CDAF800DD7CFC4EEA7A88130A0AB571736106930F36639BFD67AD721A41926E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673468, "uuid": "e53f7b9c-b758-4ff0-8aca-b0d188f63ddf", "value": "1536:jiLE90Q7gz91Bj8L4Y6O8hzyuMrgguJqayV+n8qginYV3SwX:jiLE1kBH9Y6RyuMrFVm8nGwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707673468, "uuid": "c310ec19-5b9b-44fb-8201-f6f35f410017", "value": 80672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707673468, "uuid": "163c5760-3e60-4564-a66c-7f32e1151800", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673468, "uuid": "fed53c51-f8cf-4996-8bad-75a6d947ace2", "value": "9cdf2206ee405503b15d767b985a2a83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062805e8-c899-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707627005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707627005, "uuid": "8cf8e74a-9d6c-4f3e-bdc9-12216839d547", "comment": "Malware payload (Mirai)", "value": "72babfca52ee78fb2ab3a7b1b326970e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707627005, "uuid": "217f1473-394a-4d88-922d-47ef570d3c1a", "comment": "Malware payload (Mirai)", "value": "4ffeb4b3473d4260056d9299ad19d5b589907e6b219608523699022888ebd761", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707627005, "uuid": "4c540ee9-077d-4128-a0b5-4d523f26e968", "comment": "Malware payload (Mirai)", "value": "58993713cdaa38d5faa0e059a8ad36299846827c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707627005, "uuid": "2c70a709-684c-4375-b109-c842025347e8", "comment": "Malware payload (Mirai)", "value": "699efea0ae669c06cb6d54506de856724352c5f30f1ca5df159315d1fa8a4718b00bc750c5ac442e562a7e994d400f25", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707627005, "uuid": "aa9750ae-d96f-478f-a4cc-1d667d51d028", "value": "T147230895BDC19A06CAD417BBFA0F82CD3B16639CE2DE7303DD252F51379A52B0A6B011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707627005, "uuid": "4073673b-54fa-40fd-aae8-3cf6a61f0c1c", "value": "768:MvPT5GSzhkunudh3BI5AUT/rg32vbwLrHJtCBovtrhpVkNqBT4RZGz:CNNjAAr3c3vCBarhbAq9cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707627005, "uuid": "66a3c1bc-0b38-4d87-a346-1bd116a906df", "value": 48912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707627005, "uuid": "714538e5-a7f1-4c23-b848-ea75cec409e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707627005, "uuid": "bc31a6d7-c717-4e72-af50-fb6d391a5e13", "value": "la.bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93b8909-c8a7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1707633318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707633318, "uuid": "f5e84203-4d5c-428c-8818-65798f4cabb7", "comment": "Malware payload (AsyncRAT)", "value": "a46741ec2864a2c9c7cfe6afa5f38873", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707633318, "uuid": "2c4db320-9e41-41da-9ce4-c65b3857b276", "comment": "Malware payload (AsyncRAT)", "value": "50a16971e1979b9fedd35969fb3e0658480d2d18139a935d065f76c002c8a961", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707633318, "uuid": "7caaaea2-c96c-4c14-a90d-54929d491def", "comment": "Malware payload (AsyncRAT)", "value": "58019aaf83bb12c84e5df67b01bfb3295006c3ae", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707633318, "uuid": "05706b23-d82a-4d77-b4d4-0514813b5c7b", "comment": "Malware payload (AsyncRAT)", "value": "78595c142447ad8087ee34afabfbc92d8ada2a94be59c458d77d5da8086c79598c960eb04c58ada59e9fcf18a85ebedb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707633318, "uuid": "0f502764-dc97-45e8-bebb-bd3c797798fb", "value": "T120233B103BE98136E6FE9F786CF16146877AF6632503D54E3CC801D65B13BCACA126E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707633318, "uuid": "bfaf1dd2-34a7-487b-84fa-92e714c22f2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707633318, "uuid": "971f8092-ca9c-464d-a828-18198c669f77", "value": "768:IeI6b/GoWoGX8ye91Vstjb0gxh5tdd3EvMCPEJAAuYDDG62tYcFmVc6K:IwGsYlbbxryvnAtDG6KmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707633318, "uuid": "e5b66f97-3f51-4de2-8557-07aba8a13d8b", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707633318, "uuid": "89a83292-ece4-4ddd-9e21-7dcd58075125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707633318, "uuid": "d704957b-4b99-406d-8056-7d68636b0e86", "value": "a46741ec2864a2c9c7cfe6afa5f38873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46228a1c-c880-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707616375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616375, "uuid": "1b7c80b3-3842-44a8-b43b-860122139967", "comment": "Malware payload (Mirai)", "value": "0fc8c7a5e447bb9e35232577405f9c5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616375, "uuid": "d8a7da8d-15d6-49cd-9720-55960b83f972", "comment": "Malware payload (Mirai)", "value": "51e4042e5fcb9a4b996be9ac4ee026543bfe41d031d138ffea7a0647a22b626b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616375, "uuid": "260ce260-3243-494a-9131-a68a88970765", "comment": "Malware payload (Mirai)", "value": "5a97d3797b8a267c7afbb6fdf59e445d3c720bc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616375, "uuid": "fdaaafa5-d002-4a2c-97d8-5dcbe095afad", "comment": "Malware payload (Mirai)", "value": "19ab80029faa184a2a177cd3a0d00e84759edea1652e73c903f16f7e6e778364e85c53370d4eb8eb2a2dcd32af1b5929", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616375, "uuid": "ae81110f-64c3-44ba-bd73-2b55c754acba", "value": "T15F73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616375, "uuid": "64f0e067-8a18-47be-9323-631e4e9af916", "value": "1536:zJPEBmW5iNWqcGTewnXHZ84OqdZerEStl:zJPEB8NWq9Dqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616375, "uuid": "baca6902-ed13-4706-8302-a660c7fab482", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616375, "uuid": "80eec758-90fc-44e3-8e12-6f53e6ec78fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616375, "uuid": "8071d190-cc88-4131-b4e2-20b8d1c57fa7", "value": "0fc8c7a5e447bb9e35232577405f9c5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a30aa3-c890-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707623404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707623404, "uuid": "dfb9910e-6bf0-4d69-81e4-d2faaa760204", "comment": "Malware payload (Mirai)", "value": "f05b860934440dece44e2455532da0b6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707623404, "uuid": "20a88165-96d7-4207-898a-8cd42c39473f", "comment": "Malware payload (Mirai)", "value": "5296fa9b91530b071d6fe620bf674a841090213a7f60f1ec936274cd8e2fb0a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707623404, "uuid": "d231bf91-25b5-4a4d-8616-8be8a34a5c9d", "comment": "Malware payload (Mirai)", "value": "411acf18ce8b72865e458281a376c5e186ffdd2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707623404, "uuid": "12722676-c5cd-4a09-bf7b-14a415be5ea8", "comment": "Malware payload (Mirai)", "value": "a324360c435b1c3d350305baa1245fd43bec22a256338892d3149858365ee106397d8317f227cf443f656b6ce50435d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707623404, "uuid": "c06c4822-fe8b-4116-ac54-83c8cec67b51", "value": "T158C2D1A285FBC617C86343B919281A6351641C94D70DDE2D272BDE9C53C88E32ABBC93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707623404, "uuid": "617b0ba0-669d-4b11-a8f7-6428d908d3eb", "value": "768:X5+Kcrb9VDJef5Q2PdHuzb8HoEPbRpvrV:0lrb9vehrpEOoEfzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707623404, "uuid": "4c43574e-52ce-4188-a807-5aaf190e51b6", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707623404, "uuid": "99893e73-24e8-4118-8b6a-45d1fc7c9baf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707623404, "uuid": "afda0282-f352-401c-8073-c27e7524f79b", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053675e3-c899-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707627003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707627003, "uuid": "f5046321-d176-4a12-9f25-59c77c0fe48d", "comment": "Malware payload (Mirai)", "value": "25242faa9a866789e8bf0b6610286a41", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707627003, "uuid": "b34ca857-f78a-495b-88f0-733ad8ac2305", "comment": "Malware payload (Mirai)", "value": "53deedcc375335665302254a3c350db57cc3609f586e9e828200074b589ae626", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707627003, "uuid": "aefeff4f-f2e7-49d7-aad5-dbd694521d9c", "comment": "Malware payload (Mirai)", "value": "6f400414c0c45d0577f6cf8e2540168641f78f49", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707627003, "uuid": "931f7ead-08ea-44cc-b177-ab469e79f5d9", "comment": "Malware payload (Mirai)", "value": "74e6ecbd010bc86fd9de628eacebb8c7de20cfb4d0f9f1c3f4cb4b45c2f32bef4126152b77706f1c9d9195dc44c51bbd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707627003, "uuid": "f01b9caa-d97b-4255-b2e2-a0ab00d11700", "value": "T1A463075AF9819F11D5D526BEFE0E418D335367ACE3EE7102DE206B2467CA91B0B7B402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707627003, "uuid": "3a845959-72b0-49c9-84ac-29b663be755e", "value": "1536:Qjn4Tb2ST0BzhNR42u3t7AArYgZwdBGglD9l+9i5Sea6AU2:3HfT0BzhEC2YgZwdBGLmSeavU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707627003, "uuid": "fab86025-42c2-463f-aa2a-822be034a788", "value": 73164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707627003, "uuid": "fe7e9456-9386-4d18-a3bc-bde3114d3203", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707627003, "uuid": "7eaf5e45-2cf7-4cc6-97ae-f0943a9d4b8b", "value": "la.bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8926d72b-c8d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707650847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650847, "uuid": "e3b6c3ee-ba9f-4128-91ca-6e428e5692f9", "comment": "Malware payload (Mirai)", "value": "19be43fae61d4176124508ac3348e9c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650847, "uuid": "63d2c5d2-9722-4d2a-a275-7e0c6b1a43f1", "comment": "Malware payload (Mirai)", "value": "541a17e03d27eecf10e0ade2849b86ae55c0da0e9fb4d937ec984ff55aa161de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650847, "uuid": "0b94b8c9-0933-4ce1-aeb8-b58dbfe77e41", "comment": "Malware payload (Mirai)", "value": "afa8bfa69315920b4faaf55c25aae6a7bf42e8a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650847, "uuid": "c2be41cb-06e7-46e2-9b82-32be9d72d4db", "comment": "Malware payload (Mirai)", "value": "60cfbe839dd9e45f99f535d1a41272521fb417f9155e0da6a91249b5d7e538aa64406c5b2a69236a0483cd31d662eba4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650847, "uuid": "d5b4bd03-206c-420d-9b43-620ffca040e6", "value": "T1CE219E9A67D36D17CC440277DCDF5724F362AE84869EF513E32226250C2F20A5F2214A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650847, "uuid": "74091ffd-3ae6-4885-8f93-327f78c9e13d", "value": "24:JYolMlgP9qD0at6EocGn6rUlFSy4PzLCkIddgHiGIvndNfc7:JYolMOFqDPtVrkFSy4PzLTiGI/dNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650847, "uuid": "56e29552-8291-42c6-addb-cc565e373149", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650847, "uuid": "c438d79d-02d7-4a74-93fa-001fed12ba61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650847, "uuid": "9caec932-60b9-4293-84a4-5289478ccbf7", "value": "19be43fae61d4176124508ac3348e9c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3beddfee-c8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707658448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658448, "uuid": "a1222310-179b-4988-a722-fe595bb69f4c", "comment": "Malware payload", "value": "45fd9224d365376207bc0d6a562cf39e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658448, "uuid": "5abd5e49-6548-4376-bba0-1ce8d0b37432", "comment": "Malware payload", "value": "54bb4aad5fef1e32777c2165a0ca9a7920d9029b7fbbe3886e06932a8db21675", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658448, "uuid": "b5d4b975-a2cf-4bf4-81f8-789d8dcce13b", "comment": "Malware payload", "value": "4454eb8eed1b6a0c15873b60bbf8dd09dcb10e6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658448, "uuid": "c364deae-4366-487d-97ba-a2dc11bac53b", "comment": "Malware payload", "value": "dbc5918d6d9691f2aa61fa7bfdebe13557645d7aba67e135e377d18016f83ca3d92ad71ecd881e639daceb3e81342824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658448, "uuid": "41cc4d99-6ccd-460e-9f1b-b8a4be8fffe4", "value": "T1B494014923ECA610F1BF88B9CCF692544773F28BA971D64E0E8581CA1D33FC18D95B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658448, "uuid": "6076b43f-15e9-4fd9-8ff3-e1c4ce1d34e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658448, "uuid": "303d08ce-0cc9-43a3-a22c-a7f1f7060512", "value": "6144:wjfeAkLUmv95G6HzHtZmIYEaWBx36V0JQQQma6QszRUQzUKyerReCVrK/EtbSbI+:wjfnkjv26TNZmFq36+xa6QS1tR8Iyn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658448, "uuid": "697d11fe-84d0-41fa-830d-03f089eddd06", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658448, "uuid": "818f6122-881a-4874-a73c-a26e30717ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658448, "uuid": "7cc61f06-e840-421d-bb91-869fea4a8390", "value": "SecuriteInfo.com.FileRepMalware.19939.11594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1df6587-c8cf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707650459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650459, "uuid": "dc0fdcef-806d-41fd-8b03-b3dc09bc0421", "comment": "Malware payload (Mirai)", "value": "ea5cf7a73f681494564096fc1fddc7b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650459, "uuid": "47a51109-69ae-4ee4-8bea-8f5e26dd69a0", "comment": "Malware payload (Mirai)", "value": "555afccb7cad333ac3c085917def9e738d2d7b7b9f9ad602ec5028bca7da31bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650459, "uuid": "ef9f68b7-d266-4986-9797-d1fcc041b320", "comment": "Malware payload (Mirai)", "value": "e2f5e3962778c58270dd56fbcc76fa33c28c0830", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650459, "uuid": "b8ef44ee-a7d9-4254-9a45-4a54422f9de2", "comment": "Malware payload (Mirai)", "value": "7ceebed1fc392fde9b58b47a48a6fadfadac0ab0f437a58ebffd10a7fdd0ad179987aeb0abca7224b8f5f6493a795a33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650459, "uuid": "130a017b-09c4-4034-9b13-bda6f1af90f0", "value": "T1A72102A7E2D4EC32D72200FA6286EF5723A5CD916056FF0B8A511801DD3A6C4C133238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650459, "uuid": "1d150330-b25f-4a3a-b56d-c4dc1651bae5", "value": "24:FlqMoJFHxgxEmceZGQleZ3eLjBeTvd1wyGues9O7UruQQBVNfRh:fqxL+coGQlo3eLjBeTFxqss7IHQPN5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650459, "uuid": "9022fd93-62cd-48ca-b0ed-12bad8ff122e", "value": 1180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650459, "uuid": "90425582-385c-4f21-88eb-1873eb126bd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650459, "uuid": "09ce4c07-4d64-4d27-97f3-4423a0afad7e", "value": "ea5cf7a73f681494564096fc1fddc7b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2ea129-c894-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707625030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625030, "uuid": "5abff0e2-b26b-448d-a07c-d35a97445a6e", "comment": "Malware payload (Mirai)", "value": "67d4762072bd903758979388993fe640", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625030, "uuid": "3e403d9e-6779-42e6-9ebc-154d57b98663", "comment": "Malware payload (Mirai)", "value": "5589040002679b653c050618043f060046a7610d191f9518c00713090328239d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625030, "uuid": "0194296f-8a49-4de2-b4a8-baa922f4c0ca", "comment": "Malware payload (Mirai)", "value": "c1b745b91435521c97a73b177fd1da5b33aa6749", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625030, "uuid": "fcabe5dd-6196-40b7-8075-30a64eb7794b", "comment": "Malware payload (Mirai)", "value": "e9978f635536cedc5ca256b33c81e379263061b6b35bc8223517f941f9d4476693ef1d561e7aa7732a7d973daac054a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625030, "uuid": "3d07429b-bc06-4f18-8e4d-fc8cf9bc3846", "value": "T1F9E2E165F2A63BE1C42B4BB9AC15450DE3165AFCE0FFB137257C40B8A8E34471D6A883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625030, "uuid": "dbc4370d-abc5-491c-a163-86ea8e9c7201", "value": "768:ErVGn7Vgx8RhDIWZFwLwRqfVh2gVw4V8mGbXj6Ii7ev9q3UELj3:ErVG8A5dFUYGwSCbX+IifLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707625030, "uuid": "96c25bb5-11f4-4a26-8a0d-7ea030143164", "value": 31860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707625030, "uuid": "0cb3d9ae-1b2c-4b20-ab10-76e8c2cc938f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625030, "uuid": "f7045231-84e1-4481-b806-274f3d722033", "value": "67d4762072bd903758979388993fe640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3fd041-c8f4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1707666343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666343, "uuid": "c51a5829-0851-4949-8a8e-dbc18e83dfe0", "comment": "Malware payload (Adware.Generic)", "value": "fbb68fce0e10a0e69a0c16a39d836ab7", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666343, "uuid": "9a769d8f-0222-4edf-845c-ed62849981b3", "comment": "Malware payload (Adware.Generic)", "value": "56bf95929669594f422adc443a9591b0ef88f019d73d27fcb33a74d9a28ebe32", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666343, "uuid": "d73c3268-3617-4cf9-ac51-4ac2f0513b1a", "comment": "Malware payload (Adware.Generic)", "value": "57089d81a8daae0cdf008363e4a2301ef2b4494f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666343, "uuid": "10697f79-f37f-4698-8dd8-72c43863c313", "comment": "Malware payload (Adware.Generic)", "value": "8fedd100a8b508a0ed1256c0dc83f8d21c5e1edd9ef3a42fc83a84b9cae92c96802dd607c924ac5b52f514c24a969e32", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666343, "uuid": "f0ca38e7-9bf4-43c8-bb94-befd87bce527", "value": "T196B5F127B298B53EC46A27350673A01058FBB6ADF417BE1676F4C48CCF665C00E3BA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666343, "uuid": "19aa271c-6ceb-4422-9f58-a46532e2ee79", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666343, "uuid": "9b184d25-b140-41d9-9b61-9fa24a84bb18", "value": "49152:dcW4f2vtz4gp4az+LGfRRGGDBZBnubAm4lLnBNZHQZFNSkD:dX49vcDGMBZBt5JHcvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707666343, "uuid": "16daa319-6b4b-4ff5-8da3-fe8d51f998d0", "value": 2481544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707666343, "uuid": "6fc0fa1d-78d3-4f18-9754-6aeab6017cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666343, "uuid": "43233c32-44db-4bb3-9c04-5ef01b4043b4", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.PH.gen.Eldorado.26891.22803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d84c732-c8e1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707658022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658022, "uuid": "0e9e494d-34f0-4e13-9dac-adc6502bf3f5", "comment": "Malware payload (AgentTesla)", "value": "9c1dbd904a8ef4ea3b9e780215d4b5cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658022, "uuid": "a7a2f21c-ddf0-4419-8d9d-912fac28b3ca", "comment": "Malware payload (AgentTesla)", "value": "579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658022, "uuid": "59146efc-8e71-46e2-bd10-e4951b4eb52b", "comment": "Malware payload (AgentTesla)", "value": "525e03b33d5b9796c76ae2428448acfea3a66525", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658022, "uuid": "6f479126-3382-4244-91fd-5912f18c0bab", "comment": "Malware payload (AgentTesla)", "value": "ab6a5b6c11fc0da23c947b4a9d161e9af3ad76f9faf52fe3fbeec8baf353eadd2d28d9727bb31d8dee45747c87cef758", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658022, "uuid": "ec35fae7-d424-4438-8140-00f176181305", "value": "T1F6D423243A3DB757CA0A43F26435A0205335E60ABAB1F6DDCE7691E90E67B148CE1E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658022, "uuid": "3d1497f3-a803-44db-93f5-5a0d428bb5dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658022, "uuid": "a37b938c-a06e-4856-854c-c595f1415439", "value": "12288:MOL+xEd66WXUAoFHDPdzxFdyrxbHsa0X0K85My2FHybNIZFlICgBcPA:fCxcvWXvoFjPdzx+bx/eyiANIj7NPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658022, "uuid": "1f8fbfcd-40f0-4fef-8003-c1f62b24f8a5", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658022, "uuid": "e1106073-555b-4319-8a19-ff1b15289ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658022, "uuid": "b73188d8-98ba-4e6c-86d6-9aa4dbb98ffa", "value": "K07WatpNMxZ8XuP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4afc3ca-c890-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707623405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707623405, "uuid": "d2b7ed34-bdd6-48b2-9b76-09ba16ede60d", "comment": "Malware payload (Mirai)", "value": "82a3d72fb6f455f391f7e901ada76b64", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707623405, "uuid": "bae1a1c3-c71d-4bf8-8ccb-dfa1d11a1913", "comment": "Malware payload (Mirai)", "value": "587dd23a080ae7d3cd982a7c63be090d33855e09e5c940b6e9fb34706787486d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707623405, "uuid": "5c975a1b-60d2-4fa7-9f11-10c9fda39dd4", "comment": "Malware payload (Mirai)", "value": "56b50f6ffd01822084f40c62a51d6d2e98d11a64", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707623405, "uuid": "180ace79-7acf-4134-a36d-f3af1c80f347", "comment": "Malware payload (Mirai)", "value": "e76da887a43d6365293a15dc18714e618e3523c06e67fa113a0ca0fe2ba012295fffd05f2185f6bae66f5cd78ad3d911", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707623405, "uuid": "805d9823-6822-4a61-9ecb-7d1dad6b524a", "value": "T10C33F1A393E75B73FA381C72FC9C470D7205A3B41956711137B85B38ADC4922A8E6787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707623405, "uuid": "c182c5a4-46bb-4be2-993b-4d426c7f6943", "value": "1536:QmXN2ECSR/nchXL7XcfWi7xfWMLmZz4vPCAtP/EK:QQNHCSR/ct7Xcp7xDLmNOnEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707623405, "uuid": "1784593b-3db8-4d38-9d4e-a8ccbda22ac8", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707623405, "uuid": "8d4b8b5f-196f-4a59-9bc5-f803a2925896", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707623405, "uuid": "02b27060-c5b3-408e-8716-cdcaa89a41b4", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa9e204-c90a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707675822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675822, "uuid": "df8c5a6c-9ed5-4f32-9aee-4716a37ba268", "comment": "Malware payload (DCRat)", "value": "3cac4651ce934a43d65392a7e829a7fd", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675822, "uuid": "70bcf5cb-9b4c-4764-a681-5777d9945393", "comment": "Malware payload (DCRat)", "value": "58f720c7664a0eea1e99b9293dffba1d45930a1ace26ba296ae81f461d5953d1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675822, "uuid": "e377e189-dc64-4cab-9630-12c4c6d26330", "comment": "Malware payload (DCRat)", "value": "b4c714c4706e707ffa1169f1f2b3544a609aa81c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675822, "uuid": "3423c0c5-b4ad-48c7-b662-f9e985733e49", "comment": "Malware payload (DCRat)", "value": "e8f29f1ee70d8c17266443c38c7bfe75af74b070c128921b8253c22fd7ee60083c035ed7963fb805903f5f5df623eaca", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675822, "uuid": "443ba17f-d2fc-4d5d-83fd-cd4902b1f063", "value": "T15D36AB243CFB505DA173FE926FDCB9EADD9EF6622509746A1041030B8B12E80EE5397D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675822, "uuid": "87df1afd-0092-4278-9535-c7b4bd586cb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675822, "uuid": "6e2ee767-ff24-485d-8963-2293681e1a39", "value": "49152:bf9ADg4ioiWuWekjXIKC38hje8XhDA4FYb+Ecv/6:yi3WulBKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707675822, "uuid": "5908cb7d-d19b-45db-8851-9487ce967343", "value": 5015552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707675822, "uuid": "e716e146-973d-441b-a2fe-c049a1c162f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675822, "uuid": "612c1699-f6cf-42c9-92e8-2e7c8c2a196b", "value": "SecuriteInfo.com.Trojan.TR.Dropper.Gen2.28812.6709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40998292-c8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707658456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658456, "uuid": "7f982dbe-f636-4e53-baab-88de397afa02", "comment": "Malware payload", "value": "06a0d001d0c0b7495467568eb151a3f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658456, "uuid": "315a4565-0372-4593-b334-eebbd0a972ea", "comment": "Malware payload", "value": "59f959b1e69f988171152f99eb636f9b360712234457072f78c1c08d41e1460e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658456, "uuid": "b72d4444-e8a8-4f24-81da-9f708129b0e0", "comment": "Malware payload", "value": "7e73743099310d72d9c2099b68e7b05681b49a23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658456, "uuid": "2da46239-6eaf-44a2-a810-0c03fe205fd3", "comment": "Malware payload", "value": "0de854d7afdb6fd66f7cf13ce11dbb61473e43a4d95011d6603f048b59b5cd534ece23724e4bf1ed0026d9cd6d11a424", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658456, "uuid": "eecada21-45fa-41a1-85e7-163ee49c0968", "value": "T1CB124047A2D0CE3FC8D9533844A7122472B794BEDF629713064815B63F427E81E2EB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658456, "uuid": "eb77c513-c9d2-4c36-ac4c-85bdb467126f", "value": "192:GqnWWHJZMWT1Ym/EhrsnurfjTr8sbnsl:5WWB1Ym/E8Oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658456, "uuid": "63c160e6-4410-4461-8964-c014ac44b0f4", "value": 9800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658456, "uuid": "2a3195c2-64ef-461d-87f6-3530782caeae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658456, "uuid": "744d31a4-15f5-4ae4-b62c-2e93268fb6d8", "value": "SecuriteInfo.com.Trojan.Linux.Generic.333676.1357.20776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f61e48d-c8e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707658884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658884, "uuid": "f89fa8ea-6cc6-47c4-b10d-01f9cae79066", "comment": "Malware payload (Mirai)", "value": "1769b7ed58164d8dd13855cd0aeb0982", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658884, "uuid": "884e1e27-fbca-4fa3-afbc-fb2b279e457b", "comment": "Malware payload (Mirai)", "value": "5a288dcf1f2ec638a7076ea4f1df225f2889f40e04e31d3720f044ce480b67a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658884, "uuid": "7d834f6f-293b-40f5-bec9-0b380634fda7", "comment": "Malware payload (Mirai)", "value": "3475225cc8644624bcf151b05b8bb8f8bff887e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658884, "uuid": "1457bc6f-5fb7-43ea-a821-b83f5d099032", "comment": "Malware payload (Mirai)", "value": "faa5042b6b1796986593051b9d70a0fd1c5bfbcb326fe67f770718f340e9187af938c00b4ac6fa44729b57d029a0ac88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658884, "uuid": "89537852-4054-4f5c-a0ce-666471004d3f", "value": "T1E773F819BF610F77EC6BCC370AA92B0529CC954B22E57B367934C528B60B61B19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658884, "uuid": "259b1501-33f0-479d-96dd-cdcfd0db5070", "value": "1536:7J5dbFB4x92nKoIPa98M26ofWU+UZ9CYXzdJa10N:7J5dxBu9uKoeIUXd4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658884, "uuid": "288a2dd0-a3d6-4ba6-84e4-db7e05ee2cfb", "value": 77320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658884, "uuid": "dd8ea68e-48dc-44b5-84f6-11cb0588a198", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658884, "uuid": "47760a0f-5100-44bf-9cd3-d1e5e09f22a4", "value": "1769b7ed58164d8dd13855cd0aeb0982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ca69fd-c8a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707630527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630527, "uuid": "de15b854-c46d-49e5-a1f6-39225b5489ad", "comment": "Malware payload (RedLineStealer)", "value": "70ac96d1219c3f70b75ffeb5becc1b87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630527, "uuid": "9a9a6922-f8d4-44e8-a9c7-54f02621b4b8", "comment": "Malware payload (RedLineStealer)", "value": "5c26e89aec6aa01ff423ead562a010de523565035992b4b6675747b69ac2e6ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630527, "uuid": "47153990-769c-44c0-91f5-925a6771fb23", "comment": "Malware payload (RedLineStealer)", "value": "a24fef4b70d971c3b23888c3cba62689b851b38d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630527, "uuid": "9a5d5d5b-0729-475f-9975-6c015ebfc3f3", "comment": "Malware payload (RedLineStealer)", "value": "d984bbd972d5d1c69570892489733d628396996e0c686888cdc43437c055128490973179cf85d8c7b9344a1c73ffa113", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630527, "uuid": "96376931-801a-41a0-a415-2afadf7721a4", "value": "T1FFA401257590C1B3C5B3113001E6CB3A9E2970621BAAA6D7B7DD17BA6F113E1B3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630527, "uuid": "4e3353a1-c656-474b-b52d-ad0694ce4503", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630527, "uuid": "63020647-9b70-46f0-8c3a-285b20c15556", "value": "12288:Bh1Fk70TnvjcqvZOKvxwYWprwZXYJvnIPRz3LbiF:jk70TrcUZB5XwrwZmnYz3/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630527, "uuid": "f23c0044-4754-42bb-87a0-355600ad78f8", "value": 484832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630527, "uuid": "ea831a80-9c91-4f2d-8c8c-c7c27981e3ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630527, "uuid": "98e6da4a-fe4e-4408-a2b1-e21ecd88d886", "value": "70ac96d1219c3f70b75ffeb5becc1b87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccb6b23-c879-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707613353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613353, "uuid": "f7b5cb34-ec88-43da-b895-e11f51ed4823", "comment": "Malware payload (Mirai)", "value": "529194bd21fa377aa4bd877730a7cd57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613353, "uuid": "87ca26a7-5c79-4abc-8a75-7ccea9a748f6", "comment": "Malware payload (Mirai)", "value": "5d0f26e59fd45e756e1c129d6460e569baf984e9f74c5db2c51e575e9aa5528a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613353, "uuid": "98f44bfd-c826-41a7-8160-ac092b024ce1", "comment": "Malware payload (Mirai)", "value": "3019f2b9d1f403929f79286d86cf25455ed29108", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613353, "uuid": "9f487fec-f845-4faa-b24c-9a0a2d68af49", "comment": "Malware payload (Mirai)", "value": "90c80f87d749b2b6cd3117ddb6438f70be6e7e5a690cddd01eab576364d19b03bef1a80261eff1a47ed0461ffd752f72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613353, "uuid": "01dd43b7-654a-45d6-ba9b-126bd69ffa03", "value": "T11293C71E3E258FBDF7AA823847B74E21935833D626E1D285D19CDA005F7024E641FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613353, "uuid": "3416ed8c-318e-461d-a98d-3d8f39c723f1", "value": "1536:wDfgTU16+mV1ifTPrtAbcwSsCj0+NUlIOXcLw7NTSejFTXv1B:4gT26+msrtAbcd03XcLw7NTzTfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707613353, "uuid": "d7222ae5-f4b9-4d3d-83ee-ac1e3ee8f199", "value": 97332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707613353, "uuid": "1bde695b-6b7c-4134-8d54-ea8e7d6312cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613353, "uuid": "59c71278-4a7a-4f5c-987a-5e8694d80ccf", "value": "529194bd21fa377aa4bd877730a7cd57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e147608-c880-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707616388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616388, "uuid": "d7401b7b-55cf-41c9-a85b-093be663ded3", "comment": "Malware payload (Mirai)", "value": "a34a235408918919a60219983c361a21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616388, "uuid": "7c27225e-f409-423b-b216-bd79f0f6e690", "comment": "Malware payload (Mirai)", "value": "5e1d55aa380b6a0d274c380ca1b732e2b8e7595e996a32a2bb7b6a98163ecb41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616388, "uuid": "c0998521-29e3-4458-a56a-e98c1034776b", "comment": "Malware payload (Mirai)", "value": "4a61b29128740fd351db05b5b07bb4b99dc058f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616388, "uuid": "02e71ffb-c87d-407c-b280-e633d0c1cad0", "comment": "Malware payload (Mirai)", "value": "acce67b6a20958c8de32867a759168c023d90a9338c096f8ac1f584a688fa0f723ee5a6e8b3f12a6259de606a3122003", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616388, "uuid": "bde47397-4695-417c-bb57-339712676253", "value": "T1FA632A95BC819B13C5C422BBFB6E418D332663ACD2DE7207DD256F21778781B0E67A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616388, "uuid": "8e6205cb-cc1d-465a-9b8d-f5ed858cccbd", "value": "1536:eicHbFeTIaBh0Scu+t5oE9zgUuBlb/OltVpAwMfBY3mN:eicH2JAFbRcUuXCtMkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616388, "uuid": "51aab8ab-e703-40c2-85a5-021ef293357d", "value": 73240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616388, "uuid": "9b0db284-9e70-4c46-8e67-7883979cb0fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616388, "uuid": "eddc9026-834f-4623-be48-bbacac9c8fec", "value": "a34a235408918919a60219983c361a21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81701767-c8d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707650834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650834, "uuid": "c199ab3c-263d-4dfc-ac5a-8dacde91aac5", "comment": "Malware payload (Mirai)", "value": "374b1d8ba1815f657832726b68968492", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650834, "uuid": "7e27312e-0ed7-4891-85f3-6cc51d0818f4", "comment": "Malware payload (Mirai)", "value": "5e32a7ccd55a9ac1a8e04ce166d9494ec0a464a8fdd1e7d9c1cd24b6bab8ebf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650834, "uuid": "19504247-9252-4455-bbc4-c7308e05debf", "comment": "Malware payload (Mirai)", "value": "473d70a57b6621f6792b930c7037808fcc1ce8df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650834, "uuid": "07a92e18-309d-4139-bbad-d9ae98f17b4c", "comment": "Malware payload (Mirai)", "value": "20cbb49a170029f32dc4c70f04f7565d8ecbcf06899e39e9bf1df2337598c52d87a03b56d5b785ae36f88fbc515483c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650834, "uuid": "0cced10c-10ee-4fad-b661-b531e282599c", "value": "T1A2635C45EB87D5F0DD4209B0106BF73AA635AE361120EDABEB98FE63ED72612501335C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650834, "uuid": "9f37edee-ff13-4de8-8ec7-9621d2e22cae", "value": "1536:0R+IfURc65sc2mLSiFKy4oJWDGUX31s5Ugr:gHToSicsG+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650834, "uuid": "f1040977-dee5-4892-8c65-1c23668366bb", "value": 70628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650834, "uuid": "5477af65-b661-426d-ab6e-10eee23dfb0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650834, "uuid": "476db70d-e38b-4cd2-bec4-de40cc1fcfac", "value": "374b1d8ba1815f657832726b68968492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5cc306-c877-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707612605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707612605, "uuid": "feea63d5-53d4-4568-8f04-9aba58a550ae", "comment": "Malware payload (Mirai)", "value": "ddf30daabdd0bfe9cb608b50a1a1ee91", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707612605, "uuid": "2cbffafa-0f4a-4b2a-aa29-2f3b1fc78271", "comment": "Malware payload (Mirai)", "value": "5efa4754cbce01e25f419f8a217134b0885e55a850a94bbd23497ec270929629", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707612605, "uuid": "e6ef7522-29b3-496c-8085-f85acf80f8d3", "comment": "Malware payload (Mirai)", "value": "5c04bebbb91b419148ca5335acd68632ec5d32f1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707612605, "uuid": "f83ed924-e941-4ed2-94f0-5d2cab3efa34", "comment": "Malware payload (Mirai)", "value": "6c0bded076ecdd7c1439d6017b94af68fad9eab67948e412a5148fc208262d97c47c9c44f4fb7c5b8d303c2b964d2d8c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707612605, "uuid": "80cbe3c8-7e6c-4794-afa9-977bdada8531", "value": "T114935CC5F683D4F6EA5705B15137A7329733E43A602AEF42C329AD36DC62910DA1B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707612605, "uuid": "8edd9966-ec53-4973-9b1d-8921ecf46a7d", "value": "1536:WWmseUZNsbMU+ge96KwzwkuggIyB2PRf1SwRXXt:VOUZcMUVM5awbgSBu8wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707612605, "uuid": "91110505-1d05-4f95-b31b-054a2cfcd292", "value": 92108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707612605, "uuid": "87046f1b-3bce-431b-9efa-b332e4132890", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707612605, "uuid": "727e99e6-57f1-46f0-bb48-366fc2360951", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c541d32a-c8c4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707645794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645794, "uuid": "6be39be2-b1ec-4f75-a23a-0f3e5fef713c", "comment": "Malware payload (Mirai)", "value": "3db5de79977965c4cf2d7b9c28b0d7b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645794, "uuid": "2bfa425f-207c-460a-97af-55e1d99fdd40", "comment": "Malware payload (Mirai)", "value": "5f1e4e30a97a3e80200c9d08ddf18f75aa1be1ff95a7b87a99c1837edd66b8de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645794, "uuid": "8b914848-4026-4afa-989d-ea6b5b825ad6", "comment": "Malware payload (Mirai)", "value": "dd578ebc56b463f08aae21b9b380d7d04f5554ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645794, "uuid": "3ac216f1-4885-4d89-9db2-278dc75a997e", "comment": "Malware payload (Mirai)", "value": "266bf0af100e47735a8492a0c5c858d10dc8b21f485614373db0453947fdbd5a28f3a47d57cd0ad9677ab973999f07cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645794, "uuid": "1d25bd2a-e39a-4bcc-abd4-5a8750944192", "value": "T1AAC32A45FC508B13C6C652BBFB4E428D7B2A1758D3EE72039D256F61378B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645794, "uuid": "dda75167-9f3b-4b25-9fb6-37af3487c5d5", "value": "1536:JhtOKfEquXRFOAKBc4Va2/sTgdcFBTvqs2En4dFlzeXwywrFv7U8+5tlqGKKOt7b:Jh83hFOc4pkMdcFBT8K4mpUcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707645794, "uuid": "094e2c0f-8644-42e2-9fcf-f7db04a780fa", "value": 121600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707645794, "uuid": "f44fa736-5220-4f76-9941-5691ea2a1f95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645794, "uuid": "e72364a2-30cb-417e-8235-38ef6d4acfff", "value": "cundi.arm-20240211-1003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3383fad8-c902-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707672178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672178, "uuid": "8bebee0c-258b-4744-9bce-ce0001834016", "comment": "Malware payload", "value": "aeeaa35f90b74daf1a38d8bf37f81c00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672178, "uuid": "94a3535f-d5f8-47a6-84a3-31bdbb750403", "comment": "Malware payload", "value": "60055c49b41d5600739b773eb47a77120353426935fea55cbda0e88410d5640b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672178, "uuid": "68241c6e-bd32-47bb-9fe7-b8631bfcda86", "comment": "Malware payload", "value": "67e4c538d2a2fc5fdfaefd521273672d0d668cc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672178, "uuid": "e2378bf5-30d2-4c31-af7c-79379ec65faf", "comment": "Malware payload", "value": "f566ed2dd2f11aa677b2e071b419a7a4e6cd9fe247dc824557cd66c55026ef81d14f77aed8fe30e2f1307fd7ba472862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672178, "uuid": "6ace3c47-d2e7-4384-892e-8674abb36082", "value": "T1192723C139CF80F8D5C51A34861B26DF17F2A67A4984883CEAC57D87E952F73506ACA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672178, "uuid": "aaaac565-f7fb-4cf8-9f01-632a2aad3696", "value": "e57520caf747e339a21db5d3a9c3925c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672178, "uuid": "8641fdc5-0a23-48e5-996c-a2188c054e1b", "value": "393216:L4ZXhUAM9hTWLP6Gu/eUomS0P4jVs+MPXoz:0ZRgTWuEU1J+MP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707672178, "uuid": "f5ab1dce-40eb-4538-8bf8-b737de366a7c", "value": 20959525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707672178, "uuid": "097f545f-3a3f-4a77-953d-cea8d8be6a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672178, "uuid": "f377823f-4411-492f-9bff-88d2bf7cbe40", "value": "aeeaa35f90b74daf1a38d8bf37f81c00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59839815-c894-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707624997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707624997, "uuid": "c4bf1690-f8e2-44f6-8f1c-a4c941e5fb50", "comment": "Malware payload (Mirai)", "value": "f610c64df8b8b840e7cb2d85027930c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707624997, "uuid": "eb8b1c10-7712-466d-8a84-9d02820a7736", "comment": "Malware payload (Mirai)", "value": "60259373fe7413fffb93311c53ec0fd14c4586c69d4f187652c03e83e8968917", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707624997, "uuid": "46edf8f9-217f-4030-a01a-2dff06ecaddd", "comment": "Malware payload (Mirai)", "value": "68cfc254013a4f7492bd54305260afa3f8f4ed49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707624997, "uuid": "4baddc98-5319-47da-aa36-a4295b806636", "comment": "Malware payload (Mirai)", "value": "4b7f765314c872c9e2c7fe4b176bbe7fa648e7feabf50e61e8f1eb40841d5c54189791af1b61cc1da8ee13166133fa1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707624997, "uuid": "c6000a21-f920-4c11-b046-a67b07acf110", "value": "T193732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707624997, "uuid": "1952c3a9-3f66-49f5-9897-dc44e10c91f5", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WR:927jqCt8v3GI/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707624997, "uuid": "bf173d1f-7d20-4ab5-bf22-3a8c2f4f5927", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707624997, "uuid": "d0a40b37-7ea1-4e82-b599-ed03afabd95f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707624997, "uuid": "4aab5a8f-380b-420a-96a0-fd79e301c867", "value": "f610c64df8b8b840e7cb2d85027930c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2128c296-c901-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707671718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707671718, "uuid": "8f71470a-b128-4743-b3a4-16901b8f58be", "comment": "Malware payload", "value": "572b88eb24399ecb796a86dfe7f9fc59", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707671718, "uuid": "60fcb17a-1cd0-470b-b15d-4016175ca113", "comment": "Malware payload", "value": "61085e8dfb80e7de7fba6b83066253f6479fb81b4bbc0b4c4b18477c035bf92c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707671718, "uuid": "d67c7a3a-f3b2-4b0c-8e5e-589b5f671106", "comment": "Malware payload", "value": "65db9c2f7228b938744d25035de0db78af615c14", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707671718, "uuid": "1c48e691-469b-4007-a63a-d58ecb9b599d", "comment": "Malware payload", "value": "50493de84bc93f3370349841daa1737b3b64163f7ce18c2c2a23196c65a2d487d2b49974cb7857367cff3e1728e0d95e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707671718, "uuid": "40d9e4c8-9e16-495b-979a-204d319c7757", "value": "T14F41E10407E64B35E6B38D3A1865A723AE357909ED63AF1EC2A091588815500E975F2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707671718, "uuid": "a73ab7f3-2a78-46af-bb3f-e5d2e38c7e8d", "value": "24:8faQjmPBR1vm4pyAcPkb+/445ws4f2lEahavtttGrlcKOdm:8fawmpR9mujLf2lEtvilMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707671718, "uuid": "4ef774a9-a072-43fc-9686-9d615245ac10", "value": 2140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707671718, "uuid": "7cb88c77-6da9-4be4-987e-13169abc8bfa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707671718, "uuid": "6e6c0622-2cff-4aca-935b-2cb3bacaa51a", "value": "solaris-docs.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dff13b8-c8f4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707666344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666344, "uuid": "5efe9be0-9a30-40ef-9a42-7f5aee7cd2f1", "comment": "Malware payload", "value": "ff6a97f7237340437c36c597b1b4b4a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666344, "uuid": "a2176fd9-416a-41db-946a-97c95e0fd3d7", "comment": "Malware payload", "value": "630f154b816a6412a621ad2173738a6063a0b61a14375342879666fc97b43dcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666344, "uuid": "410df79b-e6ab-44ae-ae37-879505db1fb5", "comment": "Malware payload", "value": "d8332b167a813713507d12aa84d0c8156787b258", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666344, "uuid": "e98c21b6-0ee3-4320-affe-84ce6dad1088", "comment": "Malware payload", "value": "b55c324483d86d514308dff8edbc645a430a938e39199dcb73a8c4570eb6d7d847da86a102927c82d02edfd22e399211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666344, "uuid": "5cbba807-a44e-448d-9877-a756f858f8ca", "value": "T19DB5335A403CF7C0E2DF3E36E9A419967073F4D0255AC47E965DA3864F6FE88F08186A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666344, "uuid": "9fce61a3-2104-4712-a48b-6c450dc0c224", "value": "40e4cfefb5075673054f0d48c3eb4599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666344, "uuid": "e2230ed1-9e5b-4bcd-b4e3-5f5d32239661", "value": "49152:7PxJxCKDN29VzbJVACCQUv9OUsvpYCcRwj79MVqg78+rWv1+FTqSkPFqzybEluam:dCIeBEQUv9AqCh9Ml8Bv1+FqSkPFqzct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707666344, "uuid": "c2ac659e-0f27-48e0-b751-bb73b4f49226", "value": 2277888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707666344, "uuid": "495150ca-ff48-4ff8-b54f-b509398088cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666344, "uuid": "2fb3018f-3595-4700-b0da-5f52bf18c96e", "value": "SecuriteInfo.com.Win64.TrojanX-gen.27634.18047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1e91a4-c8bc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707642234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642234, "uuid": "b2a68414-4fb0-4259-946f-ad640ec59981", "comment": "Malware payload (Mirai)", "value": "30a853a57763c83d674411128ea5ac30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642234, "uuid": "b191032b-0fe8-4869-80b1-537d73227da5", "comment": "Malware payload (Mirai)", "value": "655c4311b9862626e26e81637b0b69baa1902d7ce9518544a37bdd773f35838d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642234, "uuid": "e74a32c2-7e84-4533-90b0-3f6bb5bb6d26", "comment": "Malware payload (Mirai)", "value": "a5de1e3434d578212d375c7bfe41cc4c394f1843", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642234, "uuid": "d7a9b9b5-176c-4ac6-be94-9aba00f5d98b", "comment": "Malware payload (Mirai)", "value": "713ec120d17c87024ef567c3a9c540c841d46fcb7f016e98c4dd143749af3d980b744ca85a1b157ef7a2683a35f439b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707642234, "uuid": "831bb177-6963-49b1-bad8-65a53a71d0a8", "value": "T155C37C76DC2A5F68C695D1B0B0B08F792B63B59042875FBA19B7C2B54083C8DF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707642234, "uuid": "00b61b49-f8cc-4252-b521-3d540f38938b", "value": "1536:Da60wP/HOD9ZegOaDc+CD0K/nHflnMgEsNqmKW/FRDIhbeyzs:D/P/oDTc+K7/VMgJjKWNRDaeQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707642234, "uuid": "f4269fa0-5cbd-428f-9541-5110f7c113a5", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707642234, "uuid": "e6006404-9877-4b71-9c82-b31d0328c616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707642234, "uuid": "e6cf33df-6d0c-401e-ae40-f10dfce4e6da", "value": "30a853a57763c83d674411128ea5ac30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c608807-c918-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707681803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681803, "uuid": "e71ea41a-aebb-4a5e-8a94-a3a765c525ca", "comment": "Malware payload", "value": "3e77b1ed858d1c34aacfcd4aa35256d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681803, "uuid": "efb99536-fdb3-47fd-bbb1-1acf64516104", "comment": "Malware payload", "value": "665e8285a745b44fe29bb105d604870d6bc212e0d04b91b706caa48684beee46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681803, "uuid": "61643376-e999-45c5-90da-42692b4de66f", "comment": "Malware payload", "value": "d3e359bcd5de5fdb4754e88a8db6e62686aafeab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681803, "uuid": "c9f977a8-c9c1-4fe3-ac24-2d2e074f63e3", "comment": "Malware payload", "value": "097ef90567e770d59b697a24e2084fecf433fff2313384e21ef9fcfd1cde6292dfb10b512f2eeae253a62856938e4f28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681803, "uuid": "983c3bb3-67e7-47a6-b6df-c6ad7fd25bed", "value": "T173E5A49D721172DFC867D472DEA85D68EA20787B831B8653D02716EDAE0D897CF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681803, "uuid": "50aaa37d-e154-4bd0-b430-1a3f7698c618", "value": "40dd968292929322479512a55bbfd207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681803, "uuid": "0f41a286-c456-4122-a3e8-1f465b9dbdb9", "value": "24576:3IHViVWF74PKDeIX4CUFp4ay7Pp0G+TtWSgGKzaBL93F8/s0AT8QGswi/Q7KTY39:4HG/A7xuTApD//JPswi/YiKlJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707681803, "uuid": "34852c52-ebe3-42d3-a56a-da2860428afe", "value": 3070964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707681803, "uuid": "c8c4e339-38aa-4baa-ada6-0f0f7920f963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681803, "uuid": "dce78f4a-4231-42c5-8a78-5abd5e7b8d22", "value": "CraxsRat03~Rip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b73c940-c8d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707650824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650824, "uuid": "e19362fc-8a2d-4190-a10a-f9d60c169892", "comment": "Malware payload (Mirai)", "value": "44eab4f0c05f9bea4f0e52eda8390e43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650824, "uuid": "7fb12228-0144-4bb8-81e5-cfa2d74053f9", "comment": "Malware payload (Mirai)", "value": "6839e55b89d821a5cfb128bcc6423c0073c948d15258191e1bc1ce82bc65f0ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650824, "uuid": "b2b32209-1fb5-47b5-bd2a-bb55acb558f5", "comment": "Malware payload (Mirai)", "value": "d2fa046b5a5b6147ee9142421fc70a332246dfbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650824, "uuid": "c8e3aa15-b76e-4774-a7f4-4f783a693e85", "comment": "Malware payload (Mirai)", "value": "a57ec2279ff954a18bcbe312028347ea145699d937be102624c3ade3b21a2451b9b56229a0308b583e1322b8dae5f45b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650824, "uuid": "963e04a4-4824-41fa-81aa-052b80521ded", "value": "T1DA41E28A1F715EF9F55AD53887370B3937AE524842C04249E1ACEA006EC534D89DF7D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650824, "uuid": "3535d599-db85-42b4-9e9f-902ade55d2c3", "value": "48:Oji5E4GYg2HzxHE1EgD/9LuEpExn3meBl:956WHzmTMEpEV3Vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650824, "uuid": "296a9e3d-03e4-4590-9e3b-0fc8f0d3635f", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650824, "uuid": "7d3e1c88-f2d6-473d-bf23-4c6fff85b0cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650824, "uuid": "cac3e0df-58be-4fdd-9b01-5cc19ed64045", "value": "44eab4f0c05f9bea4f0e52eda8390e43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ec593e-c902-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707672175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672175, "uuid": "5802a600-958c-4ff7-b381-c5b9ecfa0275", "comment": "Malware payload", "value": "6af9f1887e9b504de8bc454ce9e300ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672175, "uuid": "b2bb9d5b-bac5-42e9-8cec-4e0e09fd454d", "comment": "Malware payload", "value": "6a49bc0f7ed789aa6056b9fed086717493348d569df59a352454d598e8baeb57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672175, "uuid": "d5557f92-2d55-45bc-a49e-c28393f4ac7a", "comment": "Malware payload", "value": "66e81a72c07858fc15691a1fe417b14a8a21ce1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672175, "uuid": "4a93a2c3-129c-4432-83f2-adf7be13a746", "comment": "Malware payload", "value": "c03643742ecb2f270990a726b20c79450a6483e499612207cd07066db762b1b36cc52773a33626e06bd6560073b8a4e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672175, "uuid": "edfbe0e7-3d81-40f4-b609-e500c77ba0f9", "value": "T1BD2723C139CF80F8D5C51A14861B26DF17F2A67B4984883CFAC57D87E952FB2506ACA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672175, "uuid": "390c7d43-4ab9-4579-be4c-87aed2f1cebd", "value": "e57520caf747e339a21db5d3a9c3925c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672175, "uuid": "ed81d916-ef7a-4440-a58d-f007b0763d0b", "value": "393216:L4ZXhUAM9hTWLP6Gu/eUomS0P4jVs+MPXou:0ZRgTWuEU1J+MPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707672175, "uuid": "28c19635-0441-4a7c-87d1-5470eb376df2", "value": 20911026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707672175, "uuid": "77d4d425-cd41-4d28-ba07-74a3dd25d9e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672175, "uuid": "041c8003-9fcf-4c52-9da7-d35b0fa6984e", "value": "6af9f1887e9b504de8bc454ce9e300ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07c5ab1-c8cf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707650483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650483, "uuid": "71cb1bed-182a-4ee2-9802-bff2359c9ce2", "comment": "Malware payload (Mirai)", "value": "febc3c5e8a66df3dceb228a75b0af7cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650483, "uuid": "78ff22c8-703d-4b60-b312-86caff78f481", "comment": "Malware payload (Mirai)", "value": "6a75a895731f82107fce9ab4ea68b48393cfc023541e416b99069f22c326cbe0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650483, "uuid": "b60b183a-80f9-4e71-87d8-b15587a04782", "comment": "Malware payload (Mirai)", "value": "1be01008f1e782124870e38a6a9d301b23c756e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650483, "uuid": "e8f90144-03e2-4896-a96d-ad870f5bea9d", "comment": "Malware payload (Mirai)", "value": "01300ca13d9079eaf8535a1b78ee497e946d72987a2874753d5d189e748a2eef41c5d6487c877933055a4dd511cddf54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650483, "uuid": "4e278ded-3249-42db-bd80-b26d9720b3cd", "value": "T1EE6318C1F98B80F5E807493090A7F63FCB31D9694171DAAEDF49AE35EA67601921738C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650483, "uuid": "2360bcda-143a-4a1a-83ac-6d3277b74f63", "value": "1536:oFCLfIlpZ2TFPjS31resR2ukW/6xyT49mFvqKPCe:oFCLAlpcTFPjQ1rcKixyTOIvTPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650483, "uuid": "0d3bffa3-9573-45d1-99cf-7bca4c9fdd8a", "value": 68048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650483, "uuid": "4083168a-b5c0-4483-8427-12d0b04b3435", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650483, "uuid": "b4b15729-130d-4007-ba44-af42e1d233a8", "value": "febc3c5e8a66df3dceb228a75b0af7cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d808cd8-c8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707658451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658451, "uuid": "df59afa2-7535-468f-a9c3-3089042d032b", "comment": "Malware payload (AgentTesla)", "value": "cdea1ac7d7c1be95bd43ccbe4b9f0c94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658451, "uuid": "66ee306c-d3bf-4520-8943-9fe9ec5b7a23", "comment": "Malware payload (AgentTesla)", "value": "6bdd376a0f05f39fb60037fb1add006f9794805981d5aa3295551407bbf33bcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658451, "uuid": "eddf753b-1daf-4a11-8762-6570908bbf7a", "comment": "Malware payload (AgentTesla)", "value": "e2d0182c27dd07629e7a2d647241e548c6ceaa2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658451, "uuid": "1302a8df-99dc-41e6-9b5b-32c69bd3a97c", "comment": "Malware payload (AgentTesla)", "value": "674a7914f6e15ae304c8d9a901fc0ad33eccb054e50691a8862ebadf0bd018c5c9325988c3998d7d7f1b5ce5b3f13750", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658451, "uuid": "d2d28717-a601-4bdf-b785-4fb7ac017758", "value": "T1E0338D8C5BE5B26AF97F56B2456250058379B613BA03A38FA140E1350E337D2C947EF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658451, "uuid": "6165f466-84c2-41bb-89be-6f14f8c8e1f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658451, "uuid": "12aea6f3-abba-4b2b-9914-b1de3736240c", "value": "768:eLjmX0yEkLNeG5VoYrb6Vz0bjZ/o+CUhdhaj2DF5gcJEJYXfC5/PeBoume6Gbv4t:Ybyn91aEF5jVIHi3CrAbhi7KUtBHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658451, "uuid": "b7502fc2-f778-4157-af81-03113563a665", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658451, "uuid": "a3b78e6d-49df-45f2-8381-07cc00e9e7bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658451, "uuid": "19cc0eda-c070-42ac-baa1-bf3fb3d729c6", "value": "SecuriteInfo.com.FileRepMalware.23831.4620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5616de98-c903-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707672666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672666, "uuid": "b1c91e94-2265-4aef-a829-4471aca8ee49", "comment": "Malware payload", "value": "fa5609f36bc3fc02ddac994f5756f039", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672666, "uuid": "d46c9d45-5031-4ffa-b3d4-d3f0fd695312", "comment": "Malware payload", "value": "6c8b2d238fd8b62ad29fbd8dcf173953bedbdb2c54af554333b4ebaafc3631fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672666, "uuid": "9d02eda3-8e43-47cc-9180-9cf58d81ac87", "comment": "Malware payload", "value": "02186dc26562ed3558f0f7e7b4b77aecf3a93219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672666, "uuid": "ddef0db9-248c-4098-aba7-6e56f4fac2e2", "comment": "Malware payload", "value": "2479945b4423c59cc0fdf96fb30100bccb5870d2e3b7c6e3b56e27d0c7f1ecef2867883dd9c347aade5926f22d85e7fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672666, "uuid": "19ed59c2-2a11-4804-bcc2-330ff406e548", "value": "T117B57C5A22E400ACD0F6D179CF9B9517E6B234580331DBFF16D48AA61F27BF05A3AB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672666, "uuid": "33085105-dce1-4fa8-bb5f-2e766544a04f", "value": "4bdcdd1a8b738a6b15e86d19fc355a7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672666, "uuid": "9a7c7601-6e7a-4e49-8399-38ed933eb2b8", "value": "49152:kxn7xXTlWCQ5Ky40LKG6mCkZw1Z+Qz1HZTK8pvFxOE7UT0inC5:kg5JF6zz1HZTlz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707672666, "uuid": "e908b7ca-5f27-4b26-af3d-94c1edd1400b", "value": 2401280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707672666, "uuid": "76821442-f90f-4e11-8c36-34a55fae24d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672666, "uuid": "8c880522-410f-4f02-abcc-72aaa05d2763", "value": "SecuriteInfo.com.Variant.Lazy.476458.3283.21358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe3765b-c879-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707613304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613304, "uuid": "97393b84-b486-4f0d-b7c8-13ae350f5d46", "comment": "Malware payload (RiseProStealer)", "value": "376234ed7dd25232be87595323cf48a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613304, "uuid": "b66e47bc-286a-4b48-ad46-6f84d0ae653c", "comment": "Malware payload (RiseProStealer)", "value": "708bf4d2f784b9e25e1caece1f22232fabb32c47e1f9a132a0ec68ed099fd43e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613304, "uuid": "1e04ebbc-fa6b-407c-a689-8b0d22c30520", "comment": "Malware payload (RiseProStealer)", "value": "e7a613f538b2b85e6d9a622d921dd1c4d5955a47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613304, "uuid": "67e45441-015b-4bdf-97a3-aeafe539dc05", "comment": "Malware payload (RiseProStealer)", "value": "1d14d142e32b664521901c468be978e43e965c29eb2ac1f55fa64a23e6e509cd5b915f317bcbf46b39e7fd68fa69a74d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613304, "uuid": "3a722b41-4205-4b0e-8614-3fb124823144", "value": "T163B523CDAD858223D7507A3804C2FABD173EEC809E5490E66CECBF53B573E160A67859", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613304, "uuid": "a75ee70a-f228-4312-8681-ed5d99b3b565", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613304, "uuid": "2dcf7ae2-0600-404b-9881-f85b2b058b9a", "value": "49152:xkk1vD1U/BxhHl3jCSQ9I16lzJsYmWoweYn7jhf/sk:xl1vhU/BPJjCSD6v3oweY7jx/sk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707613304, "uuid": "bdcf5878-b350-4c85-be0d-7b8ab9590741", "value": 2382848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707613304, "uuid": "caf0f52a-c5aa-4408-85b4-2018aa74aac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613304, "uuid": "3578ed0c-d1be-413c-8cbb-66b550a88fef", "value": "376234ed7dd25232be87595323cf48a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c011a76-c879-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707613324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613324, "uuid": "af009f72-c1bc-419e-92de-c691297835fe", "comment": "Malware payload (Mirai)", "value": "b51d80b9fc70a14b209d6eab6da80118", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613324, "uuid": "a7da0354-d3ae-4dfd-9045-50d780dbe474", "comment": "Malware payload (Mirai)", "value": "70f2e6e24a55676bb3539e82173fa378393e20fcda607da29cecdebde6e813b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613324, "uuid": "7c3ce94b-d59b-4958-89fc-e006162b446b", "comment": "Malware payload (Mirai)", "value": "6226581299f2f1891612bd41e86115b3ebeee5da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613324, "uuid": "d17be60e-c270-4f42-bba1-82d280894188", "comment": "Malware payload (Mirai)", "value": "6ca8dca26669ab1917ebe6e51c24d448cceb4d4778bc374d63148c9e07576a941b0a2ea0810a76742a28320210e8432c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613324, "uuid": "06bd7557-1f45-427c-a2c8-479d8e15fc53", "value": "T1CF7339DAF800DD7CFC0EE77E8463050AB531A3654A930F37676BF963AD321A52926E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613324, "uuid": "e95edb26-75da-48a3-9014-3a3c6a8e8dc5", "value": "1536:dU3o04p82oq1QbJNDFN4yeX87vyKcrWG6mqygsCcqg+rkYHyTG:dU3iTZgJxEyeayKcrD6ggBcndTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707613324, "uuid": "753676f2-e0a3-4d15-a452-ac542b513ad7", "value": 80140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707613324, "uuid": "8fdc0066-78e3-4d46-84fa-a00914059057", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613324, "uuid": "4660d230-13f0-48f7-a1e1-ca8d6e6359d6", "value": "b51d80b9fc70a14b209d6eab6da80118", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a1ee15-c890-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707623407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707623407, "uuid": "83655aff-eef4-41ed-a658-e29e37412d4f", "comment": "Malware payload (Mirai)", "value": "d659cddf70f09d4ee94e610060674377", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707623407, "uuid": "8f9c9252-a506-4e22-8463-cc41489c4230", "comment": "Malware payload (Mirai)", "value": "71676632445b627ced92c42f14fab97e72158fc08b5f4490fb50792f1c20f820", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707623407, "uuid": "4db84aab-126a-49f9-928a-b5ba494a1ab9", "comment": "Malware payload (Mirai)", "value": "910cffa3fd135e54e9214ff5141c65207f7a194f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707623407, "uuid": "8b7f2223-d551-40aa-8c28-de2b6627b57f", "comment": "Malware payload (Mirai)", "value": "d68fe0a6801f32d4cb256004131aba3c0d7eaea8a0825f4313e802afb90586777203933ddc96deae82bdc99a9d1cd30f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707623407, "uuid": "18c7389a-6525-43e3-aaae-7d5c6edbcce8", "value": "T139C2F162F244E572D9716D3BF23DD55167AA5B28C6EC3310B1E041B07E04497F2B29CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707623407, "uuid": "2bbc92a3-8406-4fd2-af07-efcfc27b5fe6", "value": "768:wyE25TleI+cRA6Krc9NVy79uxOTs3Uozf:wyP5TJ+cRA6v5DxTzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707623407, "uuid": "ebe0de63-e70a-4a70-97f2-84bdda1b607d", "value": 27360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707623407, "uuid": "3d680871-7747-4e0c-94c8-97d109c39428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707623407, "uuid": "8409ce3e-f63d-449b-9908-4d7ae1f8baa3", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a8adc6-c8bc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707642243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642243, "uuid": "9aefba9b-4f45-4162-aa7c-88a999817f9a", "comment": "Malware payload (Mirai)", "value": "2a712272f4d9b3eab7420bf0e808a1c5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642243, "uuid": "8b586a4b-43aa-4a0b-ba1c-69a99c49aedb", "comment": "Malware payload (Mirai)", "value": "7215ff558e5a4c905c9c4afe64ed4b59a3d2e64b166b25c864cb6ba10ff320e4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642243, "uuid": "0ed6a6df-6daa-4690-8439-2ffd2820d09a", "comment": "Malware payload (Mirai)", "value": "7f7583fdb19d536c46eaebac7916c8933414e6ef", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707642243, "uuid": "4156a778-2d2a-48a7-99ca-5c940851b607", "comment": "Malware payload (Mirai)", "value": "d928eeb40e8650fddf097af01b98b67841f33f8e93a2d0c072f00a8c1890b7e0f3e3050ab399bdf06c7bc4f69727c431", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707642243, "uuid": "327516e0-0fce-4918-be11-f984614983b4", "value": "T15CE34A07B4C184FDC4DAC1B44B9FF53AED32B0AD1238B17B27D4AA222E59E215F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707642243, "uuid": "dcc8403b-6642-4553-944f-ca2b375c0b6e", "value": "3072:mTUTfCdO6FFtoqV68wKhc/t/ekNaogMewcgsK027u9OlR:mTUTfCdO6FFtoq+wwQdWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707642243, "uuid": "6b363d8a-5807-410e-82d9-0d074848427b", "value": 143832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707642243, "uuid": "3aef7a4d-b342-4779-8f13-6f04ed4f1dce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707642243, "uuid": "9910d1bf-d75d-4cb9-9513-eb25f2905439", "value": "2a712272f4d9b3eab7420bf0e808a1c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f044078c-c8e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707661328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707661328, "uuid": "bac97e88-23fd-46ac-9c66-33b66b72f21c", "comment": "Malware payload", "value": "32a580c05b4a6f26f12327f1fd4ce7ab", "object_relation": "md5", "Tag": [ { "name": "fake kaspersky premium (rat)", "colour": "#459524", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707661328, "uuid": "4cea6e27-236c-4953-84ec-6e29a145ae1d", "comment": "Malware payload", "value": "72a9b9315390d523045bd1a7578f2e60660e140e548b22185630b3f6f6449ce2", "object_relation": "sha256", "Tag": [ { "name": "fake kaspersky premium (rat)", "colour": "#459524", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707661328, "uuid": "cc92112f-e5ce-48b7-8628-1fec2b4f2c1e", "comment": "Malware payload", "value": "bb6d3fb2242af853329fafe2005e134b82d3e752", "object_relation": "sha1", "Tag": [ { "name": "fake kaspersky premium (rat)", "colour": "#459524", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707661328, "uuid": "b63cc649-5780-435c-ae68-e0639d90748b", "comment": "Malware payload", "value": "1f3dbc174ea2a8178fb7a9600cd03df5d9435e5f50e586de9d7cf656fd0631ad62b127eed2ffa170d1346109fab61832", "object_relation": "sha3-384", "Tag": [ { "name": "fake kaspersky premium (rat)", "colour": "#459524", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707661328, "uuid": "8b73415a-0f8d-4fab-a1b6-3e39e2b0ac15", "value": "T16416335BE0DF668C37339D5EB27130999F378AF84A6E6ADC0DCD02A1D6837A85781341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707661328, "uuid": "40849264-f9c3-432e-bed5-b261995d8fff", "value": "98304:dVHmedcZlN92E1Rip7DuUPllxitQR6WxKWlT4xCSYHvY2R9L9b9kj:5cPzj1RQD1PlfWWHcoRF9b9kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707661328, "uuid": "3751fb70-93dd-476e-ac85-ad51e2db26d8", "value": 4390878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707661328, "uuid": "ed930da0-4af1-4a05-9ab2-500aa8fb5ef8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707661328, "uuid": "f68b87e7-7d68-4100-9ba2-1836c60e21b7", "value": "KasperskySecurity.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf0a1b0-c914-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707680113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680113, "uuid": "ded76187-50e2-44c3-8b50-fbf4b4cf6918", "comment": "Malware payload (Mirai)", "value": "a0765da23f840228b4e8552e9f18a8cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680113, "uuid": "39e64461-e6ce-4b84-8e61-981c11667f17", "comment": "Malware payload (Mirai)", "value": "736fab2b29a2ec5a8ab65a01ae2cd9e2d554510913d27f4290d14599b8f49020", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680113, "uuid": "33c4c3ac-c989-4b93-aa63-645959a55ab9", "comment": "Malware payload (Mirai)", "value": "98e8aaaf310e4be65321da5cf1780dd3c79f7b6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680113, "uuid": "f68d88f4-34af-4ad7-b24c-38d2923bca76", "comment": "Malware payload (Mirai)", "value": "943e863a45f7807be95dd992ef9a92ab3d90e83cab0402a87e96362ebacda298a61172c456151869cb02b7fc434e99c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680113, "uuid": "ef8246da-3998-462f-a1d5-1167b59349bb", "value": "T118F2F14F31C91871CE2566BEBE6437D87ED248269A1EFA27293A0C933E3442797C0597", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680113, "uuid": "1a75b6e4-be1f-498c-9e21-664a093b34a2", "value": "768:d6/0+49LizimCLuPt7Xl4X3RYlbw9BD2RvuXJTkX3uW4KT:b+ii5yuPARYlbw9BDUv4hkX3uW4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707680113, "uuid": "fe4c59cc-e709-4792-9e69-504fab27fa0e", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707680113, "uuid": "2c978031-a7b4-4189-aadd-a15d2ed2e493", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680113, "uuid": "3b334ccf-6afb-4396-9b46-a181a630368b", "value": "SecuriteInfo.com.Linux.Siggen.9999.25598.26409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4bc07f-c877-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707612604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707612604, "uuid": "901828f1-aaf2-480b-96d0-3336801f7695", "comment": "Malware payload (Mirai)", "value": "d7d938d80ef9556ca4ed91f9c11e8565", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707612604, "uuid": "25ca987a-0b93-47a3-b481-c59a9babadba", "comment": "Malware payload (Mirai)", "value": "73e0488bf18996062aaa4e4f3fd31ac2c8761663a3f1a30b331b180abb3cd6b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707612604, "uuid": "1d930fb4-fde0-4d09-995b-00a32f20ac5b", "comment": "Malware payload (Mirai)", "value": "be9917e6e766c80e8edcb2df9928c23f9c11ed86", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707612604, "uuid": "83c76d3a-9f82-4f9a-8eba-e567a493e9da", "comment": "Malware payload (Mirai)", "value": "b08b94dd672e12c92bbaaf55b5461a9364a6a4b83d45b17e8de5f804152b686e1f4acc9af93c673a0d3fbe97ccc9525b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707612604, "uuid": "09c63e84-9c45-4382-91d6-a126899c228a", "value": "T105042A46EA404B13C0D62BBAFA9F424533239B54D7EB73059528AFB43F8779E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707612604, "uuid": "7fb6078a-038a-41d5-adb0-57f8a8401530", "value": "3072:lfm9wBnwyiKj6Xa1AQimt2NnvmA5gGzC+XPSorM/RTfmpFA:lfZnwB24a1AQimtkOAOGzC+fTrM/Rq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707612604, "uuid": "dc424df1-a4a2-4fc1-9f45-99d670d5d202", "value": 180479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707612604, "uuid": "8e715c06-76e4-49dd-b0b2-7943f453fd19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707612604, "uuid": "ff94c744-2e3b-44f3-b3dd-ade0c478a14c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399cd065-c8e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707658874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658874, "uuid": "9d046ddd-1742-418f-8d50-96f268391b8c", "comment": "Malware payload (Mirai)", "value": "cd6d0d53324fcdfa7b6cac00f90c2748", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658874, "uuid": "6e72a4e6-1fa2-4a40-9c83-da3d309846ac", "comment": "Malware payload (Mirai)", "value": "74b95ecfbde2430fa5961c377f80b26055a9ef28406c79314a2904a9abaaa781", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658874, "uuid": "848cfc63-4956-48af-8ddd-aca8cd364984", "comment": "Malware payload (Mirai)", "value": "b434085e3a9086996cad5db196c68fc80d4d1158", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658874, "uuid": "ecafdfc7-528a-409f-b342-d7f66d69f6c9", "comment": "Malware payload (Mirai)", "value": "a3f1e38dcf5ec3f52085a448ff039836f2cc248a260081dab615e5f0d47adf2fd5dd3aa2de09e372938b60718ca4a62b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658874, "uuid": "94d14052-56a9-4371-b09b-6ebec7f758cb", "value": "T182431917F94685FDC089C234177EBA3AE92331FE1229B26A67D4FB263DC6D611E09D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658874, "uuid": "2100ce10-7ad8-440f-822e-fca071f34163", "value": "1536:1XIY73si3qEToSRhINUQ/K6C8u50pfEHwNLW:2Y7H6ETRhIZ/Kn5qEHw1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658874, "uuid": "f06d0f2c-2a7f-49cd-a744-c7647e66690f", "value": 58480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658874, "uuid": "a48f94b4-9656-4672-b3fe-93b3dc62de3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658874, "uuid": "dff07089-622b-4f2f-bfc9-64c847f89970", "value": "cd6d0d53324fcdfa7b6cac00f90c2748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08fbcb4-c8f4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707666348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666348, "uuid": "e5b6855f-dd2c-41cc-919f-281e6fa5f432", "comment": "Malware payload", "value": "2fc7bb2573febdedec39b547da83a64d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666348, "uuid": "63d65e72-db56-4fc0-bf70-cce66f83c1ef", "comment": "Malware payload", "value": "74f67e4e60bc168af5fddb0b05a1624c73f62d4ff9cb75a401d87770aad6b276", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666348, "uuid": "816e6b17-7363-4c2a-990d-5194e2bdbe47", "comment": "Malware payload", "value": "49d165527598a6de077a213432441078124f5e02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666348, "uuid": "33a0beff-d1a4-49a7-aaa7-6053d5c809d4", "comment": "Malware payload", "value": "eb68ef94abc34753e92b6a1764b2b029937cba1826cbfb8491860f39c018e6ae8621d0447c28e346fcfc504ea2eedf58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666348, "uuid": "ef383499-51bc-4ed8-b778-1e548d8d4cfc", "value": "T1F1853911BB505019FDF702F649FE64AD552CBDE00BA8A0D761C82AFE8629BE13E31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666348, "uuid": "ab75e0f7-c078-455f-80eb-8040ae7bfb62", "value": "ba66dcfc08cd15877a60d0a57560fd16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666348, "uuid": "b012758c-01b4-45e9-a1a2-ef3664140789", "value": "24576:8bG7JuDRDTyjIFDEb+Wq5iKjV2eUQUDHvEYw:8bjQjI2bOP2xQUzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707666348, "uuid": "577c504c-73c9-48d9-bd2c-7c086ebea9a5", "value": 1826816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707666348, "uuid": "623db8d0-09db-4b8a-9adb-2fd6aa45e0d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666348, "uuid": "0f5208a0-613c-4d5e-81ec-617d87796e7d", "value": "SecuriteInfo.com.Win32.Malware-gen.30664.8702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56920553-c8eb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707662359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662359, "uuid": "33ececab-a069-48a6-8ff7-325fcba0b824", "comment": "Malware payload", "value": "89ee9a224039b2ce1eec74bd0a1c13e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662359, "uuid": "52c1a716-262e-4f5d-8a7d-524464223690", "comment": "Malware payload", "value": "74fe73c56ed7300b8ac739001ae122e0dcd8417f6917a9c2716cb60018754f2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662359, "uuid": "addea889-06f7-4bf7-b8e5-dc1c697fae57", "comment": "Malware payload", "value": "84b1eb1fab3629b9fccc3b3e510fd4473d937c8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662359, "uuid": "586f132d-285d-4128-9138-f996124b6f43", "comment": "Malware payload", "value": "5f138bff4d50202b2781b557ca1838d910677f3381c5ada72efdda651242dedc3b1e5ca7f706791ff611019e1b2e6dc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662359, "uuid": "b8e5d0e1-9139-4849-bbbe-db4fcb4b39c4", "value": "T18AC61A16FC9244E6C5FEF13486A69322BE7138ED833177E35F909AA61625FD46A3D300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662359, "uuid": "a3c13a3c-1f65-4aed-acf5-10eae0800a8c", "value": "98304:GOepG/eidV0tcjB+GTK3udNb7g5kEn3mfQA0v1Bts2OOzsRczy4:GOwGGwV0tcjB+GTKYb7g5kEnWoVLzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707662359, "uuid": "5a96d430-a978-4c11-850e-79ece6f5d3ea", "value": 12308480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707662359, "uuid": "504b141b-a6a2-4e39-9a2b-8e5118ea8e5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662359, "uuid": "8c699f8c-7db2-4ec7-8345-cb7d2562a0cc", "value": "SecuriteInfo.com.ELF.Agent-BJG.32073.5423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd1d459-c925-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707687307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687307, "uuid": "cc96e6c3-11f7-4dee-b0f8-e411a45ec5ef", "comment": "Malware payload (Mirai)", "value": "8c27c5d92bbac115d5b25d1e1d626297", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687307, "uuid": "c435cc87-5e7d-4d30-82b7-e04699ce1862", "comment": "Malware payload (Mirai)", "value": "76296b762624a0c8013933b2645cae5405857ca2a4bd04b8b1d1ff5ab1bbe91d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687307, "uuid": "3beca121-3dd7-41eb-9765-e89587eed7bc", "comment": "Malware payload (Mirai)", "value": "9281ab0599a7ebfb7cc32bfb27504dac4f3fcd45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687307, "uuid": "ba1cf8ab-f0e6-418b-8cca-75a5c9f022b2", "comment": "Malware payload (Mirai)", "value": "82826efc1629b0d34f94163f7dba0545115a025700053ac45115d0faabf336743e3cabf3d9d1861d1b67a65ce08cfd3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687307, "uuid": "f427e2cd-6ded-477e-8551-677ed93e1241", "value": "T109734901B3184E07E5E61AF4393F1FE197BEE9C022E4F5856A1ED7465272E33584AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687307, "uuid": "e0ea3eea-da3d-4787-a0ce-cf822fc01e6b", "value": "1536:LecvZ1h6c3UBIAq+9CKRyu5ePslkGHSesujvOT:LeKkBdq+9Ce8bASeHjWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707687307, "uuid": "4548e55f-d0e2-4788-8d40-90c588af50cc", "value": 80360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707687307, "uuid": "2fd2db48-f843-431d-a447-082cf5c6279d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687307, "uuid": "c27e1106-5c12-45a1-972f-91e8562c3865", "value": "8c27c5d92bbac115d5b25d1e1d626297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d28a16-c879-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707613317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613317, "uuid": "68773667-68de-43a9-85fa-94aff1cdd8d7", "comment": "Malware payload (Mirai)", "value": "6bb45324f6cb6c46ddd3a6bf5d77b2eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613317, "uuid": "2c540c8c-654a-4fc3-aa92-58633c00b0ea", "comment": "Malware payload (Mirai)", "value": "76ecb16ff20998815df19facd55329097f43cc24cf71c15f676f8632cade49fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613317, "uuid": "95067d12-6ebc-44eb-ab37-9a91c1040789", "comment": "Malware payload (Mirai)", "value": "8e9904bd1a42c22c6c2a0147361464a791b9ceb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613317, "uuid": "646bef43-a4f7-45f2-8265-c7319ce79277", "comment": "Malware payload (Mirai)", "value": "d63357fa378737daa1a1f1c414f64569cc09b997ff6f8481aa12e452240a8e1e97fe48b7ba34df1b6e6d4542d57936bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613317, "uuid": "065fc2c0-55de-4df0-a6b5-a37fe8951da6", "value": "T1A9733A95BC919B13C6C412BBFB6E018D332663A8D2DF7207DD256F21778B82B0E67641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613317, "uuid": "b55609fc-8b82-462b-80b6-19b85ed5e55d", "value": "1536:JajEsbNVQPhThqScuot5QBLzWxMBtbdOQWNqtefBOv5mN:JajE3yDbQBLaxMH++T5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707613317, "uuid": "c60f9a9d-c8ed-4773-afd9-b3fd7563c8ba", "value": 76336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707613317, "uuid": "72da9793-4521-44b0-ae39-b865b79f5650", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613317, "uuid": "eeb3e2d2-106b-4874-b068-d8e3623bdcf0", "value": "6bb45324f6cb6c46ddd3a6bf5d77b2eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8045a6ad-c877-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707612607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707612607, "uuid": "6864894b-0112-4ea0-a493-c204e921d191", "comment": "Malware payload (Mirai)", "value": "fab1d9e7b1973278712ebb5f7297ca67", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707612607, "uuid": "4d1bc1e1-e36d-4851-a9b5-52df466f8769", "comment": "Malware payload (Mirai)", "value": "7851fc7352945dbe458565d576e5efc2a63574db5dd43bd2e801a370765d45e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707612607, "uuid": "3c3f6c1d-76b4-491f-8c23-4919e2d5aeff", "comment": "Malware payload (Mirai)", "value": "f5b33b3dfe8422c5a52139045d99f10c3bba5622", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707612607, "uuid": "5fcbf64a-218a-4429-b302-730edde560c0", "comment": "Malware payload (Mirai)", "value": "44ef7dc5349988fdbe8c24762de802a421970680f5e8b5de108244dfe677eab0beb261302d1a6a95b755f869e865fbee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707612607, "uuid": "21eb05e9-12d1-49f5-9c23-e006de030d9d", "value": "T10BC3F849FC515B13C6C612BBFB5E428D7B2A17A8D3EE720399256F60378785B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707612607, "uuid": "b9c98d18-4930-47f1-a5a9-91efb858b444", "value": "1536:uB25fCMgGyfFxAdZ54VPkOeITsxwZuusO4Es6/+/O1l1h5wywmO/BBBcsLpuTceT:uBk9oFxy4eYQxwZuucIk67v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707612607, "uuid": "08c285f9-a1dc-4edd-8058-be2058774c69", "value": 129420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707612607, "uuid": "9c3524a6-bba8-429b-af61-3f90851d8dfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707612607, "uuid": "be435812-5446-4843-b0f3-3c8f1f8ba63c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63abfde-c8da-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707655218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655218, "uuid": "2990cb26-ef8a-4e45-8605-2154063abdff", "comment": "Malware payload (DCRat)", "value": "afa014338532a8f730aa8e6b5ca09874", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655218, "uuid": "53c59631-cb15-482d-8526-fc0f055f3acd", "comment": "Malware payload (DCRat)", "value": "78a0343b36930749e066ca0bf9a171b338fd00e9dbe3d6e364e06eb4e78cf0ce", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655218, "uuid": "2f5be738-c09e-453b-a7c2-d177e57228e3", "comment": "Malware payload (DCRat)", "value": "0a55224d9cf55e5ab12087a8af15612d75753d33", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655218, "uuid": "38592690-3a11-445e-b8a2-968bfff17974", "comment": "Malware payload (DCRat)", "value": "c6094658496795ec73fd17bf0be9ac17feb64cf26db80826561d7105fef616d24a7864312184b1b788adc8c42bee68aa", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707655218, "uuid": "54e90d54-a1b5-4d9d-81ca-f55e79309255", "value": "T13C95CF4665615E33E2647F39A8D7941D42F1DA6B3212EF4B3E2F4092A8053309B5B3FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707655218, "uuid": "c954207a-9c92-42d9-bec9-5d87db5bdaff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707655218, "uuid": "68b4e5f5-0fe1-42f2-84ef-15cd7b2b4afb", "value": "24576:XZkERkn0rQKC/L5ZQk/Pv6mD6JtkOW4l2f1yz+dGP4hSjdirHEbxn4uYRtqMSZ8I:XZbRk0wXPvp0kNxdCgkdi4tnYnJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707655218, "uuid": "848e6f88-c181-4d00-a05c-ec78ef4b93a6", "value": 1933824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707655218, "uuid": "241ee595-311b-4698-a837-32139a80fc60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707655218, "uuid": "30ad1f3d-22ec-4190-87fe-5d6a614f3c03", "value": "afa014338532a8f730aa8e6b5ca09874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee39b7f-c8f4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707666345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666345, "uuid": "f0064b1b-33b6-4d2b-a48f-50b3ae09b5bc", "comment": "Malware payload", "value": "4343b9f0e1e7c48438540363710bb73d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666345, "uuid": "78563929-e635-408b-ba86-628caa46072d", "comment": "Malware payload", "value": "7ac7ebc5884f6bbf049513de2c0384a9ff6f15194c23e66c23378010ec3a4056", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666345, "uuid": "ca30237b-0c67-47fe-a4a9-31ccc193a4f0", "comment": "Malware payload", "value": "83407f59bc3e32b25405675c4b05b2e7f8156421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666345, "uuid": "b8a9e34c-1632-4406-b4a2-4ffca2ba57b3", "comment": "Malware payload", "value": "a9416a48f3c0fe0b2432e6ed8159d7beca6290053d13d6a50906db020a5f78f9d9e5808d49900d255ef85138f2d77d24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666345, "uuid": "d4d67456-b030-474d-ac83-3aef68d57f8b", "value": "T1CBB46C1276E102B5E1B7D279C9578E95FAB3B8540720A7CB03E492B66F233DC463E325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666345, "uuid": "0f7ea8d0-a696-408e-9871-4907d23077e1", "value": "49767fe8fca552fd74b2abf2d13dffe2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666345, "uuid": "86074381-20b6-4188-bbe2-b9324297d09b", "value": "6144:vif0g6k/mf3vpjfUnvCstwmeiUJ5s/yna2i35PFJF/h7yQ6:vK0gjmf3xfU6suxjTs/QbitX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707666345, "uuid": "74f17c05-d4e4-4b53-8d8c-6c202ed252d2", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707666345, "uuid": "3eee239e-3716-4a66-8b16-6f144cf72741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666345, "uuid": "b6d64e86-8c13-4df1-8fa6-e9ffc3d18335", "value": "SecuriteInfo.com.Variant.Lazy.452526.28045.10700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1138627b-c8e1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707657947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657947, "uuid": "95931e33-83a4-449c-9ec0-88a1190a735a", "comment": "Malware payload (AgentTesla)", "value": "b0d6b7687c3d3094a6948313bf920520", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657947, "uuid": "493c44c9-86da-44dc-b324-c325ec1d8566", "comment": "Malware payload (AgentTesla)", "value": "7b25460c3bb97a058fee383083d303e03e6e2de48f48df28ad6842c817665c38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657947, "uuid": "737f3d3a-190d-43b0-8ceb-65658b0d8ba7", "comment": "Malware payload (AgentTesla)", "value": "f8fc61a6ca2326ab72ff41bf546b041ec3b5e7da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657947, "uuid": "b45e5533-99c8-4109-b634-8162e086ad27", "comment": "Malware payload (AgentTesla)", "value": "ac6670e369dd05115f05e70dd9154c0039b65e747956b201d440ce5863dfff1c3b7d51080af1783a606b805310701369", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657947, "uuid": "40567144-a8f7-4424-ad6e-d3e4bc0c015a", "value": "T12CE42219797E6709C8CDABF91401A1401371202FB982D71B5DCB66EB5EB23268F91D3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657947, "uuid": "65fa5fbf-6f93-4e36-8f31-723177b9996c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657947, "uuid": "27537349-ecd8-47c3-8609-01d25e464beb", "value": "12288:GxEd6oXmzYCIF1JhXfyq1x5h1ltlCcKErQPTmHD8X2JsAKZm/pl5ocGppGAOg4Cb:GxcOcCg17Xqw53jlUrmHG2J0g/plXMvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707657947, "uuid": "04028f4c-c73d-4e81-a990-a0d1305e99a6", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707657947, "uuid": "c13cbece-4ce5-41f8-9931-2be3422f5914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657947, "uuid": "00284509-8884-438c-b51c-70578cb0af35", "value": "Justificante de Transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee452b8-c893-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1707624711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707624711, "uuid": "03db72d6-342b-46a8-917e-730b21e0b204", "comment": "Malware payload (CoinMiner)", "value": "5f4f97f402bcd5935346a94e47299ec1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707624711, "uuid": "830b0ec0-bb04-4c62-9141-6bf9b50468c7", "comment": "Malware payload (CoinMiner)", "value": "7c5db88208d7506a8d72d159d347e74e3cc49828d7596f908b1ce3a7ed10a2a4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707624711, "uuid": "a1420d0c-6ba4-4344-bfc6-ded810a3aaae", "comment": "Malware payload (CoinMiner)", "value": "554b5d093fe36d58011c6f20b7fa27cf35f9bf20", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707624711, "uuid": "6a05ba03-bfea-4ee5-906f-91fce4311541", "comment": "Malware payload (CoinMiner)", "value": "64b9494eb6356e70c37554fe6fec04344ca76effdfccb475ec7a0911c16d690bda8e591268565dcbbd8ae7b359f09708", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707624711, "uuid": "db4ab413-ca0c-4941-a672-d2b6fef5108a", "value": "T18CC5338C9C9524ECF230D075C89E31A8A5C8B8835E6189CFAF452552BE1D5D8F37DCEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707624711, "uuid": "f0fe35c7-ac69-4957-ad0b-063c2b2e188b", "value": "5d68de0544abec4f6be91e05245b348d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707624711, "uuid": "e22bd573-b965-4e39-95e2-b3342134e966", "value": "49152:f72C2bbiT7tx7P3kRumUSta/sM4ZLvAoMrnfWs1tSVpzlXGR36aeflces:Gwz3PzSE/sFZLwT1tsRl28fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707624711, "uuid": "f83d5eea-f015-4fd6-967f-ea3df8a65b39", "value": 2596352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707624711, "uuid": "c6484a21-22b2-4637-85b0-9a86024a1512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707624711, "uuid": "92b41ea8-dc36-46f7-941e-cd7a441207a0", "value": "5f4f97f402bcd5935346a94e47299ec1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff58ba1-c925-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707687312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687312, "uuid": "e10706e1-1008-43ad-b5c8-7b5881e3eb22", "comment": "Malware payload (Mirai)", "value": "00e49c48d109c7666a72b798c46ccee6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687312, "uuid": "2c6a59bd-e36d-4e0a-a9db-4168761a7dc6", "comment": "Malware payload (Mirai)", "value": "7db843f0f3a5fc56a7b3216e9fd6034ebaad5b44edb600ed5cd046a25812f30a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687312, "uuid": "67e7b5c5-b227-4910-93c4-94e6ae70f21a", "comment": "Malware payload (Mirai)", "value": "fff7d9cf1f8b76c94f676448edaba6e19c6d90e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687312, "uuid": "318762b3-f69e-4a18-abef-ad142cb7db58", "comment": "Malware payload (Mirai)", "value": "b5f010a6100bcd85121a11c184fb664f2b9f311b431fe2762ab4d3ada7eaa08a427d78cee7cdf574051b2e46e4d1e7c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687312, "uuid": "9cf7eb07-e38a-4890-a648-2e3ce1e83a9d", "value": "T10B834B99F401DE7DF48BDAB640270E0AB93162805A930F377767FDA33C320999A57D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687312, "uuid": "f43ee338-7d4e-463b-9693-609c153cadae", "value": "1536:vhtETs/Tnrt2o0FuecOlplZ53aWa1Bq8NSLiO4LWgsH9YOKnPAtRSEZpZ:vXvtSFuyDYh1Buea7YBrEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707687312, "uuid": "085600ca-a98e-4db7-9003-7bee300cb300", "value": 85476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707687312, "uuid": "389f2c5e-e165-4bf2-a8e0-66e99397c8ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687312, "uuid": "4404792e-7ec7-4a87-982f-00f8843a050c", "value": "00e49c48d109c7666a72b798c46ccee6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0838364c-c91c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707683272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707683272, "uuid": "02234184-46da-471e-8711-d99c44972b84", "comment": "Malware payload", "value": "c9a36a7e0bf431dafe139b1cc18609ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707683272, "uuid": "5c7ed517-f201-4532-8d35-66b7b6d5abc2", "comment": "Malware payload", "value": "7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707683272, "uuid": "4bb5d493-b3fd-4a97-bf3e-77c911963541", "comment": "Malware payload", "value": "4d77f0d31e994d3baeba164238634cadaf95fb77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707683272, "uuid": "36c4ffa4-5d2d-410a-9de9-9713042101bf", "comment": "Malware payload", "value": "aef5e59359b969752c61451c65876d110683a47abcb48eeb68352624c4e11c66111a06dad0f52d22ade784b775e82872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707683272, "uuid": "27310b67-e479-4e31-a7a1-ffbf8fb8e579", "value": "T17A163387D022763AF4D4533CBA34590A7AA8507B5469E205491BC3ACD378CD2B3F67BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707683272, "uuid": "978d520f-e896-46f6-bdfe-a981da334c03", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707683272, "uuid": "357d06c9-a6a2-4d46-860a-61f6e375a781", "value": "98304:6PSzwcdHYUcyX4eHU0hU/cSuijBf1ULKPQ1w9VOO6GQgjIkU:WS0cJ59U0hUkx6f1g1w9CGQ2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707683272, "uuid": "7e6aedb9-c936-4b6b-b4f2-3e7ed0373d11", "value": 4371968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707683272, "uuid": "6471ce3f-6f88-42ee-9991-37f9a9530613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707683272, "uuid": "0bdc240c-5054-4910-a514-aa974a601f53", "value": "SecuriteInfo.com.Trojan-PSW.Agent.26016.7220", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcf847a-c8c4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707645805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645805, "uuid": "a87d593d-c141-4320-b45c-e178d9d72625", "comment": "Malware payload (Mirai)", "value": "a43ba73bbafae695a67b2dd16feccdb1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645805, "uuid": "1001a77f-7d4a-4775-8dec-afabf42296fc", "comment": "Malware payload (Mirai)", "value": "7fa941e3124ec9c97d7efed02a7f0f78f5bfd0b253c6257c35ebef8133bc02f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645805, "uuid": "a9a4896c-2432-4f1c-b7fc-5df5e6436401", "comment": "Malware payload (Mirai)", "value": "239bfe5e62b1d7946e0355a68b067333584c0162", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645805, "uuid": "03fbfe42-05b7-40cd-8d81-dcc342d62368", "comment": "Malware payload (Mirai)", "value": "63cdaabad30df793c337d8be4b9106a85689216feb4826bf3d0d90007c01a0d54c86e30b9a586803a30779d05199bb82", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645805, "uuid": "f8515c73-f27d-4404-aed0-73fe75a6199b", "value": "T133D3F856F8819B12D5C111BAFE1E124E37131B3CE2DE7302AD246F657B8A8BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645805, "uuid": "833b2766-41c9-4538-bedf-e38cb08d6d3d", "value": "3072:ElUMnF230X3iUsgMafjnDX/b0zCpV21/6:+DnA0XyUsZaLDI8V21C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707645805, "uuid": "076eb113-81ce-4aa9-a41f-83fca81ad345", "value": 131932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707645805, "uuid": "0fa3e72a-9614-4db8-811a-f306f6d9d563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645805, "uuid": "e4b4840f-8848-40a3-80ea-51d1198c04ac", "value": "cundi.arm6-20240211-1003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e141f6-c8c4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707645820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645820, "uuid": "0ab1b869-6c36-438b-b31a-753a62bfaa32", "comment": "Malware payload (Mirai)", "value": "28e2aca8332fcf56d8eb8ce1d5744298", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645820, "uuid": "fe4c4e38-c77c-4a80-9d47-39d821f0633a", "comment": "Malware payload (Mirai)", "value": "82163d9ae1ca07377cdbe4c1e3cd4a64aca1023bf82f93b2e46efb5a85db7891", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645820, "uuid": "bb2766f6-f4e3-42c7-a5b2-757f284c2bee", "comment": "Malware payload (Mirai)", "value": "86c11bacc127128b0b62a1bd77829ac8fe2dcc99", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645820, "uuid": "c4d4a155-1b2c-4b7b-baf2-e8ecf7a5fe43", "comment": "Malware payload (Mirai)", "value": "107b8822a9cd6977f80c4a8598a24431a0394215feec079f5cd2123564d5515d447de015eb4f570bff7c99c29ac4c022", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645820, "uuid": "323c7664-338c-4987-8a83-d2d474bc6a88", "value": "T1F6D3391775D1D4FDC8E9D5B44F9AA13AEA72B02C1238B16B27C4AE272E4EE305F1D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645820, "uuid": "2c6a6c8c-4017-4fc2-8e05-0f8fc95badf6", "value": "3072:PntXhNt6wQ4MyuaogvXpmQ3xzJMAbl4f:PntXVjXZ9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707645820, "uuid": "a7fd0896-c03a-497f-a6d2-aaa0610dfb20", "value": 131384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707645820, "uuid": "a2de85fe-8224-451d-b439-6460baa2866a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645820, "uuid": "a4387470-adf2-472f-9acb-0c34002b6249", "value": "cundi.x86_64-20240211-1003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b41c43f-c8a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707630503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630503, "uuid": "09b0c08d-664c-4daf-9cb1-935e61287359", "comment": "Malware payload (Gafgyt)", "value": "8cf69824c6370c3d94f1b33ad82d1cb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630503, "uuid": "3f0a8ea4-1ab8-4489-ba33-9be4534dc6d1", "comment": "Malware payload (Gafgyt)", "value": "83953898a2e82deb94d627ba5fb4217060637fe05f1b3656233892f1ba1d46bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630503, "uuid": "a8517fa4-bdf4-431a-83ef-73831cee7e32", "comment": "Malware payload (Gafgyt)", "value": "229affd9b5703b7c9a0a41d747d2c3d25941bff5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630503, "uuid": "caadf1f2-25bd-4492-af1c-def8c7dce99d", "comment": "Malware payload (Gafgyt)", "value": "5474c7a17137d6cf8ae86a2d5dfa53cf22bf39104dbe3135584a1e2fd2a201a7bc0dc6dc58d593afea3b319cdf9d89d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630503, "uuid": "9e9df5c9-96be-4e8b-aaf0-717d40965a5e", "value": "T16433F1B58758F93AE170093BF762C0FC16BA0DEF542136AB1A50C57CD3D19ECC2A254A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630503, "uuid": "b5ad7868-736c-4f97-95bf-6bb3f83bf06e", "value": "1536:jYTBTpvc86Ixisjt26UEzsqoELzpANxknLWuA:ET1pvx6Ixis5mEzsNEL1YmniuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630503, "uuid": "80f3d56d-9a32-42ab-ba5d-4f8d8d8ba2ab", "value": 54912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630503, "uuid": "320a35aa-67ad-4d86-bea8-71ee71a8d066", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630503, "uuid": "c28aaa7b-71af-40e2-b114-21f4e69b2e84", "value": "8cf69824c6370c3d94f1b33ad82d1cb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c542eabb-c8bb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707641928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641928, "uuid": "230ef09a-6b96-4596-b990-43b9982d42e0", "comment": "Malware payload (Mirai)", "value": "845f9aa3337ece67e431664ebc82021b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641928, "uuid": "97b0462b-a3fe-43ea-832a-82dd1929b048", "comment": "Malware payload (Mirai)", "value": "84e799494544b7c5043a7f26bca343fa096bb063ef4a8fde5c92558ab2c0d34c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641928, "uuid": "9111bf19-af7a-462b-8d65-866d05b11597", "comment": "Malware payload (Mirai)", "value": "d79d163c8a674e2aac10074e47593adc033cd255", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641928, "uuid": "fc42a684-0831-47b9-8e2a-2fbb81d19dab", "comment": "Malware payload (Mirai)", "value": "cbdd67a6bf66931be94c12670638a73784a0a4371aaf5c831ce7e6f866ac2d26456ffa9901021ea8c722e566954fc4d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641928, "uuid": "9b526379-8680-45f7-9c4a-cf4342a197a1", "value": "T155F3C80AAF610FBBDCAFDD3706E9060139CCA51722A93B753674D528F50E54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641928, "uuid": "c95f89a1-3576-4f27-b2df-bf9f3c584432", "value": "3072:2tcIXjWn0uhTEb24H6SrLIx/YuNkdqAl:2xjWBTEv6qLiAuNEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707641928, "uuid": "1f1c4288-d5af-4585-9f0f-7edb43fd349c", "value": 161480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707641928, "uuid": "145b4c9f-e263-458b-a0e8-82cfd134db47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641928, "uuid": "933ffd57-2fb5-4e17-9005-8261e6547c35", "value": "845f9aa3337ece67e431664ebc82021b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54007bb0-c8c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Meterpreter)", "timestamp": 1707644745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644745, "uuid": "e6ddc2d4-9fea-43f1-8a53-1bfde4538d08", "comment": "Malware payload (Meterpreter)", "value": "8427bcae96bac624c94ebf3e2f605984", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644745, "uuid": "5c2e692f-51e0-4e0b-8b05-92193644173f", "comment": "Malware payload (Meterpreter)", "value": "8841199eadcc4529587ddce865c3ee84de7495ed59b90ec64acfdbb4568562b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644745, "uuid": "8faab83f-1ecf-4046-be97-35d954d05f49", "comment": "Malware payload (Meterpreter)", "value": "45ac1af64f2118702f92b27cb62a2ada4277a16e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644745, "uuid": "259a3692-5dda-48be-aa75-1e7bf29230cc", "comment": "Malware payload (Meterpreter)", "value": "30ed5e1618509afd54555951361154462dba083cb3650b8df2afa906b8aa9b0d10dffa20b7ca93789bcf3e82230464d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707644745, "uuid": "23b022a6-0ed7-4952-83c7-37ca6126e9bb", "value": "T10CD08041C5629143C07C4A3675156FAE1B15C12741511F6623D57BCC9CEA9540F33B14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707644745, "uuid": "2caf21e1-971d-402e-b5c4-7ffd77304b23", "value": "3:Bkkk/tMlwXll/O/slrCs4X1lFrSwfM4V1lePDXIM8IPNioOHyUvwGcVt6fE2:Btk/tMl//E2s4A4nlWXIKQXSEwhVYfE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707644745, "uuid": "cf61b702-a8ed-4fae-b1dd-461b78de0e66", "value": 207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707644745, "uuid": "4af3c97d-b7a9-4cf6-a9d5-97a1add3840a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707644745, "uuid": "a79d0651-0cbe-4e2f-af77-198fe4c3c1ad", "value": "8427bcae96bac624c94ebf3e2f605984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab6ac72-c8c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (ConnectBack)", "timestamp": 1707644756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644756, "uuid": "c6032ec3-ecb8-437c-afac-8507e8d680bd", "comment": "Malware payload (ConnectBack)", "value": "f346b0863980388204a0b66404f32aeb", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644756, "uuid": "004942bd-c81c-4788-bfbb-45eea79db671", "comment": "Malware payload (ConnectBack)", "value": "8b82b6f29c6a3851dbe073f89624b706ae840048aa948b757f79815740774a72", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644756, "uuid": "44e500e4-189d-4d56-9324-3bcbf75ca662", "comment": "Malware payload (ConnectBack)", "value": "2167cb6b92111e60d936361bb032fa8df7ab92a0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707644756, "uuid": "6e65060d-31de-4364-ac1e-2445aa092aaf", "comment": "Malware payload (ConnectBack)", "value": "53d535e1e7c9d87d6d5a8d7444a2e9875d4eebd3e1a7af3dcae920cca8657d1110ff7eb055593e0af3fd012e01074b27", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707644756, "uuid": "990ef378-47b2-465d-bf0c-67248a8db3ce", "value": "T12FD080331B4A81EADAD4033F657459ACD77B8976574962350950DC014C496445F53C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707644756, "uuid": "1ed6f83a-1458-469f-9a69-e4bd57e48d43", "value": "6:BnX//In8/r1uBxHocmTiQ3RQdygg5XJYD:BvwncrAH3mX532D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707644756, "uuid": "1b81a088-db7d-46a9-bd42-954d8bcec9eb", "value": 250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707644756, "uuid": "6cf8be85-f9ae-47f2-b0e7-cf5d1fb7be3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707644756, "uuid": "c1d63606-d978-413e-9988-f7e9c4ece854", "value": "f346b0863980388204a0b66404f32aeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5788a8c1-c8eb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707662360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662360, "uuid": "7aae265a-98f6-46cb-9603-f532e7b198dc", "comment": "Malware payload", "value": "13910643ecf2af042e17aabb976a91d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662360, "uuid": "50282138-9fb6-4046-8dbd-566bc145f4b2", "comment": "Malware payload", "value": "8bc84d2eacac687d2f153193f2b2d0403073f86fbb544083ec6c9dad2c9a4a10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662360, "uuid": "1cbe994c-d0fc-4869-af6c-d0c6959deeb7", "comment": "Malware payload", "value": "99b2ec68d1338fb7f272252eea8617517709e2ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662360, "uuid": "e41d17a5-da75-4e73-8327-f30b43866ea8", "comment": "Malware payload", "value": "a13fdca51d4400cc0ee91c2e11afda8ead9ff791e9c3fd0fcb6ce019de2f78d30e7c8f198a352ce3057b71926ce4b9c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662360, "uuid": "2e101620-6030-4972-8fa6-0ac5b3b50b04", "value": "T154461370B100C033F09A15B287B8DA76582D67E41FD765C39B9C3BBB5974BC0AA3562B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662360, "uuid": "df53b9a4-39cf-43f6-84d5-af475dd45be2", "value": "7591b97aeb78af3d928a02efadf17ba3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662360, "uuid": "7a0f902e-5348-4584-b518-6319f2bc7f63", "value": "98304:b7K+EZ5N68Px3mQD/+LWgaYoMkt399rcarULpqI2:Ld8Px3mVLWg9FkpcavH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707662360, "uuid": "8e155ebf-1b62-420a-9a1d-94904949b2ed", "value": 5568512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707662360, "uuid": "f993d622-5ca9-44b8-a0fe-d2815fceda54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662360, "uuid": "a7688def-383d-4280-ac84-b483c99b471c", "value": "SecuriteInfo.com.FileRepMalware.17082.26527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc00cf6e-c8bb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707641940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641940, "uuid": "390e9c20-9772-4656-ab49-7b7141f1b233", "comment": "Malware payload (Mirai)", "value": "563fb2b771b0785b3e6b92fddf8ff827", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641940, "uuid": "fb2872c0-863f-48ad-a1e6-4c08743e52f9", "comment": "Malware payload (Mirai)", "value": "8e84c71c9a3455984d110a5c0b8bd44997d3648537d95b49102caa5c2ded1c68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641940, "uuid": "906fa8b6-aa37-44a1-b684-0420e6bface4", "comment": "Malware payload (Mirai)", "value": "87e0ff414c260565ca931184ae45c65709aa973d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641940, "uuid": "5e893dff-19a7-4337-a8bb-1ed802e10e5c", "comment": "Malware payload (Mirai)", "value": "5d614040b8c1ce18365e83c66da94790038586d6ff52f73d28c20749307dd7a86d39c5a73813071744468ade8b5a65b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641940, "uuid": "f56c4ad8-315e-40ca-ac22-9a5805aa60c2", "value": "T195D33B06B30C0A07D1632EB43A3F67E093EFDAC121E4F645255F9A8A92B1E375585ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641940, "uuid": "0e65f65f-87b7-4e30-858c-feafd7d77492", "value": "1536:O+65RMfLd4/IbIuJgicUwK9xpNvTxNfjbo8PgUF7MJqvAfItK510LHqQe2khhyzf:Odcd48JYUB9xr7x17ga7MdfrhhQSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707641940, "uuid": "28ab1988-4afa-479f-98a5-07610daa4dae", "value": 136952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707641940, "uuid": "6f122415-d852-40bc-81aa-3ce8ba8db66d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641940, "uuid": "ab66566b-61d3-45c6-b824-111fd033b882", "value": "563fb2b771b0785b3e6b92fddf8ff827", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fa3847-c8d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707650838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650838, "uuid": "ebe0ca95-fbcd-406b-80ae-5f461c1bfaac", "comment": "Malware payload (Mirai)", "value": "184047f63f7a90e80013490538c9416c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650838, "uuid": "a4b8373a-f297-48ef-a7b1-820df413297c", "comment": "Malware payload (Mirai)", "value": "8f4123376f6e62c0fb0c2873c3b296938b4e4a9e71bf9ca79354a379c97c6f43", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650838, "uuid": "e087a483-0b9d-478a-8ced-5bc36ceb5356", "comment": "Malware payload (Mirai)", "value": "623474bf1cb4e40d6b4b18d8c1e9e4bc2014ffed", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650838, "uuid": "ac617b85-aff2-4fcb-8aa1-c5238930367b", "comment": "Malware payload (Mirai)", "value": "81e8dcf3a6b91d26777642e464fbd7d6f93feadf2440f4b2f7be29606ad10543ba67d2fb31e738f9f07e5bf9ec3a9a89", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650838, "uuid": "0e7a0c69-9b80-4e17-b54d-0f3e1e98bbeb", "value": "T134F2F1D6436FD6F1D4B3687F20AC4A99FA64F8239070D3571C0531684CADA69AE207F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650838, "uuid": "9e73dd5c-e373-4aff-a4e8-fe1106d9b7f8", "value": "768:N2+9wmSvVydtj6sq+BY+uBEyiHBFiQCeN4I/DbjkBSYr/scRrQHc1Nfv9sPqa:N2ewmSvVGZBrBY+u/mLXlOIb3iSYbRAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650838, "uuid": "284e81c2-6153-426d-b3d4-c1c42eccf976", "value": 37268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650838, "uuid": "2763c83f-5efc-48b6-a4e9-f10f5e0c8755", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650838, "uuid": "58c8294a-3709-4bd2-8f79-46a15a663edc", "value": "184047f63f7a90e80013490538c9416c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c6bd35-c8e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707658869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658869, "uuid": "0b9c1397-52b7-4461-bf4d-568133cb9b05", "comment": "Malware payload (Mirai)", "value": "478d29d4e28aa3cdfc5f1165ed2d4405", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658869, "uuid": "de995494-61b5-499f-adab-92164ed07be1", "comment": "Malware payload (Mirai)", "value": "8f637b82ec51481472f7e9ccbc0d943123e4b427706c3a6353965ac600780521", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658869, "uuid": "01f8bb01-1e04-449a-86bb-20edc1f3809b", "comment": "Malware payload (Mirai)", "value": "3219db67a0594e3596f07527495959663034d771", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658869, "uuid": "bd1650cb-d496-4309-9012-9403067911f7", "comment": "Malware payload (Mirai)", "value": "098be6045ab2786c5e561e05b3fce6895ca90a9ed880144a015c0d703692066cab99a6a89720e81b282ce80d46ed5cfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658869, "uuid": "d27894f4-f025-4353-b891-9cd93a05b503", "value": "T17F435B52721C0E17C4A31A70263F5BE08BFBEAE021E4B685699F5F968935D331486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658869, "uuid": "aef22cee-bcfe-4f65-834d-97879fb3720a", "value": "1536:eF6QcATQdskHosl9k1dP9sT0bI666hJa108:tqgtJHk1dPSgbI6x4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658869, "uuid": "2449b940-128e-42ea-8771-9157ac21d463", "value": 59764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658869, "uuid": "102b6a41-a427-45e6-8787-7929f1bac940", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658869, "uuid": "9c5b72d1-ce34-43c1-94a4-845a7d1ef2cc", "value": "478d29d4e28aa3cdfc5f1165ed2d4405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9b8f07-c8e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707658879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658879, "uuid": "48ae5e9d-26f0-4831-b320-5d03a8e99a2b", "comment": "Malware payload (Mirai)", "value": "430cf1d60841d3fca2cc07829638b0eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658879, "uuid": "b872c9d1-1b2c-4178-977b-e17ebde90fb9", "comment": "Malware payload (Mirai)", "value": "8fabab77e5dfbb5d42248ef741e2a2236f1ee5ea473faa59476ecb38687d74b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658879, "uuid": "6b3987ee-6919-4ce7-81ed-081c090f2ebe", "comment": "Malware payload (Mirai)", "value": "714621473e2b451fdee4a6580d3dcfce94cb70f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658879, "uuid": "92ad7bee-0f0b-4a7d-a4e0-3ab282165f13", "comment": "Malware payload (Mirai)", "value": "0b0845dc25126e53fc1f022661a8aa9ec4bd70c0e94d2aae3e000df9eed015145f2f02e48ba0c3a96046c0d97d7cd073", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658879, "uuid": "5481ab5d-1926-4416-b197-18f78748a7be", "value": "T198534B32FA762A27C0E5A47A21F78B15B5E117DE21A4C65E3DB30E4BFF606406502EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658879, "uuid": "d6ac3bb3-80ad-4581-beb4-4e1d60e16edc", "value": "1536:wwkfZJxFtojQlvnrj/Byzn7dke4tuItYZ6w8+BwQSz0XYIfiV0/:BkfZJxFtojQlvnrj/a4LYZ71YN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658879, "uuid": "1e15bb53-0e6a-4228-a44f-c1d722a6a164", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658879, "uuid": "111de8bc-49aa-4df2-8aad-8af250398cee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658879, "uuid": "9935004f-63fa-440c-86cc-9c3fe1347592", "value": "430cf1d60841d3fca2cc07829638b0eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38710a60-c879-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707613345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613345, "uuid": "c3eaa976-3027-4683-9bd5-2bfe57f682ce", "comment": "Malware payload (Mirai)", "value": "4ee56ba42a6a8e3423ad4ca3856a3bcc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613345, "uuid": "c1f6bed2-5b76-4268-b204-d38e366e218a", "comment": "Malware payload (Mirai)", "value": "915c761bb17688b8b3b11f31f0b42b508739ca5c1f956ed80a62a1dd8cc3b204", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613345, "uuid": "8484c5d3-be8e-4c66-90c2-35ee996c13b2", "comment": "Malware payload (Mirai)", "value": "d7f2f3d793c80a0c2493f5930454d8b3cd54e305", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613345, "uuid": "22455e54-31d8-4c1d-a4b0-cddab4ae1446", "comment": "Malware payload (Mirai)", "value": "587e457be8dc581dede79d26bc66907306ef3615cfbbb335332bcb98a090e68e9f8c156db23d2f33b43ff970e678910e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613345, "uuid": "b0313de1-2b49-4fa1-a721-fa61258a3230", "value": "T1A7831856B8818B11C5D512BAFE2E118E331357BCE2DE73229D246F20778B92F0E7B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613345, "uuid": "31e93814-dd54-464c-9d13-27f2d8d18d51", "value": "1536:2DnW5V9I8Utgo4jUG1ncM8foUxar0CGQMqMxiSDtfxjvD85JYkKI:FPS8ptncM8foqaGDtfxjvD8rdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707613345, "uuid": "082ef205-f02a-4249-a64e-4335b3bc0076", "value": 83636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707613345, "uuid": "c9a85a0c-7cee-4ba7-947d-c9100117d9fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613345, "uuid": "014cc0cb-ded4-4327-90e8-09bb23d20fb7", "value": "4ee56ba42a6a8e3423ad4ca3856a3bcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3431828c-c880-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707616345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616345, "uuid": "02baee8a-2d6c-4e00-b813-72141daa34fe", "comment": "Malware payload (Mirai)", "value": "c78d2ee7e49ac2acd3b9b08cc27635fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616345, "uuid": "98b69ac3-2291-441d-a935-da6300d97ce8", "comment": "Malware payload (Mirai)", "value": "941707ef0afdb1ea16c40da3791244028708a00539477b5e887837d2eb08e239", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616345, "uuid": "9884d77d-706b-407f-bd00-e8ff8428de4b", "comment": "Malware payload (Mirai)", "value": "797e75c248c0d9c6461b32ad9894350e0ef64141", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616345, "uuid": "436d7c55-f14a-4daa-8a40-64cdb7449aa3", "comment": "Malware payload (Mirai)", "value": "08630bab31eb4b0e9fa3ea88f5ee05af0e2c472d592f1de5afa17a33525a29dd6b12ffb3ba32edc804b1032c013a36d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616345, "uuid": "6ed243ef-ac86-4463-80ea-7d014203df09", "value": "T1C3230891BC819A2BC2D41379F5BE998E3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616345, "uuid": "a9c43f71-6adb-4c8f-a5f3-f9922328f5a0", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THh:5DmKF7Gxyk8cqoHAmWurAufW5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616345, "uuid": "b4f49ddf-4bb4-4292-88d2-b0e18d95fb6a", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616345, "uuid": "2b96140d-ce04-440c-b4fa-a9bbae8afebd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616345, "uuid": "81f53774-fd2e-4d54-afbb-93a87660062a", "value": "c78d2ee7e49ac2acd3b9b08cc27635fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af64c342-c914-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707680117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680117, "uuid": "46d89dca-1ac7-4d3c-b2dc-99c2b2af8e8a", "comment": "Malware payload", "value": "1055f024790fcd6e702ec27bcb282381", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680117, "uuid": "0ddb7da9-45c0-4a5d-bdd6-ce2a2dafa9ce", "comment": "Malware payload", "value": "9448df3b78912dea782621f5e24a0d1f8568a0e2b054a49be0e8e398a6b89c20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680117, "uuid": "485d379f-9311-4cce-b9a3-52d0ac3ad6d2", "comment": "Malware payload", "value": "af22266c2467408bc47bf49e21aa6e5f6c41ce8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680117, "uuid": "47d32e41-80b6-4ae2-9d64-57f695a0021b", "comment": "Malware payload", "value": "72ac095d611156857f13dc19fa36efadbc8dca1f76a67e5a2cf1ae5e613aaa61c56623aef0c5535b65a2439fc99aa3d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680117, "uuid": "13bdbe05-8573-493c-9404-4d92fd90243c", "value": "T16AB5F916F8D608EAC6BFF1304A966723BE713865833277D35F901E6A1625BE4AD3D304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680117, "uuid": "7d1d24b7-8fb7-4633-b7f3-082b86a48585", "value": "24576:QOpyDS0kUexB77KJeb2xzvUvvDgIx9h4/iLruGJKtBeJj31XUO8U:lpyDS0kUex1mJeqv6bgIx9hQiLVr11j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707680117, "uuid": "2221292e-483e-4ffe-a8aa-0d8ad8098a6d", "value": 2351552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707680117, "uuid": "406d3d60-ba7a-4fbd-9f6d-4531a6a941bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680117, "uuid": "c809b7f2-b33b-44bb-9c99-ad553df305c6", "value": "SecuriteInfo.com.PUA.Tool.Linux.Proxy.14.14528.29096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7098ad-c8fb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BazaLoader)", "timestamp": 1707669403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707669403, "uuid": "6cbd671a-0181-43f0-8b3c-881a4277db56", "comment": "Malware payload (BazaLoader)", "value": "9c8696dbb48add540a75737327c537d2", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "Lotus", "colour": "#6231C0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707669403, "uuid": "c845be7d-07cc-48aa-922c-7f292912d3f9", "comment": "Malware payload (BazaLoader)", "value": "94b8ab735d503884585fdb5a735b3ea3485b6b19c1899939a5b2c0a80616400a", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "Lotus", "colour": "#6231C0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707669403, "uuid": "a48eaace-38a5-494e-bed9-d9766d5355d9", "comment": "Malware payload (BazaLoader)", "value": "78b4eb7d363e017eb06e03408d7952bbb843f9a9", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "Lotus", "colour": "#6231C0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707669403, "uuid": "b9cdb6a4-7d9d-40cc-b5af-495ef2ce9946", "comment": "Malware payload (BazaLoader)", "value": "8afb0adcb0a98730ed7f5f9a59eb6de09147f48136eab5660906d9f2bde10c9f6192fdde49b932087b30d2405dbd6b92", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "Lotus", "colour": "#6231C0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707669403, "uuid": "584aa1f9-69d8-4619-b184-534e3199a95a", "value": "T15F75C0227386C537C96E01303A29D66B5579FDB74B3140DBA3C82D2EAE744C16639FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707669403, "uuid": "74316316-84a4-478a-bc4a-f3857f3bd871", "value": "49152:yErvYpW8zBQSc0ZnSKeZKumZr7Amyq3TGtezO:RYQ0ZncK/AEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707669403, "uuid": "7214cd81-4838-4ddb-b154-fc9711b0eb85", "value": 1608192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707669403, "uuid": "c4045454-9073-4f03-b8d5-2e7c7d7ccf66", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707669403, "uuid": "232a513f-53c9-4f2d-88d9-986ded184182", "value": "msitest2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c55548d-c911-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707678555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707678555, "uuid": "e936396f-05bf-4140-961b-f1085a3d4e7d", "comment": "Malware payload", "value": "c1560ba89f0212cf6d6117847af02f85", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707678555, "uuid": "5e335082-7705-4acf-b0f6-7c65cd9b15f7", "comment": "Malware payload", "value": "94d8b6f9aaf668356cc58c264e3644fef37ffea41e8901dcb7b738e3ad5e6a77", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707678555, "uuid": "b3c6c1ac-b6e9-481b-9293-a4c64f24d062", "comment": "Malware payload", "value": "252450cff842a8fc8687bccc8662000214a010c5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707678555, "uuid": "cba36c8c-b179-40d7-aeb6-c47468695b56", "comment": "Malware payload", "value": "d09ba01fba0fe5d567f42783889f7d9df72581a6693a33b2dfd9c99b3f16185ab7f77fef93abb99ee00aba2d378d5512", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707678555, "uuid": "f1232ea8-6fa3-406d-a7ea-9c1d16d9d318", "value": "T1810833FDE9745A8FE1BEB0329AD447EBB79B026206105A3BDB0451350ED7BE81CB7508", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707678555, "uuid": "ab68b741-90ee-4395-aa25-dd890ffbdc1c", "value": "1572864:oIHafpVv5JgkLLI1LXC4vSZnHC1mWyd39nQzMw8DbHzh7ZvgbyivK99zuHZ:n6fpVv5CCIhXd6pHCRyN9QsDTNRCyiEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707678555, "uuid": "7dc4a5fb-44e7-4c9f-b54c-0bc85039deb6", "value": 81733069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707678555, "uuid": "75a76af8-fcec-4f37-a802-0142433441dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707678555, "uuid": "d49c9277-3ecb-4421-bb8d-132702a7b305", "value": "Setup Installer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e275a069-c87f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707616208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616208, "uuid": "628e125e-2309-4d63-a1df-f727e37d8b49", "comment": "Malware payload (Mirai)", "value": "2e3c3da156c331de90cd5de6eff18f33", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616208, "uuid": "2f0ee86e-14ad-47d0-abd8-fdee3089db7a", "comment": "Malware payload (Mirai)", "value": "96d0b2ae7f57ee69b30870481a5a2bc820e818945b88ce1183f3e185be7a59b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616208, "uuid": "b748714c-1989-4b6c-902b-0acf636cd16c", "comment": "Malware payload (Mirai)", "value": "7a7c93f62325c9ba5420e1ae5aed02c2333c25ee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616208, "uuid": "1cbbc455-7174-4750-bc58-685bf7c45d86", "comment": "Malware payload (Mirai)", "value": "f46c2fc5cabdd09404b98e0fc08fe176d245c2ccddbe6deb3c178af125897e2450baa89de64a6d53ccbcb2f4fc034ee2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616208, "uuid": "706d44e4-ebfd-41c7-835a-71716ff66692", "value": "T15F431891BC819A23C5D4137AF56E56CD372133E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616208, "uuid": "5e7e2120-4150-4d1e-b91e-d9fa1d2b9ed2", "value": "1536:/M99jmL8BZp9IFUoWKdYuvQ54wIqkypZ:/M9VrmypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616208, "uuid": "3029e844-bbf2-4904-bcf6-e2d9293fda14", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616208, "uuid": "daccc897-e461-493a-8408-6a7e47884351", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616208, "uuid": "0f52b1a8-ce25-4e2c-bb9d-3b2e40afe57d", "value": "amachlenix.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b7098f-c8a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707630438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630438, "uuid": "171e8495-e64d-4ea2-b281-4776d394aac6", "comment": "Malware payload (Gafgyt)", "value": "09ce98ce7cda996581dddda15a1bc6ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630438, "uuid": "b8e5603c-a085-4d1d-9605-251926af2016", "comment": "Malware payload (Gafgyt)", "value": "9ad23a34d6ab2729467d62b0c5523229a77aa06f79097901bccbd24d2bbb6aa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630438, "uuid": "0cc082a7-da8e-4f52-837c-5e4a74e5d790", "comment": "Malware payload (Gafgyt)", "value": "8a4a42c963d0d3fd736ca728f5eaf23c0a68abdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630438, "uuid": "138f2435-2b19-451d-9200-0e8e90dded9b", "comment": "Malware payload (Gafgyt)", "value": "cfaae0785199b911f0444665e3bdc72fb56c0725710b3d24864798c2b222fbf46058492cc593e5a963cb2d7cd2fc4989", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630438, "uuid": "e42877c1-32c3-4e57-b262-2a116116cb97", "value": "T106330107E7FA4218F19FB6FA98DEB50CA415D2A1639341F49A44303F3C5097C3E6AB89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630438, "uuid": "13e66d8e-f15c-4dfa-a029-982eb75c792f", "value": "1536:Cklun8hu8PywsHCdZAMGgnouy8HyGopXO6eOTrJn:CklHhu8/7/dout2XO6lTrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630438, "uuid": "043584a5-39dc-4320-a575-9c30ea17dc13", "value": 54416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630438, "uuid": "634f0c33-d1ef-4001-b68f-2e839d7b81f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630438, "uuid": "f954b4f5-abb8-4439-82b3-ea275f237cad", "value": "09ce98ce7cda996581dddda15a1bc6ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46a2212-c8d4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707652745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707652745, "uuid": "0a396c15-b86d-4304-8811-2c87c8613ff1", "comment": "Malware payload", "value": "c6906bb26d8a9537bc9b2422dfaa8009", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707652745, "uuid": "0ac6d519-82a3-4623-be12-c418be3db1fa", "comment": "Malware payload", "value": "9ad52e0f9e0cf65d1f946ba729bfd3c6779c3c040f8bd2a5f944b7e09b5a3ca1", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707652745, "uuid": "b7b47620-6eae-44db-81e3-b6ff12c05941", "comment": "Malware payload", "value": "41edca52a876225a35d7ceba7010b80888772067", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707652745, "uuid": "81b83875-bdb3-40ff-9367-613ae78d8cd1", "comment": "Malware payload", "value": "dda762bc6260fcefcd4f172c50127b74a637dfe7e5902dcabf8e3d5ae85a3d95c552e13cf67ea6dfe989a2618ad98390", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707652745, "uuid": "4fca21b7-d7d0-4ac7-9d71-3918e8bf457e", "value": "T1A7A338112CDFC0367A117ABA1FA4B8977C57F1A21E277AC7FA082D8609F3E084581DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707652745, "uuid": "10f18ee2-25ea-4de4-892c-83e1eebf661b", "value": "1536:E44bgzEb4wIfPbIQPzoMIkTzPH3sDDXwIcPEHjIIQkgfLEHgE7PIsPzwPHQP8swM:Ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707652745, "uuid": "e0c3930e-2c40-4ac5-bdc9-04d086dfc8a1", "value": 99613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707652745, "uuid": "4d276c19-583c-4e58-a7a1-1aae99f96a7a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707652745, "uuid": "3ac55353-e1a5-4b00-813f-bd419b07104d", "value": "RD7VJO6.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23a2fb3-c8bb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707641923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641923, "uuid": "5648cce0-2df4-4ef1-b9ce-cd4a3c0b9d0f", "comment": "Malware payload (Mirai)", "value": "da19a1ba10d7ce61f68e234d41640d26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641923, "uuid": "ba5d3b7c-bf21-4330-a256-a592f32d5e0f", "comment": "Malware payload (Mirai)", "value": "a0aa62fe51020f284b141f5da977fa243f0737b28dcabe0b2d7391607550009a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641923, "uuid": "7dbbfb51-c9b9-4c19-bc5e-f146d2899f9a", "comment": "Malware payload (Mirai)", "value": "188c5e4a1a7745f7865bc49338f2efd5000be103", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641923, "uuid": "bf3ec2e9-f2c3-428c-9536-3c0e5a255d8d", "comment": "Malware payload (Mirai)", "value": "49125b8319b67ed68d8f264afdef8e226a3c81f37bb96790d58d232ab99428a1e3b622c3377eed9f7d0a0a6e822b7b93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641923, "uuid": "151ddc5b-bfec-441c-92f7-2dba81180d67", "value": "T15F735CC8BA83D4F1FC6309B2513BA7728773E12A545AEE42C729AD35CC92910E72735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641923, "uuid": "c3cecb18-90a4-4173-85bb-4ab3ea00ca5d", "value": "1536:ui0zOXnGHoKB5KAvMMZlpdtqNEloSjot0rfCeya:f0zWn4oKHCMfLt6k1j3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707641923, "uuid": "e9c5c4cd-999e-41c5-8139-3cfb6b9ace47", "value": 80232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707641923, "uuid": "b9016b76-ade3-4153-a336-c84d5898c2c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641923, "uuid": "0c29ebc3-3004-44c0-87da-d44448f5aaa8", "value": "da19a1ba10d7ce61f68e234d41640d26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1833ac80-c8c3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707645074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645074, "uuid": "34c1fd88-4e58-4575-8ef9-8927e7a7419a", "comment": "Malware payload (Mirai)", "value": "a5b2b547c87c83e24884b2be26843668", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645074, "uuid": "9df26697-3375-4188-a79b-7607a72a496d", "comment": "Malware payload (Mirai)", "value": "a24ed7285bfa84e1292affaa5f6064ff84fc574fee8fb06f6b1da77af99003fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645074, "uuid": "e75a4b96-ee50-4e42-b757-dc0180534b70", "comment": "Malware payload (Mirai)", "value": "7e0a6ee4de53eba2b0b8c4d61d3cbae723766580", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645074, "uuid": "4ca25315-b0e9-4fa8-901b-23f22806b51d", "comment": "Malware payload (Mirai)", "value": "f167bde13509f3ebc9a160d61b22351f8de8b1b4cd347073e71228373e3dcad90de17197cac544965c819a7796985b0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645074, "uuid": "d4c1239d-efca-4275-8ebd-3bc9171e159b", "value": "T1CCC37C76DC2A5F68C695D1B0B0B08F792F63B59042875FBA19B7C2B54083C8DF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645074, "uuid": "f4fb32f8-32d3-4b98-97f3-548247c2f340", "value": "1536:Da60wP/HOD9ZegqaDc+CD0K/nHflnMgEsNqmKW/FRDIhbeyzR:D/P/oDfc+K7/VMgJjKWNRDaeQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707645074, "uuid": "62a3d8ec-e8a9-45e8-8947-76c8e4bc949a", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707645074, "uuid": "053e1bbf-f45b-478c-8f1e-f318af6d13a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645074, "uuid": "5923a78e-fb26-474e-ba14-7afca07da794", "value": "a5b2b547c87c83e24884b2be26843668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347042fb-c879-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707613339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613339, "uuid": "72b19b82-6e70-4aec-95f4-0e7e7c49de43", "comment": "Malware payload (Mirai)", "value": "0db56e1854e878da991054c8df832d2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613339, "uuid": "afd1dbcc-ca13-4257-86d7-ff5c9be4f356", "comment": "Malware payload (Mirai)", "value": "a25ee1276e5e757050916daf4e66ceeb70b626fbcd581b328f004d1e2707244b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613339, "uuid": "c8a2fe93-1fae-48f2-afec-12c8e8cf6c9e", "comment": "Malware payload (Mirai)", "value": "093c49ea6e7de4cafd6923d78c9d7737932920d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613339, "uuid": "eaaebf45-25dd-4b5f-b5dd-ad81af1d59d6", "comment": "Malware payload (Mirai)", "value": "338ec37fb079eaf3cdbc5d702561dbbaa11b6d122cb6f7d1ce5abe7cd6a64c5d9ef5a1b839be837da11e60d0d0a52d17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613339, "uuid": "80bd57c1-d18d-4508-9918-bbbf275bd27e", "value": "T13A734A21BAB61A17C4D5B57A22F34320F2F2435A30BCCA1E3D620E8DBF6461066577F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613339, "uuid": "770b708c-04c0-475e-8f12-4768835cb413", "value": "1536:SCShiSla/0eYX5Xac0/esarIPOlNatNlM58CX3pytWIbH:g17JpKX/e2uwNl893p5IbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707613339, "uuid": "2ce26ea3-f764-46b8-bd73-4cad09aea9d7", "value": 79456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707613339, "uuid": "a1dd7fcd-f613-4394-a0fb-2b8e8204c495", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613339, "uuid": "8fe90316-0146-4c4e-a66a-88cb9a75136b", "value": "0db56e1854e878da991054c8df832d2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b9120a-c903-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707672663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672663, "uuid": "35e24b85-3ea5-4123-bdcb-6eef777b7f78", "comment": "Malware payload", "value": "8c29d4c72097d005a88b7aea2d950e35", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672663, "uuid": "ab868c7f-c243-4e4d-a3f3-779b1a9258b9", "comment": "Malware payload", "value": "a30798880eab8c6158073a38e63d5c014de3976e623e38c29b65dc1e6b0be3ef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672663, "uuid": "a260b7b7-d106-48bb-ac94-eda08b0c65ef", "comment": "Malware payload", "value": "327847bcece765728abb142b482bafdc5442cc58", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672663, "uuid": "da3f2a1a-659a-4a04-9139-17edda1eb592", "comment": "Malware payload", "value": "d298b0856f7d2487822c2cd638332e3ee7f93d1bf848d804c6b687e0b57314311678696ff508ba91870e2c55264fff9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672663, "uuid": "bc4e91c6-ef5c-4191-bb3e-bb36ce5ee12e", "value": "T11DF2DC48B85FEED2DA512A7A0CEED6D836303C066D27C90B7C5D736F3ABAA14C917141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672663, "uuid": "794d774b-e547-43a6-b013-797088ace9d9", "value": "384:5aDtSLuFExF5GY92GbLfe50jOP91p/C1UV6WHUN5Rr1:wI5DBi79141UV6WHSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707672663, "uuid": "30e54c14-0cb2-4527-9d4c-99b332265f41", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707672663, "uuid": "b819297c-0d06-43f1-8250-fe2f3ebcc13d", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672663, "uuid": "b92c02af-3218-437c-b4f8-cc3841cac756", "value": "SecuriteInfo.com.Script.SNH-gen.25415.17378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366d2789-c8d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PythonStealer)", "timestamp": 1707650708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650708, "uuid": "f2c6e3a5-c20a-4225-9947-eafd6d21357d", "comment": "Malware payload (PythonStealer)", "value": "2244f05940898c038b1a5b0165671926", "object_relation": "md5", "Tag": [ { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650708, "uuid": "73838907-c7ad-4f08-9f71-3304ead22b54", "comment": "Malware payload (PythonStealer)", "value": "a81235bfa27fbeb78ac8236339d80016f2e45cc621eb154a5077045472df6f01", "object_relation": "sha256", "Tag": [ { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650708, "uuid": "1e55c86c-280f-47a4-ba08-0e2aee523d2c", "comment": "Malware payload (PythonStealer)", "value": "86e2b1cee598bf80142f5126bd04dd341119454b", "object_relation": "sha1", "Tag": [ { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650708, "uuid": "12d1547c-2c93-45a2-ad11-559c16af7ab4", "comment": "Malware payload (PythonStealer)", "value": "06c209ef89e9e05ba2c19f08dd68677ebcde3522c2e549ffc778f3c852da8e159f5c9160aa329ea40ffe03ceb5d53a86", "object_relation": "sha3-384", "Tag": [ { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650708, "uuid": "63c410fc-adb9-448f-81f7-1ece3e271e91", "value": "T11E0733BE7B8A48F1F24C9AB52AE01C86FDE2283E02814DDF0399D575C2696DC4CD9F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650708, "uuid": "428fd2a3-4494-429f-b792-bdf4b40c6fba", "value": "393216:mzPU5XrSsWeIcAYiP3hjvyamTt8UdIb0OMIZX+m8CaFyptugYDFuJx:mUhWeIj1vyampeSQOmwFypHYhuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650708, "uuid": "595d5356-079c-47cb-8f3a-a80c3c045cb5", "value": 18223424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650708, "uuid": "3b5cec08-9c2f-4213-863a-b1c309bb6e6b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650708, "uuid": "af9ce472-8925-41c0-8ef5-f08a92a0b041", "value": "tJzZTV4.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb0ee27-c90d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707676977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707676977, "uuid": "7f521633-9a4e-43b9-9022-5b072db18133", "comment": "Malware payload", "value": "879f30b256f7acf2e4d4ca5a8f1ec210", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707676977, "uuid": "ec44c178-be4f-4928-86c2-85055884dfcc", "comment": "Malware payload", "value": "a9e178c8bceacd88e41673779606d041d49108a74807710cd4badf753ae2e020", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707676977, "uuid": "f2ef1282-d1c8-4fc6-a17a-e50cc9ee0219", "comment": "Malware payload", "value": "985f9903755fc011b8af09544c060531f0b459e4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707676977, "uuid": "2a4b73d4-fb8a-49da-a92a-8b823483f84c", "comment": "Malware payload", "value": "755270697611d1e003861486b488557ebb2280e94237ae746bfc32b4ef02c2b46fbfbb543fdd584ae92249da2d3e1d57", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707676977, "uuid": "8ec90b4c-7b18-40ab-8a26-7d2477b81a26", "value": "T19997339BF3689A1EC8F7527249791B60054B0C618F83D7C76918737C28BB9D06F4ABD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707676977, "uuid": "2d3e8381-4b86-4d38-8d3f-32b4903ab502", "value": "786432:63KJsO83S5QhTj1U9Ly/kfrw5nA0O5viUQtVseseTe+YuMLX66k6dwkxA+4DG:63KJsOmSv2/kfrw5nRkiLtVW9K6k6dwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707676977, "uuid": "e8bae5a8-bee8-4ccb-a897-e5be971b9a26", "value": 42144899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707676977, "uuid": "3b9133ec-c3c6-4840-b17b-0777d9a19dfd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707676977, "uuid": "36c38a19-f6f7-4e95-8633-fc3c23b4327b", "value": "Love Emojis Emoticons_1.0.1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358f75a2-c898-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707626655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707626655, "uuid": "9258f2d2-71c0-42e7-8c87-f0630a93b432", "comment": "Malware payload (Mirai)", "value": "82d2cc55806b3d9bcfa6c16c391b6f6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707626655, "uuid": "bbf32d08-aa08-485c-814c-58ae36abc8b9", "comment": "Malware payload (Mirai)", "value": "ab328e1db4437651dc5647032a54a947beda7d9e321ee8a88c4efbbea793ffee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707626655, "uuid": "0ef56bc8-42f2-41df-bd00-5b4ba8cdbf2f", "comment": "Malware payload (Mirai)", "value": "3e183cf532cfb09f96c564f07b34098cbb19e7e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707626655, "uuid": "86606b46-b97f-451c-b1f3-e6cc6449470a", "comment": "Malware payload (Mirai)", "value": "d8bb7cb257883cab409fb54781efea77683b58625dc9b2af1040dfee862fac13eb75cbd73d2a46d7ede5da0b7149c620", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707626655, "uuid": "16eb5bcf-5775-4da4-aafe-e082079d591b", "value": "T178D3F845FC505F23C6C612B7FB5E428D3B2A17E8D3EE720399256F21378A95B0D36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707626655, "uuid": "e72a77ca-321b-435a-bbbb-83fb4169963c", "value": "3072:gHL+mYo4xFOV48wlPNbMRfaPuk84GOV9LHni3E:gHLeXAV48MPNbXt9Tni0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707626655, "uuid": "18b76038-c553-428c-96e6-f5744456f9c8", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707626655, "uuid": "330c29b8-08ec-4f5c-88f4-9da7e76a65f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707626655, "uuid": "b5b223f1-8f32-4f75-9066-24e7f4d7cf59", "value": "cundi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9659e1-c8f4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707666347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666347, "uuid": "8b18c400-1dae-4413-b29b-959aa2e18684", "comment": "Malware payload (RedLineStealer)", "value": "5214e287e7509bb4940901996b496d4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666347, "uuid": "df441bf3-a29e-4842-871f-7d1eda67ab41", "comment": "Malware payload (RedLineStealer)", "value": "afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666347, "uuid": "61385cd7-c63d-4d9f-9cf4-05a400aa5b9b", "comment": "Malware payload (RedLineStealer)", "value": "a3fe343817dc817c091fb2b30b36600abfb062df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666347, "uuid": "e6ba659d-1d00-4ec4-a952-b052a9a675a0", "comment": "Malware payload (RedLineStealer)", "value": "3c54a4e10bef0b753dc811ba09454304928031aa64aea4de9fe18a7994d94ac20ff2bf86d5877b13e186f0c9739f426c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666347, "uuid": "03592d54-5c19-41e4-bad4-6ac06330a2d7", "value": "T11E8523047168915EDA33CE7D99A5C97331A69E01ECC08A20EDE97FFB7676B467082F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666347, "uuid": "879b46fb-1bea-4bb5-a148-429c78a221d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666347, "uuid": "152c24d7-f47a-4394-957a-4c665eb278d3", "value": "24576:QLBCNLuUJ8CMxio71kiSyvrZzUeQmu1+sbkGsN9zZ4uQMWsUbMjCfxXmikVgiK:Q94Lu1C6ryhwrFQmuXuFdHWjIjCgzVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707666347, "uuid": "2516ef5d-4277-46a6-8480-6c03dfe5a3d6", "value": 1783808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707666347, "uuid": "c021352a-6c68-4a73-a5d6-8535c906cef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666347, "uuid": "e70ce9a1-bb92-4ffb-895c-57a3d6cb1d2f", "value": "SecuriteInfo.com.Win32.MalwareX-gen.15133.26520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24134ae-c880-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707616664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616664, "uuid": "9bde75ca-22ab-4169-bc0a-184e8c18feb8", "comment": "Malware payload", "value": "b8d234fdeaea24be7a20b19a2f8c133e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616664, "uuid": "1601d5f5-9daa-4b4c-ae38-35e2e9fa59b6", "comment": "Malware payload", "value": "b1041d76466ba59f9c180b44594362735de4a93c3cbc72fb053fae1db1cc1410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616664, "uuid": "3dfa2fca-9831-4e4e-a079-9b927add20dc", "comment": "Malware payload", "value": "78c0da0d476cf855c4eeb9f08d3048f3342dc4e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616664, "uuid": "65ce5e0f-7b2d-4239-bcd0-b8fdb258d49b", "comment": "Malware payload", "value": "6bbad0039c4645377a68add83fca0cd9dcfc90bc4b87219c56ad14c7543bb4fbd26f4a2c84e08ac0a69b84e72a480452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616664, "uuid": "2f5d440c-da1c-4dd9-9bd9-e90f384aafd2", "value": "T13A530277663DE8BDD41341B287CD0448F66F383B5AC5272B08A19AFFCCA52986780F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616664, "uuid": "452eeae3-e079-4224-95dd-7ed980948985", "value": "a50e815adb2cfe3e58d388c791946db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616664, "uuid": "cdc43637-2546-4ce1-8b13-4a355e412429", "value": "1536:K4dJooh0Wa0aer344Jw/ytUqVS5EkIijQ1fTNPUtU7xu:K4dzVTaer344JzthRZijQ1JPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616664, "uuid": "4ea6dbc9-297a-45f3-9320-e75efca67bfa", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616664, "uuid": "f3fdc761-e06c-47f2-9e54-3e4deae49239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616664, "uuid": "601e39a3-0b3f-4557-b0f6-6bb9f328af4f", "value": "Expirium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca700a5-c8c3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707645081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645081, "uuid": "3a60dbce-fc2a-4269-b42a-348e3dfde6dc", "comment": "Malware payload (Mirai)", "value": "a4ff8af36ca49ed1a687480ad8d04824", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645081, "uuid": "07332f0d-b086-4abe-ad01-f2aff26cc73f", "comment": "Malware payload (Mirai)", "value": "b10778308a29518c19a62320fe3bc9b0f6a18ea67398ebb7cbef47ba927edfb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645081, "uuid": "290773db-a589-4dc0-9a8f-919f6633d4e5", "comment": "Malware payload (Mirai)", "value": "d84eafc1b437374265739519765c2876fa5ecf00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645081, "uuid": "a57a4a37-e706-469c-9773-e21ff5e01b3c", "comment": "Malware payload (Mirai)", "value": "16373e7b49440dcdd5c7a8a6ba42326ea404ade2301dbf1cbb07f3bb4fe42703a6cd8c903159615d42824e27567911d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645081, "uuid": "5cc98a0b-07bf-4fe4-ba86-e144d90ce61b", "value": "T11B04985E6E128F7DF668873447B78E25976833DA27E1D680D2ACC1101E6039E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645081, "uuid": "59ec4ecc-147b-4b47-8aab-1ccd5ff21130", "value": "3072:f6uSXvJnzjP0jCdzpyi579Yxy52tIen9A6qewZQPhaMh:f6uSXvJnvP0OdzYigAEnfqnZIhaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707645081, "uuid": "056a359c-66b1-4ed1-a98f-f9b4e2a358c9", "value": 181968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707645081, "uuid": "cc9fda5c-c394-4875-9184-53f7ef9d162f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645081, "uuid": "c71f544c-f4da-4549-8ea7-1d24675b3e60", "value": "a4ff8af36ca49ed1a687480ad8d04824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e2f815-c880-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707616349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616349, "uuid": "8979d7d1-8f20-4ca3-8c8c-9960f47a9432", "comment": "Malware payload (Mirai)", "value": "9d0592b05fcc9c461279958832151e3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616349, "uuid": "10429e16-351e-4d66-9eed-ae6efd7c6488", "comment": "Malware payload (Mirai)", "value": "b1779b237c735431f4d1104eac42a873c2d688c046004e3a77de451af8bae95c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616349, "uuid": "d1adfdb7-0940-4c7b-ac0f-278c5f261d93", "comment": "Malware payload (Mirai)", "value": "f6868f9d328cbd9564e4746abc37464938a7dcb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616349, "uuid": "1761ff05-7e50-4d78-96e5-0cb3d87c1c98", "comment": "Malware payload (Mirai)", "value": "e6b0cb7f7b267b47b885cee57b575a8293d09fd5956b55f4166cc4de06e0dd9c32dd7f151f0c15f03daa512e7144a336", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616349, "uuid": "30481c37-db04-498d-845b-46229bb57cbf", "value": "T1D2430981F44F81F2C44B497050A6F63FDF31D9AE42B1D62EEF99AF32DA675429101A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616349, "uuid": "6db3a9ed-794f-4273-8f72-5ea5a081ce4c", "value": "768:SfYcj17BglTIJ/sITKUEPgK+4CaS7HA691CO1zBAx3/9S2BxXVhcTqmq16US0s2:6DgIJ/sITaoECaCzulhYqmG6R52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616349, "uuid": "c1a39416-3871-431a-bddc-fefa0dccb23e", "value": 55216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616349, "uuid": "de3f697d-11f1-4406-8ac9-262eb7a1931f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616349, "uuid": "218ec5ce-a16b-46c4-adc6-f7b58a3560e7", "value": "9d0592b05fcc9c461279958832151e3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f9cfe5-c883-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DiscordRAT)", "timestamp": 1707617665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707617665, "uuid": "58c9287f-1cc1-4109-9062-28ea72e585b9", "comment": "Malware payload (DiscordRAT)", "value": "f7816fb09d8d8e6b166ef851678b9eb2", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707617665, "uuid": "b8d925fe-f15f-438e-aef4-917f69b7f5f8", "comment": "Malware payload (DiscordRAT)", "value": "b2474e75aa1c5063e02f9579101c10477596d767fba09de0a10d8a9aa22f6bbb", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707617665, "uuid": "409a7856-dac6-4631-8677-755885a75c55", "comment": "Malware payload (DiscordRAT)", "value": "652a89d9f90ff200dbb3e0ca2a868a87f86f4c40", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707617665, "uuid": "507e6ea7-4dec-44c4-a481-12c7da920b8c", "comment": "Malware payload (DiscordRAT)", "value": "e08d819f80221e03b1a7c16fa9288cea625d869f64d99e7ec5cc13d2c6c4b1be74d5f2da06ec61d55ec20b1e58769fe0", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707617665, "uuid": "95d06f33-bc0a-4aa0-a2de-aaf67b5be6e0", "value": "T19E1833517781A4DAD5D4A137B281C9AC8E22B0A00F93DB1CD7E42B7A69C31D47D36FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707617665, "uuid": "e75f7b61-29b3-4b08-9aa8-4748e30a702d", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707617665, "uuid": "b486bd13-fd1b-4b7b-84b9-43cd330f3540", "value": "1572864:uvlQ3jewiESk8IpG7V+VPhqArYE7mjCNtOWB/4PcPJKW59ObbP1g5:uvl+CTESkB05awArMu/dB/YcPsS9O3Pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707617665, "uuid": "d985ae83-0fef-4b1e-8a6c-605304b4b495", "value": 84991285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707617665, "uuid": "bdfed33e-ea16-42bf-9817-1932e681f9c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707617665, "uuid": "a0444853-90ad-4a59-b10c-3fc0cf3f71c5", "value": "LLR SETUP OP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2774e902-c8b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707638228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707638228, "uuid": "3aa8f981-e621-44b9-8923-0d78961a2154", "comment": "Malware payload (Mirai)", "value": "f30cc59c770c68a4e1717d493a777c6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707638228, "uuid": "93785da0-efa9-4c9a-b609-1fb5363cd512", "comment": "Malware payload (Mirai)", "value": "b5c8bcfab39ff142b860bcc08b0951e6a080b051554666e1509fe8fce25161fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707638228, "uuid": "955d2a33-c1a4-41a5-bda8-c397cba19c7e", "comment": "Malware payload (Mirai)", "value": "1ce4e1e80c735b59502b0e4d853b617f40738516", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707638228, "uuid": "8e187c0a-b2b7-4e6c-ae34-f822387eb650", "comment": "Malware payload (Mirai)", "value": "a6742350aa9d39ae7486bb85ebe66d25b4398e575d0d80fb0c48b28c9459cd51342504e2a8ec265b8139693a282214ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707638228, "uuid": "adce10af-a7af-48eb-b814-81cd340e3c3d", "value": "T1B1B30845FC509B17C6C212BBFB4E428D7B2A1768D3EE72039D256F61378B85B0E3A146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707638228, "uuid": "7242d1c2-0f6f-4001-8749-b2cf6865ef07", "value": "1536:ZhNOKLDdTHan1/AxPG4VamYT8rhhZM5c6qNftZxl8zwywLFOK3HbWHiJWGOJzU:ZhrhLw1/345Y4rhhZmqNVBkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707638228, "uuid": "008d8cba-496f-4307-b6d4-420948cd90e0", "value": 117504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707638228, "uuid": "333656cb-351a-4d0c-af8d-733c78ffad8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707638228, "uuid": "13e564ec-212b-4dab-8037-0741f54c75c2", "value": "cundi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d8e206-c8e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707658888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658888, "uuid": "8e4a6310-6aa4-49fb-8672-b4af369db72a", "comment": "Malware payload (Mirai)", "value": "307031184f0195ec9bd1f6830254747c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658888, "uuid": "e0a473e0-0206-4c87-9e0a-fb8d6b6818fd", "comment": "Malware payload (Mirai)", "value": "b6983d110227610d426c07653cec5c1ec5936e60056df325b5f32655fdb8230f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658888, "uuid": "ceb3d51d-34f6-41e4-bceb-a1bcad793fb5", "comment": "Malware payload (Mirai)", "value": "3577b62a12b083723e86a7f9784920c7aa76a73e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658888, "uuid": "535970b7-01a3-44fa-83bb-0ff753b44c6e", "comment": "Malware payload (Mirai)", "value": "dabf052bedf04bc84259517bc9300961a5ed4aa3f492969adbea39ffd303c4981f3d92837d7c94cef6747c521b3bf600", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658888, "uuid": "8ea5ddab-4a61-4f95-bc90-685ba36cc2b2", "value": "T144B39DABF2071591C8A346F007CB4FDE6E1722C29F57C4E36C6E253E58750DB1A0AB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658888, "uuid": "d51133d5-e04f-41ea-ad64-53bb3a6d7742", "value": "1536:Rg4uLcytbI96MfY2aye7tcOiyRLqlqOgb3a10S/LWmoo:e4uLcytU96iY2JatcwRLqlqOgbWTqmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658888, "uuid": "862bda9d-d8e3-4814-8420-31acfba17c59", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658888, "uuid": "656fe0e2-2e19-4454-8d4e-e3ed8caeee28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658888, "uuid": "71fcaa9f-fb80-4798-907b-cd77adbf9b7c", "value": "307031184f0195ec9bd1f6830254747c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f8e2a7-c90a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Heodo)", "timestamp": 1707675828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675828, "uuid": "f8ba69e5-92d5-4591-9508-878018e4b2aa", "comment": "Malware payload (Heodo)", "value": "f917c77f60c3c1ac6dbbadbf366ddd30", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675828, "uuid": "51e71d44-c0d7-478e-b791-c4220b0e57ff", "comment": "Malware payload (Heodo)", "value": "b76fbc81bbb7f3108d27d9da9e2646aeb3769fba62bf7961f79306812de3486c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675828, "uuid": "20bdf9e0-5c3d-433b-a044-e07606e9c0eb", "comment": "Malware payload (Heodo)", "value": "7614669bcb33170bbb3df2f95a5fbe3328e4bdff", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675828, "uuid": "86c36168-43e5-41f0-8237-7438815c6eeb", "comment": "Malware payload (Heodo)", "value": "189d7fb7e7eee623a6451b1e0d0bc4e899d0e30217283b8f5f062eafde20af7343b91c6adc31f23f4b79eb3006ceebe3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675828, "uuid": "5ff3d580-7f24-4769-a2cd-6a6da28df1ad", "value": "T1C856331572A009F1F4B7823CCC82890AEE77B4140710D6DF82A447B65F67AE6AD3FB56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675828, "uuid": "6cafc6b8-10c5-427b-8695-f59c0cf13db6", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675828, "uuid": "17303e17-cf11-4661-a264-3fe4843260ca", "value": "98304:rRF+nhjji65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeFp9hjkrw0ZUc:rOnrDOYjJlpZstQoS9Hf12VKXybjCM5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707675828, "uuid": "c5309311-27df-43a0-aa38-c5979f795826", "value": 6174055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707675828, "uuid": "d60183a9-a27c-4457-bfaa-2e73a84cb6fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675828, "uuid": "f150722a-ebf2-4000-8801-6bc48b25e33a", "value": "SecuriteInfo.com.Python.Muldrop.25.8678.4056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2d5674-c8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707658445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658445, "uuid": "42a84c38-6393-499d-b7ef-4b63052cc1af", "comment": "Malware payload", "value": "c3df084b2a77f9991a6dd52f8554e955", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658445, "uuid": "bfb238c2-1ef9-4529-94b9-3f2dd7cd7139", "comment": "Malware payload", "value": "b7e59d1f0872441509361a6f83764daf6ababe1f5aa1fde03ed592cc179b0ebd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658445, "uuid": "a41315ab-f0c3-4604-88af-cb993747f216", "comment": "Malware payload", "value": "07d20f0a7a586c413d6c2bdb87ada54a793fae2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658445, "uuid": "31996182-c072-4db8-b91c-871ae2e3344a", "comment": "Malware payload", "value": "9ee64b9e182240971d266257ed5395feafeb33a4310c430e7121048f3480f1dc9ccef36032d6400ab900743e3b317786", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658445, "uuid": "a8c53e93-ab03-4120-8891-59564ab7d435", "value": "T1EFC5D616F8D604E7C5BFE0348796A322BE7138AA8730B7D35FD15A5A1625FE46A3D300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658445, "uuid": "499e95fe-0da8-442f-bd69-cc4ad4b61d03", "value": "24576:8JYA0Kg4fMPmA1aYJfSYScbGCPw8aGdd4Lb4fETyvMwGVIS2bTgJLh:8JY7p4v+aYJfSYsCdjdd4/xTybGem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658445, "uuid": "0b4ab0e4-5189-444f-ab0b-1a87b43f8e49", "value": 2610744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658445, "uuid": "06106a13-3199-4a61-98de-3e508ba0369c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658445, "uuid": "78a3104e-ff61-4b13-bf73-1a55cab80a39", "value": "SecuriteInfo.com.ELF.Agent-AOM.13768.15689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d07e2f-c894-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707625018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625018, "uuid": "4e7d0ecb-07d2-48ac-a3d4-f486f5cdfee2", "comment": "Malware payload (Mirai)", "value": "4fa6da63fdfbf2ac24484aeb9b5e0215", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625018, "uuid": "bdbae816-8d17-46b1-9e9d-e3999d1fe254", "comment": "Malware payload (Mirai)", "value": "b95c0d2c6e6ef4e8b4048d00751947bb97f71b12c2a1ec9ea9d3441de24dc5fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625018, "uuid": "2e8be427-1746-4696-86ea-7d53356452e0", "comment": "Malware payload (Mirai)", "value": "d1fa567c3dba8653eb840c8c0121682543752618", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625018, "uuid": "fd8a20e7-9371-480f-b18f-05cd7d7f47d3", "comment": "Malware payload (Mirai)", "value": "d1b8fef7baaeb2e5c7b26da3f9f8437dec7ef10a4fd0de110d4ddd6ddd3255c32e77eba812620e12a1403416d0b1573e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625018, "uuid": "7a571be9-2b86-43f6-aec0-36de1d0f94d6", "value": "T106C2E191E1B62DC6FB3A7E902A75C2C177A04E9EB777CCD2255CAF0408632174709BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625018, "uuid": "7cb72d08-4c5f-40ff-a440-5d74bff3b1ce", "value": "384:Z3ez9/6Jgn9yMGEGHV4u/DT8HgPEt6seDYc/O9zlM4uVcqgw05VxJc01:FG959yM0HWubJsWDYcGI4uVcqgw09S01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707625018, "uuid": "fa6f60e5-9c0b-413d-94bc-5fea370ad8d0", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707625018, "uuid": "e10ad589-c57f-4153-b9f4-6a6c24eb1094", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625018, "uuid": "f9ec4fa9-da1a-4c1f-810b-4a670e2b3932", "value": "4fa6da63fdfbf2ac24484aeb9b5e0215", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075148b0-c91c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707683271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707683271, "uuid": "3287c09b-e0ab-4afb-a2c4-1650a9d96219", "comment": "Malware payload", "value": "fdff3dab5f961f69ea39c4e508db2c11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707683271, "uuid": "d7ebfe0a-8125-4a71-a4a2-6754214f4f5d", "comment": "Malware payload", "value": "ba43e793f372dac054027b6153c7b403180b222c7d5e1b622bbc12dab4ffdd05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707683271, "uuid": "a9255b62-cd81-472a-a489-71919421d738", "comment": "Malware payload", "value": "ad8f9b4430125939b11a5c7ee2091c3fe7f2583e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707683271, "uuid": "f05a8749-10a0-45fe-993c-aaf88e4609fa", "comment": "Malware payload", "value": "c40072763dc1ccdce403804689196933aadb385ac2f2f7b4e6040a325d3c469537df12ae297e84787d5ca5e2436e3dac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707683271, "uuid": "99d8daac-e036-4534-b348-3590702c02b4", "value": "T153A3E141A714C0B3DAF30B3065B56B6BAEF6952526B46F0B03406D4CBCD27D0AE1F7A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707683271, "uuid": "1e87ca4b-4af9-43a9-bfb2-43aca06c7f8b", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707683271, "uuid": "d9bc7efd-cdcd-46c0-9eb0-4681f885824c", "value": "1536:TQNRwF/6HWFDw2ShOp0DiJkugWQrNQLAs98YfOtvzGpkxqFI+Pl06uFsKx:sNRCywDw1DiJkuJQraFOYGvs2fWl06aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707683271, "uuid": "0eb30488-5984-4e0f-8d4d-916d1253ed69", "value": 98296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707683271, "uuid": "945fabbb-4e5e-46cb-8b35-0f3c63a350f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707683271, "uuid": "ab12c7a8-006e-4315-bd98-4ff20df27a7c", "value": "SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Agent.gen.27679.26312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77df98ba-c8d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707650818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650818, "uuid": "3fcebd03-51f4-43e6-a843-2530c0889b14", "comment": "Malware payload (Mirai)", "value": "6ef4fd11beccfa02a6f7a2ad85c3eb19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650818, "uuid": "3f884664-00a6-46ba-8959-cf1815a3d6d6", "comment": "Malware payload (Mirai)", "value": "bb56030db51af86e100cc1bf11947af9cea5fe41e1e9b4e5e0876e935038105b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650818, "uuid": "70b4ae67-0892-4a54-9c34-b2d0b6ab2f89", "comment": "Malware payload (Mirai)", "value": "08bcdf6a25296d1d363e7996ee75e2fffae6b3cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650818, "uuid": "af82f5ff-82b5-4eb2-965d-4af7457e557d", "comment": "Malware payload (Mirai)", "value": "b6bb467ecb2d327fe5f4cec489bc2fe1939e16843acc90306c03fef34fbb37a0bce3f65cf1353797028acaa82dac4ea6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650818, "uuid": "dfc3e691-5424-4cff-84ea-53fb379e4b73", "value": "T1CB4306B91615B2ACF9E45078F80320F52D020F183BEDE2D3A183657AFE74B4DB996D16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650818, "uuid": "dd183d5c-2898-4dad-9047-dce990c716e8", "value": "768:+HTDi5gFcxEpZL6Bax9vH792EKKBdwXpV7Iame:+HS5gzcB8vQOa7Iame", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650818, "uuid": "509d764a-3422-44e4-8d5e-f0962f90ca9b", "value": 59144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650818, "uuid": "f22b10bc-1c2f-4e7a-87a0-cb0cb50e0601", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650818, "uuid": "0516cae0-8525-42fa-a2dd-c6471b9727cd", "value": "6ef4fd11beccfa02a6f7a2ad85c3eb19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08838ca8-c92e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707691004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707691004, "uuid": "18a733c6-80f2-427d-845b-54fa108a9300", "comment": "Malware payload", "value": "bf17d7f8dac7df58b37582cec39e609d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707691004, "uuid": "4ac9597a-e7fc-4c1f-a404-712023c80f51", "comment": "Malware payload", "value": "bb7c3b78f2784a7ac3c090331326279476c748087188aeb69f431bbd70ac6407", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707691004, "uuid": "eee704f7-1716-43c2-a7c3-050a2f761df1", "comment": "Malware payload", "value": "0c55b3c75e5759efc6db20b6db4fad790cbcd4e7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707691004, "uuid": "e079c173-5b67-4113-b081-8f37ffd7a229", "comment": "Malware payload", "value": "f7829ce2579ed49a0cba9b865e6dd839b5fc96f72da3c39c57e2aa1f99268d75d6abf4264c093d58f31701dbb17b5558", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707691004, "uuid": "f21bfc11-aed4-4bf6-94ea-bafe6945ab40", "value": "T187F4CF0176C79632E1B7023136BE67A05A7DEC301EB5C61B9394B69C2D712D0A369FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707691004, "uuid": "8d667361-dac8-420b-8dc4-7fe1316b1f91", "value": "12288:V+HbRUFb4H6KJF/pDYkw0gCvoKWg6AZznX4y4NRlozIlGx36Thxv9ipLnGr0Hm:V+uOxtwYXT4NRlVkx303icYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707691004, "uuid": "4411d212-a201-4160-a213-1a331aec4259", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707691004, "uuid": "99e15ace-511c-474b-9566-3a09e6b6e511", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707691004, "uuid": "2816acb2-9c06-483e-aa9a-80df2e2f0bc4", "value": "Google AI Gemini Ultra For PC V1.0.1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bf7e7f-c8d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707650808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650808, "uuid": "539de6f3-606c-4e62-bec2-722742ff114b", "comment": "Malware payload", "value": "5229c6fbaf97ca3eca65c2ff4476bef0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650808, "uuid": "f1d6dd3c-cb20-45a1-a80a-70d1f6f3af7a", "comment": "Malware payload", "value": "bc2811a4c494686c90dc221178732286729c211e7b0998519f089c8b7909be84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650808, "uuid": "b6dd2f85-0d13-4671-98b7-6f8d131cb14a", "comment": "Malware payload", "value": "3b89ecf5e5c29b84f99048d295892fbae21de6a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650808, "uuid": "17afd3ed-bb75-4bbf-83b1-d61a08cac03d", "comment": "Malware payload", "value": "a031f33fc779fc2dbf8bfc2391e50d72284ffa4c20cc6b54db29f1acdec8fa3dce86aa9ae4629aff3ceb425538ae063b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650808, "uuid": "1cb8b9c0-cb6c-4504-b2d9-033e14b76d37", "value": "T1BC21FC7FFBBB8A06C850903A0E63A3147660D88C0014926ABB217B1DDC116116E921F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650808, "uuid": "d5fb27a7-397a-4827-8d8a-32985e276803", "value": "24:3jvDq3N0yTKE9kNY8MRQPhCrjSkvFSJ9lrNTawqFk:XWVTlUY8MtDv+9ZNuPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650808, "uuid": "f183e845-68f6-41b3-85a8-a047a5afe74d", "value": 1272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650808, "uuid": "34cd5223-8bae-40eb-80dd-c9a97c81d513", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650808, "uuid": "310ab2a8-58af-48e0-8c14-f0902e490bd7", "value": "5229c6fbaf97ca3eca65c2ff4476bef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7870afe8-c925-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707687326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687326, "uuid": "de456b5d-cac7-4a2f-878e-f6709995bf8e", "comment": "Malware payload (Mirai)", "value": "8e3e1a9fb5a64bb4b5de4cb166d2b034", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687326, "uuid": "18f18efb-9812-4de1-8012-995063138010", "comment": "Malware payload (Mirai)", "value": "c0dbadba08099502a7e3db1725a64d3cacc48c0fe80045e9f3df0aabc2f4ef5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687326, "uuid": "9212c895-a92e-43ca-9c51-809aab9da02f", "comment": "Malware payload (Mirai)", "value": "7293d2dd6f4ce941fd644302ad298e3b1b89a1f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687326, "uuid": "1f34c606-e3a8-4823-b5df-0cc6025ccabb", "comment": "Malware payload (Mirai)", "value": "070f17340b45341ae3df91cd11bb9088b2debd93194bb2076cb7c22c1f02a55c32783ceb95c60ab70cb7b3779809fa47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687326, "uuid": "d813afa4-afec-48fe-bab5-3e1064b06107", "value": "T16E73AD72E1686DB8D0654A747E988E719B23A48052D33EF6E781C7650413DECF40AFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687326, "uuid": "518781fe-e040-4f70-ba97-39337fd64b1e", "value": "1536:3aL/3+5hmwtIHKyNon+91rB9X0rrn9Aq3weKSbEZpp9CbwhT:36vkoIyNo+zX0rj95wRSWp9zT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707687326, "uuid": "56b2044c-fe2d-405d-b783-3ddd108d8815", "value": 78976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707687326, "uuid": "0a8ec0f7-64c9-4aa2-a156-95c786f83c64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687326, "uuid": "84ec7ce4-3033-4165-926d-7fa3298d3614", "value": "8e3e1a9fb5a64bb4b5de4cb166d2b034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f622726f-c8b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707637286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707637286, "uuid": "85fedcbb-7e60-4400-8c41-572c0b346fb4", "comment": "Malware payload", "value": "aa387ba65ff8c796cbe90feec010c008", "object_relation": "md5", "Tag": [ { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707637286, "uuid": "d0d6bf84-5079-4bff-8b8d-0d77bf3e2884", "comment": "Malware payload", "value": "c261381450b18b2eda27b856ae27826da07ae13374b435e14f5a54ef77824cbc", "object_relation": "sha256", "Tag": [ { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707637286, "uuid": "caa86b50-ab05-4c53-80e0-bba59c52abde", "comment": "Malware payload", "value": "41364464856ab1a512cb4af67762428620d8dbf2", "object_relation": "sha1", "Tag": [ { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707637286, "uuid": "98395aef-1162-442a-8974-2f373e162478", "comment": "Malware payload", "value": "9623d58c2478dea4b3330ff58ffb8ad01001fd2a311c5beea3f46c270cd368a4428c2545e38b352a4952670680d80ef2", "object_relation": "sha3-384", "Tag": [ { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707637286, "uuid": "843e2b16-1102-4f0a-898c-a54b63135095", "value": "T1A4278213BDCF8422E5686277DF9ABA466913FC421F0365CBF60A7D1A1EB3F160844E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707637286, "uuid": "a3dd815b-abcb-4df8-8e3f-43e9493e185e", "value": "12288:yUDuH/c8F8RxdIvbyM2D9H9t2DuaQxNnBKYo5:ybH/vmdIWM2hb2HQDnI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707637286, "uuid": "ebd10b9c-b5ec-4c89-9579-39a9218ea208", "value": 20971520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707637286, "uuid": "55a3ee0f-7cbb-4c3b-8289-3a39f33d0e46", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707637286, "uuid": "63d34903-3f5e-4f19-81cf-b27d76cbd526", "value": "Taxes_2023.vhdx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c3b604-c90d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707677202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707677202, "uuid": "e3bf6c6f-1b6e-4e33-9bc9-bf906c4f9ab0", "comment": "Malware payload", "value": "b6b0dd075860a0f0b4bee87ca74af37e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707677202, "uuid": "7bc2b999-6668-4364-af7e-fedcad0a7614", "comment": "Malware payload", "value": "c3d38f7f1c143a58cc65bb9c10be92d21deb24217e6dba7988039dedcc18e0a6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707677202, "uuid": "06706ded-1c0b-405e-8bdd-b7db2f2a33f4", "comment": "Malware payload", "value": "ced9354bdefac81abe203556d86323059c40592a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707677202, "uuid": "75d4b880-ace5-46e2-b55f-d240d4d10938", "comment": "Malware payload", "value": "eba1a65b2c80021bd89630bf448bcb2eceaeacb57ca006f814fafe56523da6629f54095af4c0b2e4d067df87b16b3179", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707677202, "uuid": "05dedc74-a313-43eb-9166-5f72e77e4534", "value": "T1C186EF57F31C996EC4F35376893A5672854E4E228B439B936904B33C28BB6D0CF69BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707677202, "uuid": "5d0c1b2b-ee1e-4bf0-adc3-a8720fa3791b", "value": "196608:o+whb1p+1WEvNKE3UG1vCHOYM5s6Gu/f5I2RP:o+wV1p+YEv0E3UsvWjoN3e2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707677202, "uuid": "d2195b37-7e40-4d6b-b0f1-fc51ea996ac3", "value": 8434297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707677202, "uuid": "ee49683c-c861-47cf-a1ae-ba4794c8ea9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707677202, "uuid": "485d54eb-9ccf-48d1-87b9-9c9ab6255967", "value": "Prank Chat - Fake Messenger_3.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ac57af-c88f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707622815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707622815, "uuid": "cc86ce5b-3a40-4032-8145-f894cb941933", "comment": "Malware payload (Stealc)", "value": "fcb6adcf738982cca1afdf3710ba489b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707622815, "uuid": "6789e57d-67cf-4b8d-9b72-4aece2b51efc", "comment": "Malware payload (Stealc)", "value": "c4290abc9b05d22cb4112768759acf854f881d08e697528fa2549740f89b9d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707622815, "uuid": "49a1e74b-f07c-4378-a1fc-67d2a42f1af2", "comment": "Malware payload (Stealc)", "value": "5b62a4044f9598085ea48d1984d901c85ec88723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707622815, "uuid": "4aea5ffb-f51d-4101-ab36-2f8a0bdb9f52", "comment": "Malware payload (Stealc)", "value": "93a45906c75cade959588bf2161c6f8d85c2ecaedaf0a97f8a3b48c6b61179d68c27c1f24bad2cc422e88ae78c331b58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707622815, "uuid": "a7b0ac11-4260-469b-b06b-c595ae4e2c38", "value": "T15A039EA82FA95265F9FF4B3194A31621437AF763BA42C21FDA81905815233C14787EFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707622815, "uuid": "158f0a68-bb40-49b7-80a5-fb7ad934e046", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707622815, "uuid": "cad4266d-0d4f-41d2-85ab-f3a965958c29", "value": "768:Gro0B38UZCob4fgl4zmzU6+8NaL7oRoEOqBEFiRmmY:GJsI0gl4zYQ7aoEOUeiZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707622815, "uuid": "eecb5ebb-2c5b-41b7-a2e4-b4d1420a66f1", "value": 41320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707622815, "uuid": "bb1bb83b-7b51-42da-bc54-44dc661ecf2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707622815, "uuid": "83aa5d37-241b-4bab-9cef-a98e731d5eb2", "value": "fcb6adcf738982cca1afdf3710ba489b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47a6d8f-c91e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707684474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684474, "uuid": "761ea676-27e6-498a-9144-7bb0b9ec8326", "comment": "Malware payload", "value": "115d6ee93e2f4cd90df77348227b4d7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684474, "uuid": "686b432e-f649-4978-8a71-e31a047beaef", "comment": "Malware payload", "value": "c53df3f82853491c45f3ae1144e4f038896dd47edeb1aaaed5f6d2f92abb3af7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684474, "uuid": "79c8ce3a-5443-4f81-b79c-858305132b27", "comment": "Malware payload", "value": "eea7c268f08971b57bacca68cf832ca4fad06ee4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684474, "uuid": "a15345a6-e9bb-4011-8064-852d18b897fd", "comment": "Malware payload", "value": "feb0a8fe82b05f47a63cd3f3de6e0cb93ef757e497a7dc9f9bd3c90cbced872d7a26e1251528ef98c49a1a187f560f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707684474, "uuid": "ab20602c-0785-4d98-8b84-eb97b9622d5a", "value": "T15B656A81F7C355B2E94B1670204BA73BAE355809971DCFE3C7D09E30A8663D22E3A65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707684474, "uuid": "4e23990a-312f-45ff-bd78-a3144fa7969b", "value": "3b18190c7ab6b8dd063dc8137dc0e6fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707684474, "uuid": "5cd851b2-e973-429c-93ac-51731ec21b8e", "value": "24576:xxUuNIGMn/cWI/zD1uFZ1l7cMxGyxNoZc2bIQEUSwWkuYJYXPHGdK0/NwR0gQn6L:dFMVNuTgXgKKI0HSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707684474, "uuid": "a7c951b4-c81b-4990-9c6e-6e6c3bc15ad8", "value": 1541632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707684474, "uuid": "ea809419-b2f5-40bc-ba6d-40f485a2fee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707684474, "uuid": "6a89dfde-305d-42ac-b022-ad879fee7c5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69998593-c904-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707673128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673128, "uuid": "3978b980-fa7a-46dc-be23-bc25d5e9a3d7", "comment": "Malware payload", "value": "9e327046b332f9e0d57d44c353c258e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673128, "uuid": "299a315f-75bc-4ad7-bb1f-c4aa3296df4b", "comment": "Malware payload", "value": "c605480be9676d0821dc654e13aab50b488325e6f830d3a20e5333d7ce706a74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673128, "uuid": "7a79afed-d638-498b-a901-9b60ba1ba8e9", "comment": "Malware payload", "value": "9c790c350e3591c9b827a5e57b629c3600527bcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673128, "uuid": "fd58a161-ae39-4cac-8ef1-ded7b430cc36", "comment": "Malware payload", "value": "422234e8d7b314c8504bdcbb0d242b5ecc922c713eeb23d79356bcbe110428d8714804a0e3d227057d864ce71af1ae1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673128, "uuid": "95c599b5-f908-4a32-804e-9053ee155bd0", "value": "T15903F14F19319EADCA1C3C7D201C4E718A3CA0CE214EA64D675E98A5E969D03FB1E87D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673128, "uuid": "d0ff35db-66ec-4167-a9aa-9a5183271de0", "value": "768:gRTgGmbfuw1cOCAq26HZbsopWI3SIjNN4VrrIEDUDd+WM2:gRkbPqOe21opW/YAVEEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707673128, "uuid": "69a0c38f-9a39-4983-87ee-31bd041e2abf", "value": 39176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707673128, "uuid": "5c24ba17-5474-461d-80fb-9b71a2c3b7ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673128, "uuid": "c8d5bcda-d657-4bee-a53a-4dae1b2e9c34", "value": "9e327046b332f9e0d57d44c353c258e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e678d0-c8e1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707657977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657977, "uuid": "d6e8954a-66a4-48a9-bdf6-0479d910eceb", "comment": "Malware payload (GuLoader)", "value": "c8980831bd6f312b09ca74fee43f70d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657977, "uuid": "ff9c53f7-54b5-4d66-b653-ab17854da176", "comment": "Malware payload (GuLoader)", "value": "c8a68a8fd94411c28a9a390375d590b1be5cc1a72fb9a682a53105eb3436c510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657977, "uuid": "d34f138a-455a-4bfa-a6d7-0d8c97401fa9", "comment": "Malware payload (GuLoader)", "value": "5b29b24dd9d386c3c81c7a29b1b4e0c9e2f2c450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657977, "uuid": "bc57de5f-0601-4bff-abc6-6b2d795654a8", "comment": "Malware payload (GuLoader)", "value": "0e0bfe331600ea80644619b37fa348fc6e32bd31055448d8a0bdb9e8ad0013e1c6edf9d6823210997eb6f882cbc2a0c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657977, "uuid": "a3296f85-da09-448e-94dd-d9dced50b0d8", "value": "T1040523063A54D263D7E4187168B582758FB4ED163E459A433B49BB082DEB383FB0F68D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657977, "uuid": "871841cd-6e98-46df-bc9f-a2038f571e82", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657977, "uuid": "68f25bdb-2107-47fb-aa2e-e467a2c1861e", "value": "12288:t72N2FGc1Vm1nz9GU+Si9N/hjExnFSfPAnBKdJwhqZ+rA/+iSBf7fXgqLjSjL8M:t72Aj1Vm1nk8whExFKb6qZ+8PSVfXnDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707657977, "uuid": "7a4e5fc3-c131-43a9-9de6-4ff1e2668af4", "value": 864016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707657977, "uuid": "dff7fcef-a8dd-4f83-a723-72e27aa004c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657977, "uuid": "ae738a4a-7f39-4d68-b5e7-698586d804b4", "value": "Nordahl Andersen Order no 106673 _xlsx.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492401b7-c89a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1707627547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707627547, "uuid": "34942b5e-a5c0-47d8-a534-3f763600810a", "comment": "Malware payload (CoinMiner)", "value": "8eee0f0bcbb9d63691ac5cda65dfc44c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707627547, "uuid": "b952c507-d1d8-41fe-8b80-9fb3bd116527", "comment": "Malware payload (CoinMiner)", "value": "ca7889d0eef0b84b31b707105c710e793aa02f3a1ca8d48294f8a488ef2526fa", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707627547, "uuid": "81b4ca4d-b943-4e48-bbf0-f00fb8212345", "comment": "Malware payload (CoinMiner)", "value": "4951089c091c3f76a34b7c1ca7f2ef11d9c7a272", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707627547, "uuid": "9b75cca4-8701-4aa5-98b1-4163db510e31", "comment": "Malware payload (CoinMiner)", "value": "e0aeeb605c5b04488dbe70da5671f3884e9cc5b35c1eaf50902c0552edb845a58361a18c36a12111f86718a7febcbab1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707627547, "uuid": "378a262b-bc0d-4e96-be5f-d19fe3693f1c", "value": "T1F9C533057629E884CAE0C5BB5D527EF0156C39D42B28DEE35ACAC7F27C884C53DAD1E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707627547, "uuid": "dcea9753-b219-4813-a64d-df822354488c", "value": "5d68de0544abec4f6be91e05245b348d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707627547, "uuid": "afc96b9a-0fa5-4925-818b-04c1463fecf4", "value": "49152:4EZK0WjkVdtNqSx4jRSkzAc0Fw1kRTuiG49TwzXK2EEokwuPuw0V8/AzWuO:429m+PEShkzF0WkRCirNSa2Bokwu9Az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707627547, "uuid": "9d034770-4972-4564-a9ee-68dad7566074", "value": 2596352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707627547, "uuid": "d0a1cf7c-44b3-41a7-9c09-2c2f1eccf9bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707627547, "uuid": "08524ec6-13e4-45b6-854b-3b71d3927dba", "value": "8eee0f0bcbb9d63691ac5cda65dfc44c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43c7f5d-c90a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707675830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675830, "uuid": "fa4c359b-cb33-41de-bf00-80f53a0ce8d0", "comment": "Malware payload", "value": "9803950281290044e32fb78605c129b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675830, "uuid": "ff23d39e-d8e4-4981-992b-6ffba1ee8c19", "comment": "Malware payload", "value": "cb966139adb162ea019d1f6ca648febaf4249cbb9e255f492987f26087c3397b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675830, "uuid": "bf31aee1-afff-4e78-b06e-8234834e5858", "comment": "Malware payload", "value": "133f587df70680d81c18d8c112b9a34e6041d629", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707675830, "uuid": "d2d486c4-53b7-48e8-bf60-0e8b4e9aaeed", "comment": "Malware payload", "value": "de08a5da0192b535d3b3063ebd9a187f8172a237c7599ac019d988ce0dcb88dc79578c46f2be0ba64dd495423b43a3b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675830, "uuid": "27fe78aa-7c5a-4952-8e9d-b8c8155bb1c1", "value": "T1EB368D30755EC52AD56605F0592CAB9B911C6E3E0B61A0C7B3DC7E6F2B710CB0636E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675830, "uuid": "79a1a2b2-f6b0-4938-ac58-29e83853d3bd", "value": "36aca8edddb161c588fcf5afdc1ad9fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675830, "uuid": "d4624b6f-802f-423c-8b92-dd26ffb52945", "value": "98304:pWFsTuRN2zazBLlLvOc1Pgd1E20fzsFvOF3BQQi4y0g1ea6:pWFsTuRN2zahf1Y7EhZSlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707675830, "uuid": "b694aa26-b3ab-4516-8942-701f4a8c676a", "value": 5014592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707675830, "uuid": "5e193b5f-8953-47c6-9ef9-cfa9d7ab1133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707675830, "uuid": "75c128f2-86c5-4e95-bd64-df156b81f904", "value": "SecuriteInfo.com.Trojan.GenericKD.71615099.29032.10591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bc79a6-c91f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707684604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684604, "uuid": "f6ae29eb-4251-4fa0-a12c-4c061590ae35", "comment": "Malware payload (Mirai)", "value": "891ab68db6d14ef2878fd98a234eaa6a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684604, "uuid": "1ee318ab-aa5c-4e81-98f5-fc83849edbb8", "comment": "Malware payload (Mirai)", "value": "cd6fb1022624478863f48460c308dd494902a25fd77d4e6204f016d914b3d8dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684604, "uuid": "c968031a-7cad-416d-9590-63eece7fbeb6", "comment": "Malware payload (Mirai)", "value": "c876c1ca65456664c7afcae5977b6078069fa99c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707684604, "uuid": "106a6b2a-b382-4a78-86cb-4df1e6898727", "comment": "Malware payload (Mirai)", "value": "f97eee79e1456794f9d59506cf0b4607b6f70bb7e3ad945670db4bdb237484eb6cae335323ce2419488ef9f33987adf9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707684604, "uuid": "67ac103a-668f-45ad-8d6d-b4b9cf00acc4", "value": "T156F34D46EA408B13C1D71776FAAF414A33229794E3DB73068D286BF43F8765E0E57609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707684604, "uuid": "ce94a4ad-3bc6-4992-8fc0-e12716b39b4c", "value": "3072:YsfvqoYF/FrhMZqfKPaC+LKWK6nTUCo4MbPbFJJM/9YM:Ysf/YF/08yPaC+LKWdnEPbPbFrM/9YM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707684604, "uuid": "10f6169d-2f3c-4691-a9eb-16f8e01ce906", "value": 167214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707684604, "uuid": "128b1717-98dd-4f66-bbb9-0f96ce2f8d58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707684604, "uuid": "9b3a3e54-68ac-4e7c-ae59-afb6a3d9246a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38dc4b0c-c8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707658443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658443, "uuid": "b89e3bff-59d8-4fe4-bb7b-7601dd74d2f8", "comment": "Malware payload", "value": "bfd92dedefe429205a635a38096429a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658443, "uuid": "0113eb6e-51b3-4bfa-b9d1-e90ebd478cd4", "comment": "Malware payload", "value": "ce0ae1416a4841144e8a377eed2a11fef988b08042606bac8121b4a4abd5391e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658443, "uuid": "486cc9cf-30e3-4370-b059-c899a96fc562", "comment": "Malware payload", "value": "e9d73bb749ad4e3aee0c5889dbcea27824b2bd96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658443, "uuid": "7cbcb5d5-0ec9-4e71-8c36-17d35755601e", "comment": "Malware payload", "value": "46784777f1223721738f536c44d3e2befd16d5bffbcea2ccb8831ae1c2aca6c6ebce2366902bdd85380dc71cc640ebe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658443, "uuid": "52fbb232-c35c-48ab-8714-987c5c039b17", "value": "T1F2B44BBB27D4B926F2EE9730D9906C8E42B4F45A9672FF8B148094B428977D0FC41367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658443, "uuid": "390c43d5-873d-496d-8ba1-0ea6e0d0bc77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658443, "uuid": "550fc4ec-d8ca-4887-a3b9-a29649d97f45", "value": "6144:FkzLzZZx2cG5yMA0c/FNfIQ6NDn9s72DjTqyllHYAB5V46T9NAzya38tZgxUq/6:FkzLzZZx+yMA1gnqWH1RtAzya384qq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658443, "uuid": "d63294fa-8d1b-44c5-a79c-400722d2509e", "value": 499200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658443, "uuid": "df3c7a3b-d9a4-4390-9e7e-23a6d7250cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658443, "uuid": "75fb1e28-3621-4eb7-b9c1-30cf9d979e69", "value": "SecuriteInfo.com.PUA.Tool.PassView.1968.7100.31335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044739e8-c8e1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707657926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657926, "uuid": "c4ad87c1-77d7-4072-94a8-d289c687c8bb", "comment": "Malware payload (AgentTesla)", "value": "a89aec0710f287f12cc288582bc2d716", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657926, "uuid": "c31c8c88-9e63-44c4-8855-ce74db57b915", "comment": "Malware payload (AgentTesla)", "value": "ce89a0a88051c50bf0be5ab41e5f2d478b5f3eac141b37a9743cab99423656ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657926, "uuid": "7f5c5d0e-fa98-4b15-8eb5-6dc14c90f021", "comment": "Malware payload (AgentTesla)", "value": "bf26829faa4a701fac7bb886c23831959a6899eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707657926, "uuid": "e6a18590-7142-41a8-8010-f970581ba536", "comment": "Malware payload (AgentTesla)", "value": "26ef8501d2ed360107bd51cc7cb28320ea774ae615f50601226638d5a46b28c1b100bcce650bca519e9d45ad5691fb0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657926, "uuid": "6f258c7b-8272-4652-9bc3-9ffa1b1c214c", "value": "T14B35CF2373DE8361C7B25173BA15B741AE7FBC2506A1F96B2FD8093DE920122521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657926, "uuid": "d677b23b-4975-468c-902b-288874cc91c8", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657926, "uuid": "454947ad-3b06-42de-a181-797121adb7cb", "value": "24576:0tb20pkaCqT5TBWgNQ7a/6HC0tp166ZPuHcux2j6A:dVg5tQ7a/6plmbK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707657926, "uuid": "9e169af3-5c08-47a7-ba0a-409829519ca6", "value": 1150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707657926, "uuid": "8f79ce2b-a282-4200-91fe-adbbc9d3ba4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707657926, "uuid": "ed01bf2a-ca78-4acd-b805-0cc7ec10f2d8", "value": "ORDEN DE COMPRA URGENTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5513fddb-c8eb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707662356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662356, "uuid": "ae83b17f-2f56-4b31-9a60-c9da27780c42", "comment": "Malware payload", "value": "564bfdb8a81b46479e2c0c59a9f76f39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662356, "uuid": "d33e1702-69a2-431c-9c65-c787cafea2c3", "comment": "Malware payload", "value": "ceb2cdbe279134243c3679ee27b660c2a8211bdaa4a953c7e465c7af0a6b20b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662356, "uuid": "0e39f2cc-832a-4ff1-98ab-541228ad344b", "comment": "Malware payload", "value": "fea999d62b9f374e61b8c81e176718fc8e132696", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707662356, "uuid": "c79ec6b5-b48a-4548-9592-d9e2a4a81978", "comment": "Malware payload", "value": "4a06f6b937735c0355cee6281114dfbaf79bd6b19d93526e3aede3352e71044999adce03e5b61a2d5f19c719d0f260a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662356, "uuid": "1dc13d21-85a5-409a-baeb-d40d7d256ddb", "value": "T18F065C02FCD604E7D5BEF1348A92A721BE7138B6833177935FD25A6A1626BE46D3D300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662356, "uuid": "64569254-13a7-4d1c-a2c0-e5c83c6155bb", "value": "49152:8JY7p4v+aYJfSYsCdjdd4/xTybGeIIimW18n0OHKx7:TC+7XPdjdd4yGpRq0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707662356, "uuid": "5745dd95-6f59-49cc-8810-c5568b5529cd", "value": 3882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707662356, "uuid": "20830e99-8ac2-4b53-99b1-e45a3637e504", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707662356, "uuid": "cd8459a9-5d7c-499f-a19e-36f4c948877b", "value": "SecuriteInfo.com.PUA.Tool.Linux.PrivilegeEscalation.15.30242.4961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5707d57-c901-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707672074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672074, "uuid": "c026a58b-09ef-4d29-b5fc-4a3d2ab08342", "comment": "Malware payload", "value": "a4e34a3d653476366df0f8e59c83acaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672074, "uuid": "bcb5a298-9aaf-4ad7-8b22-4df0c1f9285c", "comment": "Malware payload", "value": "ceb547850a21f7a3343d7cae804718829875626d8dede2fa3258f3f45b3a5dbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672074, "uuid": "71a35a6e-d185-449f-af9a-961c3d675970", "comment": "Malware payload", "value": "159d8a9f20bfac2587d4d3287fe09a23496c6deb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672074, "uuid": "d965703e-5fa0-40fc-a937-380b2c5c8a2c", "comment": "Malware payload", "value": "814dad7c04b7817421e0d33dc87238fd92671f9bf5d0b1c24800aabf769aece2bedf8217e59c120af77572fa4d7fda6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672074, "uuid": "6bb0df57-40d7-4f8f-9bd8-4de6df1eb825", "value": "T1CB26BF61BDE844BAE05312328DF9F5B8757EBD746729028B33943B1EF6313431A2A527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672074, "uuid": "324fcdf1-d2fa-4011-8d10-6c4fe01a8849", "value": "bc64b07c39ebf919067d5970f78f9cab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672074, "uuid": "06c0d277-bbcf-4910-b305-94e026f6db71", "value": "98304:/gGQ//aHLW6vH+osgoj9ghi1RebMIg9Cbk/V4VuARZjzfqB:/gGQi7ojDIg9Cbk/V4Vp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707672074, "uuid": "c674dc6a-9cd9-4860-a109-e1ec81f1fc41", "value": 4529568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707672074, "uuid": "170092c1-66fb-4628-88fe-713829273cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672074, "uuid": "93a1a3b2-8435-4753-902e-e67333c86500", "value": "a4e34a3d653476366df0f8e59c83acaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7da5d3-c905-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707673458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673458, "uuid": "26bdd038-e962-48ea-85db-5915b19f4678", "comment": "Malware payload (Mirai)", "value": "bdb25b48a3e25f5710404d7375ca5d48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673458, "uuid": "10ddd839-3f46-4333-94c6-9b4000056c09", "comment": "Malware payload (Mirai)", "value": "cf3b2fa1ae57458654c87b89743f17ba4a26a9ed2805f5784b2375bc7052f5cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673458, "uuid": "6b59b155-57ce-4dd6-a586-671c2cbd748d", "comment": "Malware payload (Mirai)", "value": "0b63016bc34b940b5150c0f9e7aba70cd8461f0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673458, "uuid": "0d25f2a5-eab1-432a-bef6-94cd50c89a1a", "comment": "Malware payload (Mirai)", "value": "73e794730082d052c6f7e058bfe9f072ab0aef0968b15a1c9c35ec409304f976d4433d54bf43e9a4fbfe3c2064f1a006", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673458, "uuid": "4502cd63-5795-4e8d-888a-461139065ac1", "value": "T199F2D063E3A95062C8F5AC75DDAE0D0672112F7A04D776DA386D433127C9194AFF86C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673458, "uuid": "504f5c1e-cf9f-4977-bb33-c00ec45079d4", "value": "768:S7v9aCKN1qksvrYWJBjprWIpP0kohP27mA2AR3U2Y:0vNgX4Y+Wi7SAlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707673458, "uuid": "f21af059-d2d4-480e-b71f-47e6a8ec515c", "value": 36016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707673458, "uuid": "0d04895b-c65a-4aa8-aa05-35be84963e3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673458, "uuid": "8e99734b-c153-4052-bd89-9cd970d8cdcd", "value": "bdb25b48a3e25f5710404d7375ca5d48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d908c8ae-c8c3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707645398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645398, "uuid": "725d1270-52ac-4bf6-bc4b-fc7f719ec1cc", "comment": "Malware payload (Mirai)", "value": "cbcf8cc200bf2977ecf4e77e42c2bec0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645398, "uuid": "eab2a8bd-5377-489a-9107-b6951ad1ec91", "comment": "Malware payload (Mirai)", "value": "d1cee7d6df3c780cf5462c86d91f6531169818747000df590acc34c4928bf62b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645398, "uuid": "e042230e-8d71-462a-ad3c-66aa01d901df", "comment": "Malware payload (Mirai)", "value": "676315f1ee05955cf58506c5a01a3857b9eb597c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645398, "uuid": "2d8d4880-7ffa-45cd-9cb4-e1ecfeb3eb9d", "comment": "Malware payload (Mirai)", "value": "c7732836d8c0595ee7fcc9464a9cd50daa1a714bae6fbf0f8a38ef532068ef9a166c81b54b3a05795eb78d053ac0c188", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645398, "uuid": "f5489739-3d48-40b1-b232-868da09422bc", "value": "T13F04E816AB510FBBDCAFDD3702E90B1139CCA44722A93B363674D528F54B54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645398, "uuid": "d17e476a-d08f-43be-a33d-3cb6f15eb6cd", "value": "3072:Mwoe3s50Zt9nQiX/GpO1SMRpp6NWJdWQdi:MnSsmZDQiX/2ObRWoDWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707645398, "uuid": "7bca77b4-4a18-4ca0-8fa9-5cfd27968354", "value": 181968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707645398, "uuid": "c255d40a-ff62-4bc9-affa-eb1f57fdb8dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645398, "uuid": "264e31f7-351e-49c8-86dd-ba6f3d213150", "value": "cbcf8cc200bf2977ecf4e77e42c2bec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b046677b-c914-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707680118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680118, "uuid": "0faccd91-2387-4c6e-9eab-477b6fd64b09", "comment": "Malware payload", "value": "8e0a93d997d3387a8523d38814b6eea9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680118, "uuid": "e3ce3054-48da-4375-9b29-d158dd518ca9", "comment": "Malware payload", "value": "d20eb42e369a59eb834e1b006d178c4e33326296667aa6296919ec57183850fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680118, "uuid": "91b6ea22-4beb-4ac3-b27d-40b72cd1d405", "comment": "Malware payload", "value": "7681fc420572858b1e88e0f1dc340015c7d23187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680118, "uuid": "97cfb53f-b404-416b-b110-1c6ee2fd0914", "comment": "Malware payload", "value": "99f2dc404ee575d15faa2afa42d584168173f805bc4008c2911ac9bdfce84b0aa2f6f50f56cf21fbc5f6a25fe8b8880a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680118, "uuid": "629ca5e1-6370-4203-ab08-9579bda89cf7", "value": "T10C03E1745350305FD2A5E97326F033947961C771E856FC1F2AA2AA918F9105C78DBDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680118, "uuid": "36490204-4201-4bcc-af6b-6de11abab763", "value": "768:Ok08CyKwoh5fJI3idlkNE6AmIKhCFOZnXUBFn5upT+Yw6p54vI8MCMELI/qJgGlS:fn/xAxJIGl+oK1nX45sRws4RMELI/OV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707680118, "uuid": "89305816-ecdb-457a-9792-99a009b0b71b", "value": 38076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707680118, "uuid": "5bfd1e5a-1076-4e27-a7ba-e495822b5660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680118, "uuid": "4cd17484-a722-4751-970d-02f968ed3b56", "value": "SecuriteInfo.com.Linux.Siggen.9999.16220.16740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed5af73-c8d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707650830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650830, "uuid": "87f2b7ee-18cc-498d-bc13-130e003d79b6", "comment": "Malware payload", "value": "1656f59abf6dc7a8d746530277c66d01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650830, "uuid": "495d0dd0-0d8d-4274-b7eb-ad7254cb710c", "comment": "Malware payload", "value": "d56973d029274cabefca80fdcbdf85a17faffe9b1004fb767bee3b54a20c94fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650830, "uuid": "cbd47b86-d6b9-460e-be7d-1fa32d45becd", "comment": "Malware payload", "value": "ad8543386d426f6173f006f91b87f28e8377e9bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650830, "uuid": "bac93b0d-2020-43a0-ba04-0836d7ebc525", "comment": "Malware payload", "value": "76f28998edf8d556a37525091ad84be212ba5f29d3f90bc02ee13f7de4eede68c4a73557ec4f8b5c3c1973349160d624", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650830, "uuid": "90a15a6c-9e4d-4616-a0ae-a6b1ae327d38", "value": "T1A941141A2FD01F33DD66CC36555A2B613ACC802B616A23965374ED60BD3FA05E7D38AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650830, "uuid": "2c07b6c0-035d-47e4-b753-15a61e6a34e7", "value": "24:mNBj3HsSimpHH2GixZuDa9mCt5UJL4mmlZ9qpe4g+/qc+UTK8WKUlu/eTwfwFLCf:EQ2WXnuDW3U6df9r+SMTLWPkeTHFWXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650830, "uuid": "ff61ec7d-a501-49d9-ad10-2d7f0c7c85c8", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650830, "uuid": "23aed8dd-93b4-4e6a-85e4-5c8101966c88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650830, "uuid": "c37f097a-1790-4367-a4db-b166d7915c32", "value": "1656f59abf6dc7a8d746530277c66d01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2ead1a-c89f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707629857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707629857, "uuid": "0bda4d6d-5295-43af-a12e-7661328e16e3", "comment": "Malware payload (Mirai)", "value": "ae45c690a46eb1670d0b249f806bbff3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707629857, "uuid": "550cfd33-26cc-4c33-87ab-7ef0a64c29cc", "comment": "Malware payload (Mirai)", "value": "d5a77bc6d299a65aa4b4c636770d0719586b0815f34d4c7c30e23e0dac240223", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707629857, "uuid": "7d40e49d-9d61-4004-996e-48d14d784be6", "comment": "Malware payload (Mirai)", "value": "972f153e83e17d2457899cdfd36d9df13f23f247", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707629857, "uuid": "cd5a30c3-1ac7-4208-b517-30e5207f9d16", "comment": "Malware payload (Mirai)", "value": "51e39e286089c2316ec81ce1f05b1c8857cc9981f3a5a91081ea9a61213812df40221f52163d902b835939ccb41af5ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707629857, "uuid": "922049e6-5453-4c75-8784-c3c6bde348fd", "value": "T187C33B46EB418A13C0D61779B6EF42453322EB65A3DB730695287FF43F8679E0E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707629857, "uuid": "bcc4aa5a-995e-4289-a1bf-b93f00a1b27d", "value": "3072:tDOIuhblIGmsfJUIifn1dRFGbbJM/9OtQTKP:tDOIWbaGmsfJU7fzjGb9M/9OtUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707629857, "uuid": "905ab5d2-7b96-4471-9ce9-6e522674e838", "value": 128708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707629857, "uuid": "c5ce5acf-f743-4725-94ff-f80ac8d92c52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707629857, "uuid": "e99dc407-a4bb-4042-b5a7-3e62f605f7e8", "value": "shindearm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68eb7550-c894-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707625023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625023, "uuid": "0dacf2a6-aacc-400c-9e17-3b9e0130caf0", "comment": "Malware payload (Mirai)", "value": "2236164a1cb9ab1210978676db7bab85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625023, "uuid": "488e1dc9-b39a-4c07-82a0-acf6b295c817", "comment": "Malware payload (Mirai)", "value": "d8f6eaeb70e7f642048bc92697756037a7a126d92321ccd0eff272e92bcf74c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625023, "uuid": "1bc04640-560a-4d29-bb8c-6e108197a161", "comment": "Malware payload (Mirai)", "value": "4767cf2448338eed0d3384b2e6a9a8c63f498804", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625023, "uuid": "4d79e392-35e6-48f9-bd4a-7eb9ef0125c0", "comment": "Malware payload (Mirai)", "value": "75d154050682597789d2f6bf9b223aa878d79c4cbeeea5e5b4077dfd1d2cfb1905f1cf4dda468e29c796b60c39cac823", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625023, "uuid": "d7e24b43-f270-4bd4-aa7a-e29158a2fe7d", "value": "T1DE533B99F4029E3DF88FE9B984160E05B93023D112931B276BAEFDE37D331659D12D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625023, "uuid": "e745b22f-dbda-426c-a78c-c73806bf0865", "value": "768:Ge4gpsM204GEkRbj3eX0unQiaQtdf3gFHS1eu48B8vB6J7EzNfXuuJpozL43+:Go3EkRbrzViXUFS1X48B2SEzNfeuJVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707625023, "uuid": "fc4acdd4-60cc-48c5-b319-c185cfb1c980", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707625023, "uuid": "908a7474-b2ed-416f-b400-dd82c0f3ecba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625023, "uuid": "2de920a9-2acf-446e-acb9-116a4def69cc", "value": "2236164a1cb9ab1210978676db7bab85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b52f852-c8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707658447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658447, "uuid": "26f4f8fe-ec2f-4a90-a2e3-9909352b47ac", "comment": "Malware payload (Formbook)", "value": "b44c4a259319f20aed7c92bf63e38925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658447, "uuid": "4623c3a1-04ac-4ff6-ab6a-ebc9cbdf5b01", "comment": "Malware payload (Formbook)", "value": "d93058ce47215773bfed7fc6a36c4991a4d3278ce71cfd6ec23d0c3b74566798", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658447, "uuid": "fa925f04-0586-475b-9ca3-8bfdb69d809f", "comment": "Malware payload (Formbook)", "value": "ba2ec96325e0927dd4f7fd22c8038964f2a69f4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658447, "uuid": "9572bd55-f82c-494e-b396-6da37439d220", "comment": "Malware payload (Formbook)", "value": "151f3879a79e2d78a4a2af61a4655b0fca000eaaae2e545abfba913dcf4fb5c9fd776ac588be2b1b89c2c6d0ba767390", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658447, "uuid": "33272dbf-54c7-4bf2-9f7b-47713adbe46a", "value": "T11DE4E09C3150B2DFC86BCD76CAA81C64AA6074BB531BD203945726AD9E1DACBCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658447, "uuid": "af11edc6-eb7a-49c4-9205-b5f6952883a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658447, "uuid": "0a5cfd97-3d71-493c-aab8-71e8c90d303b", "value": "12288:BM61jp2g3Wwr/PaDhDOKNIfTzi+mZZUAzb5I4yGlhA2/cMYtn9O8eIC1GFBSV/T:Hp2edeOKNOKxdIshA1ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658447, "uuid": "37a16940-5c65-4e2b-b9a5-54a5b9b22cb8", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658447, "uuid": "1ade42d8-b06e-4869-8ecc-9cd020081c9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658447, "uuid": "ea38652a-b3ec-46d8-8dc9-935962b0fc98", "value": "SecuriteInfo.com.Variant.MSILHeracles.146328.9929.3815", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f457e8-c8dc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707655804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655804, "uuid": "681caa44-f171-4ca8-b9f1-a9229b615ee2", "comment": "Malware payload (Mirai)", "value": "b15e3aa872de75ce37c4847d826d3e23", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655804, "uuid": "0da31730-bd14-47ea-a739-8349cee99798", "comment": "Malware payload (Mirai)", "value": "da0c7529f45310e6ed36972a89c187904226197263b66e5f5e94b28e5291c5ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655804, "uuid": "b1e21b0e-41fa-4a0e-9582-2c11074e1430", "comment": "Malware payload (Mirai)", "value": "b1b0fb9ec32863a57a8305cc6aac8944571e1560", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707655804, "uuid": "b4d03f44-4f49-46ee-b716-77579ed779ba", "comment": "Malware payload (Mirai)", "value": "950ebdbf164d03340b3874fbdb2b56f883f2fabacd5def5c363973d982254fe13f7e641d05a6ccd0b7cf56ab6a369c8b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707655804, "uuid": "0a95eadd-7819-444d-a9d0-adcb0592a8b1", "value": "T137D33C46FA418B13C0D51779B6EF42453322A795A3DB73069A285FF43F8679F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707655804, "uuid": "fa685329-52aa-4d1b-b18a-65b017b0fe35", "value": "3072:gdTiyN2MknA0YKoZh3t3qZgRLWH5b44XTLADM/9XXmPw/t93:aTiyN7kA0Yh3t3qZgtWVLXTsDM/9HmPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707655804, "uuid": "756475d7-d0da-409c-977d-2437f7b9dc32", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707655804, "uuid": "36e94227-b2d3-4111-940f-1f6cd8339127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707655804, "uuid": "b55da333-3d3e-49b1-9024-c3ad1a3541d6", "value": "uYtea.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601479f0-c894-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707625008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625008, "uuid": "8942a77e-b863-4b42-aaf9-51d3657b1dee", "comment": "Malware payload (Mirai)", "value": "1c3931ac941b80e53875084a8a7ee017", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625008, "uuid": "0d6ada3c-eea5-46f7-907b-f3c2fa853be6", "comment": "Malware payload (Mirai)", "value": "ddbf06878f1e4b2f3ed46f75163db2c3fc2a27803366d88afaded36727caf28a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625008, "uuid": "cb5b2366-4a8f-4255-82d1-d59b31817b7c", "comment": "Malware payload (Mirai)", "value": "760279d43b8d1ead9e9506524c85feae5ca5df64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625008, "uuid": "48f3dfbc-f3fd-4047-9427-8cd72c8049c5", "comment": "Malware payload (Mirai)", "value": "bb6c5fc1c8fe75ecb4d3c3b86d2c3750fa82554db97736d967851fc55b7a2634fc46d472c7ac03a3c89edb22c69298ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625008, "uuid": "5f2152f5-bccc-4d10-9cb7-d625b7846812", "value": "T1F2D2E04F86B6A61EC9581D7CD6DC17A2563CB0802B1D5F4C276B49C2A81868FB77263C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625008, "uuid": "f92432b0-9b67-4d05-96cc-1af082188e5f", "value": "384:N8pVWMkRnVvjjYGTO8Q83EBvH3Ur9hnqu9v7yiriLI8dX4EXO1J3WhzRWGVCz0N0:qeVv/e8fEBvH8nq+yiWI64aO1JmHW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707625008, "uuid": "1007bd2a-a319-41aa-b73a-fb960d8356b4", "value": 29928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707625008, "uuid": "846b7d4c-c5f8-43d9-be81-db89069e987f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625008, "uuid": "ef7f7500-e3f0-432d-91c0-7b3516d8075d", "value": "1c3931ac941b80e53875084a8a7ee017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c96fdec-c904-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707673133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673133, "uuid": "20ad4035-95b3-490f-9329-797ac75e2d4c", "comment": "Malware payload (Mirai)", "value": "d3fb53b895688f1191c84b1c3e930886", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673133, "uuid": "4b0b56c4-8143-4330-acc5-877a88b2b61a", "comment": "Malware payload (Mirai)", "value": "df3133427d143f49763c5bd243af4907e904ec15e02c3ffa7302b57c38323273", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673133, "uuid": "f0f0567a-3df7-46f4-b0e2-41d2f3a73b5e", "comment": "Malware payload (Mirai)", "value": "73d571331ea59ded19bf73608114109235c4d51c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673133, "uuid": "6ef24a77-c408-4836-8768-6444123d694f", "comment": "Malware payload (Mirai)", "value": "fe19360ac20440f1d61f0a0c181f319850274ed1ad60c31b3e4f147f4e4d213cd31bffc24c040959ad26a7801cf0f37a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673133, "uuid": "42dd19ba-beb8-493b-aaad-04629b95097d", "value": "T1C3E2D0E266ABE974D8231335540FCEDBF6227016AA4A97D710F4B07F5C5BD943A01743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673133, "uuid": "ae8003e2-8a75-4954-8d4f-ceafbd65636d", "value": "768:dZFKt/6YDNQ1lLDEtOP20UHdNwd5wRVfyjCBAAvrWOx0cs+:Xa/9QzEYU0QVaATpNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707673133, "uuid": "bc0f52fe-d56c-49d8-b138-0d4d450dbdde", "value": 32888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707673133, "uuid": "ee0c9b9b-a169-433a-85a6-2038e4712078", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673133, "uuid": "fcbb5fb6-3ce8-4a82-afef-62f816d7532b", "value": "d3fb53b895688f1191c84b1c3e930886", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659ef576-c904-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707673121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673121, "uuid": "1297db22-7b68-4f60-b3c5-d2859914b40b", "comment": "Malware payload (Mirai)", "value": "e836010c80b736dfa06e5e6cd8ec6ca3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673121, "uuid": "346bff52-4e76-4448-a7e3-e19ed05aa644", "comment": "Malware payload (Mirai)", "value": "e021c2c2182b81855d79fdbd5cede333d5b8dbc5d007b59eb34da43f917dd35e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673121, "uuid": "f4713ea4-af07-440d-b5c3-58c4ea1c6b47", "comment": "Malware payload (Mirai)", "value": "868f28e8787112ec88a9973ff310df55b4d5687b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673121, "uuid": "bc743980-e411-4bcd-85bc-241b6cd75c2c", "comment": "Malware payload (Mirai)", "value": "6f67f5b5acd1ccf32d7f19a5cf16a3f6547b9721301d73381cb799fe4289698a8645dd10fd64b1e3959abc0828f81aa2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673121, "uuid": "4595fa15-91f8-4d8f-a37e-8eb5c7cd508b", "value": "T16EF2F12307F6C8F8E43AD5B167CB1B58D271E8229693971A956570FD8EE3D0127B07E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673121, "uuid": "55d5719a-3348-4819-a2e3-6ba6ea0e59b2", "value": "768:y2579LO+NfzGkpWgxBnV3h+CxJ2l6GHSav9fv9sPVhL:y27ycfJWIr+MJ2l6bapFuVhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707673121, "uuid": "c8dfb320-1ae8-4222-80c6-ff3b5c08e9b8", "value": 37440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707673121, "uuid": "2c351bf1-3c2e-48c7-abb7-80280cefef52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673121, "uuid": "7f6774f2-60b3-40af-af11-cd073a20017a", "value": "e836010c80b736dfa06e5e6cd8ec6ca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8a5abf-c894-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707625002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625002, "uuid": "4ac14142-e2a6-42f8-8ab4-5e4df33fe5d4", "comment": "Malware payload (Mirai)", "value": "64717a461d75ce22891f976e8ad6b3ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625002, "uuid": "0cd56d0c-5f22-47d0-8492-aa705b0e3510", "comment": "Malware payload (Mirai)", "value": "e0f1a54a0c84d2f1298819db1cd78b5a7276e3a2140c33b9c26fb0ec733e00d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625002, "uuid": "e08357c8-dba2-410c-aae7-a432badcc8ae", "comment": "Malware payload (Mirai)", "value": "5a045310efb4e6e264ff45997b48904a144785f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707625002, "uuid": "f0c3d672-9df8-4b40-8a15-d67b08ea5a89", "comment": "Malware payload (Mirai)", "value": "5cf26a30a923535706cfa49535dcd18ef429a4924403750141101b49718862bb2c1828e5e45fe833429421312b2b5f7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625002, "uuid": "ab04b8cd-f90a-46b5-9e0d-4584ae84fb0a", "value": "T1AB538D75D12DEEA8C0424AB4A9598E304F13A0C047732EF7DA9587A69447DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625002, "uuid": "afae5340-5620-440c-a854-273fe2af2675", "value": "1536:zag/Vd/xLwtkbaOoQ3veifs3guba/qzCEZaCw:zJz/xLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707625002, "uuid": "100542b3-255a-45c9-ba0e-a2a6effa0bc2", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707625002, "uuid": "65c58d24-c755-4cc3-951d-35b249cf19c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707625002, "uuid": "21eb7dcb-75d6-4b41-90d3-0710c2125585", "value": "64717a461d75ce22891f976e8ad6b3ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9500ed08-c8fa-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707668906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707668906, "uuid": "db1936fe-133c-49f7-a255-fb86cc320d5f", "comment": "Malware payload", "value": "7885d86f358e530a39e0e396db34d29f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707668906, "uuid": "10f74e77-9ca5-44b8-b2d8-b11d59898040", "comment": "Malware payload", "value": "e100be934f676c64528b5e8a609c3fb5122b2db43b9aee3b2cf30052799a82da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707668906, "uuid": "2fee52b8-644e-4842-9444-2b1537ad68b2", "comment": "Malware payload", "value": "498a0d0b5b2bacc6f05979563cdec342655929c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707668906, "uuid": "8fc1a804-f811-4bfa-b4e3-837c380aad36", "comment": "Malware payload", "value": "d8ab6ae99dbd490f71d8d26ce99eaf49a700320d66584617dcd65f2c62b8a5da7c6a07917291d037456cee270dfef7e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707668906, "uuid": "deb67aa5-605a-4343-ba29-e8720911e0fe", "value": "T185E53A16FCD604E7D1BEE1348A92A722BE7138B6833177D35FD24A5A1626BE46D3D300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707668906, "uuid": "982b8bbd-9c69-4347-9d56-4fae1aedd0a6", "value": "49152:8JY7p4v+aYJfSYsCdjdd4/xTybGeIIimW18n05:TC+7XPdjdd4yGpRq05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707668906, "uuid": "e7bdaffd-a949-43de-99be-281915fdf938", "value": 3313024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707668906, "uuid": "b30686da-24ef-445f-8248-02109bc11267", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707668906, "uuid": "37f96c56-28b6-4f4a-9576-49966debb3cb", "value": "SecuriteInfo.com.ELF.Agent-AOM.19419.7700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f990984a-c901-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707672081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672081, "uuid": "7e9e45d8-c188-4f05-b397-a9dd49c74d56", "comment": "Malware payload", "value": "b1e8d4d7dd26612c17eccbf66b280e7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672081, "uuid": "2fd02952-92de-41d2-b48a-bbfedf064235", "comment": "Malware payload", "value": "e3940372b04a4cb2177ae409c195debccfe004600d73a39d429a577d248d4cb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672081, "uuid": "8f923f51-93a5-4bc1-919c-34e3a59b88b6", "comment": "Malware payload", "value": "97dd5e81a4014fb54ef5ac3f1db88519843c85c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707672081, "uuid": "c3859c3d-5173-4de8-ac00-dfd658ba0711", "comment": "Malware payload", "value": "ba75630e567fca887d0bf0b2622aeb6dd6663455f6e80a9ee2f4b05ee826ff1b53ea067bee0ca92ca61f0e7c54e18cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672081, "uuid": "f3a7ea0b-e013-4bdc-af79-77f487b3ce16", "value": "T19C6633816FD31599C40CF13807A1BEAD71F17F6D45218D19B8B86BDAAF17CA852B2E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672081, "uuid": "ced218cd-64f7-412d-95e0-40fca931ac21", "value": "e57520caf747e339a21db5d3a9c3925c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672081, "uuid": "4bddd7e0-ee79-4089-9286-43670d0f9f0b", "value": "98304:mowGxchzKEDTiqXui6PmQeLiwh/slCZ+DcCfdBXCknigkcXgIfzAgaUPL6W696f:mPGWhzKgGeNcoLiuEoufPS5gkUUgaXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707672081, "uuid": "a86f0151-ee12-4c92-a668-81f3d7cdd832", "value": 6648832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707672081, "uuid": "9bdbb059-d889-4398-82d5-39ae55f6c170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707672081, "uuid": "0b84cbbf-c3c3-4874-b51e-77e550ed34b2", "value": "b1e8d4d7dd26612c17eccbf66b280e7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18cb82b-c8f4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707666350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666350, "uuid": "7b8e10e0-af10-4af2-a11e-a6784fbb0347", "comment": "Malware payload", "value": "faff67fcc2669dd6006bb6b1872922f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666350, "uuid": "be83eecf-4b13-4351-a2f2-94e94304479f", "comment": "Malware payload", "value": "e4977081b070d8ef8afe4477ee1cf9be19dde4063cc3f9ca88eac98a11656b18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666350, "uuid": "dfc97c80-fa5e-4e9c-8390-83b48b552b4a", "comment": "Malware payload", "value": "88ab34140c37133755982a3f2b2b5932ad484f92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707666350, "uuid": "2be87313-bc27-4a9b-a5ee-f86a29fda297", "comment": "Malware payload", "value": "e618bf0596bf60854b42229358346602b52e31844361d76455e433bb73ef7ee9a4f4d4cdcbe7fe62c3e2cbdb132a5b2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666350, "uuid": "673c0ecb-9988-4382-923a-94b29529feef", "value": "T19E85D007F3934E9FD7E26139C061E357E7663848172687EB3ACC0918DEC82E45B99B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666350, "uuid": "1bef2e0d-9726-44dd-8355-82111420eb78", "value": "6ce5a0fe92cd6200350979b53716f64e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666350, "uuid": "e7a33a18-04ef-4114-891a-ce6a008a77e0", "value": "24576:Mn+P4LP6nis+GOLIUnNv7pLyyAVeahQdiH2M7wjHYC1eVuQs:BZ+G+/nNv7p2yAVxhQY2M7e4C1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707666350, "uuid": "9ff7f580-6bb3-4c05-8aff-a23d2154042a", "value": 1840128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707666350, "uuid": "6c86fd54-6bbb-43dd-acfe-dd538e167644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707666350, "uuid": "a9f935b7-e72e-4d30-84e6-d8192e49d219", "value": "SecuriteInfo.com.Trojan.Generic.33936191.3742.21222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2286ad6c-c8d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707652822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707652822, "uuid": "a7d0e6a1-b08b-46f5-8202-3123781b2a73", "comment": "Malware payload (DCRat)", "value": "aeee28f5cccb12c0baffe8364f4ef4e8", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707652822, "uuid": "5e94268e-e572-46b1-aa6b-1ecebb7ad586", "comment": "Malware payload (DCRat)", "value": "e5c7522853714ce5cca752c45b5d7537e912efd1c932e5eac2084acab9fbece6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707652822, "uuid": "4aa6bb69-a662-4533-aa91-15dcf66be4d8", "comment": "Malware payload (DCRat)", "value": "78fd4b83385c715f99365a5e0466f2223a4d6c0e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707652822, "uuid": "c489b398-568f-4e3b-89be-9092a6692969", "comment": "Malware payload (DCRat)", "value": "68df93bdf17f0427dabbf6851d4ac01e04876511be1bbef62886bcc2873e62b12cde81e3641c657bc52a74b762886aba", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707652822, "uuid": "6032a393-4b75-4908-83d9-0fa8d43857e7", "value": "T1FE4538027E44CA22F0191633C2EF494487B4AC516AE6E72B7EBA377D55123937C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707652822, "uuid": "ad4a92e2-9275-4f82-960b-82a4e59db2a3", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707652822, "uuid": "f967a263-e0d5-432e-a5b0-1e3842e32961", "value": "24576:U2G/nvxW3Ww0torEh1W5f2qBEADinMGbndR1bADL:UbA30QEXWrBEo4AX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707652822, "uuid": "d3c86967-1692-46b8-aad3-ba975c1e338d", "value": 1164926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707652822, "uuid": "3664531e-e297-40bb-8b4f-5e79d957796b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707652822, "uuid": "be47be63-59e7-4cf0-a234-f597140cb89b", "value": "aeee28f5cccb12c0baffe8364f4ef4e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ad9ef2-c880-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707616366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616366, "uuid": "95bfbff6-ce55-43eb-8965-895869a5d63d", "comment": "Malware payload (Mirai)", "value": "44a90b2398cdf148b7f1feafa2bb33b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616366, "uuid": "1a90bf36-2a7d-46fe-890a-460d310970f5", "comment": "Malware payload (Mirai)", "value": "e7090a36c6b756cac6090119971feff6759be0df62d7a8cd737b46efc54662bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616366, "uuid": "6deaabb7-6d62-43b5-94d4-38854aacf0b5", "comment": "Malware payload (Mirai)", "value": "39524c593eb56e05e451cf82e687d5afde9069c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616366, "uuid": "5025c6e1-271f-40a2-b7d9-3e734ad1ebc1", "comment": "Malware payload (Mirai)", "value": "03bea6fea696a98b7d61a0e97b60e6dbb4976b52689d0061e5551fbd47f87bbfc9ab270b4e75af5287d8a30fe72d9ef3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616366, "uuid": "abeb448b-cf2f-4ca3-ab0d-dccc8675c3ff", "value": "T1A4334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616366, "uuid": "a4c16d09-5271-48ef-9828-275a94967da6", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GWPS4yns96BktDgIPi8Twc:ivW3jdQGqt7Y+Z+9N9cGgI6bc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616366, "uuid": "2db9e667-3a19-4ed2-ba6b-491521c0a8be", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616366, "uuid": "5ed1dabc-f274-425a-8655-82fe099d1e97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616366, "uuid": "367aa664-76fc-4637-b648-8b0e066f0535", "value": "44a90b2398cdf148b7f1feafa2bb33b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4035ea-c8a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1707630320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630320, "uuid": "c2ff7b7b-7f38-4bda-8176-e65f450e0f61", "comment": "Malware payload (njrat)", "value": "022acabaf8af0e28844b01f4929ee95c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630320, "uuid": "4f823f71-7642-4ffe-8bb2-646dbe198334", "comment": "Malware payload (njrat)", "value": "e76ea7b90a900ed00f982ceeff3e6b1f08956f08f8e00daf59c140f51d0deb2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630320, "uuid": "068c21b3-53d5-4428-8065-42d934af00fa", "comment": "Malware payload (njrat)", "value": "b0096d8c5d45cb7e9e0b3df0b5be5c92669530dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707630320, "uuid": "1cc8331f-9378-449d-883b-b732f4003c5f", "comment": "Malware payload (njrat)", "value": "d20eb4a2f5c0a0ac037cdd6b212b79e85dba567ebe308663c4133eaa81c03be6717beb92d63a57fc6719ee5e9418953d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630320, "uuid": "f88fc454-e695-457f-998d-28e2ca11053b", "value": "T11413E78CB694E174D5FF8BF1B4A2B2890B71A017A806930FD9F154D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630320, "uuid": "60adf1ad-598a-4510-8edb-f4450a4f84d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630320, "uuid": "99d0a858-ead1-4057-ada3-aa8ef20277ec", "value": "384:YZyq6NUst+3gUy6tZFIEEEoHjtJEzQIij+ZsNO3PlpJKkkjh/TzF7pWnI/greT0k:uqwQh6PFtkjGuXQ/oJ3+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707630320, "uuid": "d4311bb6-142f-4f0d-b010-b6ec293bfb89", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707630320, "uuid": "67a37ec9-7265-46d7-a9d9-f5911e45d49d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707630320, "uuid": "0bfd45f0-11b2-46bd-992f-233a14db61ff", "value": "022acabaf8af0e28844b01f4929ee95c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5aa8dc-c8e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707658902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658902, "uuid": "c9ef6284-d155-41d3-967b-5ce0e5c78f0e", "comment": "Malware payload (Mirai)", "value": "b94a2f1cd5e70727f85b13204f843e16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658902, "uuid": "4acfe839-2fa8-42a3-9cdf-e2473fc62560", "comment": "Malware payload (Mirai)", "value": "e9de5bd5660e365f3d3bdfe7d4f83b07b503e2899fa4848fd2ce119b3a641e05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658902, "uuid": "9d467ddb-ef34-49a5-aaf2-304ae9dda1bf", "comment": "Malware payload (Mirai)", "value": "facc2b33f861dd8b519dbd6d320337f7abea75c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658902, "uuid": "9bb7aa01-cd60-44ee-8140-0bc2bcef9b5c", "comment": "Malware payload (Mirai)", "value": "1ca5397425efa97bb9e563bb551fc8d0ee1b3cb8ebac923f66cea4952f4ecd0ed1560182892787bee9d8b270c02d04cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658902, "uuid": "a0e41b82-1e75-41bd-8a61-252e26a26022", "value": "T1E473C70A7E229FBCFB9846354BB78F159A5833D627D1D641E2ACDA001D7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658902, "uuid": "4b5c688b-a3fc-463d-9d74-5a5ea5f4a53f", "value": "1536:bpxe5qoct9fdlQBI6r+EnUFndlBotYG9CJa101Dv:Fx3oANdprndvomgC4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658902, "uuid": "9532cf5e-80bd-4aea-a120-d01a65abc2aa", "value": 77288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658902, "uuid": "357a66e8-e90e-40d5-af87-64ea710aed66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658902, "uuid": "2212f5c1-08ed-41a7-aa95-870bd4a7553a", "value": "b94a2f1cd5e70727f85b13204f843e16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d29fab-c880-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707616379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616379, "uuid": "4abf8680-6a18-40ee-8a8d-f118bbb98ff2", "comment": "Malware payload (Mirai)", "value": "b132c263aefdf92c6531bf194d2081be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616379, "uuid": "f582dc5b-adc1-4c8c-958d-d0aa43fd2019", "comment": "Malware payload (Mirai)", "value": "ea3f15742b194b56a57d219fa078c4c159824cae93bcadb0c6679d927c484a6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616379, "uuid": "df2ac7f5-f0bb-4cb5-81ca-f2ea644de118", "comment": "Malware payload (Mirai)", "value": "e5f899337fc31aa840b434bf6b4bd356ff108eb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707616379, "uuid": "3909ea8c-602e-4f88-a8a6-b4f52cd85cc2", "comment": "Malware payload (Mirai)", "value": "027378f7ff61b35b32229bc59d8b0b092e9d28e9aa2521f16d794feb8ca3b3f9f5caef070f3c079bffb157167b65a40a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616379, "uuid": "afa78442-b51d-4b53-ad38-73a30bc03cb0", "value": "T199336B36E029DED4C6560134A4E88FB51F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616379, "uuid": "ec9e2baf-1dbe-4296-9fe5-f2f4f7634be1", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/98m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBRm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707616379, "uuid": "c44fef35-e1fc-499c-84e6-6007a03eda76", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707616379, "uuid": "bd566323-1f5c-4051-83db-a9e6e716b93e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707616379, "uuid": "c7bd04ef-228c-4f54-9073-6dc609166ffb", "value": "b132c263aefdf92c6531bf194d2081be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87dfd32-c8cf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707650470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650470, "uuid": "77514fa0-1ccc-433e-90cf-703e342b4c2b", "comment": "Malware payload (Mirai)", "value": "84fbf9e29a7df1a9a11e592c2a338c44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650470, "uuid": "87985a8f-43eb-429f-a916-50ebb3f83a39", "comment": "Malware payload (Mirai)", "value": "eaaa0c04cab8a4ee17ab5df288d08195a241214802eebb19d86dbfb9ee9d5241", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650470, "uuid": "4d8e535e-ad4a-4c60-a1d5-a4f3e60aa8c8", "comment": "Malware payload (Mirai)", "value": "ad2a3ca16932379654b9286018cc21bf328ec244", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650470, "uuid": "2f49820b-43bc-4412-84a8-5227c507727c", "comment": "Malware payload (Mirai)", "value": "4b918fe50c8c119c65c0a831eb89c419203c27c08e733f35bcc67d699f739c471e6862f3ec1a77eaa4485735534d7b7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650470, "uuid": "bc742745-db5a-4d28-b95a-f5af40c341b7", "value": "T18553AEA7C4262D94D14886B4B5398F741B23F1448657AFBE4A8AC3778093DECFA093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650470, "uuid": "51d1f726-56f2-47b7-be3b-3236eebf85b1", "value": "1536:Ha7wtLJVRBDSsymk/I9KumAk/hJieCzyp8MN:HgGVRFbXku2hJieV8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650470, "uuid": "50433bbd-0411-4663-8cab-bcff213315fd", "value": 65208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650470, "uuid": "3d602197-670b-4863-a61e-96ee7c437a39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650470, "uuid": "13b597cc-60c9-422e-9d8a-51e0b750d0f3", "value": "84fbf9e29a7df1a9a11e592c2a338c44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3841ae1b-c8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1707658442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658442, "uuid": "2c873901-8181-486a-a919-e18614b23d9b", "comment": "Malware payload (RustyStealer)", "value": "81f7c882cbb9d5fc05e3fb7df0bd43a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658442, "uuid": "6e76cfaf-8729-4250-bbe6-46be3237e1a8", "comment": "Malware payload (RustyStealer)", "value": "eb134ea30b4d29f5e608995faedf388a0cf18c02cd95a5dac591eaa29c9281a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658442, "uuid": "5688b01a-6cb6-48b1-8932-ea084f222325", "comment": "Malware payload (RustyStealer)", "value": "ee816ede9b6b5b404b8782d928c28cae1676536d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707658442, "uuid": "02c72b4c-bae5-4105-86c0-531399d188d0", "comment": "Malware payload (RustyStealer)", "value": "3c64f32c27df63506bdcd552fd752c012ea862f959a56443c2419c879074c57524ed11e6357de7af574d6374aeb046ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658442, "uuid": "8fd213b6-5192-448c-bbec-5a591f4a81af", "value": "T17E453A87F78089AAC45AC17482679733B632B84D4F25A79F17C0AF323D627511F2E789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658442, "uuid": "97fcbd93-3975-4e6c-a747-6b0b2235238e", "value": "4fd571275b7951da99d203a9d40127d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658442, "uuid": "897272c7-b5de-49df-95de-2e5d452ba916", "value": "24576:liP6sOEUQa5TC28FTbQKhwcnohQn652UO15rCA:la67QfnKkwcn/ujA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707658442, "uuid": "314dab1c-4218-4d8e-aef8-808ec94c15fa", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707658442, "uuid": "76980096-738d-484e-a7d9-09c526e48f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707658442, "uuid": "0a76e064-8c0e-41cb-a6da-1e7bba6b9703", "value": "SecuriteInfo.com.Trojan-PSW.Agent.15300.31832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b716ca-c8cf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707650464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650464, "uuid": "832c010b-f2ae-4701-8d4a-6c328a6ad00c", "comment": "Malware payload (Mirai)", "value": "6b972d7f2c5347b690b005d8e2936bd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650464, "uuid": "38905662-bf63-414b-a8f3-f19e6bfad7f7", "comment": "Malware payload (Mirai)", "value": "eb4574e78456728c34b34b50c857fc41795c15e212a1d7b2f80cb46561b58400", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650464, "uuid": "5652c9ce-5d04-4d6d-a4cf-a705d2cdb0f7", "comment": "Malware payload (Mirai)", "value": "d651d8d479d280954fe5cdec3b9fd8176a3a3a17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650464, "uuid": "5d654840-d820-47ab-add4-be292b246550", "comment": "Malware payload (Mirai)", "value": "657b034fe6808f06614cc23f9507f4562ad5cfc4fb07b9345dc37064459359c95dd781017f384889a18b08fbabc46643", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650464, "uuid": "dbed6c92-534a-48ee-8bc8-a76172c68c4d", "value": "T15231DFD1A3D05DBDC4A411BE9E6B4314B3799F80E0C67623830C77186D1AF785D27486", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650464, "uuid": "652c6b63-122a-4a81-82f0-ce4959333075", "value": "24:uAlKGpa7Urz/jlfdbcOXK1hUVev3gRGaJ9i1BBuLlVY9gSO:uAlKGpa7UrLZ2/+J2Bu49O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650464, "uuid": "4a298a8a-3a00-4e40-bf5c-d8236f3fbd79", "value": 1492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650464, "uuid": "50dce720-4985-461d-8966-000cb2e3ac5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650464, "uuid": "02ccd944-fa1f-4f12-b6c5-67e48322805c", "value": "6b972d7f2c5347b690b005d8e2936bd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdf8f23-c8cf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707650476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650476, "uuid": "e747cb00-68ca-427a-a87c-9409e077e1ac", "comment": "Malware payload (Mirai)", "value": "845b6ab34e2fb39420324e1e0f2bdd5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650476, "uuid": "caa082fe-1342-4cb8-ad70-4ac2fe98ae63", "comment": "Malware payload (Mirai)", "value": "ec2e5971a91c208159904ae9eb75e26a4575e4f0a495b60717499a933e9c78c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650476, "uuid": "6ef4b021-82ed-4612-817c-620fc936462c", "comment": "Malware payload (Mirai)", "value": "29ecf360ae14f54d7f64619bd9bfb6dd2d7c2bca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650476, "uuid": "8c2c7e32-ac79-4108-8acb-640d27f5025c", "comment": "Malware payload (Mirai)", "value": "bc6348c8dd377ea35b67a3c4134ed0febbf0693c44bc81fc14856fc47417ac5ea120865ea85bbad4f46f032887d21d84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650476, "uuid": "6e735f0e-84d1-4f21-a168-bd86c4a9d5cc", "value": "T1CE219B9AA7D3AE17CD440237DDEF5710F322AB84869EF513E31126150C7F31A1F2218A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650476, "uuid": "1c564c4c-29e8-4ee4-91ab-802062102349", "value": "24:JiAtVsgP9qD0at6EocGn6rUlFSy4PzLCkIddx2HwQITVNfe:JPtVFFqDPtVrkFSy4PzLBI5Nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650476, "uuid": "2c0561f6-4085-44b2-a1aa-c8662fba39b8", "value": 1160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650476, "uuid": "60be223d-0a29-46bc-a2af-62d085b6fa78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650476, "uuid": "1b749ace-8fc2-464a-9c48-b4cc6dabcb6a", "value": "845b6ab34e2fb39420324e1e0f2bdd5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4b0cb6-c8d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PythonStealer)", "timestamp": 1707650718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650718, "uuid": "5ef42751-6ea8-4f4c-9e0a-9764588fa73a", "comment": "Malware payload (PythonStealer)", "value": "92f642212cdbe6ac3a8e6f48243a2489", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650718, "uuid": "5db74ad3-6921-460b-80cc-79a179c967a4", "comment": "Malware payload (PythonStealer)", "value": "ef24286fb0f5c05f739109f955521ae44bc74b52414c05722a06daccc07ca4e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650718, "uuid": "59742d2e-0151-4024-b8bf-2cd2b7987cd0", "comment": "Malware payload (PythonStealer)", "value": "6c5b3c6fa506dc92cd0bb4aa36dc4ccdac77a727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707650718, "uuid": "d2c40d41-190a-421d-b71a-18724f574fec", "comment": "Malware payload (PythonStealer)", "value": "1929aa45aac537fae7dced53c37e94bfac2a26c19753822baa934f3bf8d2c18f00d478b842a7b17858dbda96706e8786", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650718, "uuid": "5c898746-7697-4d36-94f1-28292b6b5f2e", "value": "T190073311B21699FCE612D638CDC58E55DEB4F535024179CFABF923B1AE013C48F39A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650718, "uuid": "2f29dbb4-f178-4011-9985-c94d21b2d61e", "value": "93d43aeb382bb96365179ee6aac2f1c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650718, "uuid": "a7958fdd-dd3c-4f73-af80-f15c9bde1b95", "value": "393216:oJT9O22UETklFz4Uu1u2u+rJvtNqe6ZNIllZEzhtMkQ:oJhTETklx4Uu1xfd1Km/EzhvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707650718, "uuid": "55aec9ba-bd38-4a30-92d8-c57c722ed3fe", "value": 18317824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707650718, "uuid": "45b6a631-a40a-408d-a1af-a8afabba528f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707650718, "uuid": "022f887e-9467-4f8f-b6ab-39478b1ab986", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9ddb47-c904-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707673109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673109, "uuid": "ad36f231-b445-49a7-ba99-f321697e046f", "comment": "Malware payload", "value": "8eaf647dfb34faa67b34b3af95774dc4", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673109, "uuid": "a6c60037-1316-44d7-b6e9-186512a42017", "comment": "Malware payload", "value": "f096109b5e23f6a1e0c3388d14faf00b1c4be8af5498b11548c8731b96259129", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673109, "uuid": "bbaa5b0b-f4d4-4f6b-a9ed-73d55a1568e0", "comment": "Malware payload", "value": "d96ae71d90a4b1af9fd951de2974e2ba135b51fe", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673109, "uuid": "238cf1d0-5fdf-46b3-83a0-a23733c5676b", "comment": "Malware payload", "value": "61c512f0bf0961fbe2add5f32be4954cc3311ebc2a3cbf0d39cec9b7b0d56a723095e3c8abc6fa67ab361078624ebbda", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673109, "uuid": "232e3607-ab1f-498d-8cf3-7e14e309f285", "value": "T1490623ABFDF183B9D6136F30AC418857FE0D54A999C8F56B44F208664821D460FFAEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673109, "uuid": "0618764c-242b-4a97-b25c-745ed1c1621a", "value": "98304:DP+7oAwItpzdgj2WistOIk8AevgvmgCFBpxex7cU:j+75wI/wicBWeo7Cxxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707673109, "uuid": "4a16a38f-9fcb-4300-9e02-051520ee92c6", "value": 3963842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707673109, "uuid": "76a6fe8f-3c9d-4a7e-9872-d2cbf361b6c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673109, "uuid": "407f5666-5a23-4855-9209-72d10aa3b65e", "value": "XDemonsSkeetStyleLeak.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45625611-c879-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707613367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613367, "uuid": "a87c7459-3e11-4068-a014-864cc0a97084", "comment": "Malware payload (Mirai)", "value": "9c6b435dfcafdcf365bc065cf080a97a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613367, "uuid": "162ffd9d-dfee-4a53-937c-8f9d21d02b83", "comment": "Malware payload (Mirai)", "value": "f09955ad647b24da9f87de6f5fe02dcbb20bf00eb682baf5df5825b6026bf2aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613367, "uuid": "a6202426-8f25-46c8-aae0-70e31b242fa7", "comment": "Malware payload (Mirai)", "value": "77e48c10811a459fa011a6db202698b259279b5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707613367, "uuid": "1ac9fba3-9fc8-4869-b60f-0c5bbf52dfd2", "comment": "Malware payload (Mirai)", "value": "36c6842a7c558df501d795aebaf17af6fabb55938b624d36b88fe2065d5d7b6999001d261747ee833e7fce02c94e9971", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613367, "uuid": "1ea61464-37d6-4b30-a855-cd0a473aa005", "value": "T19AE33C46EA818B13C0D61776BAEF424533239B64D3DB73068928BFB43F8679E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613367, "uuid": "54ead64a-cb3e-4cde-8ec8-5f2de76c00e3", "value": "3072:czvupszCkqCzUaqhlngCTf2h5gFr7IBcmCSwAM/9ybGE:czvBzUiUaqhlngCTOh5EpmCS3M/9ybGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707613367, "uuid": "499f3c78-a1b0-4f70-b6a5-9e4ce38ea157", "value": 157086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707613367, "uuid": "65ec4d1b-4517-475b-a8a6-9a73ee673219", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707613367, "uuid": "05973dc1-07dc-4c4f-9db7-0d5127b2751b", "value": "9c6b435dfcafdcf365bc065cf080a97a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a720ee-c8e4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707659218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707659218, "uuid": "5e493b7b-fee1-435f-835c-99da57234a42", "comment": "Malware payload (Mirai)", "value": "138458423fa5a99a2753bd8bacfd89b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707659218, "uuid": "0a3e888e-0a2a-412d-b44c-1162e4e37825", "comment": "Malware payload (Mirai)", "value": "f111921adc1ec604bb3018076f7bef6c4531fd29944a8f44f20610385a7ada59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707659218, "uuid": "9c735059-2262-45f9-a402-d8a3adf35642", "comment": "Malware payload (Mirai)", "value": "44d3cba80455215cbb181f14b4cf8cf015aa9c8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707659218, "uuid": "04947d96-7622-42dc-a7fb-b2777bc8a1d6", "comment": "Malware payload (Mirai)", "value": "04b66964c9544f838d3d008b3e9fd1c5b48758719afde54a3c266810122d83226535b62980e7d702cc12f7eb0dd5ac2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707659218, "uuid": "d569c07d-f520-44a2-96b5-8768da6d805d", "value": "T148432B95F802DE7DF80FE67D44164E09BD3063C261830F2A27ABFEA36C720966D56D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707659218, "uuid": "fe56d6b4-8569-4a83-a1b5-7d46569348f7", "value": "1536:/+dPsTgnLbMuv5tubaXnb7f98V8TWl9ouSQy8fNLsA:23rubobZ8V8T4oHQD1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707659218, "uuid": "0da13e33-53a8-4427-8a01-9036ebd248fa", "value": 60452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707659218, "uuid": "b833cea5-e975-449d-88bf-d7cc229ce911", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707659218, "uuid": "e7511a1f-e2f3-46a5-9a04-4a8bd16ec696", "value": "138458423fa5a99a2753bd8bacfd89b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14733f2a-c8c3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707645068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645068, "uuid": "d8a5c7db-4276-4234-87a8-c6c5a39b5ab1", "comment": "Malware payload (Mirai)", "value": "f85676406362f0a97539a294921aa9c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645068, "uuid": "2673f31c-d3fa-4362-b9d3-fb186e2bb669", "comment": "Malware payload (Mirai)", "value": "f2da57f53c894b06cf89ce0a635438d17eb6b11f18bea18acf2d7a5a90559c15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645068, "uuid": "f61f6f21-c002-47c0-9386-f693fba7c829", "comment": "Malware payload (Mirai)", "value": "9894478157fab5dbb0ba5968226bed75c566db73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707645068, "uuid": "5a8e9f7e-1038-4b83-b80f-247a5276a7dc", "comment": "Malware payload (Mirai)", "value": "fe24a137667b151bb9552e0bf7f8fbfa7410412177c069f7e90fbcb69610e9dcb803aacf14f150b34cba9264c6c7da9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645068, "uuid": "2a9399ff-2b70-4724-be15-a7da244bc7aa", "value": "T11EE31B56F8818F12D5C111BAFE1E128E37131B78E2DE72129D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645068, "uuid": "f2aa31e4-bb25-4b5b-bb27-c93d1192d9a8", "value": "3072:ARpOoGgUKySLmXu2gMYRacVRjTh4CddDCY6s:ARQoGg59mXpgMMauaAdDCYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707645068, "uuid": "6c604214-0ba3-46f8-8a13-3aa3b01bb8ea", "value": 148092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707645068, "uuid": "b5dd9e19-53a0-4cae-a07c-0621ac3bae24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707645068, "uuid": "73c4bcbb-1de6-4fa1-b0ba-9a67049e3acc", "value": "f85676406362f0a97539a294921aa9c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d23d5c-c925-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707687317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687317, "uuid": "e6d832ec-f483-466b-b939-3c60c649d839", "comment": "Malware payload (Mirai)", "value": "20a6c023c56cc4516b9f6febd5c836a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687317, "uuid": "f260ab84-7aa2-4c15-8112-b725012f6f6d", "comment": "Malware payload (Mirai)", "value": "f3b450524454431b885c4236fb6e0cba5a6bde1b79f78c71d0d0834528d53dd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687317, "uuid": "1281c167-25e3-4eaa-b999-4213bda42efb", "comment": "Malware payload (Mirai)", "value": "9a4f0ff7073e0d1cb68f15775a2f283da1d3b764", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707687317, "uuid": "a657eebe-8c1b-4dc6-b8f3-df4753159567", "comment": "Malware payload (Mirai)", "value": "b153f8e50b0660441bb3be0bbeea191c1b00e9280013f4c8354a4df33a705bef9379bf3893b5d5e717228be71352fd2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687317, "uuid": "ef579071-a088-478b-86e4-38ddd324bb16", "value": "T1BF73C80A7E329FACFB99523587B78E116A4833E527E1C685D15CD6012E7024F381FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687317, "uuid": "71c83925-df8b-4684-9b23-1f2d0bd076ec", "value": "1536:xYXSlnHvywF3gnbfyV0SE9dPl8oYY51eafk9m:qCZHawRgb20/9dPl8oYY5zk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707687317, "uuid": "451fa920-61f0-4631-9b9a-4777096c9d81", "value": 80164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707687317, "uuid": "2630e504-a3a7-4670-844b-235b48c2cf5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707687317, "uuid": "73e45361-3384-4142-ad3e-fc1859aa809e", "value": "20a6c023c56cc4516b9f6febd5c836a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be12e6ae-c911-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707678853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707678853, "uuid": "31cdb49c-71c6-4b60-9f98-6f20682bf875", "comment": "Malware payload", "value": "3b6008c88517e52eb28ebeddaba26b03", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707678853, "uuid": "37e90a52-5769-40b7-988c-4246d429f736", "comment": "Malware payload", "value": "f5b97dfe4c391bb02797938d876c4c0ce94d3df705e1d98879e5ef659dc0a3d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707678853, "uuid": "71049a74-9b0f-4740-a1e8-c01bda235b6d", "comment": "Malware payload", "value": "3ca4f08841e39804281efd107c826f0276e6dbd0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707678853, "uuid": "3c9cc899-6da9-490b-a83d-09e1cb3f4ef3", "comment": "Malware payload", "value": "518e24af3c867a105d73b96e5ef911a4ebe71270a529680de5a2da03af1d5f4a8fc94383a9da8e1a222d85cb937033d0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707678853, "uuid": "e8267b15-a964-4b99-84cc-4f6ed8084f42", "value": "T1D22339C4A547D8F4EC2606B16132E7369B37F03B115ED957CB99DA23EC82B80E94729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707678853, "uuid": "0b786f5b-4836-4541-a0e3-53e07220b91d", "value": "768:X50ZMIfIlf/BoCwn+Ia/+Ugxbmj+T5ARSqFiiN4ugFLsO:X50ZMSIlf/BoCwta/w5moiSqEC4ugFwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707678853, "uuid": "2e9eaac2-ff37-470c-bb0d-e57fadd5f248", "value": 46512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707678853, "uuid": "ddcef9b9-b273-4e91-919d-3874c2bb46e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707678853, "uuid": "9d404969-0081-40d0-959c-050b23f978b6", "value": "shindex86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73b877a-c918-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707681902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681902, "uuid": "32aab110-4ac1-4c6b-8a05-8620bb7f81cc", "comment": "Malware payload", "value": "72cc2b625c2971ecf1972e7d6e147431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681902, "uuid": "eb4fc215-cb73-4b5b-8077-673f71d26f9c", "comment": "Malware payload", "value": "f6798eb70c3565c011e31eb5691f415ac9c07991788a7a3cee00a9baa2393442", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681902, "uuid": "55cb7ef1-60c0-4390-a01d-259e4f5ba2c8", "comment": "Malware payload", "value": "b3f4c48465dca8f2cd59f57a0d518c1a613c752c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707681902, "uuid": "437750df-f922-46c1-bd44-fd84a825892f", "comment": "Malware payload", "value": "62261891ce0ad052a5e625ce85f244ecc5a49a54b901e118aebf3b4e9e9fbf286a562ee1f1732b8c942b7bca2eabe1cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681902, "uuid": "266e7b1b-8f4a-43c2-810f-9875e4d6127e", "value": "T1B4F72216F341A1AEC837C2B29D391C10FA31AD9687179253B02B36EDAEFD8C1CF52595", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681902, "uuid": "df4b7fca-0c0e-435d-a46a-dbd2968aa1ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681902, "uuid": "9d2ef1f2-51f7-4621-9cde-c6c55989855d", "value": "786432:l+jLAJNIndudu80sv1vJ1HoA5AKF7zR/t6tKF+iSpl5gtD8Ko2d:sj0JNmHPs9VAMzttZmpl+twId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707681902, "uuid": "d793b2ab-b408-444a-97b9-1ac7a66ec461", "value": 70277928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707681902, "uuid": "1151f319-3c28-4f75-97e3-abb62d87d133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707681902, "uuid": "2ec31825-1185-4b4b-a75b-e1047fba7171", "value": "CraxsRat02~Rip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c88ab3-c8bb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707641933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641933, "uuid": "4a81d450-0b0c-4f65-b439-030d5e55e62d", "comment": "Malware payload (Mirai)", "value": "4d964fe844128305d88454fbc8924a70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641933, "uuid": "5c697b72-11ed-4b6e-a6c8-4137239bb72c", "comment": "Malware payload (Mirai)", "value": "f68b3cb81a8eed7cd485a95e030485b23ec7b62b225bc763a9fd1a61c3a95e08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641933, "uuid": "85d445ad-d7de-473c-955d-bdb5f35a775f", "comment": "Malware payload (Mirai)", "value": "6e2b85f75daaa37f148f2047d88072eabe3d5c2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707641933, "uuid": "2317640a-c41a-449f-872e-a031da7a47b5", "comment": "Malware payload (Mirai)", "value": "a512468040bc09a2d71e202f4fb3cb4bf61d606f5985e1c9068dd7975ed50a49645631fdd993d4f58f3f181f9090555b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641933, "uuid": "2a5be6f7-79e5-4982-b010-462cb67a96d4", "value": "T1CAF3A95E6E338F6EF66C873147B74925975923DA22E1D684E2ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641933, "uuid": "52d28df6-e09d-491a-9139-3538c07e9423", "value": "1536:9MHVOdA9edSAZTZtZdNKGd7sUeN8slP1j6TfNYoDF8T7GE9CkK:9MAZhZtvNK+7sR8sTgYo58TKE9CkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707641933, "uuid": "2a498d67-4e4f-4cc0-8e31-dd1207b29da0", "value": 161416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707641933, "uuid": "fd517a32-aa2c-42f6-9102-3ea1f8791b86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707641933, "uuid": "ce69e84d-4277-411b-84c2-0a0aea00a2f4", "value": "4d964fe844128305d88454fbc8924a70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9777aeef-c916-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707680936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680936, "uuid": "b2d33f71-957d-4829-ad3e-3392c2d6cd45", "comment": "Malware payload", "value": "846e4072261c99f1f45cf2f15fbb7aba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680936, "uuid": "ccf0844b-30bf-43b4-93a9-255b79d28934", "comment": "Malware payload", "value": "f75825fe85c7d4d5bb2f407f3fd1427c8c829a06cc33fe543e682dc50cef8b11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680936, "uuid": "fc856bd2-b661-4d2c-85cd-b69246fe2397", "comment": "Malware payload", "value": "409857926dd6fad018c871b9c9da6b30eefded4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707680936, "uuid": "30641f88-3a1f-4518-b6d9-a0ef95fc62a6", "comment": "Malware payload", "value": "fa2065fbb98002a46f2edc6f362c5d130aa123f5532d37b87c6252caafe0e50fbe25f09389fdb84310f626e808162212", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680936, "uuid": "07b8e912-bfab-465e-9478-e9b75202a410", "value": "T1AFF4122175D0C2B2D9B6147050E6CA759F7934B00B7692DBBB8D6ABA6F203D0B3742CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680936, "uuid": "52046c59-49bb-4781-82c1-db71c860f12f", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680936, "uuid": "3da5e19b-1b02-41fc-879b-bb936a382101", "value": "12288:ih1Fk70TnvjcDR5xClJ/X/v7BG/lf5cdxSENDisY+nM1nMHJ81EnxLiHA9IBda4a:Mk70TrcH8DvSzcCEXYcknMp8u8A9PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707680936, "uuid": "b9f218e9-94ab-47d5-bd6d-924d3041ccc0", "value": 766944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707680936, "uuid": "5019f90b-721c-4a62-8ab0-f021e6e4a349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707680936, "uuid": "4d14858a-0a23-4714-9053-c644dbe53901", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73674da-c906-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1707674117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707674117, "uuid": "388b7a9b-cdc2-487d-9c49-e69c970590b1", "comment": "Malware payload (Socks5Systemz)", "value": "42f5eb399ee94ad2bb7809e600abebf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707674117, "uuid": "9d608580-02b5-4a12-b0ad-e58a6d63c91f", "comment": "Malware payload (Socks5Systemz)", "value": "fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707674117, "uuid": "0a46f0a2-aef2-42fe-9065-201b1869130b", "comment": "Malware payload (Socks5Systemz)", "value": "3a2c7d6b63ce50367c9c27a08a164ac037663919", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707674117, "uuid": "e7fd4e02-27d6-4582-9704-7b7f43c2f514", "comment": "Malware payload (Socks5Systemz)", "value": "f8aabccba84b7ae65d64604d1e095e46b6486837b992badd2667f4fdf0a3687f2beae3d5e055a7b2cd37352f5b5fe732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707674117, "uuid": "1ca00ddc-93c6-4e21-9030-4ad033e3376a", "value": "T18F8633E5992FC93FE02AC5760744E8315C0B7FD2607838CE32A90779FAE769495C429B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707674117, "uuid": "87506c39-c7fa-4430-bb02-9a5b66423d24", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707674117, "uuid": "15f57911-97da-4585-874e-c30b25e5424c", "value": "196608:iCKQKmhnguWQkn9sl7pQ//XYenYQs9bOBKhOcq3RW:DmmVuQkn9sl7KX2QswBKhnyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707674117, "uuid": "c74469c8-a1c4-42aa-9523-bbfe1b09e6c2", "value": 7903118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707674117, "uuid": "84614dab-cbae-478e-86f5-7815275fa7bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707674117, "uuid": "6ec586c8-091a-45a4-afd4-a32bfd6604be", "value": "fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721cc2be-c904-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707673142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673142, "uuid": "ea3feb80-358f-4a60-9f6d-844ebec43408", "comment": "Malware payload (Mirai)", "value": "1c1bf049a679bd582481693e1aeaaf4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673142, "uuid": "2794f3cd-21a7-4be9-95f6-f583b66ffb48", "comment": "Malware payload (Mirai)", "value": "ff4f238f867f32dc40fa6b82606604fe8237f5629e48a950fe479ef9033b61d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673142, "uuid": "bfb21838-e45f-4650-abb5-17c8055672df", "comment": "Malware payload (Mirai)", "value": "d738ce09088eb550570931b25d886f9d080b1d36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707673142, "uuid": "4cd2f476-c3ce-4172-99d2-175226a20fbf", "comment": "Malware payload (Mirai)", "value": "5bf684b8ac56f3b40c04ecd256f9f04a3be543476e8c6d525f3371a342cd1102429b1730773ba9478435956c1eef34bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673142, "uuid": "8b9aa533-2880-4ba5-9421-b81dba20b0d2", "value": "T10FE2F18D09D02773CC568737595BA4C9A2A49D6F0923A0594F8F79BF9F1CED8A270309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673142, "uuid": "3501953e-2593-457e-a5a2-1fe8850dc24e", "value": "768:KJRx8bDP5l5QA3oy3iDIfLfMebcpJ5MI/IHxoArpG3azKL:KJRxSPLYy3/Tcz2I/UrpG3azQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707673142, "uuid": "c044e223-4641-4e3c-a781-a3cafe6f5134", "value": 33960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707673142, "uuid": "48ff51b5-60b9-4503-ae2d-917e83e70003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707673142, "uuid": "59ff27df-d601-485d-b0da-65a404c8defe", "value": "1c1bf049a679bd582481693e1aeaaf4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535d963e-c901-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707671802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707671802, "uuid": "f9054e85-940f-4f34-81ab-5da920a83289", "comment": "Malware payload", "value": "9c63ac93a4b34f999a4283409af471ed", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707671802, "uuid": "12a032ff-a876-4a0c-b4e2-832d77d39906", "comment": "Malware payload", "value": "ff67692abc453dbbc9c8d70bb6d623197171fd4604d82b6adccc53c2e1db4d9b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707671802, "uuid": "fcc821a0-daae-4757-9c62-ce3e5c202693", "comment": "Malware payload", "value": "4b03914c7cbb4bc61e6097846e3cc49bad153140", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707671802, "uuid": "6969919d-d196-4457-be10-42338d90a219", "comment": "Malware payload", "value": "c0563d81bb6629fef4a170454f0e17d2a2c2d0869630972bd9461562b2bd6bbba1c6d5141a02457473062f18b91a6902", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707671802, "uuid": "1a8ddd98-9333-4132-8fb8-a3018da41917", "value": "T11055AA342979BC2447D7EE2336F14A950DE545AFE4303A3B1A8EE5278A762C111B12FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707671802, "uuid": "3309726b-25b9-4abb-978e-5b2d68401443", "value": "3072:PSE1iZfQZUcaJgF4oHDgXN4Wy5iAlb2t5YRyrR3Ry/4dE4J0Yut3n8E:PSE1iuZU0lcXiWazUtlTZ0ht3n8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707671802, "uuid": "b75b4d54-82ae-4d5e-a17f-65345d96db64", "value": 1370946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707671802, "uuid": "6627aa41-3348-4887-8638-e73aec61269d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707671802, "uuid": "db98bcf1-d9f2-4ba2-8078-8de8bd777379", "value": "putty.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }