{ "Event": { "published": true, "date": "2024-02-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-02-17", "timestamp": 1708214581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "94e0324b-8d1a-4788-9313-14faffc35a32", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d4fc16-cdb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708188650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188650, "uuid": "d500d525-10eb-48a8-b725-349f3d04b683", "comment": "Malware payload (Mirai)", "value": "4361db71aec696a1b7f1d79432975659", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188650, "uuid": "cb86f062-433a-41cb-93cd-f59793ccc04c", "comment": "Malware payload (Mirai)", "value": "006eba94bab7b8e67a36efd3d56ecf31744fb6c7be095922b04aebdf063db2e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188650, "uuid": "1b52e9c9-f201-40c6-a511-ef4372eb4e2a", "comment": "Malware payload (Mirai)", "value": "ab165e91b46719e945145eafef2a7196d390681b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188650, "uuid": "a18ea024-4987-469e-80f6-f2514aa3a29e", "comment": "Malware payload (Mirai)", "value": "8d57f1d8f190847df4b6667aea925a00f2696e1fc1b5e48661d7baaf20708f744f08a0608fa68f9d349649187a20070d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188650, "uuid": "fde2fa73-e267-45a1-bc19-9fc7acb74013", "value": "T10FD30945F8404F23C6D612BBFB5E428D3B2A17A8D3EF72039D216F60378695B0E36646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188650, "uuid": "3fe351f4-d7c2-4800-932a-5f3b715c3f1b", "value": "3072:fe/GyaONGP8D1f5U44+2fuGgTqj+InV4:fe+QGPgx5U44dfuG/+InG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708188650, "uuid": "03175921-8874-4c32-a497-d81dad92a71f", "value": 137984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708188650, "uuid": "727a88ba-2379-4462-90e8-b43a1be4f18b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188650, "uuid": "944c8121-200e-465c-982f-802d696aa525", "value": "bulu.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0bceda9-cda5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708182201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182201, "uuid": "5624e98a-2327-43f1-a35f-30eb8d693c55", "comment": "Malware payload", "value": "45aa7b7cc2ce63c824ef469ed37b2b5c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182201, "uuid": "37f751be-28d9-4038-8a39-ad2cef36f8da", "comment": "Malware payload", "value": "011cc95968a349a0a0bc76cd1a4caf3316437a8cffa6fc5f56176f4984942ecf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182201, "uuid": "6340b937-f413-46f9-99ac-6ec7cf687858", "comment": "Malware payload", "value": "f9934b9104a8ba94d3b8a2104dcf67da74768eea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182201, "uuid": "cb7bb994-5f86-4541-abad-af3316058e6a", "comment": "Malware payload", "value": "753b4da2b71d1f76b223c4b9eb2df4f9fd6e63ee094e1a056aabddfb89b40cb8da76cb687c4d14a38b982ec840c78406", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182201, "uuid": "2edd987b-9fa9-4dc8-95c6-698388d2f448", "value": "T11C53734C2E329FADFBEDC23453B39A25A659379936D1D5C4C29CE6012E7020E342F7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182201, "uuid": "d4bd7140-af82-43c8-9793-f04062306c58", "value": "1536:eEnyoG9G3rvAADfWM61pOSL1rv6d6jsnYOtkyIef75:jyDervAAstL1+d6jsnYOqyIWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708182201, "uuid": "dc48dd95-a3c8-46f1-b05a-820d9878eb1d", "value": 63932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708182201, "uuid": "bf1aece6-d594-4824-809e-1d5fb274320e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182201, "uuid": "6ef7e7d4-4882-4fc5-90bb-1dd2d3409ffc", "value": "b4ngl4d3shS3N941.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9efd799-cdbf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708193410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708193410, "uuid": "1a2b107e-ae26-40ac-977a-65071c8eabea", "comment": "Malware payload (RedLineStealer)", "value": "03e350c52d08a9664b18bd53cf99d65a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708193410, "uuid": "3e6ff9f7-5f72-45e1-986d-ee6426a3efdb", "comment": "Malware payload (RedLineStealer)", "value": "04bb1e7c172b1e66461c275f930cc1517d1a95382750fb9e80fe4169d05d6fbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708193410, "uuid": "60ee7255-0af4-4026-ac20-f279d7bd2749", "comment": "Malware payload (RedLineStealer)", "value": "bb9b318570c66aa6688221c62f224aa2583c33de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708193410, "uuid": "acb1d7eb-6ee3-4153-a291-2ed3dafcc7b6", "comment": "Malware payload (RedLineStealer)", "value": "e5be32b593d6b11b04c8de94bb656c1c87a2f3e2bfab33b9b2fae2961d0ec4aa25c6b27782f7ec5243d634cd690b58cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708193410, "uuid": "73739fcf-3bd1-437e-af29-dc069a132e5d", "value": "T1A3B4027279A1D432E55A44708935C6F46D7EBCF399A4C08B33983FAF3E312915326366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708193410, "uuid": "9972b12c-fe7b-4ce9-9731-7105c5d3a4c9", "value": "34c4161f659e591de8a4c6e215c7a951", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708193410, "uuid": "eced25d3-d3a3-4c62-8d15-6285a78315d9", "value": "12288:eR72YSxPR4JeDCsE+igF/Opobx8tSC0XrJ/m:eR2hRZOsfiO/OcQGrJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708193410, "uuid": "e61761b5-b14c-4676-b94c-e7b60b2b36bf", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708193410, "uuid": "f79b5763-0dcc-4ddb-a829-38afeb1cf693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708193410, "uuid": "47094ec2-231b-426f-89fe-925564034d25", "value": "03e350c52d08a9664b18bd53cf99d65a.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f01a020-cd59-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708149288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708149288, "uuid": "b6e45e7c-0567-4275-8b90-2cc52df692f1", "comment": "Malware payload", "value": "8a6135f08e7b30bc4d41774fcbedfec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708149288, "uuid": "59ad1721-c7e2-48b5-8738-d3bc0cc3cfd3", "comment": "Malware payload", "value": "0535c347162bd4656e92eb4876282e1e4c0164fd31115044254cdf4a356b1c34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708149288, "uuid": "4178d328-9424-4333-b2b2-cec45d37e947", "comment": "Malware payload", "value": "d4388882fadaf3b3cebc190f121cdea2aba3ac60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708149288, "uuid": "81552cae-8eae-4b14-8ca1-44ac05c1892b", "comment": "Malware payload", "value": "cd81e949ac102ea6ed7e34254fdf3921d029d295deef963d2c6a87d1c49cc0e37034ed6eb6dd6b2b7167fb09a9820af1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708149288, "uuid": "8ab3b3e9-94d9-4a83-a63e-9220acf73cbe", "value": "T1CBB5186933560DF6F4930D7DB9B626A2217C28339273A2CA7ED76D09C47F6E02DE0584", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708149288, "uuid": "cc8e5852-2b17-4dd9-a4c3-0abdb69b11c9", "value": "73540c9a19a7cd429998d2500b6d80c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708149288, "uuid": "3e24fda3-f09b-4042-9d9d-cce3111a4217", "value": "49152:PlIS1EoYydydyDo3e456yMZn/+4eFHTDK:f1EGn/VgHTDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708149288, "uuid": "8c717d03-3840-4227-a786-e468d15a1739", "value": 2451968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708149288, "uuid": "f63d273a-ed0d-4ca4-9a07-b7f435fb1dd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708149288, "uuid": "e0246088-de60-412a-a966-360ed2ec41ab", "value": "n515ZctN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b54262f-cdd3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708201761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708201761, "uuid": "f83a3965-c0d9-47ca-9d4a-f189e6800b5c", "comment": "Malware payload", "value": "73f514cfa76c8488e1535442e683e5d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708201761, "uuid": "d73b0bc7-47f3-451e-a250-940c29ee9021", "comment": "Malware payload", "value": "0754ce04a0e2e21471466349e75b71769654c16d7c37cf187953b1a2402fa2aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708201761, "uuid": "eb35be46-414e-4e5f-b7f4-fb8cf4dfa874", "comment": "Malware payload", "value": "ca80f63501a3cfc171fa2582863c3b4780eb1bbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708201761, "uuid": "d7bfeeb6-f4fe-484a-a3a8-85c69672e177", "comment": "Malware payload", "value": "de8a19444aac951b9d5037a43ec6d51e85d447a457cfdf6111e0c7ba3ae84393230837a3653a808be15d169f422c1d23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708201761, "uuid": "33651462-b800-48a9-8633-90a2e4f9c2c5", "value": "T1AE766A07FC9545E4C0ADD6358A679623BB317C484B3163D36A60F7293E36BD06EBA348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708201761, "uuid": "2e029ae6-c4da-405d-94d3-d01ca89f4260", "value": "c595f1660e1a3c84f4d9b0761d23cd7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708201761, "uuid": "ecc50101-0a6a-47cb-87d3-85b8e3409f7b", "value": "49152:Q774F1MlpXrRX4V7WOdsgI0FTKsKPa8En26pmjKCJTSxQb5EmaT3HzUb3ss7FooX:r1MLbNdgI09QP+YEmay7xjph4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708201761, "uuid": "167e0475-94a3-4047-9094-a23ee1aed649", "value": 7239168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708201761, "uuid": "cacbc98c-c410-483c-a084-96956c9d5fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708201761, "uuid": "397f25a6-ecd1-4a02-ba40-07236ccd0a14", "value": "SecuriteInfo.com.Win64.TrojanX-gen.4710.27982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37253084-cdac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708185003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185003, "uuid": "51c73aa7-0b47-4b2c-b192-19b587450950", "comment": "Malware payload (Mirai)", "value": "9df9af65e8ee099a1907d369e02b5075", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185003, "uuid": "35c0bb21-cdfa-4b39-8df9-b21b69e2429b", "comment": "Malware payload (Mirai)", "value": "07cb3ab281bd3d90c3bd01f342925783adcb282c767400dd735a039677c1e358", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185003, "uuid": "f44f2b41-f27f-4392-8d22-dc37d1bbc589", "comment": "Malware payload (Mirai)", "value": "aefc101e6cbe898c03d309734264047a29214f77", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185003, "uuid": "82eea085-3ff7-443d-95f4-2663cae924d0", "comment": "Malware payload (Mirai)", "value": "9dd629a5a79273fd391d4078b74fb9bc541df185dda84fde95fbe3fefdfad004a68f000c9f74e0bb7a17aafebe80d27e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708185003, "uuid": "9bb9ed30-2328-4dea-b1b5-230b938070be", "value": "T1C8D34B46FA418A13C4D513B6FAAF4149333297A4D3DB730699186FB43FC6B6E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708185003, "uuid": "938cfa21-0656-49bb-a9ec-3500d090c9db", "value": "3072:fVOaoBmxuVJgyiOP/oxpyaEHDokBzXTEV+84/M/9vDVdYj:f0aoBwuVJgyiO4xpyaEHcs++8MM/97Yj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708185003, "uuid": "de8df891-8013-447c-a503-66a1eaeab7fd", "value": 136482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708185003, "uuid": "292d1c04-8d2e-462f-b746-fb970a9f59a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708185003, "uuid": "ccec2a34-116a-4b2f-b26f-782dd58ed936", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a0c4ff-cdd1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SystemBC)", "timestamp": 1708201218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708201218, "uuid": "2c5cb02a-433b-4464-8325-002f688a1b6d", "comment": "Malware payload (SystemBC)", "value": "365f7ff51ec4583ba6a426b15981b9e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708201218, "uuid": "d1eaf340-d030-458e-bd6d-4dbf556e53f3", "comment": "Malware payload (SystemBC)", "value": "08dd07978c07ca8d8f51d9033428f23b76fd6c6f7607e39a0e9d28821131261f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708201218, "uuid": "db767cf8-94b2-4b4a-8c4c-89c80c55cc91", "comment": "Malware payload (SystemBC)", "value": "2d66a5b213ec43165d0ccaea3a4b9e1bcdd68318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708201218, "uuid": "23b47266-c50d-44e9-95a4-fbed6f33e6ea", "comment": "Malware payload (SystemBC)", "value": "4d08a297111071e5b8054951e906cd60e6f266085fff9e46b0c67a5f19b7e88dcb94cee30f49ca0816c7a4c5c5478d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708201218, "uuid": "a67a9a37-284f-4c3c-935e-aa3f8773fe44", "value": "T1D672FAA6396188A9C411CAB43E6FA660D47D78725234D039EFE04E18377EAD3E711717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708201218, "uuid": "d55c99ad-48f8-465c-9227-ad6d6fac3bd7", "value": "b83b4c7be0b1cdd8e117bba9096d9768", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708201218, "uuid": "bbbc23cc-f53f-439f-8017-40a8f511ef6f", "value": "384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708201218, "uuid": "c2a1e7e8-b81c-49c6-8b0c-fd69c2605e6b", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708201218, "uuid": "f0c247e4-f18c-495e-b905-e977fac54f62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708201218, "uuid": "1845d674-c0ea-4eb1-a356-2477fa2faf3f", "value": "365F7FF51EC4583BA6A426B15981B9E7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe8065e-cd62-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708153551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708153551, "uuid": "b2c75e72-286f-4535-b726-054d5844f83e", "comment": "Malware payload", "value": "36db4d8dbeec5be249b1ceae19c7d31d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708153551, "uuid": "b92d0431-5ca6-4552-b806-654b0f5565b7", "comment": "Malware payload", "value": "0c6dd8b84355b6477575b8ff8bbacb7d6e10479a773368a800dcef8ac0996463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708153551, "uuid": "63f4c006-61fe-4636-b9f3-a99135af9129", "comment": "Malware payload", "value": "740dccbb95d135fec52679ce709a274c1f89aaf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708153551, "uuid": "709874f8-d55b-4f8f-a54f-57fb87357498", "comment": "Malware payload", "value": "54b4f32a19b5d5dad4bb6bdb57a3f3fb790e25573d734a159b4149dab7fc107e84392dabf117f93dd9704376f293ea8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708153551, "uuid": "cf046efe-970b-4ff8-ab5a-fabac2b6e5fd", "value": "T1992833BAB254142FD46A4A3040B2DB709C7FBDB26DAE8C0E53F43A5DDB769214D3B112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708153551, "uuid": "3d21ea2d-2ccc-4493-b8da-7bf557510653", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708153551, "uuid": "e12e50ab-5df5-49f1-862c-3f995b2f917b", "value": "3145728:TO4fLdbgmZje366oEzxO+I7HCFt62wolJq8:7hHA36is1u07qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708153551, "uuid": "4ba12940-d1d8-4ce6-bb4a-ce19f1bf0fbf", "value": 101748696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708153551, "uuid": "0d71ea4b-eb50-4e2c-98eb-e5cc4fadb922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708153551, "uuid": "291d2ebc-696c-47ed-85a1-b5eba343d2b0", "value": "video-downloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e198b6-cda3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708181141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181141, "uuid": "9bc18b61-6ac3-4cee-9fc9-f956f5a6feb5", "comment": "Malware payload (Mirai)", "value": "371c521df45b3cd8ddd77e12aebe32ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181141, "uuid": "59eab2e2-c608-47bf-a8e0-017b1a999c64", "comment": "Malware payload (Mirai)", "value": "0e5829d42a1c2e683840052e6a8d1d32975d9fdfe7ddb620a1702beb03233cc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181141, "uuid": "c3985768-c560-498e-9cdb-2e6271dee400", "comment": "Malware payload (Mirai)", "value": "610e9904c513c0664c82e0004736e33e4ffa6313", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181141, "uuid": "f11e6c49-6614-4350-a868-a4416e675a99", "comment": "Malware payload (Mirai)", "value": "7a5e6ebb3b8bc3b16fa600c3a15ae0b883cedd6729f7a3243700031c925e9ffdc4d374fa8489e7f1e14c2733b3b308fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181141, "uuid": "acfff2be-eaa8-4a39-b6c7-b9eb192a06ad", "value": "T19D53E58178919A17C5E422BBFA6E018D373563F8D1DF3216CD226F2476C982F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181141, "uuid": "48460a5c-676b-4d1f-adcd-367a33705755", "value": "1536:gP1IwP44TCRfNdbYakabDrzKQlG9Wcq8JJTyd42+:gP7V4sazKUG9bqAJTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708181141, "uuid": "094ddf7c-eb30-4a98-94f5-32b086dbb4fc", "value": 64460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708181141, "uuid": "0f22277b-975f-426d-abf7-8b5d0fb884c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181141, "uuid": "548b07e3-9543-4fac-a22a-e694b46688b9", "value": "371c521df45b3cd8ddd77e12aebe32ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26bedd3-cd8a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708170607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708170607, "uuid": "4e08a65c-cb26-438c-8e57-4b2a6570d242", "comment": "Malware payload (Mirai)", "value": "f617aec3faed4a20bd287ae80dc974a7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708170607, "uuid": "710fa49f-f1b6-4e91-a578-4986bd5442fc", "comment": "Malware payload (Mirai)", "value": "0e6260bd3ee0f752076be4f61c35cc493aa0e7dda0ec96c56c5515906ee717e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708170607, "uuid": "2ef17787-02f0-48a7-b613-9b6df6ff7b91", "comment": "Malware payload (Mirai)", "value": "b94e05a469798f3fef32a9020f435ee009f4a6e3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708170607, "uuid": "77344607-9e0c-4bc8-a184-3de2a85d013a", "comment": "Malware payload (Mirai)", "value": "d37569e164846cb15d01f78613681b527d1f756a6b345a3572dfb7b3487ae03749d17ff143c4628845386988b23a5258", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708170607, "uuid": "2fae3678-9262-4d00-bf9b-a1af84975ca8", "value": "T12AE2F1109089D992D4B23432EEF89E4F41D60A7C96DA583D391237AE72858D3888C3A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708170607, "uuid": "ff311b54-7158-4654-b4cc-309232c3bb0e", "value": "768:Uvogwx5aGEeGcpnS+ijiD/dIMKlCJtwnU3ckse4dOOsYmx0Jd3UX:vfGckXu/dF0gOsEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708170607, "uuid": "a7cc79b0-ba47-43dc-a493-d50e818d2577", "value": 31896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708170607, "uuid": "6c646651-fb51-4483-b862-522b6e978e1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708170607, "uuid": "1be064dc-d42e-4119-99f9-e16349f94223", "value": "z0r0.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebeabd9-cdb0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708186761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186761, "uuid": "1032b58b-6bbe-48d4-a35f-77e1489d462e", "comment": "Malware payload (Mirai)", "value": "92e9eb610b47a3aaebffce7e11e86861", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186761, "uuid": "cfacbb24-d1b6-48c7-a6db-f38f82873361", "comment": "Malware payload (Mirai)", "value": "0ff3549a17fea19ff3e412af8c3fa077387b5ff71ee6bf37225b37b1776079b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186761, "uuid": "227b9588-303a-4d44-8c20-d31b1f6257b9", "comment": "Malware payload (Mirai)", "value": "f51df5d8e7c27891802bc9a7b309aa357ab16dbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186761, "uuid": "bc196632-e5c8-40ed-9c3c-82753af65264", "comment": "Malware payload (Mirai)", "value": "9e6fdf14bd874a60072d29d4d4b773bc8f696f45691e21ef2b5bb1558fa4ede2f5baf1d8689994c6912a3b38818971c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186761, "uuid": "ce5603ed-bc03-4ad8-bf70-cfa1cdf720eb", "value": "T16D731A46B8818A16C5D813FBFD2E018D332667F8E2DF7212DD105F6477CA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186761, "uuid": "923cae3b-13e0-4b80-82f4-0383bf2d79a7", "value": "1536:ONn8UxkW50thqBtIC1R4/LsdH0ZBYbZvNNSVgfpnLMgiEy6uzGOd42+:AxkW0hCtIUOSqAjM8y6uzG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708186761, "uuid": "30e4ccbb-fec4-436c-b7bb-c341661fb7db", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708186761, "uuid": "2f79b123-570f-461b-8149-0cd69efea6b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186761, "uuid": "5eefea28-d4b2-4923-b04d-312f36959cff", "value": "92e9eb610b47a3aaebffce7e11e86861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cabadf-cdd1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1708200919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708200919, "uuid": "4206cbbb-a1c7-4812-81da-3a77496c502e", "comment": "Malware payload (DCRat)", "value": "2a1741fcae6ca23755c4fc01322b5d52", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708200919, "uuid": "4143ff79-1352-49f5-b1fa-61904b319ce7", "comment": "Malware payload (DCRat)", "value": "108d7f9bf923a83ea595f3841a3ecb139268d2e56f6ed1122b08f04e9769d42f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708200919, "uuid": "80e41aa3-076c-4899-acef-ff5b9a8a04b6", "comment": "Malware payload (DCRat)", "value": "9aa9ddff55c7c523d8b5b95666041a1be8a95fda", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708200919, "uuid": "f8750f9d-c174-4d5f-a485-507453f89ea6", "comment": "Malware payload (DCRat)", "value": "8d3d98ebf76f3ec39489414a4d080ffe6a205f9bb57d1019b42f8fb758d53838fdfe5dbe2e4c42d1bdf1a5358ddb2158", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708200919, "uuid": "c41dab7e-6ebf-475e-ac98-b077c8a33b3c", "value": "T1049512272796B87BE3EA0271AFD2E860D80995609FBC35DB97A101C851F1A84D73C7F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708200919, "uuid": "700e1031-db5b-4f6c-bd74-075f88ed6854", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708200919, "uuid": "d79e3dea-1d65-4b07-ade1-0024a34c2e20", "value": "24576:2TbBv5rUyXVx/kse0IkIvlWIsJXgkIAHZMOUzbLAOSZ/3DeakH49WG4vNPxT512q:IBJxTl9r+ObOSZ/zebXvTPclxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708200919, "uuid": "7cf740da-51da-4b9f-b857-92fdfaf57a32", "value": 1877828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708200919, "uuid": "000269ec-2c44-42e0-9667-2a6d2cee0efd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708200919, "uuid": "45f08dbc-1c83-4330-99b4-b84d1d10caa6", "value": "2A1741FCAE6CA23755C4FC01322B5D52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3914331a-cdac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708185007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185007, "uuid": "abe00553-1ba8-4cf5-882b-2cd812daca4c", "comment": "Malware payload (Mirai)", "value": "91f9bc06314f61fac300ec5d295327c7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185007, "uuid": "45560145-081d-43cb-a234-20294f961732", "comment": "Malware payload (Mirai)", "value": "108f667274f519f54f203373755a76f23dc5cc4f682bf8070fefa4df0dd5c3e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185007, "uuid": "21a6676d-0b89-4f77-a6f7-b9baf54bc7f1", "comment": "Malware payload (Mirai)", "value": "2c647dbd0bb8d5e4dcab1af38c4ca7d6416270af", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185007, "uuid": "198a7f1b-c4fd-436f-934a-e129ccb11b0f", "comment": "Malware payload (Mirai)", "value": "c64336eede11e54bd25c56f781ff7153c7866b10139f0f3f68f1fc00b8effad77a04286cd52bad2ce38c4a82bdce06e3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708185007, "uuid": "73b53fa2-ccd2-455c-ada7-1d02817f4532", "value": "T1D843C552B8815A2BC1E423BBEA6E518D3371B3F8D1DB3616CC111B24778952F1EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708185007, "uuid": "c5b259ee-29af-4117-8c0d-13b9829e3334", "value": "1536:rL/BMZOlXxfoYfi0p25+DfaerBkeOxllulG9WkQxnd42+:pMZ2mFkfae+eOjl6G9/Qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708185007, "uuid": "27276652-4988-40c8-ac01-72f8c8b9661d", "value": 55608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708185007, "uuid": "5879cd22-517f-47d9-81d1-ebbb68efa567", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708185007, "uuid": "964c451f-c632-4b28-802f-a2f4cb92179c", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2627d3-cd44-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1708140534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140534, "uuid": "b7e6cc67-36cd-4df4-9640-2715d2341593", "comment": "Malware payload (RiseProStealer)", "value": "2d7fdee31b6b92ff405b6d3eb74ee161", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140534, "uuid": "178a9174-5952-4a76-8d5a-501d00fdd308", "comment": "Malware payload (RiseProStealer)", "value": "1388988b71ab025c2c8fa35ec6ca280427e607d3e807585d0a08500f96d949d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140534, "uuid": "2a1e8dbb-1894-4f7c-8b99-5738236d7d2e", "comment": "Malware payload (RiseProStealer)", "value": "ad199a34884fda38de59c83abd7c8664679cfba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140534, "uuid": "19f478cf-04cc-450f-98f9-60b35760abf3", "comment": "Malware payload (RiseProStealer)", "value": "5d2f03eeecc4af757941d27c3eac47ecb06a579def7f7087d030a9f7fb3ff259fedb038f82d813190fddef50bac0c2d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140534, "uuid": "a05ad531-41c5-494c-ab29-7b352b54c3c4", "value": "T1081512CDAD414557E650763448C2F7BE412EFD91B998A0CE6CECBF9BB932E19092342C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140534, "uuid": "f96a51b9-8098-470d-9128-24bbb534b0dd", "value": "2388fee6ad8ce4f4a35dbaf64e2da01a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140534, "uuid": "09275e64-7fa8-43f0-90d1-d87822a98d3b", "value": "12288:ZatwRmalnleP/ncYPiBVCvtGzxj17rGSuREV+CMiG6+29Rsn0iGuWMctsCX:ZNJlleHU8tGx1WSuS2iG6fR1HOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708140534, "uuid": "a2ad2d5b-591b-4a4c-af1f-482f13b251c2", "value": 921968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708140534, "uuid": "3063fd57-e0bb-43e4-a631-df812ddcdba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140534, "uuid": "fe96ccf2-99b5-4231-af51-6c5dc29b6548", "value": "SecuriteInfo.com.Win32.TrojanX-gen.391.30255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a750a45-cdb0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708186781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186781, "uuid": "82775693-f8f1-434c-9b36-0d47373eabf0", "comment": "Malware payload (Mirai)", "value": "0b9c15706736b8e5dc507a1a23e788f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186781, "uuid": "9e43f800-cc5a-4c9d-8c85-b566b11892ee", "comment": "Malware payload (Mirai)", "value": "13e27bc24cbcd9fa81898c7094310b4a994578e42d31b45d7a2abafad599d93b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186781, "uuid": "7d7a53ef-f697-412e-8b05-22fe484d5294", "comment": "Malware payload (Mirai)", "value": "c0759b462ddaec524463c6fb7ec1dd7142aa2591", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186781, "uuid": "3b7b1cdb-914e-4d9e-8afc-7a6dc5f6b35a", "comment": "Malware payload (Mirai)", "value": "a58259dbeea8b2e659a24cc3635f721ba7c552367e0ee8ba53db4efa6b334578b7bbfb6e3f6252a8b673d6ecd11596e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186781, "uuid": "9297356a-df6a-488a-9e8d-222b5c95e5ed", "value": "T1D3434B0333280E17D9A21EB0353F06E093BFF95126E5B68A254FDB664639E761182FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186781, "uuid": "0352d32c-7c10-4b81-881b-1e3330f2b7f9", "value": "1536:Jt1JILhthQ+1r4adKKMBTIdWtGqhd42+o/:Jufh/sXIdOGYr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708186781, "uuid": "db25ec17-e1c9-4d6c-ae13-1653d4eb68e2", "value": 60040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708186781, "uuid": "e352e63c-6a80-4779-bbd4-aa1d90c50d63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186781, "uuid": "38f21953-dad3-41e9-80a5-a4f62e2ee201", "value": "0b9c15706736b8e5dc507a1a23e788f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e66db0-cd2c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PythonStealer)", "timestamp": 1708130349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708130349, "uuid": "1d1b0163-748b-4eb7-aa75-25da3626f20e", "comment": "Malware payload (PythonStealer)", "value": "e46145d24585e04108fbc93adda995c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708130349, "uuid": "91b51ff0-ab0e-456f-9b1d-8ca7fb2ac3cd", "comment": "Malware payload (PythonStealer)", "value": "1526c0b87228d286c8f4f13173166f62c4c8cf6c4f3b1e5c23efcec7739bc5dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708130349, "uuid": "ae491e40-5cfb-43fa-80e5-6e27c7cded91", "comment": "Malware payload (PythonStealer)", "value": "f8a47d2b3a9e3c58d461ee59f211b6e80acad8a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708130349, "uuid": "b97a6de9-6980-4ab7-99fe-911f487ced36", "comment": "Malware payload (PythonStealer)", "value": "4222281ddedcff0ea7ce9970956efe2e7824af3f4568fc781930ab73cd3587b7417c23e6a3bc6392478fdfae8c49f0f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708130349, "uuid": "1cad5465-1b5b-40fd-b6e8-2a1880b18539", "value": "T1964733D873004CB1E26AA13BF525004685B2FCA1476BD7CB9ABD753A4D9B1C0AC37F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708130349, "uuid": "c65f38ac-def2-42af-9315-7dd1d24eeeb2", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708130349, "uuid": "59edb941-64c6-429e-a2dc-2cec187f7338", "value": "786432:k9Z9bnxVK+Z+9qxU3O1n8vZW8iQj+65VKVJNpa:mvb7+XgMWhHWVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708130349, "uuid": "bd5c8447-e685-44a5-852f-0b61c5c74fef", "value": 25483656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708130349, "uuid": "ba6e94c6-c517-42cc-8827-867d613dbcb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708130349, "uuid": "1ae329bd-cabb-4612-8f84-5949e91c7691", "value": "SecuriteInfo.com.Variant.Cerbu.199527.4606.16272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99d0e7b-cdb6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708189544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708189544, "uuid": "39408566-e860-441e-b9a4-fc6e758fcf6b", "comment": "Malware payload (Mirai)", "value": "9632bc5f83cdb230ec63811abda71c1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708189544, "uuid": "761a49e1-4630-45fe-9d67-6a34be18111f", "comment": "Malware payload (Mirai)", "value": "15e31bb0e7ac65f0f0416a229f8186c2413be048abd1918c7f24580791f7c17f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708189544, "uuid": "acbaab80-bcaf-4310-beaf-b3c821402b0b", "comment": "Malware payload (Mirai)", "value": "f70547711be61749a6e1c9daef3fb28db77d1a09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708189544, "uuid": "72e16f7f-35b8-4e51-b121-dd7ed37d099c", "comment": "Malware payload (Mirai)", "value": "d219a9fbc9148b2aaecace0f9dca4961c665766051a7fcea3c1fdca43beb3fd31ed06788bcb994570ad4b39e7e46acd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708189544, "uuid": "678f012b-d1e1-4903-babd-23fe99fbac01", "value": "T169C35B3BC8267F68C555D1B4B0B58F791F93A59082479FBE25B6C2B44083D8DF904BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708189544, "uuid": "4b66de5e-7e94-4a7a-8a24-7aa337675aa2", "value": "1536:1a27gpreKVw//91AjTGXPtOrsLxCnzKCt7UgXptREGkWYwQoRqfoV2:1PgpfwHcqOALxjC5ptVkWLQouoV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708189544, "uuid": "1c8cc05f-06fa-4411-b1f1-7101a80d50c2", "value": 123072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708189544, "uuid": "047c71a1-b411-4ba9-b11f-3427a7585162", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708189544, "uuid": "e0fa8638-8aca-44f7-a3ac-f306f8aebdc5", "value": "9632bc5f83cdb230ec63811abda71c1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216fc34c-cda9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708183678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183678, "uuid": "52a84e48-ff29-49f7-8649-73efd19accfc", "comment": "Malware payload (Mirai)", "value": "770618deef7a993b9c77f2d5447121f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183678, "uuid": "38797b16-0aca-436a-aabf-e935b04352dc", "comment": "Malware payload (Mirai)", "value": "1c8aa7c1716ea81660be6d8921a83027b7445c9ae3b923df69ea3884f036c975", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183678, "uuid": "233f61c5-b603-48b0-a785-ab8227e23f33", "comment": "Malware payload (Mirai)", "value": "040a7f9b2a1cfd16d3b6137ed6ef2800cf04b8b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183678, "uuid": "1bc4451f-1da5-432b-ae8d-40922b33794d", "comment": "Malware payload (Mirai)", "value": "fba05c15d9973807bfa9d0408b328c806e7d174870336ebc369125e1dc217f813195baed8aa77020c0cdb5634e155c29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708183678, "uuid": "53f11bf1-6254-414a-9947-a12d3e6f5a21", "value": "T1A9335B31BDBA1A17C1D4A27761F7832675F9430E20B8C72EBC664F8CBF5164426622F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708183678, "uuid": "6d30d4ef-52f0-4bb9-a329-9e878ccf67c9", "value": "768:q79Os7rocEssYy6zBsyeI5SmZYO+WBbxVECwSGoS8:m9OMrLzsYrs+y83XZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708183678, "uuid": "55e7cd42-e594-4770-a4a0-a3e304234bc9", "value": 51208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708183678, "uuid": "59b7aefb-8865-4a9d-968d-3734ee801df5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708183678, "uuid": "9e38f614-f385-46f0-b526-fc7a0fd945e1", "value": "770618deef7a993b9c77f2d5447121f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6a2cf9-cd4c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708144101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708144101, "uuid": "d97ff069-ead8-47c1-8243-1ea4d6089dde", "comment": "Malware payload (RedLineStealer)", "value": "86eb1197449d5c977d37805f347d20fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708144101, "uuid": "d0fb3a2f-da03-4fa1-9d81-1e56216e7331", "comment": "Malware payload (RedLineStealer)", "value": "1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708144101, "uuid": "23cb75fa-588d-4796-a630-af1dae308d1a", "comment": "Malware payload (RedLineStealer)", "value": "7900e5214fcb1c6be206e72f96c25cf6dd2f11ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708144101, "uuid": "a6f5a563-247f-440b-99ae-599d15f6f1fb", "comment": "Malware payload (RedLineStealer)", "value": "26f0a8501cbad06920a31a6ef4755995983291ce03e9a450c8d5e98dda24fbc6266b149f47f166fdbe532a3500378784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708144101, "uuid": "f564da28-8d40-40c0-a341-61378b75c202", "value": "T13AA40124AFE5C031D39351B5CA25CBB18FBF783161A2E89F5BC347B92F247918618369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708144101, "uuid": "74d96b7b-14ad-42e2-a2cb-012b50be39e8", "value": "140f68ca5d8c01b19a34d785fa5fc14d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708144101, "uuid": "c6462138-1de8-4452-8258-5f209c085cea", "value": "12288:YVef96Y9OD2l5+Jjhu/jgdO2ZFbqw9rBx2njPvUfHA6S:YVZY9tEvJZFGw9rBUzcfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708144101, "uuid": "2820b7db-9d62-4cb3-abd8-be7e2c7bae3c", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708144101, "uuid": "165dd0a0-0ca6-4b25-a62d-c990276dc814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708144101, "uuid": "e5d4aeff-9c0d-4400-a131-e6190e27be83", "value": "SecuriteInfo.com.Win32.PWSX-gen.11209.1921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0541e9e-cd8a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708170604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708170604, "uuid": "18342e6b-caf9-4b34-bab4-43dd0d04f46b", "comment": "Malware payload (Mirai)", "value": "cf9446810cc7bfeae16b0fd536399d4b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708170604, "uuid": "274f13ee-fba9-4ec3-ac76-3b4e4e815f3c", "comment": "Malware payload (Mirai)", "value": "2194f28bcbd5ad84998102d705debc6919b28a3514dfd81a56d6541fa359fae8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708170604, "uuid": "97d234e3-42bc-47a6-8e23-66a3220a9f62", "comment": "Malware payload (Mirai)", "value": "e4e7baa9f208da125765462fc20137f2d7f72baa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708170604, "uuid": "561a1888-67ed-4ef0-8fce-05dd174bb823", "comment": "Malware payload (Mirai)", "value": "44cdfe46e4f3156c8171515a35280f97ff1a5d720584fce8cce5c212db389cb016cc1255f91a7688799f953c215ba13c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708170604, "uuid": "f3117377-ef51-43b4-b5a9-88a7154581e7", "value": "T193E2F1FA460A8D2DDEDD3273D4CD30A10DB92B713F6B5A641CB80A96035A6DD52A98D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708170604, "uuid": "ab543d4a-d55b-4e16-afd2-3f02905de12f", "value": "768:wq3yJi2rg98FdmvPyQw7NdiapJysdPZkbzAd9QsUoKSb:ziFdmvPgltAbzA0Ep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708170604, "uuid": "f40857b0-b0d9-4959-9476-ac75f8fa4727", "value": 31328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708170604, "uuid": "20b5a439-026e-4d47-b017-9a6b688b88d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708170604, "uuid": "ba3fb2ff-0aa5-4a25-9949-87321b03ea31", "value": "z0r0.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0813a269-cd88-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708169462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169462, "uuid": "a4970d60-e072-4154-afbc-25d088319445", "comment": "Malware payload", "value": "8bb5ffd8188c5d356a23eaa2a883cff1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169462, "uuid": "04f0e517-ae9b-426e-8cd8-7c471fef2192", "comment": "Malware payload", "value": "224617d7e78c42d8eadf0f2dcd6aeb42f8c75435347e19c30578a01b82734506", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169462, "uuid": "134b86da-6eeb-4bdc-a33b-fa384ab79218", "comment": "Malware payload", "value": "a503baff7a65da3f485ee867b632b247f639db0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169462, "uuid": "eb9b9e02-a5d4-4203-bed7-4c3d31338ef3", "comment": "Malware payload", "value": "d003b5d6a0d67bad7b7ade2bbf244c2a4249ff071bee6fb41f14db853fd87fee953a1935978b286451a15e3b45516c79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169462, "uuid": "1ae86f90-1d1d-4ae4-90eb-d20eb4039fe6", "value": "T11564E60BB7538436F07E09348DD247A4D6E2AC096D71CA5B2B6C770C2DB2178DE526BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169462, "uuid": "27fa497e-1e07-4acd-aca9-7dbc28f41df7", "value": "821c455b475c3595aa1e4e6ad93e77fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169462, "uuid": "66205155-943b-4f48-a494-8f391cf0ee4c", "value": "3072:Xkr/yOo8yOSuRtr9ndhjZd8Fb5pheVneD0cWgJsWmov5DAMpS8tbs:XSd8Fb5phF9v4MpNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708169462, "uuid": "199e60f8-2246-492d-bb07-1fe9f748ab13", "value": 333255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708169462, "uuid": "a869953d-e2ce-479e-9107-47c5f3a567bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169462, "uuid": "b00beb5c-0384-4f45-8c19-372ebf25071d", "value": "SecuriteInfo.com.Trojan.Win32.Agent.24872.312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0137e4-cdcf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1708200017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708200017, "uuid": "c2825929-6046-471f-820a-507e7d36ed2e", "comment": "Malware payload (Stealc)", "value": "38d829e2c9ce1218e43b053ff926aa9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708200017, "uuid": "ddeaa5d7-0b56-4403-aec9-3638c913e86e", "comment": "Malware payload (Stealc)", "value": "225cbc74f957f8831349771de0a88e15bc458090166276d08bad6d304fb7c257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708200017, "uuid": "d6258a59-5b30-440b-9ccc-6c20e413b29e", "comment": "Malware payload (Stealc)", "value": "c5636b967605ab837fa8d4ae6e63c475a0032dea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708200017, "uuid": "9fe28d8e-cd88-4799-8573-54c7a8bc853e", "comment": "Malware payload (Stealc)", "value": "7e17c9ffd20f77c6ba0c9ff7d30f30c4dbe6953ba867f613144352c89efa1561d1fcc7849e08b036bc246a5de12c0dca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708200017, "uuid": "9d559e6d-e8d1-4a4d-82e4-ea62ea8a3ee7", "value": "T112240933D98554F2D8359A3C22B9BAD1661E6B421379F8DB2DD42F58DEE07813E38603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708200017, "uuid": "dc818d1d-beed-4ea3-98e0-1c681adcc48a", "value": "6bd84bdd266cf6186651348d6be7d442", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708200017, "uuid": "4be3d70b-71d3-48d9-a20a-94d87007d674", "value": "6144:JQagWQptc1lhMIqpwU4ziFaQWleIHmulE1vC1VVIwzR:LQpAEhqWvQVVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708200017, "uuid": "3734ea42-f13c-4a98-b2a8-242a56a91d93", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708200017, "uuid": "875fd5db-28c9-4669-9ff1-8226dcba0c88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708200017, "uuid": "95b907f2-299f-48d6-b890-f71a5c5d0778", "value": "38D829E2C9CE1218E43B053FF926AA9B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f9c135-cd9b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708177804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708177804, "uuid": "5a4170b3-8c16-47d1-bd90-a6ef28675d62", "comment": "Malware payload (Mirai)", "value": "c35ad03da28fefd985ed8580efe58eff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708177804, "uuid": "20fedb46-9dfc-4e08-aac4-579e1149cec3", "comment": "Malware payload (Mirai)", "value": "2380d85a2944ef3b2fb09a7e38441a0d4140a8cb3a8042c5b605160c7cd4edd4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708177804, "uuid": "5cfe96c7-0de2-4717-bf59-00db700cda81", "comment": "Malware payload (Mirai)", "value": "439880de6aaf670c4220b9faa9ff20da2775c297", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708177804, "uuid": "a2e8d4c1-03e6-4a29-8944-2ef59057fedc", "comment": "Malware payload (Mirai)", "value": "833afc574a875d1317f45d3e3cc68480269cf1986e8780fc56089c2f347abf1102dde01e6b9f60fd8b07d6b6dfb30562", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708177804, "uuid": "eb90c460-f7bc-42e2-b04c-aebfba21c5d8", "value": "T1A4D34B46FA418A13C4D513BABAAF41493332D7A4D3DB730699185FB43FC67AE0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708177804, "uuid": "40b5a558-3183-4ed0-8de3-acd2aa365467", "value": "3072:5KacBqVuJVkW1cIOPZoxNOqMP0wctzHnOPF+84/M/92L18Yj:kacBQuJVkW1cIOaxNOqMPVoIF+8MM/9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708177804, "uuid": "09d6b7b3-f6a9-4653-b3d8-3837268a9076", "value": 136482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708177804, "uuid": "dca3d028-461e-4ae0-aceb-1f058c9b66e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708177804, "uuid": "c69cd4ae-a5e2-4f7f-8fa5-141abb990ccb", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22bdd4e-cd4c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708143951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143951, "uuid": "5e3b7429-6e85-4310-952e-a166ef19789d", "comment": "Malware payload", "value": "0ee0c538fe60bf719bb63054dcb2387f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143951, "uuid": "13255265-600f-47af-ae11-67852437c92d", "comment": "Malware payload", "value": "2b902eae6e77726fa2c70b5e4ca1e7609c16e382692e715a738f3ac6ecdc950f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143951, "uuid": "aa9ccf2f-c1d0-4167-a428-66c2fc1fd9f6", "comment": "Malware payload", "value": "f27f6c7557d4f4305bcf8ce395f0c2b1758ab804", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143951, "uuid": "5b464e6d-1bf0-45fc-b01e-16cfc7d434b8", "comment": "Malware payload", "value": "b331c1c2b7a1e5b8e308a570ea42ec6f4483b19439a3fc26d9e7ccc450c7793389a6f120236cfa4c96a6830a13552f3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143951, "uuid": "f2d3fef7-0d04-4e4c-93c0-45ac0191186b", "value": "T16992E75A6FEA4026F3F3CE3555B2BA069D3E7A133C51E88F91C1058D0976942E8A831F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143951, "uuid": "11d09ab9-5b57-4661-86f0-4127b427a462", "value": "c42e3d8499c171d7518473e1ff91b3fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143951, "uuid": "c56a9d9a-3e4e-4925-8f9a-dcbc78d25d67", "value": "384:+RaF13hxjBn272MUvMEQzW+57omhGFlyKb4uYbd:+R4xxjBnlMUf1+5sfF9fYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708143951, "uuid": "007a46b3-bdc2-41ea-9649-2620f5f0c57d", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708143951, "uuid": "6a71609b-9fe7-420c-a7a0-bb4dd3155719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143951, "uuid": "f8b9e1d0-4743-426f-8605-1d7c3123e7b1", "value": "1598212142.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac7afbe-cd3e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708138060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708138060, "uuid": "1794f1b5-8ae7-4eb6-ae3f-cf65acf82676", "comment": "Malware payload (Mirai)", "value": "500b884d421ee1d24c962f9abb46a70e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708138060, "uuid": "42742d4e-ddfa-4893-b553-6fc5f4a4c2da", "comment": "Malware payload (Mirai)", "value": "2c5ec634b6895ad6df4d8d38e082d690599788c4d805593601a96d97be0a51f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708138060, "uuid": "b6a4412f-3144-42a5-a138-202561e1590d", "comment": "Malware payload (Mirai)", "value": "e2f3eea8c30ec6b79370c12dd0ed0b2f0b3ef427", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708138060, "uuid": "0b9e5989-fa5a-4d2c-9bc2-1a62ddd1ee04", "comment": "Malware payload (Mirai)", "value": "02942e8cdcecd39158cb8ec2e9c75fc79163d9453196d8caabd7cd2f4fb9322e17ab7fb790c7a697a9217926d5b6a2c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708138060, "uuid": "017a43d7-e939-411e-bcdc-cbadb6277f14", "value": "T195E2F107A6F10C35FE8D53B616D12B496622640682C571632E3D9F5F4F3A0EA53F0ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708138060, "uuid": "10195363-65de-47b7-8910-f97ab869469d", "value": "768:BGvb+A02V/4ft3w48NhJ/dwjysJaC+mT/uKQ1:Bq74fJ2/dwZFm51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708138060, "uuid": "0f422e11-dda1-4f3d-807a-7d433408f02e", "value": 31776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708138060, "uuid": "9de3ab7c-ed8c-4b52-8859-332e6c6657a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708138060, "uuid": "ecf5c0cb-3350-4674-909f-754db9680f95", "value": "500b884d421ee1d24c962f9abb46a70e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28551e53-cda9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708183690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183690, "uuid": "5f80d472-5355-49f4-8a0c-e5764575e579", "comment": "Malware payload (Mirai)", "value": "7b8ce3d7dd5f4fe6a4fc78c6d579dec9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183690, "uuid": "ee397f30-c6a9-43f3-947a-4bbe600230cb", "comment": "Malware payload (Mirai)", "value": "316561b1cb54938693f19f1aaf65c3f989ea6672ba4b50dbc9d41d8ad48ab7cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183690, "uuid": "e0b5c9ae-1873-4df9-afb9-537dc1935818", "comment": "Malware payload (Mirai)", "value": "76486f07ffe4a295ccdef92ea6554b1982deebb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183690, "uuid": "7fb44fd2-3d30-442a-b9d6-735e7375bf07", "comment": "Malware payload (Mirai)", "value": "b57bc6c53723d47df76074910f41ec42e6f2d967e4080498229a7e9c3463a9caa46d110fe1dd01c786d7afef325ea512", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708183690, "uuid": "84bade71-20c7-46a2-b11d-da87de9824cc", "value": "T1F6233941339C0947E2972FF5363F2BE593AEDD9022A5F1C4224FFB4A8175A734609E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708183690, "uuid": "7c90cd8a-7e16-41da-ac39-bfff769f5701", "value": "768:UbCsSmkaMtbDUcrnLaopR2i+k1iPn6CyMUe6mDn1vis:+iaPaHrMUe6kVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708183690, "uuid": "a0c16a84-2a9f-4079-bd67-16ecc028771c", "value": 46400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708183690, "uuid": "70723bc0-27b8-4140-9037-147fd9d681bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708183690, "uuid": "4ced7fc7-b854-4a09-8e1b-56b33a6234eb", "value": "7b8ce3d7dd5f4fe6a4fc78c6d579dec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b949b13-cdc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708196741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708196741, "uuid": "3cf14429-7ec2-4589-beca-5ac259dcee64", "comment": "Malware payload", "value": "48bde2cde8d0239e50da3612ccb0cc51", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708196741, "uuid": "4a72a254-d28b-4d28-a27f-5d189eff8759", "comment": "Malware payload", "value": "3729104fc485ea9c5a752f6de9226ad5add663f528b8114050d0f958a68ae774", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708196741, "uuid": "dbe0fea3-d680-4dc9-b29b-d681a47fe9aa", "comment": "Malware payload", "value": "9b3fec60f264dcd99a31141c8a2bcb0a09f2bff6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708196741, "uuid": "6cc9e041-6e36-4d2b-926d-16327b1cc38a", "comment": "Malware payload", "value": "d9414a8a08f7a49322ee521d85d12bc5c875e42cac55fd850f9c5a6e73c6eed0385bf0201f1e9424c19a225d1361fad2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708196741, "uuid": "762617ae-a6b5-4dbd-89a4-0e4cce3d8c02", "value": "T1DBF733B5D288572DC43FB1FD504ED09662383A5641A2F217F5222CFE0887EB59723AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708196741, "uuid": "cf118f14-4947-45ac-a135-a46adcc63976", "value": "1572864:QITfzLPkhaZfjzOo534Y9Qocnw5p78Lx6rP514ReSHneyISp:QGfH3yo5x9Jcnw5pIteBeMSHeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708196741, "uuid": "c20f5893-be73-40c3-bac4-b3f575af2254", "value": 71128621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708196741, "uuid": "4f3bada1-1925-470e-aad6-f81bc5b44666", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708196741, "uuid": "ca928009-da96-489b-b0ef-77984b04d3fd", "value": "Mia_Khalifa 18+.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4891940-cd2c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1708130345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708130345, "uuid": "62159015-8c69-458c-b7b1-e8b0acc4e46f", "comment": "Malware payload (PureLogStealer)", "value": "aaf1ba15541f90afc068bd08b2ddc456", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708130345, "uuid": "bd7e9b6f-ecfa-41c7-b03b-c9d718d402f7", "comment": "Malware payload (PureLogStealer)", "value": "3ae209c4dc4c7b42db3e1fc3081e302b30c346cba789e5a0aa6f1be26d775779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708130345, "uuid": "f1cea04f-8502-4854-b919-ccf7da40f478", "comment": "Malware payload (PureLogStealer)", "value": "a6add5aae8cc0eeda7d0d5417ab978608d9e7a6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708130345, "uuid": "84e19e44-56d5-4c40-bb29-5ee4bae1dff2", "comment": "Malware payload (PureLogStealer)", "value": "10b94cdf1be57303abf468341e697c4fa52f5556bae6bf58674005421aa77567730317c87e7fa4e04048fa669ed31638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708130345, "uuid": "2f49ef89-9a91-46d6-9413-f3d913dbbb92", "value": "T13C652BC863F4FBA0EC6E3E765A6DBF75722811B6AB8ED0C5C0AC91753CF15A41849603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708130345, "uuid": "265dea28-acd4-41b0-87ce-7b7efa746c53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708130345, "uuid": "27a5459b-7520-44da-a426-8fb5de9cf31e", "value": "24576:cxTrlInVN/O769VtqLrm1qNZ4KaxVByxCYVQ2:qva7OOrtqLS1qS/BSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708130345, "uuid": "40dcec6f-877b-4f68-93db-31fc22c65ba6", "value": 1533952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708130345, "uuid": "eb41fed4-6d77-49eb-b5e0-5ca5ea918943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708130345, "uuid": "e724d353-d348-4f18-924b-c9fc8c749de5", "value": "SecuriteInfo.com.Variant.Marsilia.103510.20430.24633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8082d245-cd59-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708149478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708149478, "uuid": "05007c9f-1e7e-4b63-b422-975725f45b16", "comment": "Malware payload", "value": "ae32552bced40a6e6a3ac113e2e3c8bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708149478, "uuid": "42f4194a-d577-4ed3-9cf2-2a040969eb05", "comment": "Malware payload", "value": "3fb0f72c1a392523344e24575f9cbfd68da6980c93fb883f4fcf5097aa587d78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708149478, "uuid": "f46f5229-7518-41a2-8ba4-e600ad50c2b2", "comment": "Malware payload", "value": "c985dcc696b769a28b5bd755e05a84a34c164e74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708149478, "uuid": "65769094-c742-4b70-83c6-881dba19514b", "comment": "Malware payload", "value": "e23577a277e93b0fbb6f22a9b2e12b5ccf42220020d547a761bd4f4c9090a3b061b385436eb242226715ca4de669cc61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708149478, "uuid": "cf316e77-8c53-4352-9f55-51c93c5a5f97", "value": "T19AD622057F9DE255C759707E8AC6F27732AA5EE82C976BB10CC52EC3B02CEA5E0C5844", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708149478, "uuid": "7d53d350-69b2-4007-8c5d-ea3a88ce29ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708149478, "uuid": "ee3af6a4-c7fa-4607-b683-941d8866885d", "value": "393216:IcrS9tCfHAXguucNvPPiaNCh0PDPpGor82MOv1:ZFfglHPZNChcDPpGog/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708149478, "uuid": "b459237f-2cc3-4de2-9a25-dd64d3fda882", "value": 13312000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708149478, "uuid": "24031f8f-9e88-4ae3-8091-a150982a9b36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708149478, "uuid": "d3e66f82-abef-46ed-89f7-e5f6f80fdc7e", "value": "XWorm V3.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b80d8f-cdeb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708212319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708212319, "uuid": "3a8c9cb2-e743-452a-b5fb-52c22817af9b", "comment": "Malware payload (RedLineStealer)", "value": "0e99381e9633b7c791adf6625e687309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708212319, "uuid": "26665a9b-b575-4175-a208-ad2547da3d55", "comment": "Malware payload (RedLineStealer)", "value": "422251fc26441d43538e110d6e6281461dde367d9d495ecdd2499cc63ede6b1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708212319, "uuid": "731fc07d-99a2-4765-a553-95e2be7fbb06", "comment": "Malware payload (RedLineStealer)", "value": "b2ba57e7cc3ae955e42d49d9c4d5e1b6003b4a96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708212319, "uuid": "b80b5f35-0119-4bca-a200-eb81391ae256", "comment": "Malware payload (RedLineStealer)", "value": "638b169e5bd6daae12705c29dec1dc2d1c1c98ced82c557a21443de5c393bb262da57bc35c528466e0d18d1bdbae392a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708212319, "uuid": "9679c59c-671e-4469-848f-5e9cc23f2371", "value": "T1B4648D00E756DA51EBEE03B6C4D2040893F0DD2A9142DB1B6DC833D75A2375BFA5E29B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708212319, "uuid": "85850502-588c-4f41-a23d-cd6ec4e4d61c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708212319, "uuid": "0893d573-625e-4120-a6da-f4a1a50c3c8e", "value": "6144:MkDsLcyRUHRS/nACZbYJRsbWBqxYup7XsqSpD6J31qB0z:psL9IA/fZbY2xYu5pseJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708212319, "uuid": "64c1bdc7-2f6e-4c63-9cf0-ce8abd70844e", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708212319, "uuid": "86444e35-4e4c-4c1d-9b60-9e1aa999222a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708212319, "uuid": "1c9f4e0a-892f-4783-a2d5-18d35f38e8b3", "value": "0e99381e9633b7c791adf6625e687309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc8f637-cd44-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708140535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140535, "uuid": "2b7df157-dd4e-476e-b83d-4218c5078c5a", "comment": "Malware payload (RedLineStealer)", "value": "82cdc3929a00fcb38376e0ab0e6e71c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140535, "uuid": "3bd37c76-d48d-45a7-8ba8-78f487078137", "comment": "Malware payload (RedLineStealer)", "value": "44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140535, "uuid": "11b3dd2c-e1cd-4c32-9058-ba97e51cbb13", "comment": "Malware payload (RedLineStealer)", "value": "384c2fab9badfa36e3af1df8827e51de06c5615d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140535, "uuid": "b2bbbffc-1ed9-4c88-932d-ed7fa3e05d7d", "comment": "Malware payload (RedLineStealer)", "value": "9991e45884e6e9830de741feae9d18a2619cb66a7c6f44720c4ad0dae9ddb19b7890717c84769c054f305ba3e9333094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140535, "uuid": "35a42a81-d2fc-4268-8a3c-f4c599103d93", "value": "T140A4F11022E5C073D38319B4856DCBB14ABA78726175998F6BD78A3A2F347B1C61D33E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140535, "uuid": "82645309-d7fb-4bdb-b599-630fe0bf49c0", "value": "ab4b20db27905f9ef383a4e0564b2b9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140535, "uuid": "7b6fc409-f67e-4207-92b6-a331fab398d1", "value": "12288:YthvZeaBzUU+Ibh+YWfGFAYozZaPQP0Xpf:YthlU8V+YWfGF9ozMPu4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708140535, "uuid": "f789ef50-3c64-4db1-8327-5c4361b4d29e", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708140535, "uuid": "b3625c85-4809-495e-a370-dc12dac84c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140535, "uuid": "c2df1588-ce7c-4f32-a12e-c2aff5b92384", "value": "SecuriteInfo.com.Win32.TrojanX-gen.10958.28541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0771f289-cd88-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708169461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169461, "uuid": "12b889c8-2d9a-4e50-b5d8-ede4fc109b28", "comment": "Malware payload", "value": "b96826254785026338d3456a663aeeec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169461, "uuid": "6701795c-597a-49e1-b510-8eabf2100ac7", "comment": "Malware payload", "value": "4b659140cd5b2ee2e59c69d3c0d52852b50593e05300235894e6a5327d76db31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169461, "uuid": "542611dd-a098-44fd-aff5-3793444d5ef7", "comment": "Malware payload", "value": "06464049933a03dbedf8a662fcdc2650e9629061", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169461, "uuid": "3f8d6bb4-9d78-4628-a78d-56cd647c66e3", "comment": "Malware payload", "value": "ac4a7805b31ecb99fe754f173e609d5cd30e2910123e4914b8dd4fa56fdda9906c7d0d89f3385c33e68ac91eac7e3455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169461, "uuid": "9600bf65-8736-4265-85c0-ad93573b74ac", "value": "T1A0C6337A21BAEAE4D869CE788D319250BC6FBC8EDFE3D8E25787F4974561018007C54B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169461, "uuid": "a542a70c-76a9-42b4-a480-ebd7c12d09ce", "value": "2ae406c2886f9f3b5d71bb4135c38d64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169461, "uuid": "f8b5e374-a672-460d-91f5-be93cead68cc", "value": "196608:wJ1pdSZVnwyGZ+eCDfYjPq0Nz2JZ+vGn1zxfO+5/qySyxOrLM0Ok94kw4p7:+daVnwdMegYq0NEZPnZ5/FwR+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708169461, "uuid": "933435c3-9ab4-47c5-877c-159412a4dcdb", "value": 12152832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708169461, "uuid": "9cd9b8f2-8bbb-4598-a19d-7b2f3fb840b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169461, "uuid": "00e8d132-554d-4e47-a321-9df56a3bc38d", "value": "SecuriteInfo.com.Variant.Bulz.467496.20475.7100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b923ab-cdb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708188603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188603, "uuid": "eac1c753-0be7-4429-8b8f-95cc7e018cb2", "comment": "Malware payload (Mirai)", "value": "3ec42c2b5735a9af6069cfb2a6fab7e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188603, "uuid": "833287fb-c1a4-4895-b404-cd5e37c2ce91", "comment": "Malware payload (Mirai)", "value": "4c0015b10dc4587576678e3220c4e79f74e315e644966fa547b5c748268462ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188603, "uuid": "008ccd1c-e17f-4db5-98e1-1b6707057443", "comment": "Malware payload (Mirai)", "value": "ac87428571c10dd202db2529ee8ee354d88c9d29", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188603, "uuid": "0b35f843-3f04-42eb-a601-6e459005f5f2", "comment": "Malware payload (Mirai)", "value": "ee0101a79b9dc28dab90154bfe7365dbf2b1d1b2ab1b20b52f2aaadfc3943fad5406b03da83ce63763729137b79e3f17", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188603, "uuid": "f543aa44-6981-468a-87d3-2042150a0b89", "value": "T121937EC4F343D4F5E95704711277EB369B73E079121AEA53C378AE32ACA1542EA06B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188603, "uuid": "788c60f9-9dd1-45b7-a95f-064b622f69a4", "value": "1536:VCuLcw/F/nVBysNdiu7RjKhXKn7Tfr4qcm0TyNTWuQn/E6uTuSsRXtb:Lcw/F/VssNdioKhX87TfjBayQuQRY3Ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708188603, "uuid": "3a86020f-8849-4a80-b1cc-d3a4d751f12f", "value": 95912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708188603, "uuid": "471af826-358f-4534-bf22-c7aaa154ca4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188603, "uuid": "a30228d0-4826-4d47-a9c5-b8fe67b34432", "value": "bulu.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5831ba30-cd95-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708175180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175180, "uuid": "ba541ad9-d93a-4804-b299-6b884c344775", "comment": "Malware payload (Mirai)", "value": "77473662cf1385f578bca441b2c60085", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175180, "uuid": "fb4ea9b4-73fd-4911-a05b-1ce2ac507944", "comment": "Malware payload (Mirai)", "value": "4d4c44478354d8ecaca6005d033526d67719fe2d281726a29503b0cdca403357", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175180, "uuid": "7cc44ca3-7b56-46e7-9032-c73942551bf1", "comment": "Malware payload (Mirai)", "value": "020d4ddb56c68e35ab2deb67a94cd15a70e57ed6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175180, "uuid": "2fa4cd35-31d9-4f43-82fa-46b1579da7b9", "comment": "Malware payload (Mirai)", "value": "6c25ca0dfabbc0af72851cce4bf39404a6e2963971fa2320020aedb1951e364cfd1cce8cc7dd78cc72d0b4b43afc7fda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175180, "uuid": "2ee5866f-11c8-42e5-ab6d-e19a9cb8a8d1", "value": "T12C138D77C43AAE98C2554674F971CB740B93F009D2A36EFA0B5682568443EECFA093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175180, "uuid": "c91d9716-f281-4aa2-a19b-b2b58729e4cc", "value": "768:znaNwt96BlfgezowioyBccbLBRPifbYWURv7VoEvAop5CCjwR:DaNwt97yowijccArUt7aEtp5CCMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708175180, "uuid": "5e22e2e8-d3c7-4d76-89bf-17df17a20a76", "value": 44328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708175180, "uuid": "6be75867-b054-4e77-ace3-42ca47cd8874", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175180, "uuid": "eb067301-39ca-40b5-a430-56a37f0e6bb8", "value": "77473662cf1385f578bca441b2c60085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360db42e-cda3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708181136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181136, "uuid": "b0d89b82-4bfa-4c72-8233-b8c528a917a5", "comment": "Malware payload (Mirai)", "value": "da6c9d8f418901493c9acef3fe4bc835", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181136, "uuid": "31460aea-9346-42a4-b24c-5937387ad861", "comment": "Malware payload (Mirai)", "value": "4d81166dba4168687aa29a8a322bd9c614a189be2b6182a0143d3456ef892699", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181136, "uuid": "ab8e9e56-1f9d-4344-b5ea-69e927b96baa", "comment": "Malware payload (Mirai)", "value": "33e43109d0d670a1ba72da59b7b302aeede864f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181136, "uuid": "a9637e55-3984-41c1-a108-48f5c333398b", "comment": "Malware payload (Mirai)", "value": "07a98aff9db54ced6dd8eb762b0ab1d7963a5b8c0b72dce566905de34625a7f0cb08e35c27e99a0db6bfbe2b12b7d003", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181136, "uuid": "488d2cec-a570-49b5-a543-e65170ebd65f", "value": "T170731A45B8818A16C5D813FBFD2E018D332667F8E2DF7212DD105F6477CA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181136, "uuid": "88baa0b0-5f21-4826-bbde-3875f43f21a6", "value": "1536:eNn8UxkW50thqBtIC1R4/LsdH0ZBYSSZvNNSVzfpnDM4ioyuuz60d42+:wxkW0hCtIUOSqzgjMbyuuz60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708181136, "uuid": "a15909da-d5c0-40cb-8a12-503e55ce5fdc", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708181136, "uuid": "a3069f03-5cec-4775-98c5-5d0058171491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181136, "uuid": "6d0255e8-2309-4efa-81e6-cf24f51a2fee", "value": "da6c9d8f418901493c9acef3fe4bc835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f41314-cd63-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1708153670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708153670, "uuid": "f7afc1f3-3d26-42b8-86b4-844708de3ad3", "comment": "Malware payload (DBatLoader)", "value": "58a7c547fc9ede965fc0e00d3f8b111d", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708153670, "uuid": "1300cc5e-3e4d-41c1-9e41-124afb53489e", "comment": "Malware payload (DBatLoader)", "value": "4de29373a57b722bee86a89fa4b704288d12219f1cc1cf29d4743175116a3b42", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708153670, "uuid": "21e957b6-ba0a-444d-b3dc-0173edb6fc74", "comment": "Malware payload (DBatLoader)", "value": "0ca0a8444278552d39e8e1196f90b7f58f5453cf", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708153670, "uuid": "b8413595-475d-4a22-9d5d-3bc2e0ac70be", "comment": "Malware payload (DBatLoader)", "value": "d9242094f2b1e12207c434f35ae89a9a0c6b47967814db4f5c05228622002f221ff94d85852e4de5c4040d6b0c67cdef", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708153670, "uuid": "7fd1212d-0d4a-47cd-8de1-59cde2511f64", "value": "T167283337A258A43DD56E0636947381608CB737A1B90F8E9E4BF00D59CFEE5612E37623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708153670, "uuid": "b0835428-1047-47a9-b130-2501a42cf3b7", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708153670, "uuid": "d209c543-3149-4885-9452-fca55add67e1", "value": "1572864:hh1JT1PiUgzxJUxfE4irUY4/wWLvxsO6ojm/kaieTjeB5Is9yxvsckEfM+nnEJl:/1JtFKU0g/wWLZs7gCtieTOjpckEfM+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708153670, "uuid": "61f0700b-6b32-4f5a-a1e8-9ea7eecdfe29", "value": 96233600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708153670, "uuid": "25fc1e08-de85-4a25-9c36-7138365d5e3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708153670, "uuid": "bf9d106d-03ae-4841-b02b-cc60b606e9a5", "value": "PictureFinderSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694f40d2-cd2a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708129253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708129253, "uuid": "94df71b5-ab19-460f-aad5-d558b2a0d579", "comment": "Malware payload", "value": "148845ee40ab1265e147dfba37e52271", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "pig butchering", "colour": "#77F896", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "scammer", "colour": "#AC751A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708129253, "uuid": "b3ebc48a-573e-4a62-bfce-fc4fe0d56c18", "comment": "Malware payload", "value": "4e268a399ee9cea4d7271452ad397f9bc6ecd051b80edf24087a0100f7f4a5ef", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "pig butchering", "colour": "#77F896", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "scammer", "colour": "#AC751A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708129253, "uuid": "5197f35d-3f9a-458a-a32d-c7d4dad05031", "comment": "Malware payload", "value": "f44f8f20a62cd17aa0a469262e9491caa37b39a0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "pig butchering", "colour": "#77F896", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "scammer", "colour": "#AC751A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708129253, "uuid": "99540b47-fe0e-4a3f-8964-ddeab18daafc", "comment": "Malware payload", "value": "691e9746ee2a1461107a0dbeb85793fd6411c2b3a53fbdbf98da3907a30c8e9e374eb70c3939adfc6d77e190ff155144", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "pig butchering", "colour": "#77F896", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "scammer", "colour": "#AC751A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708129253, "uuid": "bd9185be-df3d-41ea-9417-674e8a0337fc", "value": "T17A061281B7E8AD2FCD77C8330BA646A691468D868186C7074565F21C4CBBDCA9F85FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708129253, "uuid": "848de36c-8759-46b4-8972-361b9ab5b592", "value": "98304:JYvIxdlgcCEP3tYLA8eqeFCxosAExwW8MaNJlT/Bg3Ss:KAvlgZ6EoCKmxwW8NTm3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708129253, "uuid": "c92a0c9e-a2fb-40c2-b8fa-eea57e3b6e85", "value": 3909299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708129253, "uuid": "f94a6827-d4ca-4aa4-9e0d-5b1439127d9e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708129253, "uuid": "e24b5e88-b408-4bfd-940b-337608ae5c7c", "value": "bmp2309021803.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c485df31-cdcd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1708199414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708199414, "uuid": "dd5ce844-4778-4a7a-8371-c6104f58a4e7", "comment": "Malware payload (njrat)", "value": "3e5ba25aa4f23ceb11be209d1967e341", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708199414, "uuid": "02c20300-e9b4-4cdb-98ea-cbb13ea6599a", "comment": "Malware payload (njrat)", "value": "518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708199414, "uuid": "c2068f3a-d168-4747-8533-2d8fdf5656b1", "comment": "Malware payload (njrat)", "value": "c25a05acb5231776456d08fad7df0e48d92931c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708199414, "uuid": "e75b68e2-e328-49d9-a07b-b7fd97b41593", "comment": "Malware payload (njrat)", "value": "0232c54d75f585b77f54cc5778b1f3599337ad5864171e63012c52fb3fa627049a2e78f90349e6bcc179eb7ca0bf2f4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708199414, "uuid": "d544e69d-ce2d-4f89-af6b-7fd2008095d9", "value": "T156A4E113FAC1D0B2D03219321669CB61A6BC7C101F254BEB63D97D3DEA251D2AB317A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708199414, "uuid": "56d21d8e-ff57-40a5-bc17-41eedc5c0918", "value": "75e9596d74d063246ba6f3ac7c5369a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708199414, "uuid": "2ae167e1-c0aa-482e-b5f7-4cc77f24eb7d", "value": "6144:jE+yclwQKjdn+WPtYVJIoBfRT+tkbOSeC2xDjAzQeOOg7Y55HkVSGsc:jBdlwHRn+WlYV+8T+tkKC0EEE17HkV8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708199414, "uuid": "e6b0bf61-4d26-45a3-866e-b5c13e47c90b", "value": 471910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708199414, "uuid": "90436b32-4de9-46cc-b486-ab5f7b2c2700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708199414, "uuid": "809cf403-cef5-4f15-a05f-f3df26978383", "value": "3E5BA25AA4F23CEB11BE209D1967E341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d9fd59-cd2c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708130344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708130344, "uuid": "55bdddf5-2e90-4f74-87d8-0bc9442fba4c", "comment": "Malware payload (RedLineStealer)", "value": "344ab5f6badfc8e09e9b8384f5cb3e60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708130344, "uuid": "7512e400-5407-449b-bd40-7907897a5776", "comment": "Malware payload (RedLineStealer)", "value": "5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708130344, "uuid": "c24cc7b8-3e74-42e7-8126-e01cadb2224c", "comment": "Malware payload (RedLineStealer)", "value": "1213df1776390d5a9acd3395f0b806bbae13127f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708130344, "uuid": "8c7854bd-60a3-42ec-bd7b-2e57680b90b4", "comment": "Malware payload (RedLineStealer)", "value": "e5bc2fb007dc6aa6ce1b0ac85ef6fd72e802f86521c6c6d83d2451956f33d7579928d623a9d2f1585906b10fc6a73d2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708130344, "uuid": "c3beafeb-1153-4f9c-ad5d-9fdb51384814", "value": "T191A4F11023A0D036D29352B5C635C7B00FFB387235B2A98E7B96667D2F36791832971E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708130344, "uuid": "af0d6299-c86c-409b-8ce2-510026e0f0b0", "value": "ab4b20db27905f9ef383a4e0564b2b9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708130344, "uuid": "afa13c81-191d-41a4-96d9-592f4e77ef67", "value": "12288:fdhvZeiD9j3AaVZ3r1l5D/Ei1t1egcCpRScNsuCWJuffs:fdhBD9jjZ3rJLX0gcm9GuCWoff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708130344, "uuid": "5cf35ab4-56b4-466e-924c-3e3e76818114", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708130344, "uuid": "2817e811-c8ea-4434-9736-532d42a1cf07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708130344, "uuid": "01b5f5ab-0bfd-46e9-84ae-82cb34024b6d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.31581.31589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55825fd9-cd95-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708175176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175176, "uuid": "adc91aed-2e3a-447b-9270-d2c2676a7059", "comment": "Malware payload (Mirai)", "value": "64782e99c73a7673f26668ab477fc606", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175176, "uuid": "cf1e01d7-2454-4bd3-a3b9-12db02ae574b", "comment": "Malware payload (Mirai)", "value": "54e8501e13986ca93b019cf6c5e49cc8a810da461aa5c85e6078fd4ee6a6b633", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175176, "uuid": "231ddb52-566f-483c-826b-1f082167168e", "comment": "Malware payload (Mirai)", "value": "347dad127bf8253414393da2cdbd0cb13d5f312b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175176, "uuid": "41483885-8e93-4259-8e4e-aec160dd1471", "comment": "Malware payload (Mirai)", "value": "797fcde0e163904079081aa84fbf9839bbfc8217fc53d404215bb18b61bba58f6c0c2de113bb91fa0e330090a06ad603", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175176, "uuid": "486df921-2939-4910-8779-738806bbc3fa", "value": "T1B5333C22BA791E17C0E0A87A62F74755B2F2575F25B8CA1E7D710E8EFF1064069036F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175176, "uuid": "472d0376-c4e8-4209-97fb-313bf1a14097", "value": "768:pjoCa+q9lYkv3Myn02Ax4lCXsdjWsDO5a+O+YH6jJWKZwsk:pjzSekv3Myn02AxyTBaaMYQhisk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708175176, "uuid": "176a9ad9-7d69-4525-9dd6-dc8697f71eb0", "value": 51992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708175176, "uuid": "06e77d73-3589-486e-a829-821c20f73f47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175176, "uuid": "2adfa168-9dff-48ba-bfe3-f222502e074f", "value": "64782e99c73a7673f26668ab477fc606", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132c0405-cd93-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708174206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174206, "uuid": "bbb70125-7510-47c0-b5d5-37204de4d12c", "comment": "Malware payload", "value": "c73e9fd41e7c49438535f2603fc12941", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174206, "uuid": "cc7348db-7815-49e4-885d-b099f788f0de", "comment": "Malware payload", "value": "56578709616c9007b79e474f7db3c2dff1b62b01dd9d00c57868c42c6c807051", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174206, "uuid": "6f4f85b9-dbe7-468f-a77b-685667190d66", "comment": "Malware payload", "value": "a1aa0c42a138a8ae80eeed1bef3820f6bdfa61b4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174206, "uuid": "ca21ab45-589d-4c72-8517-bfa1cc979f16", "comment": "Malware payload", "value": "1a86b54314a93c3d5abac58d8290d8fce43f11854d2f22b0fadcd7d1accae3e857ae19d63474c9caea339a821803b718", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708174206, "uuid": "7cb10757-3cc8-4b79-b67b-16a57a270317", "value": "T1E6436BC4F643D8F5EC8715702077FB379B72E1E622A8D643D3B4D932AC52612E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708174206, "uuid": "afe811e7-1029-4428-bea2-0e443c0f502b", "value": "1536:JeESt/basV2rcZhG6ySN7na2tad1zWOIaEjrqMHs:JeESt/basVTgS7na2QdttXESA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708174206, "uuid": "61dd08c0-5c5f-4eaa-ab7c-bf719ac4b74d", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708174206, "uuid": "3d24ca01-099e-4903-96fd-e2a95e6b9891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708174206, "uuid": "100e866e-ff8e-495f-8fc4-12c687aef853", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8540f37-cdb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708188629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188629, "uuid": "2a7c4607-b708-49f2-9cb3-f00e739804b8", "comment": "Malware payload (Mirai)", "value": "a796c3b653bd69eba85d9793ec9c962e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188629, "uuid": "2f423311-e9ff-40e4-997b-68aeddc9b4ab", "comment": "Malware payload (Mirai)", "value": "57136117d508d510eb87791ed7e2b6266f119d9e8098a2c3041c37f3a17d0fc2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188629, "uuid": "96ef085b-7bd5-4592-b725-cba7c4e49719", "comment": "Malware payload (Mirai)", "value": "7dfe90ed0a8cd367a2508e7efce222f897316e11", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188629, "uuid": "18c89c0e-61df-420d-a120-4a0140a13c47", "comment": "Malware payload (Mirai)", "value": "f1e21d13a93560903e07647406422009e548168919e660d2cf5ba2a02667d55f620a2d8a4c40904559149535bf914e40", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188629, "uuid": "a28ed152-dd9b-45fc-a8ae-0b5994d34bd5", "value": "T156E30B46F9818B12D5C111BAFE1D128E37231B78E2DE72139D246F647B8B97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188629, "uuid": "876a8e06-08a6-4750-ace4-d4ef8ad7d01a", "value": "3072:3CuRmUdqHLxXaTRxgMawuAE6DKOCedHvRXI:SuwmMxX4RxZa3BU3dHvRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708188629, "uuid": "74af86fa-5d1e-4bc0-8cf1-46fe0c89cda8", "value": 150428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708188629, "uuid": "a0922be7-fb69-4b68-bb81-b9cf96b4f564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188629, "uuid": "588aa807-7a83-499d-bbcd-4a2ac7435fec", "value": "bulu.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f80c9b-cd88-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708169459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169459, "uuid": "508e81ec-9707-443b-8906-1fc8dcf81c30", "comment": "Malware payload", "value": "454541172fef2ebcd97e65ec67d4217d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169459, "uuid": "226b1bd3-f811-4971-ae66-79e08e50edab", "comment": "Malware payload", "value": "57d1561d9ee0838279628094624eb483984d47606daedd0f61c09848738ea663", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169459, "uuid": "6049bb67-20a9-427e-89e3-094c8b0e90b4", "comment": "Malware payload", "value": "c296d4e71d58dfd41f860e9e722d7d0c5824c615", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169459, "uuid": "1150bcd8-9ea5-4487-8bcb-32173248d9ce", "comment": "Malware payload", "value": "6049cb658aeb1928e3b5fe4757cf4251f9e129778d8807c9310aa168059cc69fffca4f89e246d49bedc88440dc29e5f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169459, "uuid": "7e645992-7134-4ce7-b011-27b2dd7bd47c", "value": "T1B91533D3EBB2C562D54AD571C80F0F5A3F9B9F578832278058867B24BBFA265E817013", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169459, "uuid": "b588c2a2-ed56-49ab-a146-60422b231769", "value": "8b622929ea50a8c504908172dfb237c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169459, "uuid": "5462af3e-adbc-4100-a0b7-2ea875b3d539", "value": "24576:bqzSg4eo8aeJlE4rccsp9OhuuIIsWSgNiwhJ+KePSex:m+Xj8a+E5csp9Ohuj7tgwwhJCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708169459, "uuid": "b7c17cd2-adf2-467e-989e-888b495a0895", "value": 960755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708169459, "uuid": "f0328bae-88e3-496f-bc20-2bd0b1779f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169459, "uuid": "b3d6ada6-d3c7-418f-8741-0c64fec7ecef", "value": "SecuriteInfo.com.FileRepMalware.4780.6839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e3b6a2-cd68-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708155790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708155790, "uuid": "667cacf8-306e-4545-88f3-af1fe32cb72a", "comment": "Malware payload", "value": "038007ecacd3af41fc68569fa1e4c293", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708155790, "uuid": "32fac946-0d34-43ac-8e9d-e8f262f04fc3", "comment": "Malware payload", "value": "5aecd6c41a3d3dfb92bf0e63203ae431a783d4788a8bad9785bb660f4fd02367", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708155790, "uuid": "3b9e0ba6-c080-4959-bb1c-7394c9c649c9", "comment": "Malware payload", "value": "2fbc35f9bb6d7a7adc0dde02d3de50452871a5c6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708155790, "uuid": "61525b10-0b4e-41ff-bef0-4cc39e739258", "comment": "Malware payload", "value": "e372d675420c93cbf9a60046f22f571d6eec0ffdbf0f838b59dca71d5cba92e9db015ea7557a705496c85a47042ade6b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708155790, "uuid": "43f81e4e-63a7-4739-b59a-20f3e92bd501", "value": "T11FC63310B241C226D0F506F79B7293B22D7ADC508BA041D733553FAC6EBABD42276BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708155790, "uuid": "e006e099-1bbb-4fe8-8e09-9f1c4a46251b", "value": "196608:asOOzrjlf8X/+tG1iDjCyfgfR4WEDFrKyv99be8MQw8fCDKCJyKCkNBHDbfGLySc:asOOzn15D7oxQbenH4CDJJyEXPeLvDch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708155790, "uuid": "d32370b0-e5b0-4163-ba11-915cee377010", "value": 12500992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708155790, "uuid": "fb1471c2-d7c4-4b08-b497-977854a774c0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708155790, "uuid": "b6a1f06a-2ce9-4b84-aca5-2f1a9cfbacc9", "value": "SecuriteInfo.com.Program.Unwanted.5084.14720.4408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bfd7f2-cd88-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708169464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169464, "uuid": "1d54eceb-8586-4531-b686-ac84c55369b8", "comment": "Malware payload", "value": "864478fef94d7bcbc6b07ff0dfda067e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169464, "uuid": "07b689db-8b61-4b5d-a587-99c77cd48c68", "comment": "Malware payload", "value": "5afa1bb68db83e1f560deefa22759a38f3c2e095e99e1fb9a8963c8c76a6f298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169464, "uuid": "0d3a4961-d9e4-46b0-b210-a0abc6fadff3", "comment": "Malware payload", "value": "4adf59b5f3db36c9632c2f01ed1f6bde0e6dee7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169464, "uuid": "a3256bf9-7975-4f78-859b-2d938f0869c2", "comment": "Malware payload", "value": "f53d5d5d208e6f89ddfce057ba8e6bc012ab8c60f5bab11f0cae5b8ce338e7c9db887f97d7a6a88e6beee06daf1ecffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169464, "uuid": "7eb35981-4dd4-4a6e-8792-196cd558c779", "value": "T1CEE48D13F592C0F6C325263115AA5737AE799E410E358B87E7A8FE393D32150AE3722D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169464, "uuid": "bf0c43ff-e918-4ee6-ac7c-68f62f37bb17", "value": "e1aad23f54df0834a27b2ffad8258cd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169464, "uuid": "d8ce2c9b-5dae-422b-b9e0-ce8d20c284a4", "value": "6144:4nvnnnluhSThKSXnXeaXrh+oxmFwkroTYnSScJAVwSTQgmT8onb/tRZJ:4nfnlZtbnzXrh+kGngqwSVeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708169464, "uuid": "70a072ef-c16e-441e-b042-2543edda31bc", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708169464, "uuid": "3c8619f8-ef27-40d7-907e-22e8cd3a53d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169464, "uuid": "45533465-edb8-40be-a22d-7487a8e31e38", "value": "SecuriteInfo.com.FileRepMalware.8987.8491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcb0243-cdef-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1708213818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708213818, "uuid": "9112d985-c496-4001-9966-0deee2bcb1b3", "comment": "Malware payload (njrat)", "value": "13fbdc1f024974523245ed9bfdc3104f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708213818, "uuid": "5309a2fa-f824-46a6-8241-aa30142b0dfb", "comment": "Malware payload (njrat)", "value": "60239c0043a1472285ba7b9975a424e9481dd1e94510952ded231294a2dd3f8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708213818, "uuid": "e73d0f05-55f2-4258-969e-818ef722d0b2", "comment": "Malware payload (njrat)", "value": "358c2baf3681d96f5022b25084b5eb6b726d40e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708213818, "uuid": "455e326a-6995-4abe-8a7f-99a5a8614f28", "comment": "Malware payload (njrat)", "value": "c188d03e4c1a735546f28862813a03a9bad2b1248d5392dc00805eabad4ecde83fd8274b2a75bd289357b1830da9f343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708213818, "uuid": "950abbaa-dba3-4e6b-823e-4cf59ebc2aa9", "value": "T18993E84D33E15069E2FE4AB39971B2404F79F0871743938D49E1A8A61B336D88F58DBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708213818, "uuid": "b5aac20b-b643-4ff5-8c7c-43ad694a2156", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708213818, "uuid": "e3d8dde8-7c99-4b50-a7d6-987e851eddab", "value": "1536:vzY+2ccZUn4D5dMqeoWuXZk5MVR1jpUv:bY+eu4D5dMqmE+MVRnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708213818, "uuid": "6103f75c-222a-4e2f-a181-b37721a02f13", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708213818, "uuid": "bbecefd6-0d1f-4418-9c76-31a3fcb2b4b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708213818, "uuid": "3d3c8671-0d52-4d8e-a3ff-362246fd09b2", "value": "13fbdc1f024974523245ed9bfdc3104f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0942f1-cd95-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708175185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175185, "uuid": "a7ab1d23-7f9b-4d11-a895-0626e818fa5a", "comment": "Malware payload (Mirai)", "value": "14a2498009d2640a204c3f756d6c3a2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175185, "uuid": "4c09737d-e565-4a41-93b6-f62d9ae8e607", "comment": "Malware payload (Mirai)", "value": "60b2aca2a6e5e91f0ded379693a1c9b8d73f1b5110704199f172be4b7fe66c11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175185, "uuid": "9312bb4a-eb48-46d3-924c-abb867dba54b", "comment": "Malware payload (Mirai)", "value": "9e374d3a1884126d72e93390912c08eaa1ea2dfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175185, "uuid": "a4304601-c338-422c-bf39-2e00301215b5", "comment": "Malware payload (Mirai)", "value": "e6102a89ce03bd8809a65034948ef0bd2060c467213ae0de122b0db4938a7f7148bd26d95060d59ebdc8e9dc2e95a2ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175185, "uuid": "0bdb1105-7ab5-4a9b-8634-1385c00d5b8f", "value": "T14A43A60E2E258FFCFBA8C73457B79A155348378B36E1C585E1ACD6012E7024E641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175185, "uuid": "b06a910d-187f-4e5d-85fe-f628cfd6f20b", "value": "768:y3+ibEOoAiKFro15pYzAH3JIGyVsA+3tgyMjIXDsYAWy+/GwH+:y33EICpYzJ+3tgyzwbQ/fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708175185, "uuid": "06466264-c695-47b5-9b7e-5fc91dc0f32b", "value": 56920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708175185, "uuid": "056f51eb-735b-44ee-9b5b-8c8fbcaddc7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175185, "uuid": "a0dde1d6-f82c-48bc-acda-229fd3638713", "value": "14a2498009d2640a204c3f756d6c3a2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c953138-cd51-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1708146062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708146062, "uuid": "2dfcb700-64c9-452d-8b93-3ae4d317a644", "comment": "Malware payload (Stealc)", "value": "58074a3c828a0387409827dc9d3d5a27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708146062, "uuid": "9135f70c-b544-4cf5-b4dd-31116fbae444", "comment": "Malware payload (Stealc)", "value": "634bf075d6d8a187a316a7ff567c867dea7454f4c414fc1dfb5e8a6bae2ab38e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708146062, "uuid": "9153a828-ca9e-4f10-aa55-959047d3eb61", "comment": "Malware payload (Stealc)", "value": "8afc23602702ff2997003b98a06bb6068133b7bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708146062, "uuid": "aefc7a69-a5cc-42a0-9fe3-9d05d2c99668", "comment": "Malware payload (Stealc)", "value": "28861d5b1b9b068966f91b9b86f3f13efee02d6ef1c6330016be90b181813278d14c379d2767849d3abef7e0fb402c06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708146062, "uuid": "b6f12a48-6767-4103-9026-5e830d8e5f4e", "value": "T1A1860114D502A13AF8F305F7CAFF547EAA19A711130424DBA7C86D6DEB689E23D3025B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708146062, "uuid": "ac9681f4-e3fe-4e01-9bc5-658235e28d9b", "value": "1e13c87ad8b783b6ccf9a85c1dc91764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708146062, "uuid": "4368ed93-8eab-42de-972a-f825e11c3a7f", "value": "24576:3tLWjQIZG/HUw/vh9+KMKebVVnGbVG6Zj:9L6i/0Yp9RoTGxRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708146062, "uuid": "368526fe-e7de-47ee-93b8-c9fe29c86d4e", "value": 8395760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708146062, "uuid": "df826487-3648-48f7-9c4a-4e2bdfadb712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708146062, "uuid": "0a7907dd-990c-43d5-b5ea-43d41ac5652f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73860a72-cda2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1708180810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180810, "uuid": "34b86e98-28d1-4d44-88fb-c839e916a040", "comment": "Malware payload (NanoCore)", "value": "d0b86cae284be980712f0db432a66dad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180810, "uuid": "ff5faf34-5327-4210-bebb-9705a3ee4e30", "comment": "Malware payload (NanoCore)", "value": "64f7f22452241592c6dc0e2c8e0f2cf44b52da13f9330e8c73211eb8e2d27906", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180810, "uuid": "458b0657-c2ad-46f1-b493-c631002a45b8", "comment": "Malware payload (NanoCore)", "value": "1df45f7e7bd186db6ce3e0ba2828df7d006cce6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180810, "uuid": "d1bc0b16-f456-4fef-9a48-6cd5c8dd62d4", "comment": "Malware payload (NanoCore)", "value": "821303233c213b6a113c1e7b6522a3c812dbdbf87bd8e16ed15e892fa0aa08a0b379c7eab95240d54fec6a0c10c29fb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708180810, "uuid": "e1b50f39-f2ef-416a-88b6-6051f5c20805", "value": "T10155BE91FA4FC4B0F0222475CA339AF3A16E6D20F62489677256BE3EB9F4341515372B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708180810, "uuid": "4eb971fd-3912-44ee-9a38-59da5e853bbd", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708180810, "uuid": "36119c01-686e-468f-8610-7ca36ecae1e1", "value": "24576:MTbBv5rUl4oO7RJVxWoJ3MTGtR8B/hIdNCXYzJc:OBwl+T/WoJ3MTGoB/hWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708180810, "uuid": "dddbc017-a5b7-4078-a4cc-403277728eb4", "value": 1302464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708180810, "uuid": "fe7a449f-29e9-4847-b828-4aa3bb6b1d19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708180810, "uuid": "77b56f60-c443-4b4a-b2f0-11fad663d45a", "value": "D0B86CAE284BE980712F0DB432A66DAD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ac4f36-cd6e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708158297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708158297, "uuid": "42db245f-848f-49fc-9d6a-0c77d272544a", "comment": "Malware payload", "value": "937bd53a5f505b8e9b00416590ad8d92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708158297, "uuid": "e54ea58b-59cd-4c3d-a279-18e5010d89e5", "comment": "Malware payload", "value": "662d56478c8fa24fb43b71cba64af8d941ddb90659c2412144b46137e2cc4c36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708158297, "uuid": "d4c466c1-c0d2-4fb7-a3ac-e6e4bcb5f6c7", "comment": "Malware payload", "value": "5abece11f9d282ec009bf441f132676344f1ede2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708158297, "uuid": "a9ffb1ef-91f1-4d38-b24f-8ded5533f857", "comment": "Malware payload", "value": "3191c7ddd26b50bc2538bfd5c514722a03da752f91da249b869a28fcb5a5ad7165978bb00615578c07885e808c51418a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708158297, "uuid": "7ef9d9b9-16c6-4575-9bf0-6472852f1fbc", "value": "T1B185E0C6E3A201ADDFA6B03C80465B17DAB53C5507B182CB27EC85262F573F46A7E760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708158297, "uuid": "02e1283a-fe34-46d5-9502-4f9dc6d26fa5", "value": "6b5075b82f10534e3c23be1eaf3d1551", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708158297, "uuid": "900dbb9b-1993-4539-8819-9afbafba2185", "value": "49152:MXi87ZaoNcK9mVrSPYO1M+BrgdhwmzJnU:yvycBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708158297, "uuid": "8ffb78b3-96ec-43c9-a4f7-dafe81e2e216", "value": 1828352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708158297, "uuid": "5a4ac48d-9e36-4aa4-ad48-b3afe30afe7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708158297, "uuid": "321005e3-abcf-4076-8e39-108fd084e13e", "value": "SecuriteInfo.com.Win64.Application.Agent.HY04IQ.1270.25702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5c812e-cda3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708181148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181148, "uuid": "f5b90e5b-26a1-4bc2-9fe6-263fff718e16", "comment": "Malware payload (Mirai)", "value": "d3be5fe976729106f5bbe4b7f3a0e78a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181148, "uuid": "3c58039e-7a11-46ad-9f08-f78095644686", "comment": "Malware payload (Mirai)", "value": "6cee8aee84975236b451c8ea43ef54d18e7944cba7f9c29536e3b6e022a969ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181148, "uuid": "67edf7f9-e846-4bd2-b580-908b985a6a4d", "comment": "Malware payload (Mirai)", "value": "19f126e98cb0f53f08c8f4df5147092494b4c8f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181148, "uuid": "b6e03171-219a-4055-9fce-32d458d041f3", "comment": "Malware payload (Mirai)", "value": "0a1374f0d53cb5d2a1bf86c32c35d104ff0c33f7ccc06e77cbe7e7e64b6862b4b6deb231d608db2b978985f687e3d20e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181148, "uuid": "ed8a93d2-57b3-4cf5-9659-5405aef077c5", "value": "T1B8839316BF601FF7EC9ACC378AA91705289D611E31A93B75B830D428F25B25F15E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181148, "uuid": "1ecca1e6-9ca4-44bd-b8e1-c74782c44eac", "value": "1536:bw4pjQLOQ2GTZHslkJGAopJpPok9Z5ztyEd42+B:bw4pjWQAFslok99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708181148, "uuid": "37ce9964-a4cb-48bd-8907-23dc3c76f213", "value": 84172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708181148, "uuid": "0b67d6fc-f5f4-4ad6-b91c-10b9ea962b71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181148, "uuid": "f2e82f55-9273-4712-be3f-9fd20471f013", "value": "d3be5fe976729106f5bbe4b7f3a0e78a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc00b1b-cdb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708188611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188611, "uuid": "91f46f59-18cb-4d5e-a154-d9c021954980", "comment": "Malware payload (Mirai)", "value": "9712d23a31fc079adceffbd97341a5b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188611, "uuid": "43f94409-c026-4469-ab8e-1ebd344ce6eb", "comment": "Malware payload (Mirai)", "value": "6cf55812ad8c626a4b42877ffe7ee454a170895280262418abe4de777ac6737c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188611, "uuid": "dbd69ee7-73da-4cb5-b741-e3cbe1a2e23f", "comment": "Malware payload (Mirai)", "value": "79fc7d3a3f907d9856bc1a9d3eb98a02e189b973", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188611, "uuid": "c30d5e1d-6ffc-4d20-a9f5-3f4da936930c", "comment": "Malware payload (Mirai)", "value": "3ca96e1be6f5b81fa97a9e86057ef52a32aeac7f1a1c5768f7fb7de129a537981b9c6b21a2c859184b1819c0b7d7343f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188611, "uuid": "fd5cea88-f610-45ff-bc2f-0050de12e5e6", "value": "T13804981E6E228F7DF668873447B74E25976833D627E1E641E1ACC1102E6039E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188611, "uuid": "bca11e4a-7d4c-4d6e-9627-041910591680", "value": "1536:ByxAwfIOuY8bfDHtdF1Nl9VLPz3hqbKWW6B80WdHB83gQgimjIukv7teJZQy0gjA:huu1KlkB83p1yIuy7AZQytWrKzv/AVJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708188611, "uuid": "49120981-ea9a-47ec-bdf3-5467e4bf9479", "value": 186092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708188611, "uuid": "7de04c72-2755-4801-b092-5490505f32b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188611, "uuid": "62748950-e0f4-4766-b2ef-49f459a75b06", "value": "bulu.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15c1519-cd8a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708170605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708170605, "uuid": "e8721b05-e099-48b0-82df-21e4a81250f3", "comment": "Malware payload (Mirai)", "value": "64b95c6420a9afdf34806b65005bc08e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708170605, "uuid": "a059ee37-02f7-49b1-81f2-816151c14407", "comment": "Malware payload (Mirai)", "value": "6daf9fcfb85065965a646b85f3dcc4e0380198a0a440e71fa00f34efbafff374", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708170605, "uuid": "fd1b0df5-248d-4345-be48-05a9cea35148", "comment": "Malware payload (Mirai)", "value": "7c154340470c405629a2a93ff2a6cc23b470b621", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708170605, "uuid": "d626e244-5b4c-4054-a7cc-3aea4d39bfbd", "comment": "Malware payload (Mirai)", "value": "9498e25e869f014a834a219a6ada306058771a29012d0140eede215d4dbb8a5bb2cd66526b0a1c324e22aeb7028f2c71", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708170605, "uuid": "e983a68c-b501-44a9-aab3-82af6ff986a3", "value": "T16A4301FD89F1C960F8A21C6688AF16357BAA197114FB8B02207D47D277E2583FB5604B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708170605, "uuid": "e56a980f-d367-4206-8789-5a4b88a67647", "value": "768:Hx/Aykmrpc3L8RLHNmUai0hqEQRlm3u4DMhgCq3UIwQ5GNdGUwh6uc4gL3pA8z:HJA3spc3UR/0rQRtRh2H0N0UOJq3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708170605, "uuid": "a86c9c8d-fdce-4765-b0fc-c48ccd39cd9d", "value": 56064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708170605, "uuid": "47f535dc-18aa-45d9-9bbd-12e8a2ea535d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708170605, "uuid": "4b7ef334-d482-46bf-901b-17f903a120fa", "value": "z0r0.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e196790-cd96-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708175512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175512, "uuid": "20fdd989-9c0c-4a30-923a-a71bc71b14ef", "comment": "Malware payload (Mirai)", "value": "fadf6b5dc97b884455a76adf49cacb1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175512, "uuid": "b807ff5c-b7ae-4ce8-8356-cb86d3481da3", "comment": "Malware payload (Mirai)", "value": "6f71f3522f02bb6a7b17769eda35a900f44c38a0252b6527f1f81e4966dd69b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175512, "uuid": "e4728a7b-2d9e-4f18-8a89-34d6506c9b1a", "comment": "Malware payload (Mirai)", "value": "8283a82434cb4a52597e8edc1769efab0ec0f68d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175512, "uuid": "288946f4-87b5-428a-8646-d0a8e1d9b56e", "comment": "Malware payload (Mirai)", "value": "3ab41bbe5f14fb14c9b130e33dc83d5350dffc67345a10c589ef0944c210470dcc50ecb78331259913fdc0cc560d6d2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175512, "uuid": "75362bd5-6fcb-4fe6-97a6-e8da0fe8fd55", "value": "T19953B71E6E228FFCFBA9833447B78E296758339636D0D6C5E25CD6011E7024E641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175512, "uuid": "7c29b17d-2fcf-4445-a4b0-7770d629449c", "value": "768:cdEoTUB+z0ErvJPaN14iM623vUehbV49ROYM3ZwVnVZcsyylu9BbwRLuu:cEV+pUN1tIKROYMu3J+9BERLuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708175512, "uuid": "4fc55653-9887-4ba5-9896-58bf0caf8658", "value": 64488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708175512, "uuid": "87302c68-be74-48ec-8433-34fb4c7ba2c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175512, "uuid": "fb2cb505-0484-4de7-b2e0-cbaacde74e77", "value": "fadf6b5dc97b884455a76adf49cacb1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a288d96-cd88-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708169466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169466, "uuid": "d7e9e966-0325-4f9b-bf51-9322dc4130bb", "comment": "Malware payload", "value": "8b5bc367a9aa64541f4d87823d0cdccb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169466, "uuid": "58c25506-466a-442c-83db-8aa7ae831803", "comment": "Malware payload", "value": "6f7dc6c4fa5a2c21a8b97b203b0a854597ed1a0537d665b9eab05960c2a339c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169466, "uuid": "0e3b246b-c025-44ae-a32e-a94b60241298", "comment": "Malware payload", "value": "c4ca3d156b2c3093684c390197bdffa8bd182ba4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169466, "uuid": "74d73b52-75fc-42af-baf7-1f2b9046be21", "comment": "Malware payload", "value": "c14d82bdcf860f0f5fa9b742be61940058b5792a88bc5033b4ea154fb29b291df8215d7f83a786e65b542355edfbbd6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169466, "uuid": "c3375a20-f026-4a9a-9b8d-593927729203", "value": "T142F4AF02F58390F6D568257214A67336AA74B7014E18DF83A394DF3EBC3A641FE37299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169466, "uuid": "5dad6cbc-584d-45c0-9364-74ba9bdf0917", "value": "ddcb612d954099a1a388eddab5637cf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169466, "uuid": "ce47b09b-fffa-4717-843f-c5eec55e8d52", "value": "12288:yk4XiLLQy4sD8Leo8qTYY2gWfunIeV8I5mwtiW4:yk4XiLeLeoTYVgWOIc8+muiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708169466, "uuid": "1b59b5de-14c1-4fdf-8178-a04315f206f4", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708169466, "uuid": "5cfa132f-1df2-4021-b0e6-ab4e7dfbdfde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169466, "uuid": "e370095b-a9f0-49a9-9c74-9a2f736bf8e5", "value": "SecuriteInfo.com.FileRepMalware.1486.14630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9717d461-cd4f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1708145221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708145221, "uuid": "dff73f71-ede1-4e8d-8012-c5106c0b4e43", "comment": "Malware payload (DCRat)", "value": "8ebfb00f97e5120227605496dee1ba2d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708145221, "uuid": "c97f3e91-0ce1-472e-96ef-93cb757d5e29", "comment": "Malware payload (DCRat)", "value": "72ac498f8d99dd2b4c4c4f68a2c709c97dd3f397ac02be6ad1b5b874450c146e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708145221, "uuid": "78855798-22e4-4be1-9369-38e91baa890c", "comment": "Malware payload (DCRat)", "value": "3c225ff088d0fde20c4f2908363909dcc8efdc8c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708145221, "uuid": "2b30a5a0-d0ad-4f56-bf2b-7d2eaafc3905", "comment": "Malware payload (DCRat)", "value": "04415adf1aa31f1e4ef690e6e4a975cfa7dbb42a3479b4978708868c2c44be162321045a066892077c16825ac509b2e6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708145221, "uuid": "1680dedd-3d6a-4706-aac8-63a1829543f5", "value": "T18A759D017E48CE91F40816B7C3FF45584BB0A85166A6E32B7DBA336D56063A37C0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708145221, "uuid": "0ec9cfc2-14ec-461c-80d0-9a477cccde5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708145221, "uuid": "ced0c10b-39a3-42b9-8e32-56c399acc0f2", "value": "24576:U+varIF+BiWM5bL6kxfV1dEX2GEOQpQcHZbEmdOpt6FLW3q9:U4arIcqJLhK2GEFScHD8OA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708145221, "uuid": "75061635-f302-4e44-966e-76b8a1921261", "value": 1610240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708145221, "uuid": "d6d6ef8d-e952-41af-b8c6-b4f9db7bdcbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708145221, "uuid": "e886819a-2b3a-4fff-b9da-d21a6e799d87", "value": "System.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054e27c1-cd88-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708169458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169458, "uuid": "99672dbc-c2e1-4e9d-a9ec-891e64bd1ec8", "comment": "Malware payload", "value": "d146af7399fcd3e527fc0c1769179252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169458, "uuid": "941c9e0c-7586-4ac8-a641-ae34f06749c2", "comment": "Malware payload", "value": "75765d393d2e6b02c0f56152e3b95476894d932632f45e1ce1e594a4afdfebfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169458, "uuid": "a5ce9d5c-30ba-4c7d-90f6-2e9c99157eb6", "comment": "Malware payload", "value": "c002da43e6f5429feed17ffdcd046f8502f6069a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169458, "uuid": "338f4099-537b-4254-bc2e-e26257657d1d", "comment": "Malware payload", "value": "3a9ee14d7eb07715c44b4c33e65465d0e7900e47597d656949bd1d84184e58177e27b92f044519125aa9ec2a9a36278c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169458, "uuid": "f00f5cd0-bea7-49a6-ad10-4075d66c6d3c", "value": "T118E49F21F5C68036C2B323B19E7EF76A963D69361336D29727C82D315EA05816B39733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169458, "uuid": "82272f2e-5f7a-4761-9a45-44b075199369", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169458, "uuid": "3e0d5081-7992-4c2b-9070-5715abd65f86", "value": "12288:khkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a/J9q:8RmJkcoQricOIQxiZY1ia/Pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708169458, "uuid": "e8f6e3c2-9e03-44ff-ae39-829843b62767", "value": 667519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708169458, "uuid": "7691b5ab-ad8e-4ce2-a9e3-548c883fbf66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169458, "uuid": "6cb922a5-5b28-4a4a-b7fa-64e779d4a049", "value": "SecuriteInfo.com.W32.Autoit.AOZ.gen.Eldorado.19572.26888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b580c2a-cd96-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708175508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175508, "uuid": "9beb0eb7-7e8b-436e-b096-2dccf34905b1", "comment": "Malware payload (Mirai)", "value": "a70e3929b2a31c6625f3c9be8fe4144f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175508, "uuid": "1509de50-ff66-4e4e-8d54-8fe211644e7d", "comment": "Malware payload (Mirai)", "value": "7603157d417ad2778d7d4457d2dd474e94d985e8829c886d62854717077ab480", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175508, "uuid": "8685b285-b7bb-4e9f-aa30-b6928acb2fa1", "comment": "Malware payload (Mirai)", "value": "ada459b0a95d6a35dd4e1d4f5bf4d8df8c05f237", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175508, "uuid": "45732d72-23c5-4f2d-9503-4716de7d05a2", "comment": "Malware payload (Mirai)", "value": "9cd64448701a988354a59ca7eabf4750ec4b5c145ad2c9d34c53b26a3f390d6bc086b49297f314d5fad0f65708150fad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175508, "uuid": "e5eaa6ae-32b8-4a43-a53a-6aec5a2d31ec", "value": "T124333AD6F401ADBDF80FE77A4813091DB670674101831B3677ABFD93AC322A95D62D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175508, "uuid": "bbab9cec-ff0d-4c48-a3bf-00aace8bd37a", "value": "768:5tvMernXDHh/1Qxhr5zTaiFZ8PP/e86YuHA3l7w5tPZmqwwR/nGQ:5t0qntixhrpaiZ8Pne8tuGl7w5hZv1uQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708175508, "uuid": "572152fa-f8c1-452b-8be2-b806e8f4be84", "value": 51156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708175508, "uuid": "94236acb-b92f-4447-b9db-e017f6e1a980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175508, "uuid": "4091b010-c35b-434f-928b-9526bfe137d7", "value": "a70e3929b2a31c6625f3c9be8fe4144f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7eca82a-cda5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708182186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182186, "uuid": "b751e9df-f884-4816-bdbb-402574bc0bcd", "comment": "Malware payload", "value": "67d5321edd78d4d2a24b313976a682a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182186, "uuid": "d04f2225-9e75-4096-9938-2ed3d5cfee83", "comment": "Malware payload", "value": "773e97cf6eaa7fd3e4dbb498c7cc9ef442ace6f333e680f9cfeae14f80179525", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182186, "uuid": "bb3a0fec-715a-4537-80ec-ce3b778bdb2e", "comment": "Malware payload", "value": "bee6bd0b3e8dd4b233e6e3e1972cab9a5e6911ae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182186, "uuid": "78b40e6c-0c83-4642-a748-8bf0eff694f0", "comment": "Malware payload", "value": "ab14f357d249af1f658266c4f99b1e83b08659d2cd3b1ca4725d44effb1e4d61c47a1ffe2025845074ab3ba748c07d4c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182186, "uuid": "8ca179af-2387-470d-a125-6dbf8e7c5c7c", "value": "T104330548E607D1F5DD474D70A05BF97FE7309A22E530EDAAEF85B902EE33A126006719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182186, "uuid": "23d31a80-82c0-4282-ae85-a198edaa060d", "value": "768:jWECYQPURpCNgPIaJECR6GbyEBUwPe900dKxzsaXA2v11W/5BQA7i:adsR5PIiR6mvBZPe60dKFM8WRBQA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708182186, "uuid": "d0dbb74e-fe72-4f49-8000-50cead430084", "value": 51004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708182186, "uuid": "40b5ccc1-5349-414e-a408-de140a540993", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182186, "uuid": "087f3fe9-97c2-48e8-a6d2-d62c487c1b01", "value": "b4ngl4d3shS3N941.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e90b41-cda5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708182183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182183, "uuid": "04534d64-630c-4db0-86fc-420b8a604884", "comment": "Malware payload", "value": "e0d1de2f49f282594547c9f4b9f82164", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182183, "uuid": "cd1c0b15-6f59-45f3-8495-0d3bc16546fe", "comment": "Malware payload", "value": "775f2c6316b56f9cf2adf40eb3306fd42456d9ed92c772a56a223f05af086f83", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182183, "uuid": "76b25f7a-8482-4f08-ba9d-e3d5f9d7af24", "comment": "Malware payload", "value": "649609a3f8cc4dde4c36abdcc65dc7f08c1f94e9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182183, "uuid": "241ed95b-0223-4494-b183-0e48c40bd35f", "comment": "Malware payload", "value": "4ed802bf07f33c1acc8e90ed34e2deed36797b548271d2f5ab1f664a3e9496cc40efd0d0fd8b86923008b9650645c411", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182183, "uuid": "0cfdf23a-5c61-42b4-9092-8810dfdfdd20", "value": "T14B23295ABDD1CF02C9D4A2B7BA1E029D3B166398E2DF33039D156F61728782E0E77046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182183, "uuid": "a85d3c60-9eb9-461f-880d-c2ce5760237c", "value": "768:qn9GbyIIqVFK051vqPiy2BZEIKPXPeWZr3srZV2BNO86SYl1Pb1viM:u9G+y91a72BIA1pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708182183, "uuid": "d9057d9e-acd5-45b2-8569-1c84943da13d", "value": 46480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708182183, "uuid": "1cf17b8f-6ba1-4c87-ab88-f8dc94d96773", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182183, "uuid": "8d00c926-b28a-45b2-ad46-eedf17a80092", "value": "b4ngl4d3shS3N941.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011c3945-cde5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708209394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708209394, "uuid": "1187f988-bec9-480b-bcf4-7fb17c8a32cd", "comment": "Malware payload", "value": "0228889b09c02333958c290677ad1907", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708209394, "uuid": "69d754dd-0b00-410d-aba0-f020f7370572", "comment": "Malware payload", "value": "785cf63b7ae50c86d31c35dc7811bf714e9e2114dd6ebf1c511c662eb28605b6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708209394, "uuid": "c89768e8-4551-4f22-8639-3907015babd0", "comment": "Malware payload", "value": "a427f2e63e389ef894074a060a406eae4e442f9d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708209394, "uuid": "b4458ffe-2b72-4c7a-9261-f190bf39d613", "comment": "Malware payload", "value": "5952563ba2545044f4f68c1056343d801f43089408d86f7609c62995a9fe1e0b454cfbcc019d115bbd1995e1d9cb711d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708209394, "uuid": "fcdcb98d-91dd-489a-872e-a64f3a94eb96", "value": "T1EA936DC5F743D4F1EC8301B11177EB368B33E0B92029EA52D3A99A31ED62951EA17B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708209394, "uuid": "37a5cca8-d49d-4a4f-97e0-3e11621a90a3", "value": "1536:FUDeMR1KvdQO7lA+FU5/Z0AERr3NNX+Ln4kI/k2tWNsKfSaxaGJDZ:FOX7KvCltZtE1TXwn4k6kMkza8DZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708209394, "uuid": "b786fe35-fe8b-4e9b-9800-3d512aaa8225", "value": 96612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708209394, "uuid": "76ae2d2b-af6a-4b27-a240-4dc6c0f4f27e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708209394, "uuid": "209dfac8-6fae-4053-8cd1-24aa4ead2d28", "value": "most-x86-20240217-2236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ad924e-cd58-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708149005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708149005, "uuid": "f6ae34bd-72ee-4c60-9fe3-071ceba1f5de", "comment": "Malware payload (Formbook)", "value": "fe4225ff901b8bfd8d2a8e7efd9f4e9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708149005, "uuid": "0ac0cd14-645f-4fbb-a4b7-c6b380c67c8d", "comment": "Malware payload (Formbook)", "value": "78a5f44353c706e27ab659985b3bd57b1cb20d16d66f19368f8b682e6a104ae2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708149005, "uuid": "c0fe8b12-b4c8-4c57-95e1-e605f915e27d", "comment": "Malware payload (Formbook)", "value": "c86a6c6d02a5e58e266123eb7ab05ee2ba324d13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708149005, "uuid": "4a6a91bd-765f-44f9-8478-10fc061d9ac7", "comment": "Malware payload (Formbook)", "value": "f4a9a297010eb2bf89779e335d3413a71e543c2536602e76ad2a1a62d46c8d6c0628820bd5a18e911bd9ca7856bfbbe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708149005, "uuid": "878b479b-86d0-43a9-bc13-db653c4a74bf", "value": "T11D453316DA5782D9CE699B360E835720E3B3714A94F847FF7F40313867A1E658AC20BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708149005, "uuid": "252c20bf-9829-4671-afc0-1257c1ba6f98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708149005, "uuid": "dc7099c2-85a5-4d66-a55b-2a52a6b1c475", "value": "24576:pkKzHJcUfgTEBk/poO2I+boT6/INuazuaSV2e8fhMfM+1QEGoJ:pkEJyTdCM+biEGVuadJ4te9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708149005, "uuid": "b5594b10-d154-4019-8344-ea32ad079982", "value": 1218560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708149005, "uuid": "a2cbbebc-6ff8-402d-9872-96e3625d7e89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708149005, "uuid": "87e18a26-c9e9-43f9-8c3d-c2c7c904ad3e", "value": "Run Rocket.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbdc3d0-cda5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708182192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182192, "uuid": "8584afe4-2f74-4543-bc11-ada8116f8fc3", "comment": "Malware payload", "value": "8cea2558479786735e0d78b17f53236d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182192, "uuid": "d65598fc-07e2-4363-a04a-9f4f8e3913a0", "comment": "Malware payload", "value": "7c2226cd85cb2f794cb27c6d8278d6f9bdf08b2aa8d2b0616d006c9d5fe20202", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182192, "uuid": "ed71ed5b-4dc7-48cf-b455-6977cd52a19d", "comment": "Malware payload", "value": "01981bad3a17f8dbb6770c79ef3a5b4c17ff2743", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182192, "uuid": "3b2c868f-1dee-4298-8bab-bb37f20461de", "comment": "Malware payload", "value": "a6d0c0db80b1308192798c44ab32e3d8e2849dac8acae3278eae3dcd67d8a9bc7dc7b018398bd6b7c3c9bb8768af5d59", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182192, "uuid": "1e42611e-9840-4249-8611-deefdbf0390c", "value": "T17FA3296243438D6EFCAB87B907E35A32B5F5682231B35543F36A7F085B322D54E18AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182192, "uuid": "d58f3987-5d03-4755-a0ec-70126c7f161e", "value": "1536:uGJpuYOIvh/djGNR0h6mer9h0O+keTTh3l2ptygfTOahQzaWrM4g/sx2sXAW/RJG:3nhv6COmOgFkOah4dvSq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708182192, "uuid": "4b1b4a65-0a58-4f8e-9aa7-21af72dbe39c", "value": 104255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708182192, "uuid": "bdbaa74b-84b2-4f38-b2c8-2a6317d4008c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182192, "uuid": "728e262d-fe0a-49cb-bf24-fa1787f0ea29", "value": "b4ngl4d3shS3N941.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537e1692-cd53-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708146826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708146826, "uuid": "9194bb11-6f8a-4a57-9e47-e3ec10af3788", "comment": "Malware payload (AgentTesla)", "value": "642bbf552dc8a71fc044ecee09db0847", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708146826, "uuid": "90a23f53-d5ae-4ec8-b7d9-72f1b52b521c", "comment": "Malware payload (AgentTesla)", "value": "7c6a16016a161dce6cc4832fbda3ffb573ec280f3c16229244877c96464aa072", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708146826, "uuid": "7820e153-6592-4842-a335-9c2aa050567e", "comment": "Malware payload (AgentTesla)", "value": "b74847e2c92862fa81db6297d192b26aff898e59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708146826, "uuid": "47befce4-8a1d-4694-8f6d-b670bc470d09", "comment": "Malware payload (AgentTesla)", "value": "a60f1cf46ac234306a324e8f95ffe68d936761e196c44b0aea4ae7de9c96aa3b1441ef3bd67d72668162576591b82130", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708146826, "uuid": "d67cbd67-81e7-4c20-a67d-a54b1ac7489b", "value": "T1D035C021B7D29036C2F326B05D7AF3E65639A9260336C29767D42D377E704822F29772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708146826, "uuid": "28c7e146-10dc-4229-91a2-68c765b6cb26", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708146826, "uuid": "fdc5936c-d36e-49d7-8db9-95e57a44808e", "value": "24576:fRmJkcoQricOIQxiZY1iaUSY1sbeipkAHj:0JZoQrbTFZY1iaUx0JpvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708146826, "uuid": "602969b2-57fb-4f4b-a796-b2ee18a2ee49", "value": 1080855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708146826, "uuid": "f5fa3bdf-248e-4058-8d8d-4013c63d04ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708146826, "uuid": "606d51a0-7534-40b8-8e37-1135ca09b6d7", "value": "642bbf552dc8a71fc044ecee09db0847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a8d024-cd44-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708140541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140541, "uuid": "b4cdcc9c-c1dd-415a-a82d-82e05dacf180", "comment": "Malware payload", "value": "7e36f32b876d9409ec1793d434a65c44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140541, "uuid": "54c4d5d1-2d6f-4707-87be-e462c2a708db", "comment": "Malware payload", "value": "7ee94cf882a7f5a71799aa1de2caf880260a8a6d312371712bb82c0c2b570564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140541, "uuid": "a77771d3-6d20-4908-839a-20599a39abc2", "comment": "Malware payload", "value": "fb8e973b5d57446f6e6b323fe4dff7486a0f1e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140541, "uuid": "092b46dd-d6bc-4f07-beb4-9081a8ec8e64", "comment": "Malware payload", "value": "be657b161ab3fd9fa07e887cbd5b3661c2ab88d991be1b88a52d012fffb3607cd8363e732f46a526fd36f97dff26469d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140541, "uuid": "ca2758d2-b8fa-44c0-85f8-8d3215164726", "value": "T1B9A77C036857D071C296D6B689A24142F63034886B2062D73F6CE6BD27A6FD473FE7B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140541, "uuid": "c1c1d0e2-4286-4dd1-9c55-edc9a4d07543", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140541, "uuid": "932a5e19-637b-4ce5-bd98-de1fd79c8a7c", "value": "393216:XDM1NJdSZ+kL+t9/ARjI8H6C66CG/P2H:oLA+t9/MI8H6ktPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708140541, "uuid": "82a04e5e-bf59-4034-b612-454d2dba990d", "value": 47113728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708140541, "uuid": "4911f31e-d062-416c-bcac-37cfe0692f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140541, "uuid": "036ecaa1-5ab8-49eb-b30c-cbdfd6ce0c7a", "value": "SecuriteInfo.com.Heur.18007.398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d2f96c-cda3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1708181110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181110, "uuid": "0edc11e4-2e24-42e4-ba2b-eddf96f8e202", "comment": "Malware payload (NanoCore)", "value": "d15300b9633fe68ace9c95d55664ecdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181110, "uuid": "f4e2bfab-10f9-4ea9-b045-456dedc8d9bc", "comment": "Malware payload (NanoCore)", "value": "7f24051d8ea086ac0d78f5cb8e0f127140aee0ec0ca7a9e3137dbae04b76dd70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181110, "uuid": "0df13654-a7c8-4682-b25b-99ab7f29e232", "comment": "Malware payload (NanoCore)", "value": "556b9726a17b12a0a59473da1f7dabc3e74aced6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181110, "uuid": "4db68dd6-641b-45e3-9ce6-db1699004b15", "comment": "Malware payload (NanoCore)", "value": "eed8c362b87b27fa486fb62d071e7f448906d0f422ec2eb3ae21f18a5a9935464e7d5e0236efb1f27028561f1df82596", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181110, "uuid": "9de0b031-f0bf-413b-8913-1b7904906c03", "value": "T1B655BE91FA4FC4B0F0222475C633A9F3A16E6D20FA2489677256BE3AB9F4341515373B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181110, "uuid": "542e69c3-224d-4769-afbe-1f01889f9e12", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181110, "uuid": "9f29e733-b72f-4512-a4a2-354056110b6f", "value": "24576:MTbBv5rUl4oU7RJVxI7BMTGtR8B/hIdNCXYzJey:OBwlMT/ItMTGoB/hWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708181110, "uuid": "28b3bd61-e487-4e83-bcda-1a273627a823", "value": 1328024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708181110, "uuid": "eeba9d3f-df24-4912-bf11-497e8599aab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181110, "uuid": "735fe392-eb5c-4d63-bbc0-5a7bbef5a275", "value": "D15300B9633FE68ACE9C95D55664ECDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041e53e7-cd4c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708143686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143686, "uuid": "a5f49f82-6c04-4a05-95bc-fbfbd7baaad0", "comment": "Malware payload", "value": "5f3581bbd47fb7cb578b359b040fa069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143686, "uuid": "89753d45-43dc-4a70-bc8b-79c209b8403c", "comment": "Malware payload", "value": "7fd7c8185a5b6495ac3cb545c233e6af9ffccc2ca8b874b5fc4bc0391e5cc468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143686, "uuid": "f5d80a63-c640-4821-bd40-b8f1424d6984", "comment": "Malware payload", "value": "5b1faf41d2bcba3cf29f3f78472305b5e9b3b621", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143686, "uuid": "697b66b8-48a7-45a8-8252-b173ac2e9b77", "comment": "Malware payload", "value": "68f1ae709ba424e21d13882551a27094e6abe266c49e608341d4c361d91edce0cf609d7786953651f085b0fd6cc26fe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143686, "uuid": "fb6032b3-dcdc-4328-9f8b-ecc3482ddc87", "value": "T1B5A2191AD903C221E0A0023591A3EB3B9D7F47B2374668CFEBD442DA1B361D26D3395B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143686, "uuid": "144212af-853f-465b-8629-95abcdd4f21b", "value": "e0273950932caa2c798d8a8ad987acf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143686, "uuid": "1ec79dea-b870-43b8-9cf8-eb20bfdaed40", "value": "384:j/Xh/Mnh0nyRzHN/YpkYibjngSh8MmfLUOQ19chuDII46Q:zG+nKypkYib7Th8MmfLUx9UI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708143686, "uuid": "d40a3abe-ccc4-40e6-beab-c7918d4012e7", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708143686, "uuid": "06c81ced-6cbb-439a-a674-ca155c92c964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143686, "uuid": "3b087f10-f0be-4881-9d01-bcdad2ac27c7", "value": "1208819601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1244169b-cd93-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708174204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174204, "uuid": "81b0e957-fe2d-47c8-9e5a-f670965fdc06", "comment": "Malware payload", "value": "5f2afda29b1c7404f2cd7838af93cd2c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174204, "uuid": "afc19a3a-34ad-4fb3-a196-779c608550d3", "comment": "Malware payload", "value": "803f680d0ff3be3f6b2f56cca8199397c8a920266c35d626de7647876170b972", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174204, "uuid": "8b6da3b3-21fe-45fe-8ff5-f35b1b79f193", "comment": "Malware payload", "value": "cbb6eeaecffb498fee31d25e12143da23584ee5e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174204, "uuid": "c2624650-b89b-47b4-9159-360e6d1ff2f7", "comment": "Malware payload", "value": "41f89dd512ebd734b4c972b44e4decde5fae316b85388904304abfc70b0deb26cbb2fc4f7b2cc278868e19c15c0e0dc6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708174204, "uuid": "e84f41e6-595d-489e-aee6-75d74f928cf5", "value": "T113E33B56FA418B13C0D61779B6DF42453323ABA493DB73069928BFB43F8679E0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708174204, "uuid": "ae954a04-d912-4ff3-a28a-e6446590de87", "value": "3072:yJTc2dBEBXpUc9aQvzj4dnTVhnlQrldgMXMknM/9sY:yJTcVX9aQvzj4dTVhm/gMXMEM/9sY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708174204, "uuid": "5b80686c-853c-4d68-9e46-8fdb80888b56", "value": 150618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708174204, "uuid": "5b772a14-ee79-4564-bcca-8ef39a50c4af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708174204, "uuid": "1a68cc64-d8db-4d0f-bba6-49d7f3ab2d47", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e22242c-cdcc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708198813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708198813, "uuid": "4ef44d10-a370-4a31-9a62-45e7a2ee2ae6", "comment": "Malware payload (RedLineStealer)", "value": "117eef8a227e6ce3646718d0ed6fb7b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708198813, "uuid": "213c24ed-1679-4bb5-8f3d-99bf45b8fccd", "comment": "Malware payload (RedLineStealer)", "value": "80488bf5f30ea2398ff207b9045a0e230aff2d052ea56156a0e96b57784dc0e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708198813, "uuid": "9ec7d299-25eb-44b7-a0c7-32980df5e65c", "comment": "Malware payload (RedLineStealer)", "value": "db6e21bf637604aa0be4f73142a1b7447cc83553", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708198813, "uuid": "07d9bf25-ce23-4ee3-a265-cda424e2c2ac", "comment": "Malware payload (RedLineStealer)", "value": "5482656616d60f9b138773d9e744d063a9b7303b623e6c16702a3b300a77e95266cd23748b0aa71af7835b6e4df15101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708198813, "uuid": "65822302-ed9b-4faa-8924-3fd1a5eb490e", "value": "T1B0A35D2067AC9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC154E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708198813, "uuid": "1e745bd0-8467-4706-aec9-c5f5d53b3654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708198813, "uuid": "616dfb55-3797-4a91-96fb-7301b7318dbf", "value": "1536:Fqsgaq+A/lbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2z3teulgS6pQl:DfZeYP+zi0ZbYe1g0ujyzdfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708198813, "uuid": "e3bc3f8b-7e51-48bd-a6ec-5684bedaba66", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708198813, "uuid": "20f9fc61-fc5a-4b6d-92ff-b6c39acb784b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708198813, "uuid": "64464c3d-5738-4170-ab67-1823d1e47610", "value": "117EEF8A227E6CE3646718D0ED6FB7B1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de73a64d-cd87-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708169393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169393, "uuid": "a5492016-74bf-4aa2-b149-49dc1b022efd", "comment": "Malware payload", "value": "d97a55dfbddee15005fbe1bc65c2895f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169393, "uuid": "567cc58c-9749-4b1b-a987-c1150f4878fc", "comment": "Malware payload", "value": "821e694b9c4eb2d6ab08b9fbe82f8b6c6965ce8ebd4d9ca08dd4ec0eef941289", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169393, "uuid": "be1a8145-9374-42cc-9c10-b4ea7d9ee867", "comment": "Malware payload", "value": "6d36103ec64b99150829b458ab9c280a36b48f2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169393, "uuid": "b030d151-067f-4273-8a3e-3f5e5deac553", "comment": "Malware payload", "value": "f25c8248857774e8e56c9813e77f02a0d4803257da4c3739c8eb6ef379372f41d3c35e756e87b083b9ee73e27160e6e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169393, "uuid": "8b5962b4-3e53-43e4-b611-3efb9b32def9", "value": "T19CC219AD6AD8C62ED66F4BBC78B316240374F3825916DB866C9C99BF2C6330108353D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169393, "uuid": "4cc3060c-745f-404f-b07b-459b23240270", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169393, "uuid": "a0a785ad-c358-4081-aa32-b579f59f28ce", "value": "768:mEHP83Nxk5NkkkkEvkkIhswkkkkkkkkkkkkkwjHEM41v1BbVixgm3Hrdx:mEHP83N2kkkkOkkIhswkkkkkkkkkkkkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708169393, "uuid": "bad2324f-e2f4-4584-bc39-7a3e13a84681", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708169393, "uuid": "0a6cf528-2a6f-46f2-9746-339daf09ec96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169393, "uuid": "f01a181a-3695-45e5-aca5-bfd4e81e9d87", "value": "d97a55dfbddee15005fbe1bc65c2895f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c15985-cd5d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708151257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708151257, "uuid": "a3e91dc2-8b25-48fd-ab7a-25a046d7b648", "comment": "Malware payload", "value": "5654d2672deab994c1d3bc15b9e8daff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708151257, "uuid": "dfca5b06-0db9-498d-b7b9-674ca94f7227", "comment": "Malware payload", "value": "82bef45df82555c55653aa99606aab9b8c0288fec8274c8cbe9f4cc542edd404", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708151257, "uuid": "edb03410-396e-4b99-8f46-7c16f8f99f05", "comment": "Malware payload", "value": "a2633403389a9cdc284b00b345bf1db2987b6261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708151257, "uuid": "32ef5e4c-0592-4dff-9d30-7ec485a55145", "comment": "Malware payload", "value": "5dea073d7b83e39d61e2accb4be204c49ae12e956c71054bda79b79012d2f4a6449ecdd31942501313e45da36a5297d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708151257, "uuid": "311d287f-4297-498a-9003-af78a4dd07b1", "value": "T1E1358E4773E6C0E9DE6781B6C9614232E73178211B388BDB25D0862EEF63ED15E39B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708151257, "uuid": "9f0f42f1-ca32-4c02-951e-fecd2558a814", "value": "62483b3db3efa2372310b5b9fb5f58a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708151257, "uuid": "6b056d38-d3c8-415e-a789-369080595671", "value": "24576:6GmJF1rShv2DpiaKqJo8dmoLRVGcr/JPqh1maoGG:evsN2DpiaKq28HRVGcr/JP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708151257, "uuid": "5eb4c96b-e303-43bd-9992-1d10c8038378", "value": 1134976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708151257, "uuid": "7afb75e5-8bb3-4d2c-923a-e7772d36df2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708151257, "uuid": "699a2d6b-0ec0-4f9c-b963-dd94e36f62a9", "value": "SecuriteInfo.com.FileRepMalware.16623.17166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097128a6-cd88-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708169465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169465, "uuid": "524e71d5-36fb-4411-85b9-d222584a9552", "comment": "Malware payload", "value": "d47c871717a0b6e46c99b9b52bf2777a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169465, "uuid": "35b32195-7b96-453d-a621-a9480eb5f6db", "comment": "Malware payload", "value": "84d9db5140c905cc657102dadde82b6b108b6011bb75d8234703c96ea3bad214", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169465, "uuid": "75886dfc-c88a-42cb-9530-6f6fd3825a62", "comment": "Malware payload", "value": "648c9564296ce068bebac44a8b47104258ffe0ec", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169465, "uuid": "df50b5ea-2749-411c-8581-ac242bedc8d3", "comment": "Malware payload", "value": "14d5756e3a0206b90a74d1adcb957f0635fad3d2a437f4d2e7657fc45729345a4cf137a7b9410d82d96073e6dd09d9e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169465, "uuid": "622b77ba-b6b9-4502-9235-4e16889da736", "value": "T13B644C162BC98EF1CD5D2E35C414652052B1E04F6997FF4FADC422E81EDA3C5AF86AC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169465, "uuid": "80980711-bd16-4fb7-a183-63ad63153f13", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169465, "uuid": "67a01fb1-e4b0-49fc-b1e2-774d256d0a76", "value": "6144:Od1FDORwzACZZwmfAltULiNyrHjdD+/ncz:O9ORwzAKeJ/cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708169465, "uuid": "06442e60-7d48-412f-849f-e7538a408a3f", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708169465, "uuid": "1fe1f519-5edb-41c8-9770-b4858ff27e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169465, "uuid": "35592b81-2e8a-40e8-ae8a-ceb7e4b520d9", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.JGC.gen.Eldorado.23056.30411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5170ddf6-cdb0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708186765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186765, "uuid": "cf321ecc-5c4c-450f-82eb-99a352daa6db", "comment": "Malware payload (Mirai)", "value": "e68d18c2688cc191a95f3ab53150030c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186765, "uuid": "ba146185-5c53-4610-a633-ce6d353acbb4", "comment": "Malware payload (Mirai)", "value": "861ed7c281b143274e7ac77598ec7f2e59926d1023a3ef4ffc62b8f0b5b935c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186765, "uuid": "3fac4c9f-8213-4325-9c17-f9bc8f7a6f02", "comment": "Malware payload (Mirai)", "value": "6eaa24f07e0461647a12513a73d561ea40affc23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186765, "uuid": "11561ee9-f57d-4b79-ac58-c8955fa2380c", "comment": "Malware payload (Mirai)", "value": "8a2c35a6d69651a33343442743015bc3efb854a39644dc14017ca739fb52e6f85f0b221eb40991d904284142a3ba315f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186765, "uuid": "f3bc5946-998f-4ec7-b592-20fd56d8a355", "value": "T1AB839316BF601FF7EC9ACC338AA91705289D651E31A93B75B830D428F25B25F15E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186765, "uuid": "bc533f08-940c-4cfa-9fae-95b2a423fbc1", "value": "1536:bw4pjQLOQyGTZHslkJGAopJpPok9Z5ztySd42+B:bw4pjWsAFslok9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708186765, "uuid": "127506a7-4db1-4375-a151-0b4755daeace", "value": 84172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708186765, "uuid": "e0498dd5-58ae-4bd1-a20e-23993af33dfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186765, "uuid": "6b181e50-3293-4c57-9765-89dc1accc45c", "value": "e68d18c2688cc191a95f3ab53150030c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f622640-cd5b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708150389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708150389, "uuid": "373c68b3-a8a4-4f99-8eec-f4c817af52a9", "comment": "Malware payload", "value": "b6d86875d7d1e423cabb2bb687ef1b70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708150389, "uuid": "7046e7db-67c2-4869-b879-173cb5dfec8f", "comment": "Malware payload", "value": "875853df32dc938dd49e561f858509edd15224e1ab5cc48542bbff3fcf33489f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708150389, "uuid": "10f0fd03-164c-4382-95bb-57a4450d5efb", "comment": "Malware payload", "value": "ca7ad082b457bfc2f1d0a3f30321cf472e4aaeba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708150389, "uuid": "3c1e2c9e-111e-4270-b160-928ff3484adb", "comment": "Malware payload", "value": "97bc96d169e8a1df51e4db908bd5b299b97db24af9288b0197061c0c5cd0e7a5ad923358d98de410c0bb92e5b19e8c39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708150389, "uuid": "34ee1d77-5f49-4260-8cfc-1d3c0f071f15", "value": "T107D7330E2D66FA43D17F4F768416383493F4CA134F12D76923E9BADE9EC23488586627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708150389, "uuid": "7cfc3fdc-2d9a-4c4f-a664-3228fd802b0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708150389, "uuid": "6d724411-e714-48a6-8bf4-7a07332f70e9", "value": "1572864:U27iM5TcccNXfavgvRLs7cpInNWggwAICFedQYU4:T7f/ifavgvFs7cpA4vZICFedQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708150389, "uuid": "74d3cb13-db4b-4589-baf1-28b75398a6a7", "value": 57960448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708150389, "uuid": "bfab16e3-5aa7-4990-81a4-bc021bd7e9de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708150389, "uuid": "b1aeda6d-1b53-4d83-9905-18ff4ea11789", "value": "CraxsRat_protected.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18777c71-cd96-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708175503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175503, "uuid": "9e11b820-a799-4078-a5a8-70c307d4cf8e", "comment": "Malware payload (Mirai)", "value": "cbaee505059fefcc21ef9c84a4dbf6f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175503, "uuid": "f66dab90-1a2f-42f6-9b65-ebe3288ed983", "comment": "Malware payload (Mirai)", "value": "8a8c3ff94a95aba6b379f9c3369d8ebe1f0cd46435b89260ae91876460a6e561", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175503, "uuid": "c75137cb-ab1a-4f1d-ae04-36f02a6681c7", "comment": "Malware payload (Mirai)", "value": "3a694118c7d73cc4627190686b05aff50409f0b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175503, "uuid": "289d621b-2ce1-4655-8d19-1c21a5c1251e", "comment": "Malware payload (Mirai)", "value": "447d3e3c5966feb8b57c0f11467c3db47b92befeb2977fe4cab30c016a515d97b66da947fafbf1bd784c3b422b81091c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175503, "uuid": "4b1d6892-1c57-41dd-94a4-77dfcbfeaa8d", "value": "T1A063C54ABF650FB7D8ABCD3309AA170129CCA51B25B97B357934D82CB50B24F16E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175503, "uuid": "c8727fa7-b1c9-4414-b647-02c367aa8d52", "value": "768:7qQBQ80+/Wh2IAdUwTBO1ewe2OeDrt1w99ZYuaXi4nKZcBLwR:GkQ8z+EIAdBTepPOsTw/ZYuRZcaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708175503, "uuid": "4d7132a9-004e-4917-8e8b-c3f04db8b705", "value": 68584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708175503, "uuid": "3ff30948-20ed-4605-9c67-ba3c7d35e9e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175503, "uuid": "681acba4-3724-4aec-8e4b-d75efeb98aea", "value": "cbaee505059fefcc21ef9c84a4dbf6f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171c31db-cdb8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708190104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708190104, "uuid": "9dd59888-4f62-4d71-a083-5fd68f5f8b3b", "comment": "Malware payload", "value": "d8f4ab2a01c5d8ad7ffd4aec3cf93921", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708190104, "uuid": "624bca1d-d929-49f9-a042-73a446a47f92", "comment": "Malware payload", "value": "8b66a3ecbb30f4351758c45f1c11dfa8faa9804b2976e108e9557ba39bae3202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708190104, "uuid": "4ce2655f-5195-46c2-a178-2e0854d77b41", "comment": "Malware payload", "value": "3d85e9ba0f6972cc9aa6274da014bee2f63cd9aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708190104, "uuid": "8b898c15-900d-43f1-a85e-155ce16d9dd4", "comment": "Malware payload", "value": "e815c55b006255b94c4cd04db8a053aa93f7b44be8ba7d4b15c94ac514668df850918d934a7df16700e7a261ad917150", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708190104, "uuid": "a2f67276-50e8-4405-8d6c-70d29575931b", "value": "T1828601119642A136F8F306B7CDFF587EAA18AF21130454CB67C87DAA976C9E27D30247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708190104, "uuid": "d85296fa-4296-4f1d-b97b-2bcc24bec9cd", "value": "1e13c87ad8b783b6ccf9a85c1dc91764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708190104, "uuid": "750661ec-1bd1-4eb5-9d05-45b2c23a4b12", "value": "24576:etLWjQMC7jinocDJE2Hf1L5o350zlSqrKjSciG+ym:sL6PuN72/1Fo350z4aKWA5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708190104, "uuid": "c65ee6aa-9498-414e-a15d-9ab769a70426", "value": 8396328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708190104, "uuid": "03db5577-3e9c-4f91-ae1d-db939fe43b91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708190104, "uuid": "fd12bf65-cd26-4a2f-bde0-72065e78ec22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c7ffb7-cdd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708203006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708203006, "uuid": "816da56d-8c38-4690-94fd-d26e3207ab5a", "comment": "Malware payload (Mirai)", "value": "7a892360e8ffdcbbd908d586998d10f8", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708203006, "uuid": "29819f56-64af-4d88-907c-25be08bf1a50", "comment": "Malware payload (Mirai)", "value": "8b7f280f8836558381c518487a8881b0a67b87b41e812cef34bb49790559cceb", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708203006, "uuid": "f3440f04-b4f8-4029-994a-7cf0fba712a4", "comment": "Malware payload (Mirai)", "value": "c8789a9a3397bcb7eefb349c6851f8316a270187", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708203006, "uuid": "ba333d4b-7a03-48c1-bec0-712b62e14759", "comment": "Malware payload (Mirai)", "value": "fe2c345dfe0e4def68b9646db2360902e3f287ca232abad1013667229e0d9f7a7c7eb4c4f86bbe1c113c3ae013cb7174", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708203006, "uuid": "cb063f80-8253-49a2-a16a-b514c6808a47", "value": "T13EE33B86FA408A13C4C51B76FAAF414D3322A755E3EB73068D185FF43F86A5E4E27606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708203006, "uuid": "f8776f1a-e5e0-40b9-88e1-5adff433b75f", "value": "3072:hb8xFqv7UshHGP0Yq96pjXUASP/tYkIymaGYpM/9em/N6l:5AqvXhHGweXUASP/ekQaGuM/9r6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708203006, "uuid": "59783c97-56f5-4f5b-b57b-03b22f12ec19", "value": 152684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708203006, "uuid": "742ebcf6-5df3-438b-b400-597f64c96ffd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708203006, "uuid": "cfd9371b-b74d-4182-8a52-2bf635e9bedb", "value": "nullnet_load.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fca889-cdb0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708186776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186776, "uuid": "4973d9db-266f-4570-aaa5-d4915b5072b0", "comment": "Malware payload (Mirai)", "value": "e7108d6ba5421df1a96de00c290ecb7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186776, "uuid": "860eac89-1665-467e-b83b-0c8aa3f642de", "comment": "Malware payload (Mirai)", "value": "8baaefd89f728deea66b5e3473bf6e5308c2ba5e21d593ec880ce0f75968549d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186776, "uuid": "2f283082-bc2e-409c-a26b-8f67cd02fcb9", "comment": "Malware payload (Mirai)", "value": "abb8ca1b5a89375af677fc3a357951d09e22170b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186776, "uuid": "994a2f96-80ca-4079-9ff3-ba9b6d588af6", "comment": "Malware payload (Mirai)", "value": "b7d4a1a61b9a959be83ff1102ba9208df2a8263ab98737181e89e09d166e61d1c770dc6d3ab667af0209b07c8e412e05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186776, "uuid": "6ddbdb71-20e8-494c-a00e-d63d110857ad", "value": "T12A53E64178819A17C5E422BBFA6E018D373563F8D1DF3216CD226F6476C982F0DA7B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186776, "uuid": "fdd60a19-5052-4494-9b1d-447d2574668d", "value": "1536:1PdIMPcUTCRfRpbY20ybvLze/lG9Wcq8tJtZ4d42+:1PP14AezetG9bqsJtZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708186776, "uuid": "7ce6fe95-7962-44ff-b975-46bc4466a261", "value": 64456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708186776, "uuid": "7fd54739-29a8-4995-9624-513978e1e2d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186776, "uuid": "611d4cd4-7be2-4fe6-8fa1-fd98c20f326c", "value": "e7108d6ba5421df1a96de00c290ecb7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665c6662-cd36-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1708134402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708134402, "uuid": "efea1699-9aa6-4449-8ee4-10b46154bde2", "comment": "Malware payload (IRATA)", "value": "bbf2a8ed116cb34454a60641bb2d6a57", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708134402, "uuid": "8bcca1d2-ff10-4980-ba0a-5dc801f2190d", "comment": "Malware payload (IRATA)", "value": "8baea2e83cfc696a8ff9186f48d0da2f3192acb7c17267964117b5e947a05768", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708134402, "uuid": "89f004d2-68d8-4eca-87a8-3cf53d8730f1", "comment": "Malware payload (IRATA)", "value": "ad5b1a2d95be058511dd4b5c320a18117bbb21f3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708134402, "uuid": "04b14a38-34c5-4d2f-bb43-2f0c789ab0db", "comment": "Malware payload (IRATA)", "value": "24666df28addf0418765b5f9543d6bf2639173679922b1da33aaf57b857bb1dac7b590723b924f64f911c9242602be87", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708134402, "uuid": "cd4034c9-d485-4f5f-aa07-dccc39c12912", "value": "T18E162303F2A6AD17D5E6C37236252636013A1D69D743FB4B39583BF928BBCD80B846D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708134402, "uuid": "0ef2dacf-e56d-497e-8e42-748412e42197", "value": "98304:zGZTSHh5MkkmXx5TfPHt74OM70al0QOB9eg6CIy3lYR:zGZTSHMahVXHt74xwQ6cN9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708134402, "uuid": "a38210aa-e201-41ed-b187-b994152e580b", "value": 4039069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708134402, "uuid": "d7ba3403-1a11-43d8-b23e-4ee6b4667d43", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708134402, "uuid": "e9f33f73-16c3-487a-af67-dbd87df92bb6", "value": "KissGamer.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330da3f6-cda3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708181131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181131, "uuid": "36618a22-e30b-4f9e-9708-681b4b0b9ce9", "comment": "Malware payload (Mirai)", "value": "0cc93a7412b5dd9628ce72f9b307b7dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181131, "uuid": "47e1a3d8-aabb-4b74-b15f-85a8f713bd8e", "comment": "Malware payload (Mirai)", "value": "8d7edf282f6e3f771afb0726f21043f19c5f2d12cb6a7131f18f9a6288fb8262", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181131, "uuid": "7f121383-8565-46ec-85b5-ae822a683cf3", "comment": "Malware payload (Mirai)", "value": "bcaeffc79c63e3158a10b3b610adac6691a00264", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708181131, "uuid": "a55066d3-6a10-4865-873b-67dbd33bbe75", "comment": "Malware payload (Mirai)", "value": "3bbfc888237858b26c5fea39bbb7100efd149ffea7600ffcb937578c5fba905f110d6498203eb012818f073b1faa5e86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181131, "uuid": "68109c88-76a8-48ac-8c31-15368da69191", "value": "T151438E36C47FADA8C5858638A42149741F63F50882A7AFFA9BC587645047FFCF6083E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181131, "uuid": "a08a751e-2d0b-497f-91e0-b8ebd96e6eb0", "value": "1536:rHdIcHE2ZwtdW4KWjUKbq9V9R3qLw2h5CwXd42+:rHFHE2Znnz9ZqLw2h5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708181131, "uuid": "a44a23dc-5103-49f7-a330-2da2ec7530a9", "value": 55212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708181131, "uuid": "0f83c35d-d657-4973-aa5c-ab5247c14922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708181131, "uuid": "75cad72d-301d-43dc-8ea3-ed6481c843c0", "value": "0cc93a7412b5dd9628ce72f9b307b7dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ba60cf-cdc0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708193807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708193807, "uuid": "dc789677-10e4-4448-a420-a748d6af8327", "comment": "Malware payload (RedLineStealer)", "value": "b193c3393e07c06375d39d92c352c011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708193807, "uuid": "20bf4a27-7e82-450b-82f4-b0d50cd01d45", "comment": "Malware payload (RedLineStealer)", "value": "8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708193807, "uuid": "a3df1f5f-42a6-4cd1-b0ac-50ee6e1860b2", "comment": "Malware payload (RedLineStealer)", "value": "866b3f6fd77c703efb874eaf3cc518c3e86ac209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708193807, "uuid": "86789cf9-18a6-45bc-ac6a-c3f3c1100f2f", "comment": "Malware payload (RedLineStealer)", "value": "62a0810145288d4c3ebbf6628e6f7c3529fc650eaa9acc60d8c5471ef5321d50e948aada575223ac01469b5ef7a76ee9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708193807, "uuid": "d9d1395c-e79c-4a2d-86a0-d76f0a1c9597", "value": "T16FA4F1127AE0E432CD9B84705434F7F4297AFCA1A578C08B37983F6F3D71692666A361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708193807, "uuid": "b5b04b2d-207c-4a43-ac43-0f341a7be904", "value": "34c4161f659e591de8a4c6e215c7a951", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708193807, "uuid": "5ba7cd97-4be7-405b-b3fc-7e7f8df22d5b", "value": "6144:tGi0UFErSII8Yo2OWDa1zapDA6KnALOaUvs6+sFW3ChCBm8Z0pJ8JFE2DC:t6wgoHja1mpfKALO1vj+yIdSf2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708193807, "uuid": "3ff52ec8-dc0c-4ab4-9f9c-2ad1cab352c2", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708193807, "uuid": "b10fe008-7b11-4707-b30b-83bffb716a16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708193807, "uuid": "cad2b493-a72c-46d8-a324-1c7354c1bcd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84101b88-cda2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708180837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180837, "uuid": "37f31ba8-fb6e-4080-af78-3814e42c6e9d", "comment": "Malware payload (Mirai)", "value": "576929e55c26b33a7ae1e0378801b7eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180837, "uuid": "b3a2cd1a-6b1d-48cb-b411-3a621c2be8c2", "comment": "Malware payload (Mirai)", "value": "8fae3a0518a22a1c5123cbcdfa0db7f2b6f6f8a7f4843886965fe7f9a2c2d227", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180837, "uuid": "fea0f0dc-8304-4721-a054-a36611e147db", "comment": "Malware payload (Mirai)", "value": "e4651ecf1a8bc12553a8e27fac5cdb20bdbfac65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180837, "uuid": "3ef653fb-b5bc-4c6e-a6a2-f2cf711d8000", "comment": "Malware payload (Mirai)", "value": "f59814664350b2988e676f8ec6f8a36d4518f1c339ffa6a83780394bd13769fe2d268818c2a8004ade53d15e2d78a743", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708180837, "uuid": "4b60aba3-4e8b-4a76-8620-9b8257c56160", "value": "T1CD73A9092E358F6CFB5D823697B78F219758339626E1C645E16CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708180837, "uuid": "656693c2-027c-45fe-9cc9-b611d1794c35", "value": "1536:lo89L2T27mQaXcn6EyvXqaQSiIHW5VU+6Y3jfhdR2QEc8LMkEd42+T7w:lo+2TIaXIE6aZiIH0VU+6KfhdR2Hc8Lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708180837, "uuid": "44e87960-52f7-4264-855c-e34dc2ca38a0", "value": 80188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708180837, "uuid": "f2a07aa6-bf4b-46d0-a547-92f4c9115ad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708180837, "uuid": "d69171bc-b76b-4262-8dce-c69e4ac047c6", "value": "576929e55c26b33a7ae1e0378801b7eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9cb9840-cda5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708182189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182189, "uuid": "0dd47bf0-f837-431b-9b9c-fc08804fffb2", "comment": "Malware payload", "value": "68a147f842bfc99ef86ad47c9f83416a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182189, "uuid": "60c975ff-1bbb-4d85-8cdd-f58f6a03f859", "comment": "Malware payload", "value": "94748f7b9fa4b916dabdb18519a50a38779c0faa9685838dd6b0a39fe512119f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182189, "uuid": "8702bcce-e532-400d-8529-fb1ac1cb3299", "comment": "Malware payload", "value": "9d9364a2885b71924afc956b5627b6a5390fe21f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182189, "uuid": "9ee07fcf-b488-4ca6-8c3f-bda3cf505bf4", "comment": "Malware payload", "value": "08f982fc9686241aab912385abc14ffa2599a0d93e8fea58b68c8dd8c28aaf050592761fc1519fcaf65198c626c22052", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182189, "uuid": "614d0ab3-20b1-4254-925e-8a3c4c19a1fd", "value": "T18F234A46EA87C9F4CD4A0970107BAB7AD774DC312260DEA7E7C9BD279E72203905639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182189, "uuid": "e2e718f2-3319-4e54-95e2-02292edf57e3", "value": "768:XPdRmfnnxpMqqeoLm7IVrDtjf6muMGdhfIiH310vu+i:XmnxpMhd9tOmufOK0W+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708182189, "uuid": "4343e787-ba7d-42db-8012-aa292b0232a2", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708182189, "uuid": "bacc8338-d95d-4b2e-b496-11848405a37e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182189, "uuid": "559e7a2e-d2b7-4af9-86a9-349706e14cd7", "value": "b4ngl4d3shS3N941.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc33fa5-cda5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708182199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182199, "uuid": "dfcd58d7-08a9-4352-ae04-11e1e28ecdb4", "comment": "Malware payload", "value": "6cd0fdf1c6e13dfffacccf61d739b521", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182199, "uuid": "d210493d-944c-4fc6-ba52-a633a204f4ee", "comment": "Malware payload", "value": "964236965621313416ab67dae09f3f1967d1ac664d836eba60da991faaf8596f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182199, "uuid": "d6caa7f2-8704-48ac-8133-747508fe6cfe", "comment": "Malware payload", "value": "172cf499334ee486b1bcf46632ceabdf1acd55a4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182199, "uuid": "7b4cb573-2378-4a6f-886c-1a94426dd7a9", "comment": "Malware payload", "value": "b1fad5a76a9063314462cc07157d6ecfd709975f4bc33c0832be766cb6f620a345b7fecce4b904e958dd33312191e781", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182199, "uuid": "6c838ab2-1bb8-4b76-a917-c5476bdae0ea", "value": "T13043F65AB991CF11C4C5227ABA1E258E33135768E3DF73239E14AF20778B86B0E7A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182199, "uuid": "a071165c-b5e6-4b90-bd48-f476d0f6e9c2", "value": "1536:7tnAQYxGW17wfPIZTjW5L8FzRIxile2vuuR:6Q6HGo1jne2vuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708182199, "uuid": "f002e1e7-84c3-4bba-8766-b294caf2b941", "value": 58672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708182199, "uuid": "cf63cf9c-1ee3-443c-b47c-7ccadfd679fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182199, "uuid": "4a70e64f-4bad-4aaf-827b-8a0d6349c3af", "value": "b4ngl4d3shS3N941.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f995f4-cd4b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1708143573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143573, "uuid": "cb243f50-2c53-44c9-914e-a7c772cb2fd3", "comment": "Malware payload (Stop)", "value": "f69fbfb1df73fe4e156367497fb3e4e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143573, "uuid": "e75efc74-5a47-4cf8-9da0-ee7c12b7e25b", "comment": "Malware payload (Stop)", "value": "971e39310ce70dc7833890a3dd839d7a25565f2e31dac2ac83e67da5e1ed9e44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143573, "uuid": "2c797431-c0ef-4b4c-962c-65809b559a7f", "comment": "Malware payload (Stop)", "value": "6634982ba334a44db94a56fa72f83ca3d3276421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143573, "uuid": "36f2c715-e0cf-4953-a6e7-51db03892161", "comment": "Malware payload (Stop)", "value": "44013bfa13826675e4bb280fce341e1e47dd11784d305089b82e66085fa76fc7bd643525f13a9227e72f1843028263a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143573, "uuid": "30698451-c33f-4818-9f9a-ae06379b40ac", "value": "T127F41210BAC1C032D3A32534C526C6B28EBF786264B15DBD5B961BBE1F24750EB6473E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143573, "uuid": "123124b8-e129-43af-b996-971fe03974dd", "value": "b6f7aa84b290a6b592ee3dcd2ed37342", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143573, "uuid": "b3c26278-1e29-4848-819a-c7c2b0297025", "value": "12288:AcMMxRUXZ+ODd3KezN1QccrtKtQ0r+ZLod5v1jV95ifyUA23mkbJT8yBA6S:AcKZ+Qd3KezNycftR+hizn8KcBbJYy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708143573, "uuid": "72d959c8-8cbe-40b1-8c78-f547a5683d22", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708143573, "uuid": "61a08baa-6625-49cf-9a0b-dd1156140e29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143573, "uuid": "ac22222c-17ec-4b94-9e81-4688db013036", "value": "buildz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9ff0ad-cd6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708157659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708157659, "uuid": "8a6bff54-c930-4155-805e-f6e67c23471f", "comment": "Malware payload", "value": "44602d7e73fe059fa5334079fb5029e9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708157659, "uuid": "c64f6468-7da8-4550-abde-e518f4af2874", "comment": "Malware payload", "value": "98580c61960415ae15a6b65fd338faa962a96c473e19ea69c610f544dcedae46", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708157659, "uuid": "cbb21d6f-84c5-4f5a-b6d2-7d6ea78bfb04", "comment": "Malware payload", "value": "a0f35bcd8afa40f2cbb4d555412ec32fb18dd000", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708157659, "uuid": "3a0aba87-b084-4466-a032-cf721b1eb6eb", "comment": "Malware payload", "value": "5e0d9ad4346fa23c1cf82267e3cd84590fdc73a6f21f5eeaf2389e1e7cb6b57655d71ba2bd634a83624e29e9c59c0172", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708157659, "uuid": "804e7fdf-9fc4-469a-8209-4f5195f72209", "value": "T11AD7331ADB28955EC5760B326E4A23B8A0580E05568BFB06371D73713877ACC8E5EFF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708157659, "uuid": "96afff21-084c-4e8a-bca8-ad6452e5ccac", "value": "1572864:38OMt5Xi/O/R3aDDVXpzFIFPJbbPQixOiRYzeAs5o:65x/R3aDx5xIFPJbboiLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708157659, "uuid": "485505d1-7b13-4c86-ab88-bd0be53e639d", "value": 60682054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708157659, "uuid": "486eb75a-334a-428c-a3f0-b53b70161915", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708157659, "uuid": "c308c7ae-1f47-4456-96c4-3ea1612bf11e", "value": "Cartoon GameBox_1.1.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a65c093-cdca-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708197867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708197867, "uuid": "3d064613-39b7-4a60-832c-ce1cdffec63b", "comment": "Malware payload", "value": "12ed79692bf630627105c30d92c76fd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708197867, "uuid": "512e03ba-9b15-463a-8769-64ab4d9c8f8c", "comment": "Malware payload", "value": "98ac8964b677346d7f5b012327eaddf5102255f1abf256e4951893fbc5759816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708197867, "uuid": "a6a7f46b-7ea5-4e67-ab4d-3617f17b9b04", "comment": "Malware payload", "value": "a6bb689316d87268559d38dfb5340bd4b6f01423", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708197867, "uuid": "701f1501-9410-4b14-bb27-42f83493c1fa", "comment": "Malware payload", "value": "6f25006ff53825f38441999192dd20a27c649a74b156ec8e07f91ed40e03444bb7beedd0764b0b0d20ae59c9ff7303d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708197867, "uuid": "09724fe9-3c81-4a38-8279-a8f565649f09", "value": "T18666AE71325AC42BDA6241B6592C8EDA512A7E350BB154CBB3CC3E3E1FB45C21736E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708197867, "uuid": "837c57ec-e75b-45c7-a4b0-0ee524948e8d", "value": "d79dd35f147f0bd91cc18a6615fcfa5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708197867, "uuid": "d7aad3fe-ec6f-4113-8482-1157ff450c41", "value": "98304:0As++BUHecpbpx+sborjZGS/mJ7oRXnH9EEkXPEJLaiSYtK19jNCNX8sz:0AKBx4px+sNE32pPEJOqAIVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708197867, "uuid": "f4f85f42-801b-4a22-9228-fdaa4a74b234", "value": 6587027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708197867, "uuid": "53bdcdb1-778d-49fc-a660-1e71e80aa771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708197867, "uuid": "83457236-414f-4d98-b30a-55bf98840cdf", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dac1e36-cd95-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708175190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175190, "uuid": "9f18b173-8373-4ec8-a2ba-008c94c151a0", "comment": "Malware payload (Mirai)", "value": "6ee54fa74b4c79ac7af89f98fb1f0988", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175190, "uuid": "0a896cdc-ed90-456e-a01e-1d48fdca52fc", "comment": "Malware payload (Mirai)", "value": "9932164c2f31ffe9a348e715d0206b579541cca09283ef956dda8dccfafcac37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175190, "uuid": "27142f6c-b216-4241-92a3-7665e387f998", "comment": "Malware payload (Mirai)", "value": "6c1aaa9657c819a3365dcc4a4eedb2983885a957", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175190, "uuid": "b6df9467-123c-48ff-b705-a9891dee126f", "comment": "Malware payload (Mirai)", "value": "ef370ada4e56f3144c966fb73dfa9f4f9195dd063976ab3dfc0533762b9bc606277511e4bcc83f108832a25854a4cf3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175190, "uuid": "0d078ced-6d5f-46d1-b5cf-57b8ca77aaf3", "value": "T171430946F9C18E11C5D4137AFA2E018D33176778E3DFB2229D106F61778AA6B0E3B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175190, "uuid": "52b396f8-ccf8-4ab3-a5cc-947aab65ce31", "value": "1536:N/nms2/Qq8CvTqNXiagQhHM2iO0XjaAGR1:oIqHYXv0XjaAGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708175190, "uuid": "bcd8cad9-249e-476a-8c5f-285c99f3e36d", "value": 59456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708175190, "uuid": "ae22a444-d94b-430e-9a8a-770163f30dfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175190, "uuid": "17be188e-27f6-4585-a476-a0b83203972f", "value": "6ee54fa74b4c79ac7af89f98fb1f0988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4f4b90-cda9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708183994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183994, "uuid": "c10b1305-ec22-431d-88a5-33e66757c3b8", "comment": "Malware payload (Mirai)", "value": "84517473e8b678c96912616eab04816c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183994, "uuid": "692f123f-3e68-49c1-9646-9bc3b88f1b5e", "comment": "Malware payload (Mirai)", "value": "9a060a7a6b26770d32f786a848477ae2d7f63c8589d4796fbca7ca138962d76b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183994, "uuid": "8bd19063-f2ad-4172-974b-40c73deb1a87", "comment": "Malware payload (Mirai)", "value": "7bf25fcdb7ee94d2e5fd8d0b08f8b0609b2eb620", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183994, "uuid": "336be529-7e91-4e4b-869d-b43b2887ffa2", "comment": "Malware payload (Mirai)", "value": "91160d532d3dbadad4c203dbd7c4ad8bf6d42566984202ae2038fb73a9c3595fbd1e3711e97b459b9aa699b2a633889b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708183994, "uuid": "58b75709-5205-484a-b28d-00e01429cf05", "value": "T143136C61C9B85C8CE25C46BC75389E3D8723DA15AB072EF9425BC766A013ACCF65D3B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708183994, "uuid": "59bf7ab7-646d-4e9c-9807-214012410b8f", "value": "768:E/2JGDxYsn385LsTAaTfxoYKp/fCuRR4ovHsUf6WLC1Q1vi:E/IIS4YhaLbeXvHsBWLC1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708183994, "uuid": "b036d05d-8e2d-490e-b9e4-4eec655fe69b", "value": 43216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708183994, "uuid": "4242be2e-d389-4d65-8d82-a43e298c7b7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708183994, "uuid": "c70c2d09-2bb3-4ef5-95c7-3278828526c8", "value": "84517473e8b678c96912616eab04816c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9d3cc1-cd37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1708134899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708134899, "uuid": "c1a77a71-0076-4536-99dd-365ebf9eb344", "comment": "Malware payload (IRATA)", "value": "527ed1fd528f1fc0411ded6a0fe7aae7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708134899, "uuid": "a649871f-3984-42d7-86d6-4277e8610795", "comment": "Malware payload (IRATA)", "value": "9a18e212ffdd94dd262de2eeab7758657dee156ee2ddebeec6b97df7227ab8be", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708134899, "uuid": "8353d9e3-9d1f-436d-a416-5ccd999bc2f9", "comment": "Malware payload (IRATA)", "value": "1ba7df77264a60ce99c4bff19f87f0d3836e8331", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708134899, "uuid": "6b70fcba-d5a1-4965-aef0-edb2d8149ccb", "comment": "Malware payload (IRATA)", "value": "10c51f748746d8e05bef24fd01d63f4150f678661ae2483e21b08b52b007f5456283ab9f5c276e5aaa32990da4cdf558", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708134899, "uuid": "d69db3d0-e396-411e-ac4d-985698450073", "value": "T163162313F66AA813C9F2C37121701936217B4D66CB93F78A21187BFD68BBEC907846D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708134899, "uuid": "e7915a8b-4aed-4731-b66d-52ce5d43c9e6", "value": "98304:zGZTSHh5MkkmXanyXzECw9F+TINptfDx9DhlTUG:zGZTSHMaKnyQCwWMX1Dx9VX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708134899, "uuid": "78312115-1235-4144-a63c-76207a8df1fc", "value": 4039069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708134899, "uuid": "93ecea53-cbc5-4dd2-a178-090a73d49937", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708134899, "uuid": "5eba2f78-0b06-4c33-b35a-9998c06ec95b", "value": "KissLands.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64afe2d-cdaa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1708184411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708184411, "uuid": "5a9fb551-f936-473a-b302-0c7d9950a637", "comment": "Malware payload (NanoCore)", "value": "dbceffb1a0dc1e9d8339bfdf8f587c1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708184411, "uuid": "5bf68a41-e0b7-43e7-a4fd-b915beb383e6", "comment": "Malware payload (NanoCore)", "value": "9b68bcf4e287320a6e257953091213ac7e016d7aabc63ee02b0e73e75a782150", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708184411, "uuid": "8f60e1e9-1e2d-4f8b-b19a-d48328c27294", "comment": "Malware payload (NanoCore)", "value": "0d36d97eb42bf9b46feab2d332aaa42e8c0c7dbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708184411, "uuid": "33e3a696-7311-48d1-b156-57ffeaf4e417", "comment": "Malware payload (NanoCore)", "value": "f906a76c3bb477b66e3d6677c1062d7d1b6841b0216c36b6fed819ffb8d51e4d621205bf5f364a94b7df54be9aec7a53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708184411, "uuid": "6d5951c5-a2c9-4885-8521-21a039100233", "value": "T1B614C0563BA9492FE2DECA79612252138378C2E398C3F3EE18D455B74F167E40A4B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708184411, "uuid": "6004fe1e-4133-4a01-bec2-d320d26f7ccd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708184411, "uuid": "1628df48-a22c-4ca1-b66a-affa1f862c55", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIKPQAKhm6+aocJXRBFLCnXwEfs:sLV6Bta6dtJmakIM5rfaocNFCbysvXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708184411, "uuid": "37c27a76-d9f1-41d7-b0a2-99a95a9b6289", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708184411, "uuid": "87e021a7-9385-4cc4-a138-fdec9926628d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708184411, "uuid": "6308e4cf-30c7-499f-98d4-dd1b2eb707d6", "value": "DBCEFFB1A0DC1E9D8339BFDF8F587C1A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2bd3d6-cdd3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708201759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708201759, "uuid": "98dd8f98-0753-47c4-b827-fc6f93ed1da7", "comment": "Malware payload", "value": "1e4069ed0d620ba12e648697f21e43f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708201759, "uuid": "de1235d5-52d9-4055-846e-cd7019001f04", "comment": "Malware payload", "value": "9b980d34aa67cd67e33835edc514d0c89722a161b347b9111c59042e3996e9e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708201759, "uuid": "1deb5458-7f89-4697-915f-26835e9daaca", "comment": "Malware payload", "value": "16b30b6d08d84b6d73004e83b762aae4c7b66ee4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708201759, "uuid": "1be64aba-5948-4027-8b2a-c4e996615f6f", "comment": "Malware payload", "value": "e381640c4b89aa990b1b0e74c82af206056da39c5842aca9dc3f9be53f3214d37833d7a693d160c19e86673da86ee794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708201759, "uuid": "12560572-1c35-441c-83f9-5d653ff93298", "value": "T1080733A167948890D5F5863F8C1EC9254A70FD0517A4ED8FD3B8622E5EA33142E7BFE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708201759, "uuid": "6952476c-9fc0-4aef-85a9-02ff8c3a5455", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708201759, "uuid": "78592e50-7af1-4123-9d34-df20c4ae6768", "value": "196608:t11mUXDB2ML0sKYu/PaQdXGn9m4JHHICBeNlCBFJMIDJD5qgsAGK4R0/dvL413Ym:VXxQdXGpICClkFqy4gste07kaTULi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708201759, "uuid": "7a10cd8d-44d3-4e6e-bb01-f80a347d6d15", "value": 17228855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708201759, "uuid": "0f7b6997-3a82-49cc-add3-592ed1e903a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708201759, "uuid": "8b0b4ddf-8d8d-46a6-b351-d19a4fc56122", "value": "SecuriteInfo.com.Trojan.Python.Crypt.4012.13273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6a10fb-cd7a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708163566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708163566, "uuid": "7b876cc4-e03b-4fce-8611-906b264533dd", "comment": "Malware payload (AgentTesla)", "value": "cf6effc50c7bc57e13af085bb380be42", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708163566, "uuid": "c7a3f396-253a-4838-8eb5-df1c738b16a8", "comment": "Malware payload (AgentTesla)", "value": "9d2d99fba726b3a919f1b27e67daa17f2cb88db4420498561f04f54a173349d0", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708163566, "uuid": "54958459-5709-4945-aecd-90214c3c5afd", "comment": "Malware payload (AgentTesla)", "value": "c81067adc21f9e017f72ff5a60b33839002da7ba", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708163566, "uuid": "015b53fc-6858-4a56-8efe-45777f87adfc", "comment": "Malware payload (AgentTesla)", "value": "70792b4595d6de1ac15af044114e63de4e49b0679928e42182d64ae3f42adf09dd362a4c800669196024427db5382634", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708163566, "uuid": "cdf341ac-f84c-46c6-afbe-e4c373b6103c", "value": "T12B3423284AE6769F6B082EB56A72CD8605927015F3D55C240F7E0A67827CBFC3BDD08D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708163566, "uuid": "7c8b483f-2151-4ba0-b2c6-e13234ca8aaa", "value": "6144:OZQDX0W74N5/v+Y+rIxpn0VI+un36Fh/zJiFnlbMwdZopSX0YRZ5:OA6N5/2T+pn0VI+unqvzJiplwcZopSXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708163566, "uuid": "83b2abeb-ac87-415f-b814-520e7a784ae7", "value": 253131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708163566, "uuid": "f7f7641b-1235-42d5-8de0-b817613eb530", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708163566, "uuid": "f1f43b29-ff3e-4c31-b904-abe33a13f1b7", "value": "Docu_0786063.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbe6fc9-cdb6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708189527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708189527, "uuid": "b14bde49-3013-47f7-8040-7cd3abc7b9aa", "comment": "Malware payload (Mirai)", "value": "f22623fa852f3f7ab24ff4df8f246da0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708189527, "uuid": "e9d11b00-d1aa-4fcb-bca4-c92f5cd33b52", "comment": "Malware payload (Mirai)", "value": "9e1e40da90ba05eefdd2a992225c8c77765ad279dc635a8b72e0f893f99d03d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708189527, "uuid": "f398d212-2b9d-4cc0-b7b5-a72aaaa040ca", "comment": "Malware payload (Mirai)", "value": "cdf4b818aa786c80fa3e20c5f97a978134081999", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708189527, "uuid": "447639bd-46c2-4d66-ac6a-0dfaa9bebecb", "comment": "Malware payload (Mirai)", "value": "cb935a5e83bc67ec83779919788f3a1b86a3d345f27dba409d881ed91ae5c634260423cb615ade18e05bde27362c3333", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708189527, "uuid": "52de5cfd-6181-457f-b4d8-aa6bada77891", "value": "T16AD33902B31C0A07D1632EB43A3F67E097EFEA8131E4F640695F9A8A9171D375586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708189527, "uuid": "42cefc72-4bc9-45e2-a6ed-a51e8ea910bc", "value": "1536:CmIyAi11hAsHTtcMcZshM++xkjvglxuLM9hpIUBLOy2revvAyPchQq3JDqiy6yit:CmeiK/CM++xeol8mLmrnyd5iVwEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708189527, "uuid": "243e5815-0532-4447-b8ec-e453cf6a8d83", "value": 139256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708189527, "uuid": "6ddc593d-925b-47fb-bdc5-d776a8148daa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708189527, "uuid": "d96268ca-9725-4b92-a8f2-cdb8ab868c67", "value": "f22623fa852f3f7ab24ff4df8f246da0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143187a5-cd93-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708174207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174207, "uuid": "ca45bd7c-29c4-4484-84a6-1c442949af2c", "comment": "Malware payload", "value": "0d53549d9e5f0c52a6cc9d2a70e57e4c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174207, "uuid": "9405bcc9-e1e7-4ba3-b21e-c41c8afb7ad3", "comment": "Malware payload", "value": "9f68f67e0cf0a8f337091efd3bd1033427ce33284441c32d369330d43d1e0621", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174207, "uuid": "bbd25c30-7e6b-4d6c-9d0c-f1c307aa8f90", "comment": "Malware payload", "value": "f6d948e9814eec2be2363cb1632eabbcaa3bb51f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174207, "uuid": "50b33374-3241-42a9-8d3a-0199c227635e", "comment": "Malware payload", "value": "9601b32c3946722314622748dc57a856b25c45febcd1d3c52790413eaa843b5a22c7dba303b1ec8243cc46044f846a99", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708174207, "uuid": "3861d31a-1bad-4222-b693-c52fd009b384", "value": "T1C0633991BC819613C6D1127BFA6E028D3B2613E8E3DF72079D225F2137C695B0D37A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708174207, "uuid": "0495bb3e-b714-4e76-b1c0-fde30031b20c", "value": "1536:tZFltmm9LwV7raY/KrVRo+Fz3rImXK3wjqvjWP:tZEKLPFz3rIewfja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708174207, "uuid": "99c5a3b6-4237-4657-804d-145a8991da90", "value": 66912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708174207, "uuid": "9389a2a0-5053-4b92-9f65-8b2b9ca94891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708174207, "uuid": "912ae87b-0ed0-4fea-84b7-ba20569fcc04", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897e6b76-cdda-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708204898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708204898, "uuid": "2a36dd7b-2a7a-4c57-a7a6-97b424d934e7", "comment": "Malware payload", "value": "57a9d811639119a0605c26fd3d544c6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708204898, "uuid": "fa84ce36-13a0-4d31-b904-d0d08585cb3f", "comment": "Malware payload", "value": "a289bc2aead3cfb95b81df85c6a276266014f8cf131a310165365cd82e48463e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708204898, "uuid": "cb2d6300-2aef-4924-b10b-895a8d58be53", "comment": "Malware payload", "value": "bd625bdf541b83a1022da46c0b2ee1feb206d8b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708204898, "uuid": "38875190-709c-4e32-9afb-96cf979a0020", "comment": "Malware payload", "value": "e46a205f78f5a6f544216bbd4c8a485e3eab9777d2be75a6d3b24c741ddc92574560cec49556e5b7ce1d8feaa10dd7a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708204898, "uuid": "fa9bb053-070b-4771-9f8d-05033d79a5e7", "value": "T162F63324634408D9E591887BC9E0CB229A727C7542B9CB634EF97DD7297B7EC4E2B700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708204898, "uuid": "aee3465e-b982-409d-9410-cae684fafb28", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708204898, "uuid": "5b108456-a7e9-4a56-afeb-fef352656c6a", "value": "393216:jOL3/dp47ZnGW+eGQRJ9jozau5qW80hoA/ECZBYC:yTkxGW+e5RJ9MR5qW80h2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708204898, "uuid": "58acfa73-5832-4832-b570-198ce99c3d6b", "value": 16629857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708204898, "uuid": "66a60fd9-bb39-430e-a68f-44877e180f7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708204898, "uuid": "0d8b44e3-4625-4b1d-b85d-5df4c952d3f4", "value": "Sailor Events.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d23cd2-cd9b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708177807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708177807, "uuid": "5862fafd-6b32-4fe9-8fb7-bd026da37bae", "comment": "Malware payload (Mirai)", "value": "3da89d737f0bd90fcc95228984dda9fb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708177807, "uuid": "e0a35eb3-6204-477a-aee3-a03d5e65ff8f", "comment": "Malware payload (Mirai)", "value": "a37b3e3ec4ea44bdcfff15bad34f494a8321774a5bcb9ee35a861ee87c5d2b54", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708177807, "uuid": "517d7630-8535-4672-991d-a2acfb94815a", "comment": "Malware payload (Mirai)", "value": "fbc0dc40a8f3c634d624b9e4a1ed0c5d3c4b114a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708177807, "uuid": "4dba7c4d-acce-4a7c-84d8-1a4d166d7e22", "comment": "Malware payload (Mirai)", "value": "9fd50ee7bc272d25ce2627ae205c2ee4461a2e4f41b69cc72b59538bd6d6c48d54e74801b8c5fe81ad408de9ce305757", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708177807, "uuid": "8a3e4499-6b88-452d-97fd-9854af3659f6", "value": "T1F343C652B8815A6BC1E423BBEA6E518D3371B3F8D1DF3616CC111B24778952F0EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708177807, "uuid": "f6e5a64b-6c21-4999-a2a3-1846299b265f", "value": "1536:Jk48ZOlDxbcYfiQ125+XDW+rd8ea0ClG9WkQxxd42+:x8ZKut4DW+iea0OG9/QJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708177807, "uuid": "bf04d9fe-25b2-4cc7-b34c-fcebcca85195", "value": 55612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708177807, "uuid": "841113bb-4c6d-4ef1-9f63-ad4c1fcbd83f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708177807, "uuid": "4017959c-8449-4f39-9a0d-7eebef9ed8ac", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963fa420-cdbd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708192464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708192464, "uuid": "d159f3ac-90eb-42a7-809d-b7658653a4c1", "comment": "Malware payload (Mirai)", "value": "188e6545e816e498f309b1dc614b691d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708192464, "uuid": "d68d09d6-c9fd-4350-aa5f-d1041fb6720f", "comment": "Malware payload (Mirai)", "value": "a5c35b6163e9fd1ed98d407fc9fcfed286898f783c3f35ddc568609e36686273", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708192464, "uuid": "b68953cf-c615-4f83-8d50-d01e2b1080a1", "comment": "Malware payload (Mirai)", "value": "839ba7a3746872ba48211d605dcc6ab45ec28ef3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708192464, "uuid": "0239608c-d917-4e44-9e21-cf2bb3f41b04", "comment": "Malware payload (Mirai)", "value": "7419ad3dff4341bd7955ea480ceb6c872daa33a794e7925b1982b82a6f6b7306c868a395e1eba61cb7703db1c73f64e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708192464, "uuid": "c12e385d-4688-4d3d-af2d-4285a7ac27d0", "value": "T145233A02731C0A57C5A72A70263F53E493BFE99020F4F689695F9B4A8535E76148AFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708192464, "uuid": "fa6552bf-8cc4-40ae-be26-9791cdbcd94f", "value": "768:SXhLrRPa0xt6R1tmrwMI2+LYsUo4TLhc2AQL/mq3iPRIWXs0kT0OEwRsv:gTPL8Y0a+MqvGxSRIWrMxlRsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708192464, "uuid": "8bd329ef-ce56-444e-9034-69647e4ee21b", "value": 48204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708192464, "uuid": "dd427911-3a90-4cf4-93fa-2bd49fdc47f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708192464, "uuid": "e3da60c5-6f5d-4418-b0a4-568b82977016", "value": "188e6545e816e498f309b1dc614b691d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d47fbf2-cd68-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1708155915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708155915, "uuid": "be195550-2e1e-4d9a-ad45-4c2dcda8d997", "comment": "Malware payload (DCRat)", "value": "b9ed84696306d78e044856c1051e185c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708155915, "uuid": "5a4e5e54-9373-4395-817e-1c3ff1773e4d", "comment": "Malware payload (DCRat)", "value": "a8db619c3a1f082794d5b3837c574ea528724ee2e324677362c4f49ef8fb98a3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708155915, "uuid": "a52e9e37-13a4-49da-b839-602458caa039", "comment": "Malware payload (DCRat)", "value": "4f290faab5808fa54bccd39e3db42df60d42351d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708155915, "uuid": "3322a24e-db79-4802-8692-7a98795efffa", "comment": "Malware payload (DCRat)", "value": "f0cce1466e877ca5d5a19bd2971ec966ac10f707febf87422b6472f598f1f820dd9ce635e09bdfcd3ef3529413756858", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708155915, "uuid": "ac3dbbe8-c731-490b-b275-b5b151b159ad", "value": "T126752200B9C199B2D47219365A796721657C7E202F72CECFA7946E2EED315C0DB323A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708155915, "uuid": "a9d04150-725d-4b56-8934-ebf494d4e896", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708155915, "uuid": "63d8c948-a24f-4f2b-ae67-b9244bb8a8bf", "value": "24576:2TbBv5rUyXVUgH7jDkPlYGxvxDFvwKY/X7PJbxxqf1++Pq/IrKQL9R5nKKFwkKS5:IBJUgHQuMF43/rw0uq/IdR9K6wC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708155915, "uuid": "b4cb61f1-9240-4d8f-a2c2-fb3e2d153f65", "value": 1602253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708155915, "uuid": "a28eec32-5e41-4b77-b53a-2c9f3b91c32a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708155915, "uuid": "57e5a0ab-7532-4f47-a936-b214268ccfd9", "value": "b9ed84696306d78e044856c1051e185c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c52e97-cdae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1708185912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185912, "uuid": "827efb73-6c90-4431-b1de-39ffd6f95ffe", "comment": "Malware payload (NanoCore)", "value": "dee80f55d6bfd6645d9835d9fac1f59c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185912, "uuid": "97cb497c-9634-465c-997b-1bb7b2fb5869", "comment": "Malware payload (NanoCore)", "value": "a94efd2fd4a39e5412ae71262505321a76acccfbedd2b9aa0417721740be6bfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185912, "uuid": "f5633ea5-1e9b-4822-8789-1f1d750ac1c2", "comment": "Malware payload (NanoCore)", "value": "9b24f649e2213bcb3d3153bde48439ee21798630", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185912, "uuid": "45dbeaa8-55a1-43ef-bf16-7e270e9057e8", "comment": "Malware payload (NanoCore)", "value": "e1b0a3697faa70a3cc9e41e607b56425e189a63c74b1e7ac227505f15e0d989b347f67e0c0cc155da95a31d9591eee11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708185912, "uuid": "1bf74b71-027e-40b6-9e73-46e9baf5ddd3", "value": "T16A351202BED154B2D4A309325A756B10A9BDBD300FA68ECF53D08D9EDE216C1D7367B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708185912, "uuid": "744d4dfc-84f5-4095-9581-d5299859a0a9", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708185912, "uuid": "0a44ffc7-bae2-4cca-bb68-63c2f1167533", "value": "24576:YTbBv5rUinwAb7RJVx0y7QiRiMTGtR8B/hIdNCXYzJk:aB7nV/T/0kiMTGoB/hWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708185912, "uuid": "5b294846-d30d-4db5-b668-b95b4538596e", "value": 1106118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708185912, "uuid": "6c525936-b754-4e49-ae72-bfd4de796779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708185912, "uuid": "ef67d570-763e-4cb1-be47-0ae8e888e766", "value": "DEE80F55D6BFD6645D9835D9FAC1F59C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08d735c-cdb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708188616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188616, "uuid": "2c61a3dc-421c-4c59-81ed-dfbea59aa78b", "comment": "Malware payload (Mirai)", "value": "43eb31f9e75822bf5a1bf849eefdba7d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188616, "uuid": "6c8912b7-2070-4490-a11e-f259c4635591", "comment": "Malware payload (Mirai)", "value": "b068683dac909b99994815ed5727dd0d9ffd6a90cb874f471c5f419554e62e20", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188616, "uuid": "5a7d4a66-b653-4158-8d97-51c5e6d225f5", "comment": "Malware payload (Mirai)", "value": "d0666df3a0675d93113c90952ac042648ea6fac3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188616, "uuid": "8a572859-8df5-45ab-970f-fa9f09ac5a91", "comment": "Malware payload (Mirai)", "value": "1cd8dc01860c8843b37226675ae1d7916da7b869b0924e8fd3bf8c1155d97a2b09ea359fa79b80915b1ea75b6f355d21", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188616, "uuid": "1e4fc5e2-45cc-4883-90ae-f207701d3d0d", "value": "T17AD30945FC414B23C6D612BBFB5E428D3B2A17E8D2EE72039D216F25378685B0D37A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188616, "uuid": "1766637c-0922-4129-ba00-38a983ef7e3a", "value": "1536:g20YcaNXgSTw/I7Xkw45hbAVkPF4A0rY4VoNm9TCMlAd7JnGNygl0ltcWwywaFrO:g2sS3ksVCF4o4A0+MlAdkwgcuAHVsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708188616, "uuid": "5bb15b27-38ee-4584-954b-0c5b98ac22d1", "value": 142080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708188616, "uuid": "6791d42b-c2ca-417b-8335-56044d94658a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188616, "uuid": "89457f00-f227-49c0-8d42-bf0e3d60efd3", "value": "bulu.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6af6005-cdb6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708189539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708189539, "uuid": "893f099a-299a-4c0d-acbc-744faf3d2eb3", "comment": "Malware payload (Mirai)", "value": "2c31f8dd1aeeefd910d7cea32ef51b17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708189539, "uuid": "8f99f194-1a91-4fac-be25-f7cbdaa13990", "comment": "Malware payload (Mirai)", "value": "b2ffb851e3a15f0accfeaf849da6566defdae310448a1de2f7c092655d96a57b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708189539, "uuid": "b543a60e-55d2-499c-9188-bdf7aa137951", "comment": "Malware payload (Mirai)", "value": "7350dd372574708aa9760f6bfa548c4bf54e402e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708189539, "uuid": "62380741-7882-4b4d-b9b6-a50101375650", "comment": "Malware payload (Mirai)", "value": "b9fc430f709964aeb126fc75ecf3393da77892a31463a3b8a0d4a6e621b9484a54581a6982556a64bc8eb516ce1c7074", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708189539, "uuid": "bb926579-3907-4904-819e-e2bd0f314a67", "value": "T18AE33AC7F800DEBEF80AE33748530905B530B7D215925A37629B79BBED3A1D91427E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708189539, "uuid": "713009e5-1083-4dda-99d9-8df270213e60", "value": "3072:KwIguBb0T2UJBn9tdyRIPfrI9uVrjbiuL1jTzVyb7Z94:FIhRc/dMIrI94L1j9ybF94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708189539, "uuid": "c6b9ec4b-a805-4998-8d05-183856e53183", "value": 157024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708189539, "uuid": "1e30dd43-c241-4731-a852-fae609d71563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708189539, "uuid": "3c4ed33f-bf72-4ed6-8960-2abe27ea5acf", "value": "2c31f8dd1aeeefd910d7cea32ef51b17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e34e0fa-cda2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708180828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180828, "uuid": "70425a1c-51fb-4ad3-919a-0045c9fe4881", "comment": "Malware payload (Mirai)", "value": "8e051d4d325b25950cfd405a8e95815b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180828, "uuid": "95301757-f532-40b3-b1a3-4c1930a7e6d5", "comment": "Malware payload (Mirai)", "value": "b3ad0f5543d3625550c7c81ed59f911fb13222716ab8fb56653234cca9e9bb77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180828, "uuid": "19337748-e05f-4aa5-860d-f420bf8e149f", "comment": "Malware payload (Mirai)", "value": "864456d2a61d85cee6fcbb8578413c160782cb7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180828, "uuid": "59d05e3c-3bde-49c6-8fe8-0a6ab495fd33", "comment": "Malware payload (Mirai)", "value": "675ccfd3d2982d6db518aef180a4aaecea1295650289b716854208db279b4430d76c4acf7970413d4b89febe1b55089a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708180828, "uuid": "27f5cbff-50c2-481e-899d-da80f7702344", "value": "T10F433B03322C0E17D9A21EB0353F06E093BFF95126E1B68A254FDB664639E7615C2F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708180828, "uuid": "7eb8e0b8-47bf-4948-bcec-a63e3d0c629d", "value": "1536:1t1JILhthQ+1r4atGKmifAKWNGaPd42+8/:1ufh/w4AK+GuP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708180828, "uuid": "f8a1973a-2239-4e56-8dda-1052690f51ca", "value": 60040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708180828, "uuid": "3c752377-c82a-437c-8372-7f3b93a4e8af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708180828, "uuid": "be7a99e0-7ab8-4c61-9606-f9abe4edc554", "value": "8e051d4d325b25950cfd405a8e95815b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab77618-cda5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708182191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182191, "uuid": "30ea510f-da2d-4335-909d-e08c471c3b63", "comment": "Malware payload", "value": "c8fd09551a47cfad8b30a6fc94fe4a1f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182191, "uuid": "de3b67e8-114e-41b1-b2c8-478aaa2f1060", "comment": "Malware payload", "value": "b3eb6322d323522dea07cef7e770dc7521cd1df21680233f003c2c0712dfe291", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182191, "uuid": "8c9041dc-4f6b-4ecc-b7cb-0254d7c4d65d", "comment": "Malware payload", "value": "ffbdf47a3558c8ab1ee82afa61b8ce008038132e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182191, "uuid": "3844d925-65f5-423f-aef8-94effd35ca6d", "comment": "Malware payload", "value": "378e804a7923cc1e2b4e0d7570133b23fd99baa747a0c5f44c9796e4e4ee8f85c87147215b29d2197bad421d3f5d24e4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182191, "uuid": "766e2e5d-46db-4d0c-b255-cd3f33280c66", "value": "T12F935BABB51F6C81C2C2C3F48FD34FA8392779708E5791F67E06133E94A65DA8854392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182191, "uuid": "aeec9cb4-931f-4e0d-9a9b-f2259546e272", "value": "1536:tYK0WV8xmsIlg2fO1KDRyOulimABsSgpgpcXV/LW:qYKxm1lrfjDRyL1Cclq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708182191, "uuid": "a25f2e1f-5983-497a-8f8c-dd8a359abb17", "value": 95984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708182191, "uuid": "f1ad5971-9195-4daa-8a58-e8e1b546cdf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182191, "uuid": "ec875a72-cb3e-44ba-b150-d2ffd6222811", "value": "b4ngl4d3shS3N941.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfce710-cdb0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708186786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186786, "uuid": "da9bd546-7a67-4ad6-afc6-031a6db40346", "comment": "Malware payload (Mirai)", "value": "ecfc72b6fd9216d4f8aebff29aca31b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186786, "uuid": "27f03b27-0b72-4065-a091-d5fd403ed4f8", "comment": "Malware payload (Mirai)", "value": "b5b94ea5eeb4006bcc3321398bddff0f44367733b1d21b8d8ff840a60310ed20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186786, "uuid": "530c2410-00b1-4a48-9500-9a750cdbded7", "comment": "Malware payload (Mirai)", "value": "392933dfb6721758c57e1d212f7ad85e5ab227c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186786, "uuid": "c4bbc29b-7408-428f-a0ef-1ab26ea35c0a", "comment": "Malware payload (Mirai)", "value": "073257ea0b840f7f43ff05cfb0b3fd049d292e3a035d1c385d1f6426fe0c1940fd22456ce84793818148562c001c4ae7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186786, "uuid": "6260d250-deb7-47bf-9698-e353890bbbdc", "value": "T1A673A9092E358F6CFB5D823697B78F219758339626E1C645E16CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186786, "uuid": "235ad956-134a-43b8-b02e-1392cca50aa7", "value": "1536:lo89L2T27mQaXcn6EyvX2aQSiIHW5VU+6Y3jfhdR2QEc8LMkSd42+T7w:lo+2TIaXIEGaZiIH0VU+6KfhdR2Hc8LM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708186786, "uuid": "c3f61fd3-627b-40c5-8d37-ac3de589ad2b", "value": 80188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708186786, "uuid": "878bd175-aeca-44aa-9402-fc4127a880ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186786, "uuid": "481ff525-764d-49be-bd0e-54a4921f7774", "value": "ecfc72b6fd9216d4f8aebff29aca31b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7707168-cd9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708179689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708179689, "uuid": "0d60f8f1-fe41-4bf7-af50-f2cf14d0ed53", "comment": "Malware payload (Mirai)", "value": "37179c749a4b7fcafd9d6109224a1226", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708179689, "uuid": "2f6e7ac9-025b-47e9-8293-d63d513ab68d", "comment": "Malware payload (Mirai)", "value": "b81e6e77782c93d128feee03808c89ba738d02748135fa28adf29274966e048f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708179689, "uuid": "6c4f7819-37fb-4ade-ba8d-6b252501c7bb", "comment": "Malware payload (Mirai)", "value": "a189e50dcea9b81421f76f80ab21abb1a847a949", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708179689, "uuid": "cb1b0eea-d583-4dc1-87aa-c9f0b38e1337", "comment": "Malware payload (Mirai)", "value": "76ddceb1d9db4043d4c01b514036d62ec12eb40f3c6bb58bf493c4917c29c98fb43f0a3a009a45e3baf4ef766a1213d6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708179689, "uuid": "6748680f-a13e-4b3f-8877-42ca8d063061", "value": "T192D33B46E7408B13C4D61B79BADB42063323AB5493DB73069928BFF43F867AE0E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708179689, "uuid": "622abd23-cc59-4601-8147-8033c8e6379c", "value": "3072:Ain4xWTagwWH6Anp69BattOy03KoP+M/9w2Gn:AC4oTavWH6Ans92S3Ko2M/98n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708179689, "uuid": "a6154da6-6976-4b2e-be35-81fc7748017a", "value": 135037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708179689, "uuid": "e632e70f-5314-4f46-b837-b0827b07f875", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708179689, "uuid": "034a9bdd-c792-4011-8732-8518c48d5eea", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a137c4-cd85-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1708168552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708168552, "uuid": "815b35c0-1f3e-4cf8-ba59-458d7b985a79", "comment": "Malware payload (LummaStealer)", "value": "ab1f0e93b1b6575e0db40d904078a940", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708168552, "uuid": "72a36017-34e0-4774-8310-167913413f6a", "comment": "Malware payload (LummaStealer)", "value": "ba7b7882b51f9d1fa150b7d63b1b04d60a461623be25bb5318887536a8af15e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708168552, "uuid": "d741c46e-1410-4ee7-acf1-db18fbeaf140", "comment": "Malware payload (LummaStealer)", "value": "350be689016495d2de296801f2b0490110595a6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708168552, "uuid": "1c498f46-bd6f-4057-a91d-1c43ababc83f", "comment": "Malware payload (LummaStealer)", "value": "269dba2cfd61ec50807c7e2b86330782d72979601efa6ba44513fdf4be42a350d6cf4d7baa8eb7526017eb87af611832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708168552, "uuid": "aae18bc5-125d-4e19-9f9e-5b426bd1ad07", "value": "T1D85633D33704D4D5C0658AB2095ED1E502A93E3EA9B5407ABA1F7BCDC7310DCAF98BA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708168552, "uuid": "6af2867c-47a2-4a0f-bff8-06aa685b323e", "value": "49b6343a7e296cc33dfa349b97649cac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708168552, "uuid": "f173e45b-93c1-4215-911e-2f35462ef363", "value": "98304:PLYyArRU+pKIYF3Wsh3zaVzMI5VAIU4hss+EaNJ5vuaPEWCNSbTwbCH7:PJArvpK5eVIAu4EtvLEWnbTweb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708168552, "uuid": "3e8a1f25-0f8c-48f8-b06e-6980ddc57292", "value": 6262450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708168552, "uuid": "5134068f-f8bf-45b2-8d5b-68daf79f3102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708168552, "uuid": "21ba2326-6b7a-47c8-a221-62af7b7ee977", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02857756-cde5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708209396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708209396, "uuid": "10bfc72a-5369-4d1b-bde1-53b932c22dc7", "comment": "Malware payload (Mirai)", "value": "0dd43e1fa22c2eab669c025815702ec2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708209396, "uuid": "c8fdfccd-4f57-4f92-86a1-7a9af474ac51", "comment": "Malware payload (Mirai)", "value": "bacd3c368135ac2d160a5a4fc2d5479500607f3065199157305701f0cacffc31", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708209396, "uuid": "5dbc8dbf-4a9a-4a76-adcd-1e4f66ae12ad", "comment": "Malware payload (Mirai)", "value": "28bb0f3c44c94c1e177752f337074ee0acd22677", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708209396, "uuid": "1824a316-7957-4bc1-9624-1072c572c226", "comment": "Malware payload (Mirai)", "value": "e674f4653364a540952098b624213565c810dc8d227dcf837fb3c0ae2f94a9f53b4f4228f931aa85b1bb94c253c618fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708209396, "uuid": "bf08354a-067a-4479-9531-21934f723dc2", "value": "T150042A46EA404B13C0D727B9FADF424633239B9497E773069528AFB43F8679E4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708209396, "uuid": "077b1631-7077-47d0-861a-22d76abe690b", "value": "3072:8xbCWipkFzcGXIvaYrfB7XM8cgUCBI0UPrrboTM/RFIS:8xfFFzbYvaYrfB7XDBBLUPHETM/R/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708209396, "uuid": "85e72cd4-3dca-4434-b86b-89ff26b8557a", "value": 183944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708209396, "uuid": "da0a7d63-f79d-4731-ae98-1dc6c6f51c05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708209396, "uuid": "2282b394-8d03-423e-b11f-5a93c929cc5b", "value": "most-arm7-20240217-2236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049c2302-cd88-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708169457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169457, "uuid": "125654f0-ce62-4b57-b041-fe3b78871c38", "comment": "Malware payload", "value": "cbbb102d00e1aa853b2938e12564abce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169457, "uuid": "55a263eb-c4f9-4383-ae08-d99a28666cbe", "comment": "Malware payload", "value": "be98e12e90cae9c29bcda08c0e10e4b08d7e85c7f4c7bc795458e790f34c729a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169457, "uuid": "529daf91-1bc6-4ae9-851e-cb213eb73484", "comment": "Malware payload", "value": "c05a16c8771f442a84a1f0ea5dae27288d70d943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169457, "uuid": "7386bc45-c461-4276-a192-7b92e513e88f", "comment": "Malware payload", "value": "8755a81a96c56d705a6f0be7e54e215b5fb4b1cd71c69ee64af9237d4f8b22f07045da568566479eda1f36a0a985f996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169457, "uuid": "c762024b-d03b-4b65-875d-826485d1aee6", "value": "T126D49F21F5C68036C2B323B19E7EF76A963D79361336D29727C82D315EA05816B39723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169457, "uuid": "b97aa33c-ed21-4d31-a899-5789cc93d137", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169457, "uuid": "be457c7d-e12a-4a51-92c9-b9e3d95ea684", "value": "12288:khkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a/uT1l:8RmJkcoQricOIQxiZY1ia/Uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708169457, "uuid": "2c0bbc11-0f58-46a3-a096-0b27c57932ac", "value": 650319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708169457, "uuid": "d347ce2f-0dcf-45fd-a011-a8ec63836848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169457, "uuid": "b41d7405-a028-47e9-af2a-34b05065b65b", "value": "SecuriteInfo.com.W32.Autoit.AOZ.gen.Eldorado.20531.15511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ffd42e-cd63-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1708153801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708153801, "uuid": "18a69fa8-3abf-4523-a7c3-2198a2bda750", "comment": "Malware payload (Adware.Generic)", "value": "961f71d71587ab5f89166ee62ec773c3", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708153801, "uuid": "743e7b3f-dca3-403c-9017-b16c85c22911", "comment": "Malware payload (Adware.Generic)", "value": "c21742a2fb1f94f246e628c4b520d59ef53c226a88d776b1c972f3f3d40ad0f4", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708153801, "uuid": "5d3d06b6-3aa2-4201-a7a5-db9a6954304e", "comment": "Malware payload (Adware.Generic)", "value": "0628e6be65bbed914454b316354e8f16e99441b7", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708153801, "uuid": "52971dce-159b-4090-a8d9-645be7de14df", "comment": "Malware payload (Adware.Generic)", "value": "537eeeffdd2e15696b5d87ae9a688c26cb6fb9a16e23f1db2bec2a240beb3b0646dae160004b3eec7daece9d478e01fc", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708153801, "uuid": "36d2f1ed-b448-4f2d-82e1-58ca4e7d024f", "value": "T11527333FF228953EC46E6632057393105A77BA62681A8C5B47FC794DCF3A4701E3BA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708153801, "uuid": "60f5761a-9b87-46ef-a784-f1db42fac80b", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708153801, "uuid": "a023630d-0421-459c-8cfe-2a12a85ec0e9", "value": "393216:4ag7GQXT47uUGz75m53XFGoxchXrv6E9zUZIf2xIryYMo9ir:MKKTG0f5MF3xyX26gZIux88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708153801, "uuid": "a38c8a47-387a-45c0-978a-c1b5c5039424", "value": 21205992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708153801, "uuid": "e462ed4c-2f11-4df1-9fef-feca14669da7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708153801, "uuid": "e6ee862a-fa09-41a4-a092-313f2ecc740e", "value": "bid_6_40_setup_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc3a877-cd92-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1708174113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174113, "uuid": "74c3f4b2-5610-4be7-8af0-adbc95b86765", "comment": "Malware payload (LummaStealer)", "value": "6e6f98b7ccbec911e2491211590c559f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174113, "uuid": "094854f5-1fa1-46d1-9019-345b8b74cb74", "comment": "Malware payload (LummaStealer)", "value": "c67fe4029e318e3730fa59f53c183a59623b544dc1abe05f0255312d9654542a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174113, "uuid": "321b3aef-2d8f-420d-bb40-ce9a9ff2e159", "comment": "Malware payload (LummaStealer)", "value": "7575deca6c4bdfd2dca8b2395eb6bf45e8dd8285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708174113, "uuid": "fcba8dda-d448-4584-ae24-a630f2e092dc", "comment": "Malware payload (LummaStealer)", "value": "6becfd1614f93fe78d90faac4cf72f383a97ef6085ea4f6b14eaea5a09916cfddc10cb6325b250899690dc5e0be82196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708174113, "uuid": "2c49eefb-496b-439e-8922-c63cabe7daa9", "value": "T107566A17FC9105E5C0ED9235896B9652BB217C484B3067D72BA0FB283F76BC4AEB9704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708174113, "uuid": "388348bb-9938-4dc9-88fd-4831f01369be", "value": "c595f1660e1a3c84f4d9b0761d23cd7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708174113, "uuid": "67d54198-7c69-4444-b247-aba93feecf82", "value": "49152:RwZNnLotbLMc1bogf9BOlkEeY1mbGzbUbhkEyjrZZejO5E5FxPMmwfluMGd+f89h:RUmbZpFINeYkh0EBMjQyz3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708174113, "uuid": "f8ad279a-37cc-4ef5-80fe-52c341db5cff", "value": 6149120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708174113, "uuid": "3f3b6f46-72f6-4eb4-a751-910807703d84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708174113, "uuid": "42426c4a-5b85-4b30-94c7-2f6e62fa1a31", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e7d4be-cd88-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708169455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169455, "uuid": "b9ac69eb-251a-4c55-9c69-e1f427ab324c", "comment": "Malware payload", "value": "61b6a41943a8c56fb75606e6864b5bb4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169455, "uuid": "b8a0d384-3575-4ef8-b0f9-7e906c046e4f", "comment": "Malware payload", "value": "c6b009e6c1342c48aafe38bfaa42d1d3bbd12da84bd18c3bd745749667824cf5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169455, "uuid": "35d0228a-d825-483b-aa3c-6db8812c1663", "comment": "Malware payload", "value": "452415a81156e8d1c5084015498eb0e431a129b6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708169455, "uuid": "7793567e-4e84-477b-a7ba-637cd1abbfac", "comment": "Malware payload", "value": "2bb9675adb4f156ac8a8941b49aae4055be326aff9d47b4b4f3290db968ed2c3ea1d94c2e94c2e3139a90c96fe6dbb28", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169455, "uuid": "dd09a639-c009-4e0a-8955-234dfccccf2c", "value": "T150444A3F38B9FCD2CC0859335DF27BD0A96198134C958A4F6A58664CA873181ED63EF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169455, "uuid": "2cfd2a70-68b6-40b8-8a74-a2c63334725f", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169455, "uuid": "5eb0d1c6-7ca8-4189-b2df-c3078b008d91", "value": "3072:9GSa2bPoHnMKIob7qRdNCKWKGxkZVVCoJsBrJbLMVSMdFGQzMDKmeQocFP8vviYQ:0NMKcdNM2VCCsDWMDuo8vvymCv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708169455, "uuid": "176d3076-c2f0-4575-a047-7b85ab629ea4", "value": 266373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708169455, "uuid": "c87e297e-0eb2-403c-9a06-ed0cf374ed37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708169455, "uuid": "1746c4b2-c041-44b7-948c-9511325fa7e2", "value": "SecuriteInfo.com.Trojan.Win32.20680.24765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62250726-cd95-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708175197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175197, "uuid": "10fa77bb-a86a-4b63-945f-a35731966a64", "comment": "Malware payload (Mirai)", "value": "092c3a5d8a0ae9c56f629c1edf314180", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175197, "uuid": "220b7424-8e35-4d8c-8f15-823c8eceb284", "comment": "Malware payload (Mirai)", "value": "cbe2f1d203d33154fd59d124b6405fd0388b26c84ca106e74e33c41eaff1070c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175197, "uuid": "559c1838-9a1b-41a2-825a-3a1248197e60", "comment": "Malware payload (Mirai)", "value": "d02ff2976c5b30aa5a03d19f764cdd46d9db5144", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175197, "uuid": "d8a49803-525f-4d07-bdc5-8f9337e6217b", "comment": "Malware payload (Mirai)", "value": "5c31e54d4f09a7edd2571812a39139becd3607897fd2fb2aae4f89d69a371a5dab7dff0d96af492aa301439b19d13484", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175197, "uuid": "498ab7f3-75be-490d-ab0e-76191bc1401c", "value": "T1BA031992B8825A6BC2D013B5B66E619E3361B3F8C2CF722BCD105B14BB8951F1D77B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175197, "uuid": "0f8217f9-a798-42e6-9f53-a73b0543caf6", "value": "768:6bDfEJed8ZlXV+8T8hcLT6PD9fXiqG6lDUv6GzmIJoBPPPwR:uvKZBVJT2fXbtUvPmIvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708175197, "uuid": "14e508db-45c4-41b6-8434-90f94ad0e476", "value": 39292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708175197, "uuid": "323d3fb6-8e05-440b-9980-f9834c1a1d6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175197, "uuid": "37485908-f89d-4a86-a268-566f07fa5e37", "value": "092c3a5d8a0ae9c56f629c1edf314180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52859354-cd95-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708175171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175171, "uuid": "647e5f7f-9dc0-4819-afa1-8f4721ef1f7a", "comment": "Malware payload (Mirai)", "value": "eb7bc9ec7543219abfe6419bb51b7a16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175171, "uuid": "8e58516b-1c12-427f-8547-1e3a8394c4e7", "comment": "Malware payload (Mirai)", "value": "cc94f88c1578f7fb7f1dd23ef248ef18f3d9027ea7b107d25bf31a3742f6513c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175171, "uuid": "f0e14d1d-a8dd-4f56-b574-0768930d6066", "comment": "Malware payload (Mirai)", "value": "a1debc4751ad8140e8540d89454a07201ef1dcc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175171, "uuid": "85c66807-6948-430a-b69f-9c39ab57906c", "comment": "Malware payload (Mirai)", "value": "751fa37283e0df94afa54de7e91a0d2df1832823eeb767475db2324cc383cd41e0a0bdfd600a0da1f9a602cba7eec9b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175171, "uuid": "f2923c70-f055-43cd-a597-e97bd94ef727", "value": "T1502318C1F54B84FAD05B493060A2F23FCB32E42951B19A6DEF8A9E75DE67641921238C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175171, "uuid": "52289e20-cc9c-4586-ade0-cc1845ac356e", "value": "768:TpBv9XzfKPdUIzq8FKDNeMNHB4g/kVtKrcn88WEol8qeiJYK1/ssI:TD9jLIzTIwMNhpSN88doeiJxCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708175171, "uuid": "40485337-2487-464e-9b4c-245d0bee637f", "value": 47856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708175171, "uuid": "cb462fdd-6453-4015-bca8-2d20eb0f1b8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175171, "uuid": "9bbad848-6d4f-473b-8050-f9ba75cc7df1", "value": "eb7bc9ec7543219abfe6419bb51b7a16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc8cacb-cdb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708188638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188638, "uuid": "d5c3b294-c281-42dd-b43b-64a94f41674e", "comment": "Malware payload (Mirai)", "value": "314c928614a86e35204c1f1129923f64", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188638, "uuid": "e5083984-7b06-4777-ae5e-c3130a2aa633", "comment": "Malware payload (Mirai)", "value": "cf476320b9842d795a1480670f98b26eb6f316ffc78b621763ffbf2b319251da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188638, "uuid": "5fa0ed8a-ed89-4499-b3e8-b0a859e0ad2c", "comment": "Malware payload (Mirai)", "value": "445aee438affc129a19ae2129e9bba16c4b1327b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188638, "uuid": "1ad1250a-5c47-4bf3-a55d-5dbdbf5d10da", "comment": "Malware payload (Mirai)", "value": "6449016ee27cc15a635f2259ec26b67e34ed0cf94b558197ef59cfbbfc8fb17123d641b73f6457ecddc487d9ece5bd55", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188638, "uuid": "9eead954-37cb-4b5a-a913-0ecdaf2238ce", "value": "T11D042A46EA404B13C0D72779F6DF42453323ABA497EB73069528AFB43F8779E4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188638, "uuid": "f0054ef6-7bfe-4769-bb02-628d13264974", "value": "3072:8l4pCF3Br8cwhyma0ttqko6A4T/bBXUyTVRMo8M/RWAW3r:I4cBr8Rsma0ttqko1GBkyTbR8M/RTW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708188638, "uuid": "2e2152e6-53f4-4ce1-ad81-8f68dfdc5e33", "value": 187661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708188638, "uuid": "88282fa9-8f0b-4aab-b66f-9efedf9af150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188638, "uuid": "a8740d5e-1931-4692-a098-3f1dd278bfc1", "value": "bulu.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3c257f-cd44-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708140556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140556, "uuid": "da33a318-de63-42e3-985a-814ce557abf9", "comment": "Malware payload", "value": "02296241caf4a6d4248180e0012aa37e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140556, "uuid": "2e9e4775-fc1e-493f-a299-b69b617af9e7", "comment": "Malware payload", "value": "d00db649fb58e9c282549136c18b3b15d7007164968ac2cbb1e2f86f578d6280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140556, "uuid": "7cda2ad2-a02b-4c0a-af75-e6a3da063b25", "comment": "Malware payload", "value": "16a63f2682624f8b36925e84a7aaf41085535dcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140556, "uuid": "4f6e3250-f384-4801-8431-88c066034105", "comment": "Malware payload", "value": "2898a4afe11120a20e4de3d4bce87a99cefba8352ebbcb371119965c802251054fae5dd60fd0e507ad0aaa4550476854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140556, "uuid": "8ef7fc39-2be0-4caa-8af3-f45b49d21f9b", "value": "T1C4C733BBE19BC7BFC45404719644F70C562A382512C54ECBE2CAD9BF26BBAC35A30D58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140556, "uuid": "e8de727a-8a72-45d4-a162-cd4c2841aa60", "value": "bcd9b900dca2824f3e88e56b12ad4263", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140556, "uuid": "8e72ccd9-22d1-48a2-a7e2-d73e4a5db8e7", "value": "786432:X83UM9LH9bK5ydn/Q9MuBJhvQ37XwFxFP0VTb7dNRprl+KwK/yaxrdcPeNPKXu:s3dLH9TUBJhQrXwF437teKMgCPOPKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708140556, "uuid": "5098e792-a9b3-4b7a-a87b-f86739687d7c", "value": 55523952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708140556, "uuid": "b2958fa4-a9b8-401d-a015-f80f612d8f18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140556, "uuid": "2f19add3-4332-410a-bf26-c36dc3b33411", "value": "SecuriteInfo.com.Heur.11421.5882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c18f09-cd9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708178713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708178713, "uuid": "246e4ade-46c0-4bc8-a8b5-42b1ae499756", "comment": "Malware payload (RedLineStealer)", "value": "c94596d2dd331b02a3bdf89a8a528880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708178713, "uuid": "e1f516d2-d449-4407-bb9d-8184cca66943", "comment": "Malware payload (RedLineStealer)", "value": "d19a0d180f6f962ea912480c752eafe875eb2d869bc4214e4304c6ea3c525ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708178713, "uuid": "969aacdc-8ce2-4fac-92c6-4b6317d8d3eb", "comment": "Malware payload (RedLineStealer)", "value": "fa42da7569f0baf01185969915372c068f80d926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708178713, "uuid": "1848c7e7-c0c6-4000-b2a4-0aae77b4662f", "comment": "Malware payload (RedLineStealer)", "value": "4bf73d0c9de5f533a5f7a408b02aaad6a736f29c10d3e6af171bc900a5e066bffcc7e574827b76edead2e680cc35406c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708178713, "uuid": "2672c05d-478e-41bb-ba03-3c31811669f5", "value": "T1FDE533563BE535BAF0FA78B264D82B656FFCE41CCF8200D7E79844499C221C196712DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708178713, "uuid": "81e23fd3-f99a-48ff-a936-9dcbd90ddbfa", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708178713, "uuid": "dbc22b97-2ade-4260-af4a-ad99b56c9885", "value": "49152:t/5oiXZgc3ZLp7PXi19L2xjNlQH/OaZc6mwkD75TwXNElsBLtRgJjOv+7p4:t/5jXZg49oLcN+Hm7AElMLJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708178713, "uuid": "5c965c1b-3eec-440c-8fe8-d7faf296f8c1", "value": 3296480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708178713, "uuid": "991bc5d5-65b4-4802-9010-e77b92c1552f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708178713, "uuid": "54d6c6f4-cf00-4a97-ad00-d7039cf6f0e0", "value": "C94596D2DD331B02A3BDF89A8A528880.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206a2da8-cdd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708203004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708203004, "uuid": "2c609618-7c79-4625-afde-9f684bda735d", "comment": "Malware payload (Mirai)", "value": "1d9768de015834a78ba323e0e6c3ded1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708203004, "uuid": "e55aecff-82e8-4522-9684-4e27a036a36b", "comment": "Malware payload (Mirai)", "value": "d415cbae8e6ba03fd6ab3a91647f2df06123f5568429a936f4bd36f9a837e8ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708203004, "uuid": "9e4fd6fe-16bb-40c1-83a8-f4fd1f1a6823", "comment": "Malware payload (Mirai)", "value": "6fd29166bfb61609f3a91fe7694516f38410f39e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708203004, "uuid": "d638c1ca-57f3-48e1-aa03-652ef08717f5", "comment": "Malware payload (Mirai)", "value": "555d9d0239a02588256137a5d117d107d036575d0b3420d735e025938c3c543d33a7def0506f2c6cfa793f1acec6149c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708203004, "uuid": "152429bb-2bae-4e01-b44f-959f6252f6c9", "value": "T117634BC8A593F8F5EC000A383177AB719AB7F53F6139EE97E7A85523EC41602900269D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708203004, "uuid": "8bc41cc3-d7a4-40ec-891a-5169b4972275", "value": "1536:dt/lTQT7GPYmueXqVXJmB72MFnKiaILO2418HR0jWzvOijgVzOun/a0t:n/lkT7W+6wXJmt2MFnKWL/4CHRjQv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708203004, "uuid": "9d973c88-19ae-4a7b-a9a5-7391383ea4ff", "value": 70512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708203004, "uuid": "39857abe-6734-4ff1-8fa5-ae00ca04918d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708203004, "uuid": "1469e7a3-b69f-4ad4-aa90-13ae4dd94fcd", "value": "nullnet_load.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cac1eb2-cd4d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708144210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708144210, "uuid": "887afc82-b54f-4163-bf3a-7d4840d71f53", "comment": "Malware payload (Gafgyt)", "value": "cd5d9feffa72d2284ba765795b6bf642", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708144210, "uuid": "28f2f36c-0e2d-4e88-9757-dda95c94c382", "comment": "Malware payload (Gafgyt)", "value": "d4715c16ce84d57b0457d6bdfbb7acae5ed716ecfffdf9ac2e0323abd5337153", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708144210, "uuid": "c68871ee-cce0-4535-885a-35ac9400ae0e", "comment": "Malware payload (Gafgyt)", "value": "6661857e508c9c35d90d6a71d114c80bbea6b42f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708144210, "uuid": "e5f20be3-6c4d-4ec9-b47e-61ed746beeeb", "comment": "Malware payload (Gafgyt)", "value": "2e3666573a8e6f81c504fdc0f367981621945399b8532d4860b01e00e5c6694dfed75eb72d4b887fbbc0962123b7bffa", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708144210, "uuid": "304386c2-60bc-49b6-99bb-028fc47a7ace", "value": "T175935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708144210, "uuid": "04732429-9ef6-4ceb-8b43-b09ac280f81a", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3ByPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKRifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708144210, "uuid": "83d87e3a-dd94-4e5f-8b32-c72390a10f83", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708144210, "uuid": "68f9a950-b56a-4abf-aa7f-f33fb28b6a19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708144210, "uuid": "384c44b4-1a2a-4ce3-a6e0-3ba74d0fb70e", "value": "cd5d9feffa72d2284ba765795b6bf642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e09c01-cda5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708182188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182188, "uuid": "704383f0-c23c-4841-867e-de33753135a4", "comment": "Malware payload", "value": "5b545d6067f11292b73875924308330e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182188, "uuid": "bfe522be-8b52-407a-b928-5228d9e8aadd", "comment": "Malware payload", "value": "d673f70daa6508e5435a5fd619d4fc27435970d2b053715f1e51d754480b6223", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182188, "uuid": "03b46016-5ee6-4563-a03f-f652390701c5", "comment": "Malware payload", "value": "3cddbe70184d3cc47abf77169e3907fbefd3b74b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182188, "uuid": "71d77316-3d2d-45de-a91a-fccff8eec11b", "comment": "Malware payload", "value": "be874d15284cecf66fa22776e30f6bcf1e5c1d96dd0c8dcbc3bc9af5a23bc40e0ea0b91cfa851940da850fd4cbd1f4ab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182188, "uuid": "e04a6764-3e55-4eff-a889-a6fb76595c63", "value": "T1B153744CAFA14EFBE8ABDC3745E9174628CD952622B83FB5B934D428F20A14F15D3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182188, "uuid": "73153101-2328-4aff-81c1-aee35714cd78", "value": "1536:HeNJS+8i5qWn3KaztX/AK462zjJ8dOqxD05ZQe+c/:+NJ4iAoVWY05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708182188, "uuid": "750ac4aa-d6f5-4845-b903-0c41c6fae64f", "value": 63932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708182188, "uuid": "b0d5e98b-76ce-428e-95ad-cd6e290b6fff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182188, "uuid": "60d08367-b1f0-4bed-bb92-dabe009e8584", "value": "b4ngl4d3shS3N941.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3bb3e2-cd4c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708143945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143945, "uuid": "74d6e5d2-ea5d-4c74-ae4c-cf69e2b8ed91", "comment": "Malware payload (AgentTesla)", "value": "6bb6023d672f8817aebd54a3e54c82e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143945, "uuid": "64e253e9-3c3a-41c0-9043-668f0a4c476c", "comment": "Malware payload (AgentTesla)", "value": "d69af24cb696c4e9de1910acdbced3b8f912e61591c0308a8de7fd798b86ecea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143945, "uuid": "0e4e34b5-49ce-4ed2-8e41-ef5b1814e7e2", "comment": "Malware payload (AgentTesla)", "value": "8060d4863cefd3ad6334c20b7230b739a2038db0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143945, "uuid": "73aab58e-c66c-406a-8270-6a7d86625023", "comment": "Malware payload (AgentTesla)", "value": "85c8134cb9b97c4366b979fe6141c78260f0a2d63aa45d730c5f9d7042677ad287852d0c4d5479ca12b78aeee497de39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143945, "uuid": "4540f0af-4125-43ea-9c61-bc4e2480ecd0", "value": "T1A7257B15609D42A1CC73A2BB4D69E79E6A385C2512A1DF5FDE843E204A7F3C1163F2B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143945, "uuid": "466ba243-fbef-492a-b75c-c7a8664303b0", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143945, "uuid": "812d9208-75d4-4a3f-a146-333afdaa0b91", "value": "12288:IhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4az6ooSVYQxRS4XqJcFSEaF:wRmJkcoQricOIQxiZY1iazbUQxUJJuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708143945, "uuid": "15516a89-059e-4fbd-8f8c-dfc4f8b8b593", "value": 1045407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708143945, "uuid": "7a6efc08-889e-4a1d-ac4c-082f8b686880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143945, "uuid": "58e62b3d-84cd-4574-ac81-d391e0e32939", "value": "6bb6023d672f8817aebd54a3e54c82e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09dd153-cda9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708183972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183972, "uuid": "69cd7254-415a-4410-8e69-6864c462c762", "comment": "Malware payload (Mirai)", "value": "1fd4120072c2d075bcb9348bb1c3be9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183972, "uuid": "be73f685-6ff9-477b-b938-801fcb26d975", "comment": "Malware payload (Mirai)", "value": "d9da39511afcbc7d6569c9b4decea3504fe85cfce8b149454252bd5f8e6eb9b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183972, "uuid": "e4a81da9-def6-40f5-b4f8-e72d35a6c4c9", "comment": "Malware payload (Mirai)", "value": "cba35cf13fa9414eabe5ed7ffbb0172a96da1581", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708183972, "uuid": "3c9869b1-ffb2-4478-9dde-6b27d4495299", "comment": "Malware payload (Mirai)", "value": "ffee6c663c286218dddc9559c41be152d37954d6e1fc744838cc7be0dbee7144c902c852e6843271375faed34e52fb23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708183972, "uuid": "26759d43-374a-46c7-a6c4-8ca0f67cb8d7", "value": "T11A3329D6B400AD7DFC6FEB7A4423490EB621762540A31B737373BE53AD321A46A2BD05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708183972, "uuid": "5fde4b1e-0c3a-455b-bc11-8be8fd40fcb5", "value": "1536:RATsxP+V+nP6Y3IKo1Gt3i+KpxECrtrN5B8Sd:R98ki+C+2rzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708183972, "uuid": "66ca97d3-1855-4a1d-a550-b29d0618fe3f", "value": 50340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708183972, "uuid": "12041410-568a-47ae-8b7b-fd877649d838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708183972, "uuid": "16561a4a-17e8-48a0-96aa-10bd2aca65c2", "value": "1fd4120072c2d075bcb9348bb1c3be9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ff95a7-cdb0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708186770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186770, "uuid": "97c01bb3-03c8-42f5-b22d-0dba190e67e4", "comment": "Malware payload (Mirai)", "value": "65e72d51517146927dd5f56d28dc5ade", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186770, "uuid": "756e2e1e-d705-451a-982c-5968facaeb6c", "comment": "Malware payload (Mirai)", "value": "dc61f5c0b16bed563ff660d516937795ab1a70503684a13c02c510b0e0b97f92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186770, "uuid": "c57916d4-4d34-4013-a1cf-b39200eed00b", "comment": "Malware payload (Mirai)", "value": "eadfe41c8c935830860eb97e4a2c28b9fd10cb78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186770, "uuid": "7e8707bf-fa4c-4d96-8fa9-d77926f5584a", "comment": "Malware payload (Mirai)", "value": "d823a395969d69c0ed6c7a5fe71a3f49c3bb9cade819a1b1c9742ae8f536626f1beb270650cae257e8b75289b8cea0f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186770, "uuid": "74552c4c-04fb-4213-98b2-1a952da9f666", "value": "T1F8532D97A401AD3CFC5BEABD40121A19F9213A3065B30F2B9797FC939C322A65D1BD41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186770, "uuid": "5da27dc4-5d9d-40fd-bfa6-5b112f4f66f5", "value": "768:Cez+KJpwvt5mSGesAb6C15uIS4N1ux8yXziCMlqXxmiPXq5ht:CQvsvt51GLAb6SA4NUx8yXpqq4iPQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708186770, "uuid": "1b4d8163-ba82-4326-bcb0-32e0b6fb556f", "value": 61428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708186770, "uuid": "c915f6cd-2421-4301-8fc9-94add8f199f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186770, "uuid": "ec823d0a-2c05-401b-aacc-e3cad79e14e8", "value": "65e72d51517146927dd5f56d28dc5ade", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4a3a93-cda5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708182195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182195, "uuid": "d3ac4789-d623-4d45-b393-5a081c2ce161", "comment": "Malware payload", "value": "417378d18fb7c9df831f7b182fb4ac9f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182195, "uuid": "b4922891-1b8f-41b4-9559-d33a1411c98a", "comment": "Malware payload", "value": "dfa1151bb7c5defd60a86df95ae010c9e58b325ef6585a162590c1f29787bc32", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182195, "uuid": "ff4cbbdd-60ad-4360-8113-607577667fd5", "comment": "Malware payload", "value": "52074ae8a9c2f6a38c160a112effa1aad40cbf3d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182195, "uuid": "ef68b533-7976-43a2-aeac-1f76c18cacc9", "comment": "Malware payload", "value": "d9e0753321a66fe59cd91b06ae9681878c6360662fa97e6146e0355107a6002365948d3ba99b7afd7b9e975bdfc3d1cc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182195, "uuid": "496bb4d6-13cd-46a7-b298-dcd20988fa65", "value": "T1A9232996BD91CF02C9D4A277BA1E029D3B166398E2EF33039D156F61738782E0E77146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182195, "uuid": "8706c21b-893d-495b-ba62-a55cff0ac698", "value": "768:wF/gizitgCz6L9/mQZvqPQm2BWECC9RPyWKn3Op7BNOrGnDNSP51vio:K4izWgDzZa52BDAjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708182195, "uuid": "843060ce-2deb-47cc-928a-4781ef47b0bc", "value": 46480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708182195, "uuid": "c2ac3899-d36f-4793-94e8-b94fd0c00df1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182195, "uuid": "82dea4e4-49c4-437c-9ee8-4a7f739369be", "value": "b4ngl4d3shS3N941.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d870d3-cd9b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708177805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708177805, "uuid": "78bc9d3f-677f-44cf-8a30-a6caebafcfd3", "comment": "Malware payload", "value": "f67790441941079c1b2a5b9f41596150", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708177805, "uuid": "cbadd7a6-8e55-4c27-bc54-dfaf43caed5b", "comment": "Malware payload", "value": "e5bbe941b4a13ba9db4730935f5bdfca341c86897eb25dea4859f26822d47d55", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708177805, "uuid": "955de365-8eb1-428a-972a-d2db31a81241", "comment": "Malware payload", "value": "ae544c76da79811a9bedbf85bb2e6ba89d8b61e1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708177805, "uuid": "6dea47a6-a32a-4a47-aa06-9f9414ab63ef", "comment": "Malware payload", "value": "9a8991b8260386ebe93314d5a75bb4d60fcbcd368cd1ef49ee613e8144b25f66b9518ad135fc115635cd7bb61c4feef3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708177805, "uuid": "2641d4bf-3e29-4578-9ab7-c465a733a0d9", "value": "T1C73329C4E943DDF8EC5115712067EB328776F13B1029EA87E7ACA623BC86B41E44729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708177805, "uuid": "8b097290-6128-4519-82a2-408c43cab9b6", "value": "1536:O13kynNjv6czSEZeLmI37KNCgoTTIkvQz6Nsw2RAvah50Q:AUyntv6cuEZ437KAgoHIkveaswiND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708177805, "uuid": "a3013ef4-32ea-457c-bef7-9f2dcc8d4a65", "value": 54864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708177805, "uuid": "780bcb82-ffd2-4f64-bba5-8be8ba131432", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708177805, "uuid": "0903f2eb-544e-48c3-a2e6-3340ea0fe9d4", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81267fb4-cda2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708180833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180833, "uuid": "d2e4925e-cca5-4a5c-8737-3592886e4b41", "comment": "Malware payload (Mirai)", "value": "a696fb12348ef1dbc89927153ff3b8aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180833, "uuid": "c9eb7fb1-74d7-4393-b734-c2a567a49fdb", "comment": "Malware payload (Mirai)", "value": "e8e14e75307687fc3463d7f55af88d0e12561e1fc542cfc88320fded7f398bc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180833, "uuid": "8ad0e75f-8bb1-43e1-a4ee-165cdbaf478c", "comment": "Malware payload (Mirai)", "value": "eb62b1f14752c0e63b1bfc102935390720ef14ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708180833, "uuid": "8c96e426-b58c-45ec-9f44-32b7d2144bd2", "comment": "Malware payload (Mirai)", "value": "8b513004d0b943fbe77fd274e45df8208b82b96e0ea21a343a1f09910d1adb168bc444d87b4c0cfbb0d510f1a536ec59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708180833, "uuid": "300e5b58-ec9f-4802-a18f-e2693481676d", "value": "T14B534C96B801AD3CFD1BF7BA40121B19FA213B7415A30F2BA797FC939C321A69D16D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708180833, "uuid": "80555a61-f1e4-4ffb-8de1-9fe7291498a1", "value": "768:neT+6JhUvtNaEVGyXXltK2x9+bilvN1ul8yXLyCIlqXxXv2XWFFh:nInQvtNFGyXX7KexlNUl8yXx2qBvyCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708180833, "uuid": "427576df-c1f4-4587-8642-9c7f0bcbd210", "value": 61432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708180833, "uuid": "c47a181e-6e51-468b-8bd6-799e5d4f3413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708180833, "uuid": "5e101703-9fc6-4d24-b12e-231265d7a354", "value": "a696fb12348ef1dbc89927153ff3b8aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5a122a-cdb0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708186754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186754, "uuid": "001c3706-fe33-4cc8-a322-7bfd882208aa", "comment": "Malware payload (Mirai)", "value": "e40d7429be3d13a1b5762a04951f257e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186754, "uuid": "12ab6235-ddfc-4b29-a3c1-7d3b794ac646", "comment": "Malware payload (Mirai)", "value": "ec1a49abde390b444e3cc968486496f0e9f89a2ddaea630814080fb9b69ef26c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186754, "uuid": "9f80d646-5341-42f3-b04e-358e56eb9ec6", "comment": "Malware payload (Mirai)", "value": "0d1aaba1585b5e79ac0325556d721c3f461d8c44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708186754, "uuid": "48ae0ce2-e30d-49f4-aa2b-0777beb0634e", "comment": "Malware payload (Mirai)", "value": "cb33a8abfbfdc4e4ff9bf3a15aeaa65fd45dac088d8a4be7948406f359800af0c6e1bcd8914cb35bb36237cc395b7db2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186754, "uuid": "ee2c8c60-7d49-4d4f-9442-6ea3f7ffece0", "value": "T1E6438F36C47FADA8C5448238A4214A741F63F50882A7AFFA5BC18765504BFFCF6583E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186754, "uuid": "b513cde1-1011-43a0-8288-6b1168c7f78c", "value": "1536:L7dIsToytwtd1IGGrcnQN9F53Y7ImV1CkVd42+:L71ToytcD4N5Y7ImV1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708186754, "uuid": "dbc4d9f6-a6ee-4226-9a06-755746f8eb4c", "value": 55208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708186754, "uuid": "b2f54045-88f7-4245-bde9-485ce6ba699b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708186754, "uuid": "0fb19d2d-7754-4579-8514-ed8cf575424a", "value": "e40d7429be3d13a1b5762a04951f257e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156f8621-cd96-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708175498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175498, "uuid": "86dfc085-8932-46b5-a4ad-afdde2e15fd0", "comment": "Malware payload (Mirai)", "value": "f0a30c31614d20a39b7927c4eebb42b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175498, "uuid": "fdb5391d-09ae-4bf6-b68d-70f6e44af6f3", "comment": "Malware payload (Mirai)", "value": "ec2656954bfe2f1fab504f412ecd7c82f7fe4db2e45ade010465988ea599305a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175498, "uuid": "645e1bd4-ed43-4e6c-a0a3-e2a379d1d7b2", "comment": "Malware payload (Mirai)", "value": "9fd57b920e65d5451f67ef6669ff77a014d2da36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708175498, "uuid": "fb40b3b1-c293-442c-bbc0-93ec97e9589f", "comment": "Malware payload (Mirai)", "value": "33605b3e86f9d25d0661042e66549df26be3723cb31056a93527d17530749d5bf87f0511dfd8ecadb8fb476484c814cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175498, "uuid": "b3546931-0324-4ebf-8b54-6cdca46c60f9", "value": "T11C1319B51509F26CEEF51078F48321E925920F1C37CCE2C361D395A5EEB0B88B956E2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175498, "uuid": "a3860b59-a071-4593-9cc0-8239bcd01eb2", "value": "768:930WyYnAY1XLHKYaDU/kJUND+frpAITsnlg:l00nptiaqfr0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708175498, "uuid": "ff31ada2-d48d-4cde-bee1-674a4ae0971d", "value": 42688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708175498, "uuid": "2b59c990-9968-4146-99f3-34698619dc60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708175498, "uuid": "a2c5f10a-c8c7-4f2d-a3d2-96f608783d39", "value": "f0a30c31614d20a39b7927c4eebb42b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b112e737-cdb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708188644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188644, "uuid": "d45d3182-ff1d-4bff-b1df-46f83be42e8e", "comment": "Malware payload (Mirai)", "value": "4f7f6c4ab5b55db2ebbfe407aacf888b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188644, "uuid": "b5b94373-245b-4605-865d-c9d03fa4e74b", "comment": "Malware payload (Mirai)", "value": "ee863dea004ae412cb903c84ac9affb22273d3e3f6d62c4ff03189cf09e7e1fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188644, "uuid": "ee04e487-82e8-4e44-b0f5-2856632f1591", "comment": "Malware payload (Mirai)", "value": "1c36aa08d0dd20af097dfc840c40cad6c75d964e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188644, "uuid": "0089f69c-36e5-4294-8bc9-a429808cdedc", "comment": "Malware payload (Mirai)", "value": "8261a0ca955809b39c7205d00bcc0253be2a67d5a3f642739cffa5564dfd5f8ab58d64d4122bf1136dad7d12499845e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188644, "uuid": "452a9c84-da26-46bd-9303-83f7db7e7851", "value": "T19804C81AAB550FFBDCAFCD3706E9070139CCA44722A47B3A3674D528F54A94B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188644, "uuid": "5c34fa98-80b8-4e30-869b-1e4421811cdc", "value": "3072:YJPmnsApE2klal9W0TPNTiLoUJY+JVv0J:YosApZkl6W0LNOL/ygR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708188644, "uuid": "86e7b9da-9438-484a-8c43-fc40f4deb5dd", "value": 186092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708188644, "uuid": "daa951bd-c3ad-4c99-b396-80b6061684e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188644, "uuid": "e43ecf77-ef32-4b3d-918b-7a729c759c54", "value": "bulu.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd71067-cd6e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708158305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708158305, "uuid": "115e416c-3c5e-4071-ab23-46dd80d0ddfe", "comment": "Malware payload", "value": "011e4c8d4716feb9ca917e4fa5efa95d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708158305, "uuid": "e974e2f2-9471-40e4-ac59-af725d3c689f", "comment": "Malware payload", "value": "eef1a8cc4c67c27af7143f564aa2d91ad8a6f8f6e30d767e0f6546008b5c9b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708158305, "uuid": "4a4e6360-da83-4317-b271-15cc74b849f4", "comment": "Malware payload", "value": "4a06c7682bd94c083208306635d542fc61ef8717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708158305, "uuid": "61ed6d9b-9002-4a6d-a291-3cc92c5655df", "comment": "Malware payload", "value": "64ced43ee62d1d9393057f88f98152e3272ddb0ba1115e01a3d5fa106a2252c7da7168b56ee7cf96fa78f991c6c7a597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708158305, "uuid": "3f7e857f-2798-4e14-bdbe-1a69475a62d5", "value": "T1515612EE6248339CC01EC838D433FD58B5B2512F0EFA95B971DB76D0679B521D682B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708158305, "uuid": "0dd25271-d202-405d-94d8-98302b2dbbaa", "value": "2d99b23b0bab8b0fca14bb2a3b2a08d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708158305, "uuid": "00c26f0c-9134-4a0a-93c9-3f8c913f5d4b", "value": "98304:O8DqHX3X8KvRCQPRU8YLRk1vC7hyKtv+W/1SAZEQFLU:O8DqHXdpPuRlQvC7EyZ/1HEoLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708158305, "uuid": "5d01d011-8283-43ab-b5ce-0dc1af7c378d", "value": 6411776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708158305, "uuid": "8e4800d8-c4e9-4734-a15d-00e7223d55bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708158305, "uuid": "dad56f11-6353-4bc8-83ac-945f9c797a83", "value": "SecuriteInfo.com.W64.ABRisk.QFLC-7046.15147.8967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f428d5-cdd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708203008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708203008, "uuid": "0f9ae6b4-91bf-4842-a8d3-d831f79bf5c2", "comment": "Malware payload (Mirai)", "value": "56974d0cf5e92678ced4b18489b71dd8", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708203008, "uuid": "a6979332-52ad-4dd5-9016-efa58e0b9927", "comment": "Malware payload (Mirai)", "value": "f05d8912de2d67ce5ecdad9ae793f89d4f11158468a1b7300b05eea113c791a1", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708203008, "uuid": "7d97315e-03a8-4294-ab23-6378c6cf2f0a", "comment": "Malware payload (Mirai)", "value": "d347d5f895c9fe6a881a1f7b0cb16ef8f982a573", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708203008, "uuid": "2f718bd6-7d9f-45bd-92e2-991ade25204e", "comment": "Malware payload (Mirai)", "value": "932592f6f287f0820c7477d26286c280e1ae0c87ff9b1e15d8ae33743100d8a3d3969eed3721aa1cb2e437b587bf6e50", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708203008, "uuid": "531dfd36-43a1-4341-b094-88cd18ad5084", "value": "T17D731882BC80EA16C7C01677F96F508E3311A7ECE1EA32069D255FA4768BC1F0D6B756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708203008, "uuid": "a35b301c-aba2-4393-8efd-e7fe5bae4a00", "value": "1536:JQU5w0Jj8bvVQuHCmSbuLqY3BxXB8t46AqQviJj7s:JQCw0zuimKYjR843qmiJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708203008, "uuid": "7e26dd16-62fe-470b-8bfa-184e915a433e", "value": 79048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708203008, "uuid": "b32dc3bf-6922-4781-aac8-999db330936d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708203008, "uuid": "22d39272-c9bc-44ef-9083-d7dd7e6611c0", "value": "nullnet_load.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793979ab-cdc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1708196711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708196711, "uuid": "f8cc2afb-a623-4f24-96c5-80ae6158c153", "comment": "Malware payload (njrat)", "value": "1660ad56d483caa69ccb56251c6f89bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708196711, "uuid": "a4afb388-c6a9-40c5-b6f8-c44928eef207", "comment": "Malware payload (njrat)", "value": "f44933fa819aaf68b95ddd712bcb7e069ec952cd151862c1d3313dce52203c6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708196711, "uuid": "31ddfb65-c4aa-4163-b8f8-cd69f4e7b584", "comment": "Malware payload (njrat)", "value": "b45a9bd339562b15239abe2b9c65d65ab599eb94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708196711, "uuid": "033bce71-d441-443f-a227-a5bdb901494b", "comment": "Malware payload (njrat)", "value": "2c889aa337820146ae7e5a9c97437d14e0eb8c4e6c76de80102377f0e60d14c0e6765088b696cc3c0045d8cdfc9625d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708196711, "uuid": "712ccf58-fd1f-4cfe-8d9f-79be7189bde9", "value": "T19483DFC503C2E7ABC6E5D1FB542197F43336C99894266BAFC22CD6010CD925E1E8FE66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708196711, "uuid": "210d4c60-03d9-416e-8719-417606e3ed09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708196711, "uuid": "0324bd87-315f-4be8-b241-331333179855", "value": "1536:78zYOd3c8QduE6hP03VGY0ciL45ZWVUHmYNr0aNoY9/9F:4zYOdM8QdwhP0FJiU5AUHMaikF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708196711, "uuid": "80e19139-0528-4a02-bf91-c83595ef0656", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708196711, "uuid": "6bd11db0-3eb5-44c5-84f2-3a1e4cd3c094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708196711, "uuid": "f3c9eaf9-7c9e-4819-9d68-36e28877c08b", "value": "1660AD56D483CAA69CCB56251C6F89BC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382297fb-cdac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708185005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185005, "uuid": "57a4a1f5-5917-40f2-969a-b31ea7b80bb6", "comment": "Malware payload (Mirai)", "value": "be7b0e82c2be7ad9ead93f824a251aeb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185005, "uuid": "800d2a7f-77a8-4813-9acf-2dbe802cfd85", "comment": "Malware payload (Mirai)", "value": "f4be9dee868fbdf2542c5a8c3e9d5e190ec12c68c1025eb493952aa196b0c60e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185005, "uuid": "dae44444-6861-4d84-ace7-dcd27a988269", "comment": "Malware payload (Mirai)", "value": "7897b18e26656f6b3c9ac0af8a1d24b1b4c6c462", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708185005, "uuid": "54c787cb-9203-479a-add7-279d9c435c80", "comment": "Malware payload (Mirai)", "value": "a2add611e88006a71b6ff1ba14364192cbb9e78aff010f6f399ea99d49069118d5a5f222eeb15e77e47fc0692ead2c36", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708185005, "uuid": "433a5866-2539-4e18-a05c-c18b025d7173", "value": "T1A13329C4E943DDF8EC5115712067EB328776F13B1029EA87E7ACA623BC86B41E44729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708185005, "uuid": "946f4679-d993-4f0d-b3fb-99587d411fe7", "value": "1536:O13kynNjv6czSEZeLmI37KNCgoTSIkvQz6Nsw2RAvah50Q:AUyntv6cuEZ437KAgomIkveaswiND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708185005, "uuid": "9a5e3307-6cb8-49e7-9f5c-4cca03996320", "value": 54864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708185005, "uuid": "73044d0c-07ee-4dd4-8f80-dd5cbc2aa5a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708185005, "uuid": "861cfe84-2db8-4a55-b62f-a10f8b4fd3f1", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20265bc-cd4c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1708143951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143951, "uuid": "9805d47f-75b8-4b79-a6b5-ceace43625a4", "comment": "Malware payload (VenomRAT)", "value": "d7963dc144158429102bda49bc79e89b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143951, "uuid": "cca26a12-9b60-445b-8262-fce50cecc8a5", "comment": "Malware payload (VenomRAT)", "value": "f5c19d29589d4ac662c87f4aac467d9ca07396d51321d4c589c2dc285a88cd75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143951, "uuid": "64d4b39d-d865-40ac-8ac7-62978520db6c", "comment": "Malware payload (VenomRAT)", "value": "2d17331b35c800bbc22c2d33e55159a7a49fa5da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708143951, "uuid": "22482d54-7124-4070-b047-3004df682e90", "comment": "Malware payload (VenomRAT)", "value": "9323dc93e333ab65ef4fa0e329d266a1049c616b4acafa564c251a8f0bba2d6b9a81a9fe4b4692748abc15f342b61ca3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143951, "uuid": "7f0b7144-cab5-4a76-9f29-51e2c7e668e6", "value": "T1E2735B013BE88D2AF2AE47B9ACF256074DF4D1576512CE5E3CC800DD5A67BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143951, "uuid": "99061bda-ba4f-454b-9a0a-3cbcee0b6652", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143951, "uuid": "25c86333-654d-430d-93de-33ec20e04eb5", "value": "1536:cOUWQcxh31CfGPMVGe9VdQuDI6H1bf/egV2LFm+bBAQzcaLVclN:cOUvcxhlEGPMVGe9VdQsH1bftAL0+OQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708143951, "uuid": "96451dae-5946-4ced-bd0a-ee3a619e3e2b", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708143951, "uuid": "05173bc0-25ba-4764-85df-e7bba8b33553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708143951, "uuid": "2a7c0670-f7e8-4329-b08f-a39244fad05c", "value": "d7963dc144158429102bda49bc79e89b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f88e38-cd6e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1708158295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708158295, "uuid": "35a51015-b6de-488e-8ebc-6b5cf85ff730", "comment": "Malware payload (Adware.Generic)", "value": "68a70ef9d99e94926e7231e00e136890", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708158295, "uuid": "ab3ebfc7-589f-4d2c-9573-bddb9fcd6d2a", "comment": "Malware payload (Adware.Generic)", "value": "f72ee83436cb1f82366bfaafb14a4c0cb99826c02166fc0bd21fb6e7eb5190c6", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708158295, "uuid": "fb24ec2c-4c57-4d72-836c-e1aed82820a8", "comment": "Malware payload (Adware.Generic)", "value": "5486bb9e8ad619d60e627efb13b1eb474a47c94f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708158295, "uuid": "b8c3ca83-c7b6-4f59-8c4c-7cf6221232c7", "comment": "Malware payload (Adware.Generic)", "value": "2a37a17bf8a352517d7531becd3acb3f8144a26db9041632271139b02aa9ea85c13c7e07eeb4103a2023641bf75268fe", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708158295, "uuid": "64424892-ccb3-41d9-b7bf-56d4cd292ee6", "value": "T13085CE3FB268753EC5AA0B3245B39310997BBE61B91A8C1E47F0284CCF765601E3F656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708158295, "uuid": "7505e7fe-9ab0-4797-a274-54dc36cad5fd", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708158295, "uuid": "ae9ed0d7-1867-4e2a-9290-d16cc9d9b80a", "value": "24576:O7FUDowAyrTVE3U5FFdj79NTMazaDNfBFLDnDoxJlPWZ67Po6EFd1it8OgqL7X:OBuZrEUz9NwazalBVsPWU7Po6Z8/qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708158295, "uuid": "cd3625dc-bfcf-4caa-88b9-25644f6a1a47", "value": 1763848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708158295, "uuid": "4f356f06-3f0d-4dcd-8e78-0aa063d97b11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708158295, "uuid": "83d85e97-cfd5-41d6-bc4f-adae304930df", "value": "SecuriteInfo.com.Adware.Downware.20091.25676.15900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a315eaa3-cdb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708188620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188620, "uuid": "ecbc65c9-a53e-4d71-b05f-96801d6be74b", "comment": "Malware payload (Mirai)", "value": "defb528691e9b5f2e48bb22412532fdb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188620, "uuid": "00ef9391-9c98-4a47-8596-b4b7e4e1e618", "comment": "Malware payload (Mirai)", "value": "f7c1e5984c8a2117ae77a98a2ffbae010e6e1ec6a032d14664349203ff244c5c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188620, "uuid": "6769f97c-fade-4e8f-a144-0dc1e041464f", "comment": "Malware payload (Mirai)", "value": "f57ba7374ccb3ecb28adf80c2b82c4771cd52dcc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708188620, "uuid": "7b1e6644-1ca6-4efa-bd88-b89dc442de99", "comment": "Malware payload (Mirai)", "value": "01e614a41beb8503730715d71776c2fa9bdb683a633db8db98d6f0c7f9a453f85449ce12228b0b4e095dd2a38a35066e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188620, "uuid": "272b2180-d9b2-4b6a-8830-7109de024ccd", "value": "T16AE33907B5C184FDC4DAC1B44B9AF53ADD32F09D1238B26B67D8AE261E4EE215F1DA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188620, "uuid": "af5689b7-44b1-4089-bbff-17a16b881e81", "value": "3072:B6RwkdI+dUKfIayIO/HYiT0PqvEUYoOEH9nVbdQZX8f6SHQGMJWQ1Zty:B6RwkdI+dUKfIayIWYiAYEe69rZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708188620, "uuid": "54d51bad-1f7d-449a-ad75-b69d16c64079", "value": 146584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708188620, "uuid": "026dd481-dfee-4fad-ba50-11fc01240345", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708188620, "uuid": "beeec01f-9fa2-4886-95bd-491577ac185e", "value": "bulu.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b60cbb-cd44-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708140548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140548, "uuid": "7779307c-7a64-41ab-aafc-81321150e551", "comment": "Malware payload", "value": "3b94a8e80127f5cdfd401246a70bef75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140548, "uuid": "7be1b5a7-89da-462a-8367-53974873eff3", "comment": "Malware payload", "value": "f7c8ceca9c44b97a4d1d7a59b87f88ec70d2b56a5941e8ae9785fbb8ac998547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140548, "uuid": "e54cedaf-efb7-4794-a36f-19f705a39d8c", "comment": "Malware payload", "value": "bac40f08735daf7a3e04fcddf4a3fc268ccca10c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708140548, "uuid": "ccc61a5d-514c-47f6-bd08-fa8fdbfddf61", "comment": "Malware payload", "value": "be447f006b59877915f617e31622b0f1630d7f68747392a2da2e49a65437d1d3e8e39ac3d9e138029b9a44d852fcc572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140548, "uuid": "3755256d-f22a-4d7f-a442-565a9ad21866", "value": "T1E4A7AE41BD5BE431C7039AB218E3412BF630354466218985FA5C9A6EE3ABF5032FF779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140548, "uuid": "ed7acc3c-e1d7-4f1b-85a5-cb3dac862da7", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140548, "uuid": "529944dc-520e-4037-9761-7dea0c55cb15", "value": "196608:zCPmzSJjYgqcNffG78eAuMvHLC4UMJmRgxhb/QL+EP7f+/fMxqE0SCV1Y2hRYmdR:B7INfG78DucCgkL+EjmQ2VudEeZ46i7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708140548, "uuid": "390f9d95-21e3-43cd-8f8d-0fba68b9de4c", "value": 46000640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708140548, "uuid": "d49712d8-6c03-4f9f-b659-637411af4cef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708140548, "uuid": "a078ee91-0e67-4c3b-b878-762ac5504915", "value": "SecuriteInfo.com.Heur.19492.30410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f72f68-cda5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708182184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182184, "uuid": "0b1a4ce2-46d3-40cf-909a-aae75952c5dc", "comment": "Malware payload", "value": "a3b68d54c4fa73e48c03e5adc6da344a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182184, "uuid": "570fdc91-b4f2-43b4-8494-ac097175c1db", "comment": "Malware payload", "value": "f852ce544fb649bcfdfce6adf8f87827665b512e01ced47b9bd2458285db737c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182184, "uuid": "44c77a42-82f4-456f-b8aa-681512d3eb47", "comment": "Malware payload", "value": "273fcbe0e3bafbf1bbf2d0e525ce413c3cbbf344", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182184, "uuid": "8b0b2373-378a-452d-9e3e-e9cc29bb4335", "comment": "Malware payload", "value": "1ba11c8acd2afe3e74d7638b384213e6deb8be4351b3e9b92f710f69b75d67fa5752574492498d704f8b4233c9fa108b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182184, "uuid": "74771b04-9dc8-4506-9e11-6b3d4f74b5ae", "value": "T122134BCDF583DEF9EC11067230BBAF7297B6D63F2054AA86C3D9D972DA46502A10630D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182184, "uuid": "33219f16-97ab-4830-baca-160247b57d99", "value": "768:sXKliE6ZJAlx0oKITPhutOA3/VsKDotNBGB7bkdi:mAiE6ZS0YO3bDotNBi7bkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708182184, "uuid": "cb6e06da-42ed-4a32-aec3-58df6c39ca2a", "value": 43504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708182184, "uuid": "c9692470-1e33-4c2c-a78e-88f9b7ee8b4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182184, "uuid": "393c419c-8065-4b76-8579-627701b033c3", "value": "b4ngl4d3shS3N941.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63268012-cd8d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708171763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708171763, "uuid": "29f9d8f1-82a2-4666-ba6e-189516b616fc", "comment": "Malware payload (RedLineStealer)", "value": "3d221950d9a9a15cae330681ba641ed3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708171763, "uuid": "f5bef4d3-67a3-4967-a9d0-a8856a4457c9", "comment": "Malware payload (RedLineStealer)", "value": "f8c472c817f6c8a4dfffd64f338ae1c8c2c118e463f07558f2f7dd9838cc1fa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708171763, "uuid": "240a70ee-a9e5-4e08-8130-112cf89cdb44", "comment": "Malware payload (RedLineStealer)", "value": "dd1e2e860943b17b34430125f23eab53e8451e9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708171763, "uuid": "42f9d2e9-3188-45c2-860a-9ddb24480fba", "comment": "Malware payload (RedLineStealer)", "value": "4b6d496d368d6e20cecd9d629e2756b24a2a1bd0cf619648ee2c48ff9d3cd92bca5fd18fad162026e0927e1e1606b0fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708171763, "uuid": "1879ed43-ea7d-4a57-a239-b791e3705319", "value": "T108A4F122F9F2E432C49A85744835D5F0157ABC71A995829F37983F7F3D322826B62336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708171763, "uuid": "93831861-9739-4b88-9cde-1d578b975abf", "value": "34c4161f659e591de8a4c6e215c7a951", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708171763, "uuid": "277f0dfc-2637-4479-99f0-8fd96c57d7a8", "value": "6144:nGi0rdEWlEp2U73be9sviw41HyJMRDck67892wrC0o2/hIOV57ZVqRvmL/E:n6rdtlEpHiwCJVcwrC0tSOV0UL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708171763, "uuid": "d36fded2-4789-4b20-b501-4990f4caabc3", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708171763, "uuid": "24f1d869-4f62-42ca-a980-29abb70dc90a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708171763, "uuid": "f3458ba3-130e-42f8-89f0-7214d1891574", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae306b34-cda5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708182197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182197, "uuid": "5debf363-183e-4da6-a74d-5503ad6b5c7b", "comment": "Malware payload", "value": "3332c737222d6552022298c8aee4de78", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182197, "uuid": "37c4ec24-d279-4dcc-bf90-c9b4dd34d390", "comment": "Malware payload", "value": "faaf4f81831dfb333ade31a7260413cbe0d82c6d0144ec5203eefec34642bf2f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182197, "uuid": "b98efe85-29d8-4c8e-b776-6ed177bfb4f2", "comment": "Malware payload", "value": "fa0bdda8ab99eae77290d25df9b274a479c9050e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708182197, "uuid": "7973a3a0-7bf4-4e90-8642-0943037863c2", "comment": "Malware payload", "value": "8eb3cbac5f91f193ef38eb7820ab5e3ccc350123d34acc63f96402ccf41a5d188ed35522e6fc14f0c90c258d7e86006d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182197, "uuid": "5c851dcb-77ee-4bd1-9d37-69ce91881b56", "value": "T125C33B4AEB808B03C4D62775BA9F42563323DB54E3DB23069D18AFB43F867AD4E67405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182197, "uuid": "a5e02a92-1529-401e-b886-3be6273f04f4", "value": "3072:+sK6hx9Gruzw8JoYLyeYUJCQaiM/9+g5TRGR7w:+sK6hx9lzw8JoYOeZCQjM/9t5Tg7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708182197, "uuid": "7681405e-5dcd-49a9-a7a4-deb7e9bab18d", "value": 120339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708182197, "uuid": "4d913909-52a1-481c-ac5e-8173b485ce6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708182197, "uuid": "baefc715-0e52-4cac-820c-f985fe56bee5", "value": "b4ngl4d3shS3N941.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e78170-cd98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708176416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708176416, "uuid": "baf06576-df7b-454c-8d16-48b70f711f01", "comment": "Malware payload (RedLineStealer)", "value": "3c36b361d58956b8d2e7cd288c3565e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708176416, "uuid": "548064c9-8047-4445-9642-c1a093c271b2", "comment": "Malware payload (RedLineStealer)", "value": "fc93385270760875676a65e0663ad9a3e2d86b495e1586fef048d2e197f62a6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708176416, "uuid": "d793cabc-cf65-47f3-acd4-671c3dd30c59", "comment": "Malware payload (RedLineStealer)", "value": "ea7b32ef78b6364214d4c3ceb46ad161bf38075a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708176416, "uuid": "4b02fa69-6cea-4e93-adf9-b715f4199a14", "comment": "Malware payload (RedLineStealer)", "value": "d07159d2bedc624f735c2e194f84dd3bec0cfb9f4771c4c085864d800bafe8a596cabf881caab6f3e95fe60217f9ca1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708176416, "uuid": "8a22b0fa-3db6-4f05-a0c6-51cb5a71f74f", "value": "T1F26523127584D1F3D0BEA53901E1DA71563A207003999AEBB7DC7BE61E213E5F73A2C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708176416, "uuid": "4f26b1c7-f350-4097-a6c7-e9559cdb6eaa", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708176416, "uuid": "fccdca66-8c16-4972-8eed-4f1cfeaa6590", "value": "24576:Ak70TrcwLpKe4m/ahJAg/+nEWlIphxJXxtmop6Ab5LJDudW4ecS3zMyUk1hH/Njh:AkQTAAwWWGr/cxIhQ9wrEHDjp83k3/6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708176416, "uuid": "b99b9be6-4076-4b9d-9a4d-4d41d25f15ed", "value": 1470976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708176416, "uuid": "71a83fd1-3933-40eb-a575-d4b8d828a107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708176416, "uuid": "a3738873-2fea-4754-941f-a0c9f845e0f2", "value": "Investor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70eea670-cd34-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1708133561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708133561, "uuid": "f359a186-8269-434e-8043-f5513d7c4a5a", "comment": "Malware payload (CoinMiner)", "value": "49db7b3e827ab7d47b9106f924cf0d08", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708133561, "uuid": "387bcee7-bfc3-452b-8728-b45e8292d269", "comment": "Malware payload (CoinMiner)", "value": "fe6157ea3ff94f6c4f84da31a56ea05038dba490cc441bac0086999456170d18", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708133561, "uuid": "06b1ee33-79f4-4956-bd08-f3b8a889db4c", "comment": "Malware payload (CoinMiner)", "value": "0c8d26a2e408bb4efbe6c64d38c21cf85cafdf24", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708133561, "uuid": "36915d1d-9bb2-4733-85ae-a37afc4befc3", "comment": "Malware payload (CoinMiner)", "value": "6c2228f8c660933780193a22c8448e489b2778baded8e96cdaafdb16e47126d90b2b71f64ae9fe3c4a8f75fd98ef699b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708133561, "uuid": "8144eb87-6559-41b0-ac7e-91c98fb16608", "value": "T17B867D53B2C9657ED0AB1A3A483BAB54993FBA212A12CD5717F40C8CCF355407A3EE17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708133561, "uuid": "1feab1e6-f2b5-43d1-9db8-5d31e4ef389d", "value": "079aff5f0c92a8b1ea3306115a7aca36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708133561, "uuid": "52be841a-ebce-436e-9f12-67427e316ae3", "value": "98304:ceidhlFrjrskTaHuZXVoYWJKxNOJmrOw4/M1mfxjXem5t:8nFrjaHKLCmrOMofxjfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708133561, "uuid": "133b3f3d-0469-41cc-b16f-f904ecd4b47d", "value": 8141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708133561, "uuid": "f8988e88-1b2e-4f74-9dbf-e484445d6423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708133561, "uuid": "9705f77d-a62a-467c-af92-fa46b84b7c4f", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.Bingoml.gen.21724.30704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }