{ "Event": { "published": true, "date": "2024-01-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-01-02", "timestamp": 1704240182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9b4aabf9-b144-4704-8c4d-e0f16ed55ddb", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662d5cfc-a92a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1704171006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704171006, "uuid": "d144823b-fb97-41ab-9661-41f53c34db51", "comment": "Malware payload (Gafgyt)", "value": "b76e9c8dd335fc73004ad9658417a9ca", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704171006, "uuid": "b8bc2a8b-6088-4566-bb27-2570f1b5fde7", "comment": "Malware payload (Gafgyt)", "value": "01a3c32b8cbafa4cb8d818e8c97035df9b31e3f162e1a926271f44b009074c39", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704171006, "uuid": "03cc2c86-0c66-47d4-8620-5e7ed7b6037d", "comment": "Malware payload (Gafgyt)", "value": "5fef925123c074068387e8564f2e6c3069e478ed", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704171006, "uuid": "3ed584b2-5ff8-4c38-a2ac-4bc9ab34b35b", "comment": "Malware payload (Gafgyt)", "value": "e3a55f2c79d4b21fbd792d839a790ba9f2f1d8c40d86a2e75f89855c01cd2bbd6a1d20b6cca77c83f4735c3c8dc869b5", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704171006, "uuid": "ba1674cf-badb-4ed0-9b14-469c45115d7c", "value": "T132C3F731E8044B1BC2C223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704171006, "uuid": "5683badd-3e2d-411c-85ec-d1ab4b9d220a", "value": "3072:6jVlyaL5JCrIpv04szbttiEiTmP46aQyfPlfKsNb:yoCJCN4szbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704171006, "uuid": "94821db7-8799-42dc-8b78-69bb16e35a55", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704171006, "uuid": "21d2e361-b5db-41b4-90fd-962c6fc0e4c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704171006, "uuid": "191ab773-dbe0-40b8-8b7e-e35f519f2127", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c88338-a917-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704162813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162813, "uuid": "bfa6da01-9601-4f11-9d3c-57f961d4980f", "comment": "Malware payload", "value": "b4ebbcf74298180f439eeec89d8f181f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162813, "uuid": "77e6ed2a-b57e-48ca-a83c-e21ef4002849", "comment": "Malware payload", "value": "01f70016a0f13a5f9e561d0d5d60e7cc0f8087e1e124efb1468ff9fdb30ab8e4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162813, "uuid": "3a7dfd55-ade8-4c08-a2f5-21c89b66dc29", "comment": "Malware payload", "value": "d1cce5c08711f74eb313f08911373855500bc09f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162813, "uuid": "e3cdff80-2608-4170-b2c5-4f054098c8a9", "comment": "Malware payload", "value": "c31bd8e43c51d9739a3d184a8a19bed4e6ebb9002236b99187cdf11c8866ce2efd432967fe253d49a193fb72fc3e891d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162813, "uuid": "3c057039-2024-4852-aa03-78d2c656d8b7", "value": "T1324533479448B549E689B57A2B6ED03A20FEB28C44C7CE62735F41E473CF9847B87C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162813, "uuid": "aa3f81b7-401a-4232-bbc0-50c86c46adfb", "value": "24576:YJWGMxzcweviIBOiYHSLNeMVQToB6S7wquD:BBFgviHiISLIMVRkS7wnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704162813, "uuid": "eef2a919-abcf-403f-9229-907ef2e4b94a", "value": 1172984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704162813, "uuid": "33e72226-b3ec-4af7-8cfb-66ce99b135b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162813, "uuid": "f153edfe-5c4d-49f7-9808-232178387311", "value": "linux-mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3fe1ee-a97b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704205726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704205726, "uuid": "722e69d5-971b-4482-b0fe-5937b75e1313", "comment": "Malware payload", "value": "e559ce2050868f97404610e59fffb2db", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704205726, "uuid": "5bfb5257-95b9-4657-bcb3-51d8a60dd9b9", "comment": "Malware payload", "value": "03888813079d01e1ba2d2675cf35724e529d58a78b9efd8161c746e8e33c643d", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704205726, "uuid": "28fb5c10-50e5-4130-9f1f-ee7a047b39f6", "comment": "Malware payload", "value": "1e7316cce516c110b4858093f610db9f79a202ac", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704205726, "uuid": "79d23aa4-2840-4b74-8913-3f6743f9f19d", "comment": "Malware payload", "value": "b52dcb24b6250879b517126ae28ba86d83b12d3b87061350f0625d283fec5d23cb84e4ba97c573f8f196ce5cd166eef0", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704205726, "uuid": "0684a262-a1e9-4d25-8480-8f0bf61d8f42", "value": "T1EC262790FECB54F6D9431E3044ABA22F57315D094F24EB97EA507F6AED376A2093620C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704205726, "uuid": "8e00c1e7-7950-477b-b83a-c0215e89d5fe", "value": "49152:xcYBhGN1FeeUHrc3oYIOWhMojcrthMrTo55xk16Sm46adbADL10B1:1f6DYI3o1hh8hL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704205726, "uuid": "747aec2b-f021-40c4-8ff6-76c46b04f06b", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704205726, "uuid": "cdc7945b-7633-405e-9e18-81d646730aa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704205726, "uuid": "97f5c789-7ba2-4665-856e-3ef5255e96c1", "value": "e559ce2050868f97404610e59fffb2db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba308ef9-a94f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1704187038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187038, "uuid": "f3a23f58-a368-4b27-bc2a-8c63963027af", "comment": "Malware payload (Formbook)", "value": "d50751a023fc8006c2ac9ad4fdcc69e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187038, "uuid": "a84632b7-39a5-4fdd-b87b-d13fd9752ee4", "comment": "Malware payload (Formbook)", "value": "03d64134db5f0c1296f16f64b8ef153fe5096753cb6654de01eaa74e988247dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187038, "uuid": "a4c9e7d6-12e9-49bc-acbe-99a408f96cf1", "comment": "Malware payload (Formbook)", "value": "373e6180649ffa9932ed313dd251756cbbac2216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187038, "uuid": "e19c6bff-640b-4a2a-a506-a8820de8636e", "comment": "Malware payload (Formbook)", "value": "bd65c7b01ad0f7decb5f4c71ece09681ac9416fcc2118aa20a73c9ac2e2583748b34ad45056af34064c90ff942cf9d7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187038, "uuid": "f7938c4d-c14d-4ad8-8934-435ba0dc54c9", "value": "T1F484235231DA14BFF6E687718B71DB5DD6B89E9E4AB520CB13A48FE13C302874927813", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187038, "uuid": "9151d432-ecb0-49fe-8655-6dd3131225d4", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187038, "uuid": "8733c92d-a080-4921-81ea-cbc42dc57935", "value": "6144:bhjmb0fGNBKZhALMYUYk3XqZaUs+/0cN2QuaZZItQLLMRvOTEGTF6F9QfT8:c0fgPLMY+36aUnMcN2OZLSGEGTh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704187038, "uuid": "0e502510-b555-4af4-b124-22d2582b695b", "value": 378260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704187038, "uuid": "0384744d-e91a-4a63-9a70-d9e7e6a252d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187038, "uuid": "42f51b5d-bad5-4289-869d-5afbcb01a9ce", "value": "All requests and company profile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90792052-a957-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704190404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704190404, "uuid": "504a4787-bf84-4d2a-a9f3-dce626f0f757", "comment": "Malware payload", "value": "f6c23a735baf5ec7266cdeb9943aee74", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704190404, "uuid": "851234d4-fba8-4f71-906b-b4f97c980ffa", "comment": "Malware payload", "value": "058b287c3f22cd3b4775a792bc26f01686b1e8ec77a0ba75e7e075945340bf05", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704190404, "uuid": "e4c7fbba-4b77-447e-ba3e-882ce1bf199a", "comment": "Malware payload", "value": "c5ad4e5247612a470fbdc5ec50dd81993a42fc92", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704190404, "uuid": "18288f0b-59b1-4a92-a102-6a5bba4588d0", "comment": "Malware payload", "value": "f0a0aa6b07dd348ccfa1d60f4a271d76b37746532a7ad1d91d945d091c48c6b844313fcaa49d6100fd8178883620689d", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704190404, "uuid": "0241c0f5-a913-4883-a4cf-04457f65d66a", "value": "T112652A4004B8687F4C49B143DCBDFE3F2DF46A169784685DB9EEAB4C43EDA880D5E05A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704190404, "uuid": "fdfda711-8606-4495-b5e9-858e4d58ba92", "value": "12288:woSYSuSXScSdSNSaSpaFrQR9vOn0KHKVKlKtKdKgF9TEqWSYKgebzSeuJGKGWkP2:wkyrjdbueuJGKG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704190404, "uuid": "54e46996-d6ca-4d19-ab74-3ae29e059c6c", "value": 1502199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704190404, "uuid": "29d07378-be6f-4c04-8554-0443704bc936", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704190404, "uuid": "24121dd7-d248-493a-aafa-1f1d5cef80b4", "value": "freeformatter-out.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2ea3f5-a950-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1704187553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187553, "uuid": "6a89325a-f68a-4a1d-a15a-9093d4ab0800", "comment": "Malware payload (RemcosRAT)", "value": "87982f1f940cc4ad215ce2dd3fe45678", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187553, "uuid": "799eb6ea-8bf0-4b48-8387-15c7a80f0807", "comment": "Malware payload (RemcosRAT)", "value": "05f0ff8b8b6a8040947d1e42e4dc6ee89b109634afbd957279a36f758f33067a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187553, "uuid": "0dd6c83c-e763-4e58-91fd-f4f6d0483c9f", "comment": "Malware payload (RemcosRAT)", "value": "ab69b4663d660eefd6bae607b5f471761c90d934", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187553, "uuid": "efa06a63-491b-48a5-a124-7dc74e10b678", "comment": "Malware payload (RemcosRAT)", "value": "12095d22961db54aa37aae108fae90b29f9eec968beee73cf13bedb432a1e801ca6b86e346acdd3c2fa19831bb9a7e73", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187553, "uuid": "1465c04a-5688-400e-8dec-2d5c5b6ff441", "value": "T112824AE3CD1B54E4B61F3ADCBD497990917CD26B05320369ECEA139E1207A6CA6FC60D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187553, "uuid": "7039b716-453f-4285-93db-831fad4d73d8", "value": "192:GAARWxC3Mebmv9g9njInwpBWLXajbv3IzOru9Uf+lpsYrIwR2+DC1otzeeoreNh6:GxCC3MebmliBRbAOcpsmD8NvWaJnEcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704187553, "uuid": "4c09db47-6067-4bf5-b763-36d9db542756", "value": 18666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704187553, "uuid": "f9261f1a-7691-4d0b-917f-256f61709813", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187553, "uuid": "54ff27eb-631c-4add-97e1-83f3015a19b3", "value": "rfq_new_order_sheet_2024_PO_NoRZODOSKY00000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa3468e-a963-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704195575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704195575, "uuid": "526241f7-0bdc-4cef-81b8-9436af28669b", "comment": "Malware payload (Mirai)", "value": "c8f1c6559c273e48787b84619106ac5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704195575, "uuid": "1b2c2b8a-956f-4c4d-8739-8f53faa46a39", "comment": "Malware payload (Mirai)", "value": "06206d8fb1ad3ffe39a98aa38f0bf424b5fd774e848b8417fb2e8d9be6cdbbb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704195575, "uuid": "440cfdf2-58c4-4cb3-9057-4552a9155ef2", "comment": "Malware payload (Mirai)", "value": "d5693a8add3e7e99618e52b12f8b71d90dc3b258", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704195575, "uuid": "e7dc2816-bbd5-4eab-ae82-8567cc50e93e", "comment": "Malware payload (Mirai)", "value": "8c619de6e8a985aab522575e42cd5382b23e9efc714f1b16e5f8da3a7b4bc22827f3adba4dc764382c5df5569fd0ca30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704195575, "uuid": "b3a1328d-c8f9-4f56-b172-3ca3f4bbc554", "value": "T1D3A3C509BF510FF7E89FDC378AE91702388D941A21A47B76B574D828F24B54B49E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704195575, "uuid": "2f409ec1-18df-4400-90e7-1823ea2ebd73", "value": "1536:uI5ETw86eKnkV4gEqRq522ykUiIh7NQVJ9AfoJ1ZVbi7N4RsgwbZnLM:uI5ETw86V84gEKq596UOfc1p1wbZnLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704195575, "uuid": "e8c073b5-8fc5-4826-b39d-9d20949d87cc", "value": 105360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704195575, "uuid": "68003456-cfd9-4ecd-9021-b4396661e644", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704195575, "uuid": "930d65c7-2889-479f-af63-f76512b50bad", "value": "c8f1c6559c273e48787b84619106ac5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6626871f-a92a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1704171006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704171006, "uuid": "5c028ec5-9186-44a0-a92e-8e0b9475b582", "comment": "Malware payload (Gafgyt)", "value": "5b6b8480e9db3194a7b61d2176b24d80", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704171006, "uuid": "b4bf862b-4510-4863-b704-55b970c1f21d", "comment": "Malware payload (Gafgyt)", "value": "06e1e5c18b69560b06263e86b7f620bdca8d640c53f163b0a653b86e07713306", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704171006, "uuid": "848a71c3-6dc3-46dd-91f5-5b02832d41a4", "comment": "Malware payload (Gafgyt)", "value": "9d239f83723dd2d6e9484f879d51ad0935b7dc9c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704171006, "uuid": "f7c7ac64-7d47-4f9a-85f3-1175d411cf8c", "comment": "Malware payload (Gafgyt)", "value": "c05ead58fd4e0f2d2c55dd7c9b20494e2f0e2891a79fa9e7ce7fe40b04c118fddb4ce10955de3c348fa1e0f211602052", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704171006, "uuid": "276fb8df-2e53-4fc2-9c21-8fe2e219818c", "value": "T16CC3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704171006, "uuid": "30a117eb-f2b7-424c-93dc-e6c8b57820d6", "value": "3072:4jDy/+mh1vtbPIKa5bpcUPium7/L7QsvmGfIiNb:mOJ1vxfa5bywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704171006, "uuid": "294c1b86-b880-4976-9d7f-e173217677ac", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704171006, "uuid": "b8c7eb7b-6bac-4e48-b9aa-56d6bf3611c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704171006, "uuid": "2c7f07f5-3c12-4061-96b1-24c719e84892", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18e0f25-a9ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704227074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227074, "uuid": "dded3829-f75c-4ef0-96bf-bc1f0b53419e", "comment": "Malware payload (Mirai)", "value": "db563e90ec59a1c57fb9231a529f2ca8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227074, "uuid": "543b24bd-bbde-4123-94e7-6ccc1ebb129b", "comment": "Malware payload (Mirai)", "value": "07d65bb58f848502125920957932cd5769e3f4eda0109f9d3f5c7f7601c04247", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227074, "uuid": "a620f3c0-f203-4dbf-95d6-44a6cda30701", "comment": "Malware payload (Mirai)", "value": "c1d80e77e6c839b30b001bfbee59553d1f4f6f66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227074, "uuid": "55815026-5579-4f83-a879-ee82a8dfb143", "comment": "Malware payload (Mirai)", "value": "90fbc13341064c482093a4c979118ec03f6a4b4ae47860410426deae977d4f4701c39f0deeef351428805bbd841b1ac8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227074, "uuid": "d759ecb6-7e46-45a5-8d5e-037d01652696", "value": "T109E2F197C3626093DD782BB1FA6A85CB6BBC0B9CC57730A3160556282E560535F3C483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227074, "uuid": "5427d0e5-19a5-4ad3-be3f-ecd9a7df70f8", "value": "768:koiWiO031vpAPbrVWZK3XVGxm9XfVVn0/9q3UEL5IF:korm1vpALgUJfH0uLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704227074, "uuid": "e26c281a-2d81-4d94-a00d-7d8c8d21a87e", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704227074, "uuid": "d4a1c8b4-104f-4e4d-96cb-eb8874a426af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227074, "uuid": "79dfb87f-e265-4691-ba0b-1780ce374b7b", "value": "db563e90ec59a1c57fb9231a529f2ca8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df691253-a9a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704222749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222749, "uuid": "a0db5867-6664-4df7-8c4c-119d2e390d3c", "comment": "Malware payload", "value": "61364a6fe5efd106c01a7c36ba09abb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222749, "uuid": "77a44f6b-9cd7-4d57-86e8-1b293fb80d63", "comment": "Malware payload", "value": "0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222749, "uuid": "dc5593cd-ba12-489a-b1c3-77cc36d807fb", "comment": "Malware payload", "value": "90022820444fb45fc831513b51c5f6adaf092307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222749, "uuid": "7c2852ff-b3c8-43d0-8c9f-d9cbeb401b85", "comment": "Malware payload", "value": "6dbbf76b039d795543e7bde07f7214e1be26eb32ffd7eb5771d879c153ded813e77b50b5e4b38a851ac10620513ff342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222749, "uuid": "ed1e5742-c94a-4737-ad4f-481999564cd8", "value": "T198E53371BAC2C672E522183F16E09721553CBC300B744EEB5BA46E5E4E246D2963F7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222749, "uuid": "6f6ac16c-947c-43f3-b60c-438ea8b999a7", "value": "319b1edcc4538be377f43066c635ffef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222749, "uuid": "5aba6ed1-5112-4645-9488-83d50d1cc1eb", "value": "98304:ystRgLsp8zU/sb5dYLQ5gDxyhQokALsRXzppn:ywgLuz/sb5fyUKJcsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222749, "uuid": "d59b7568-e045-4670-be73-29a045089a44", "value": 3213772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222749, "uuid": "6c9b18fd-4ae4-488b-867f-0cf6511c7c77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222749, "uuid": "26676803-3b54-486a-959a-ceff8541e081", "value": "setup294(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4976873-a95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704193015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193015, "uuid": "4023a4b4-9699-4c8f-a698-966632594283", "comment": "Malware payload (Mirai)", "value": "b2b82abe1cc94b9d6da2563591a0f9cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193015, "uuid": "54dbc4f4-0ae6-4c7c-aad1-8348bb92e35e", "comment": "Malware payload (Mirai)", "value": "0cd1918717eb72d202bc7ce449d17ea01b94a298f54b034fed67122ef3750096", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193015, "uuid": "fa4d1097-03ec-45c3-a150-2e4d80b5a0d3", "comment": "Malware payload (Mirai)", "value": "683bbd7d10083b441751628ae0ea2ea7238d60a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193015, "uuid": "ef785fe2-f4d2-49d0-a38a-d10ced273f88", "comment": "Malware payload (Mirai)", "value": "ae777e65f959da194f2da71ad47d724aac19af99bd28b5b6ee74051120558a4133ba40bf8dcd8c7e9ebafe8890d2b3ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193015, "uuid": "7335bf89-cf26-4a51-b7d5-2fbaf05a94f9", "value": "T1F4A3D80E3E119FACF7A9C23447F74A21B29833D62BE1D585D19CEA015E7024E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193015, "uuid": "78f5e8fc-18e0-48d0-bfcf-a454a3e0d9a5", "value": "1536:hLqrPwu2/T/dBZ9UmoqOm+pTh4SgNZaMPXwpxNen8bwbZnjN:NZT/HZ9FDSTh4SgNZaMPXwpHbwbZnjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704193015, "uuid": "0e54d34b-6eea-4395-a2a4-c362c6d3f9cd", "value": 105360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704193015, "uuid": "d5e1e79c-ab0d-4bf9-9097-2b8916981db2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193015, "uuid": "96c5da83-ad5e-40d0-91ab-4283bbff9cdf", "value": "b2b82abe1cc94b9d6da2563591a0f9cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031ca8b0-a943-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1704181577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704181577, "uuid": "97f8415c-8d42-42d2-b2d1-726a1d099981", "comment": "Malware payload (AsyncRAT)", "value": "59946e2d6c1733100496c09cadfb420e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704181577, "uuid": "8cdf502e-a7bb-46ad-83ba-70a14b9fe0dd", "comment": "Malware payload (AsyncRAT)", "value": "0d8bcc898b4efa9dfdbabe66600df0685bc6fd33f1ce52a454661f9b2aab2f5c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704181577, "uuid": "c58a58c6-98b7-466a-aa25-95fc51f0e226", "comment": "Malware payload (AsyncRAT)", "value": "3a35285726fa1986ab97d1f3055c0c4373d3fcba", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704181577, "uuid": "692b73b4-c7df-4cb0-93ab-be5c5377032c", "comment": "Malware payload (AsyncRAT)", "value": "10f38da4dc25d0c881de28f2c5e98a9cc2e7e0eab10134e30a9c18792347cf9d8d610c888418091b66d0552cd175f8ba", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704181577, "uuid": "f79e799e-7dd7-4b38-a7ab-83ec450c00c0", "value": "T1DD141288FA1C4B1AECEC15763CD948B716FA9248A94F970F4864A7A494BBF3F5230D50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704181577, "uuid": "c9d92d57-e75b-4d6a-8ab2-6a71af552b43", "value": "6144:ZFJZe+6kpI90V2IgJTuUQ00JUQg4seMFlk4Po:JnFE0V2XwO94fd4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704181577, "uuid": "f0623485-305a-426e-9cb7-4809d74a5441", "value": 201916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704181577, "uuid": "5b31ab62-034a-47ab-bf4c-12ee034425e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704181577, "uuid": "ee4e8e6c-f813-428d-978a-bd0348636ec0", "value": "59946e2d6c1733100496c09cadfb420e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26b6e4c-a9a8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704225250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225250, "uuid": "02342414-577c-4a03-90d2-400beb5b791e", "comment": "Malware payload", "value": "d65e19ad929b947a13ec26d41e073f11", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225250, "uuid": "f12622b2-8a9e-4f2f-81b7-1a2efc0de20b", "comment": "Malware payload", "value": "104f9f406bba1446689121383770ef90a5ada32cea6fa16fac76892d8146f9fd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225250, "uuid": "24de3030-09bf-433d-ba4c-15618ffd391a", "comment": "Malware payload", "value": "1f788fb8b4f729209ff9df6904b12fb4088b6359", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225250, "uuid": "73c8b2b9-c28b-4dca-89b3-d8370f2a472a", "comment": "Malware payload", "value": "4127bf5da43bc18efb5137d6d30525c222334d3be0fb257d8093c828ea73efa9efabda4640e3886c307694230cac395e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704225250, "uuid": "ce9eedc8-aded-49ec-b6d2-782c1d1aa14c", "value": "T1872104B6014526321EAF3095D7F5B1C9B1E213171D45AC127A1C82360FE896255767B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704225250, "uuid": "6e92f570-d295-4b40-a420-5b744dcee447", "value": "24:wODpDEcRiveC7KHqeW8Apg+Zj1HUguiMKhsmFL7eKMfkXrdyEybDKEnfdyEyphQr:wwZRRiFuKDy+ZBH9QrfkXrD0fCQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704225250, "uuid": "df6809da-96f5-4b29-9875-91be034ca03a", "value": 1434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704225250, "uuid": "2c006d9d-76a3-4f9e-89ae-6d75c9edc8a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704225250, "uuid": "661daf2a-be05-4326-999c-f393f2541f41", "value": "catchform.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9086677-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704221906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221906, "uuid": "b0dd628b-a51e-4e3e-a290-67736af8526a", "comment": "Malware payload (RiseProStealer)", "value": "e4a94d95c0af5a7082f90904e577ab04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221906, "uuid": "01cd56a7-9415-4d61-8f15-2ff7cc039ee0", "comment": "Malware payload (RiseProStealer)", "value": "124d756a655a6c4338f61ec8f43551dce23078e04d51ca4c03ca34f5df66af27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221906, "uuid": "c6e04ba5-9a92-4a2e-af6c-9d88777d42ea", "comment": "Malware payload (RiseProStealer)", "value": "b2c6961b3f7e3c5fe0fe86743a3360633ab2c200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221906, "uuid": "9b2e61eb-cad4-4cae-a5ee-a47bd6922576", "comment": "Malware payload (RiseProStealer)", "value": "04686724645d17d0b9e36381523fd17a89d98c1d4d34dbfda858b70399b018f1a9adab3eb4c58e9ef1d75392f31d9389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221906, "uuid": "0d52b450-7eff-405e-a959-e426de2bc712", "value": "T15AC5334266915031CAE017709CFB47C716397EB3BAB8A71F2980E6C548F35A1B63673D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221906, "uuid": "f4fc5d8d-64ef-48c3-b8dc-1780f75bf6db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221906, "uuid": "e93fc31a-4a9f-48d4-bcca-795e6151d17b", "value": "49152:hAcs6KxDps2x208AjgcbniYA5Ml2CgUBe+82POGAPmtnDguqFfzBk:OdtstrAjgcbiYx2rAZWJ4Uuq9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221906, "uuid": "adf4e494-0ef2-4d82-921e-0d19b1ff38cb", "value": 2604544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221906, "uuid": "0c44ef25-414f-4773-bf0b-b7c7e3a4eabb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221906, "uuid": "40b32bfd-b6e4-4790-a26d-41352ff763c4", "value": "124d756a655a6c4338f61ec8f43551dce23078e04d51ca4c03ca34f5df66af27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6f9aa7-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704221913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221913, "uuid": "bcaa17c0-fd60-4839-87a3-a70109b1967b", "comment": "Malware payload (RedLineStealer)", "value": "c69b71ecaec8bacdde0a07eee4466271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221913, "uuid": "7b659ed2-4e78-4edf-a658-2d58dfe1b3ff", "comment": "Malware payload (RedLineStealer)", "value": "13735fe34c4fb1fc5efca9336215af08efaeca20859c61409f9fb7c7afc82332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221913, "uuid": "cb516890-69d2-4d80-9ac4-babb6d77a3e4", "comment": "Malware payload (RedLineStealer)", "value": "0fbe5ca5ad6ff5d8b40d9fa58fd9b27c61dc4576", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221913, "uuid": "b13bf806-8fda-4bea-8d38-653afef8795e", "comment": "Malware payload (RedLineStealer)", "value": "8b4740acd6668c460c798abb6fc1aa34548e4af04c89ac4578af5d03ae8cd9ef574796ba5696bc480d49648a881f73f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221913, "uuid": "ed8ce798-a90b-4cf1-ae64-0273d20cc6c5", "value": "T1FCC5334267C25531C9E557B1A8FB02C72A34FFB2AA289B5F3980E74408B75D1B03673E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221913, "uuid": "6c491d9e-92e0-4b89-aae5-61805ae52ba8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221913, "uuid": "0b911caf-7f9c-4d2e-99a8-9d9cf7ed6bd7", "value": "49152:/8e2YI7PLlQ72Rg8ldvgu+0DSt1kChO0hk381Hgy/PmWnqJlOyWif2GC:0rx767J6dvgu+4STs9yAe7OwyW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221913, "uuid": "07042f61-ed51-4220-87c2-1eaf5e990b08", "value": 2603520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221913, "uuid": "bacc060e-c30e-4386-909f-71810172e7f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221913, "uuid": "25895c1f-50ea-4c4d-9aed-ee65c14251be", "value": "13735fe34c4fb1fc5efca9336215af08efaeca20859c61409f9fb7c7afc82332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fde543-a9a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704223988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223988, "uuid": "f82e41d7-6e89-4983-affc-ea5e7e98195b", "comment": "Malware payload", "value": "85215c82405b536a3b55105bb3fe361a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223988, "uuid": "227e8d66-f84c-4c00-9631-dacda4c9c070", "comment": "Malware payload", "value": "141262cbd24e43f4c8911c32896fe6c1f0f5e171e8e6e6bd26a24a7bfde0dcd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223988, "uuid": "dca3bc9d-df7d-45c5-b82c-c3e43d5f7ee2", "comment": "Malware payload", "value": "e2403bdda4c4a116ea47fe98006edb2793a799a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223988, "uuid": "0741cbf0-2cd7-44d4-8722-323fd45b5abc", "comment": "Malware payload", "value": "ae7fb01b2591485e05304971ea35761244f0a37598262880270f14bcc3ddd0992f3bda96248a456285f78c993f218e5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223988, "uuid": "9942bc5d-4b3e-4935-a4cc-ec44078777d4", "value": "T1C8D47CC22A029A99DC2E1931D453EFED9377AE3AD65B0C182CC773560CABD51453F82B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223988, "uuid": "3c77abf5-1a2e-4608-bf1f-c4da23fa2c0e", "value": "903da1045a01db94c1ae4ff05ccbc0da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223988, "uuid": "284ba0b9-b757-480f-8146-9f0341cea3f6", "value": "12288:+jy9rdsHeEpuV/xS90ngivnqqbJ1/l/oWzDC:5dsHeEpuVk6guqo19wiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704223988, "uuid": "5f775383-0948-4f44-84c8-05899c6adac5", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704223988, "uuid": "5dde462b-f864-4373-a5e7-e23e4675830f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223988, "uuid": "f8b270a5-8cb6-4ed0-b4f5-c986bb6ce24b", "value": "85215c82405b536a3b55105bb3fe361a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4638efbb-a936-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1704176106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704176106, "uuid": "32e2a593-88fe-48ee-802e-f9db6187e88f", "comment": "Malware payload (njrat)", "value": "6e27d69f22198d6b1d009104148165b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704176106, "uuid": "f30f114c-4ed3-41d5-a518-fc4183e32c84", "comment": "Malware payload (njrat)", "value": "1418f1140e1930a40b4dd22279c4448e44085ea3ccf0e29dccfc66cbd1b3006b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704176106, "uuid": "fa37d248-54de-40cc-aa55-d70224b844d0", "comment": "Malware payload (njrat)", "value": "d129a17253677173d8855b170965bdee29056615", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704176106, "uuid": "72317477-62e1-41dc-a2c2-26517a30452d", "comment": "Malware payload (njrat)", "value": "5235cb6cf0592cae531f196242ee03606dcf4cd945b655159f331331408d5e75d014cdbfddc923b2394e48995f63c6f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704176106, "uuid": "132c6169-5b09-4f27-843b-6ba1bb9c7c46", "value": "T10C23C75972509235C9FF87FBA4A2AA711672D0036947F31B89F114AA4B37BC18710FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704176106, "uuid": "d4931bd5-e98e-4635-8d67-ae60b0c73860", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704176106, "uuid": "ffdab462-b604-46e7-851f-3d0246ddd254", "value": "768:ZGwzxi5vNGRJUNOk7XutjkI2+L1XUQ7ldZ:ZGwtrJut7et0K1lBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704176106, "uuid": "362ee8e0-a6ef-4f44-b3ec-54b3bf333e0d", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704176106, "uuid": "c923e1a6-2d26-4621-8ff3-12a57a5f806a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704176106, "uuid": "2f0ee656-a803-4d00-bd22-2e6e29b5a666", "value": "1418F1140E1930A40B4DD22279C4448E44085EA3CCF0E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1748cb0e-a92f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704173021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173021, "uuid": "f10e67df-8407-4228-bf53-4d9783387022", "comment": "Malware payload (Mirai)", "value": "8dc57b8ee3e05aa4820b790481d82b09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173021, "uuid": "1ac1f8e9-4a28-45ce-adb7-dc0439b81a99", "comment": "Malware payload (Mirai)", "value": "144ef7d3bc81a112bb4bcdc08344b8009a4566262cb9469035aa7e71134cba79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173021, "uuid": "f5caa090-aa39-41c9-8cf3-88aa80ae97d2", "comment": "Malware payload (Mirai)", "value": "f363392518d3eeb95d525aa02cd8d280f22ccc5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173021, "uuid": "19b4ac49-19df-4fdb-bf1a-d533ca14b69a", "comment": "Malware payload (Mirai)", "value": "aeaba358e9151db9c008e25167768de03fe8e275fcc240be7b8f82082b30b586502e66f8e101e14d8c4b618ba7434820", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173021, "uuid": "18a686ac-2ef7-48d6-a1d1-510e7a5a2a8b", "value": "T19953AFB2D86D6D90C648427879298E3C1723F904B6736EF5495E8BB6600BEECF5093F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173021, "uuid": "fb3600e9-0390-4a28-a843-3195e2fac99d", "value": "1536:j/hYOEVx4LwtRbOSsWsYkdEri0It8OUCShm:jJYBX4LSOoli0It8OU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704173021, "uuid": "1b0e8b80-4678-4061-a928-a921be71a1a0", "value": 66552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704173021, "uuid": "3de9158f-f44c-481e-b035-af9604732315", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173021, "uuid": "364c6806-def5-4dfa-8dd9-efbe455ec8c1", "value": "8dc57b8ee3e05aa4820b790481d82b09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72b0d3a-a912-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704160807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704160807, "uuid": "010a2b69-0fe3-4e5b-ba61-399396b45884", "comment": "Malware payload (Mirai)", "value": "0310eb98c58ed4954e39b9aff8c59785", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704160807, "uuid": "fd65a101-3adf-46b4-b3d5-6c2eae47c612", "comment": "Malware payload (Mirai)", "value": "171b6ee729d08135b26b3784bffd1de202717a543c5d8969d613be7a500c86aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704160807, "uuid": "fa5b6e53-fe5e-4fe7-ae42-61c0db4dc12b", "comment": "Malware payload (Mirai)", "value": "4fa57b76f64eef5f2fb663b4c442cf8819c9d4e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704160807, "uuid": "26c92380-a91f-491a-a010-d8a632c1e566", "comment": "Malware payload (Mirai)", "value": "26757ad2d9b7a2ce04dea7074f61bd0b895a43a05ef8fab4c67ab247b8a364ae7de33b8d768c004df3f00331c1c08b2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704160807, "uuid": "af06632a-db95-4e67-bea5-60a1b9664923", "value": "T182D2F160FE00A4F0CFD00C35DAEE871B331E6A70E2BFE0767D489A5DC5A5042A5B5979", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704160807, "uuid": "e2287cdf-136a-4dc0-9536-269c693df2e0", "value": "384:2EK9xFNL83p2KCPuQUZE24/2Tyy/hXcERkz2IKcfL1TqIZZqmFPjV0mdGU5E2/:89pLssNZb2HRkzzKcj1rZqM03U5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704160807, "uuid": "9c11ea09-6fe2-4580-9d25-358ad6c1b748", "value": 29044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704160807, "uuid": "a9023920-6d89-4f71-a4dd-55f7573966ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704160807, "uuid": "ef58faf9-cb06-4fa5-8498-b9cfa61c73aa", "value": "cta.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1cd612-a9a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1704222881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222881, "uuid": "c242c116-808e-4a9e-8a88-3da9ad3810e0", "comment": "Malware payload (Smoke Loader)", "value": "88db6b5d0b618c25d79c4bd58947f751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222881, "uuid": "7e2cf432-0880-49d4-a8df-c63e23d7f76f", "comment": "Malware payload (Smoke Loader)", "value": "1749c2de6125b6a38e42dd557b64b2d07abec025eb50f23743394136f655cf35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222881, "uuid": "b8d8a757-cc60-4e8b-972d-eab36d1d5c3f", "comment": "Malware payload (Smoke Loader)", "value": "cebebb5b9c4a919208e19555a5e5f0ac0c3b8c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222881, "uuid": "7e6d2d67-76dd-4c98-a848-28b1090b2697", "comment": "Malware payload (Smoke Loader)", "value": "1feb5974a8dc14f5ec4beadce75afea9a01ef9b59b9761459d0d8b35c3ead21b41bcba170b5ee4546b4eb9bc626f0978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222881, "uuid": "b92da133-08f6-4976-ab2c-5713aba3eb55", "value": "T136149D2135F0C072F6F369B549B8C7F40E7BB8626A72568E6BD506792F256D2CE1030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222881, "uuid": "e9d656a8-7042-423f-99aa-07bfa140a775", "value": "628b5625e44ec4d4a2ba4078ce3026c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222881, "uuid": "b1d8ea71-d92f-42b0-8791-f878890af415", "value": "3072:xARO2LoVS5fgevom6PJiMrt+NqaDXF6KBQ0Q2hTZMgsNKId16zxZRU5JnD:G3LofGMT3KBk2hSfNKny5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222881, "uuid": "6b376034-6830-4e7e-9c02-697f7cc43131", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222881, "uuid": "ce1921d5-6f67-460b-a4bb-f6b6a569a792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222881, "uuid": "3fa20302-4331-4000-a50f-9f4c49946f51", "value": "toolspub2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc69c51f-a92e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704172976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172976, "uuid": "a78024a3-6252-426a-891d-a01bf09c39cd", "comment": "Malware payload (Mirai)", "value": "164d5388d64b5e1427f2df0375e51352", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172976, "uuid": "a9422dbe-d37b-41f8-aeee-2953f837c633", "comment": "Malware payload (Mirai)", "value": "1f21e09f4da090783aa816fdb36fd530da92aea0fe7967f3ae8def43b2f27de7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172976, "uuid": "d99959f7-d9d8-4b4d-977a-d831ab32cfeb", "comment": "Malware payload (Mirai)", "value": "fb0d8c86b6909f1137dfb77a40c716fdd453ac13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172976, "uuid": "2c3a1b8d-8097-412d-ae95-2669d750af42", "comment": "Malware payload (Mirai)", "value": "02e787decf547c3a502858e94c0813201a0224499d9de0bc5f84d2ffd6232d2d376cf14098c96d183b9e3fac3b69b193", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172976, "uuid": "18b153ae-8c53-4cb1-b5a8-6ca05a4b8584", "value": "T147735A25B87A2E23C0E8B47A52B78361B2E6234E34B4C61D7D720F8DFF146A06567177", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172976, "uuid": "14006c31-7aa1-4fae-9204-8a497d3a77da", "value": "1536:M68wmSYWGZf51tVHtEZ9i5wJ/NSIId8aWJy:t30Txnc/0dJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704172976, "uuid": "9dea3c99-58de-4675-bfc8-d66ea793dfb3", "value": 74760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704172976, "uuid": "02103a56-fbfe-451c-80c6-d09a6bfbdf21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172976, "uuid": "edc3521a-71b2-42f0-b2de-b8aa79f996af", "value": "164d5388d64b5e1427f2df0375e51352", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a491eb98-a945-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1704182707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704182707, "uuid": "856fc0dc-12ac-47d0-aa62-6f3023619d45", "comment": "Malware payload (njrat)", "value": "a2ead558f32ff6668b61efacb53eee1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704182707, "uuid": "f5f0cea4-8c01-4f3e-9531-ba803a898be5", "comment": "Malware payload (njrat)", "value": "21c6dd94577eb8a7f102656f638e4bdbac0fdb457c6dbd902a474b9c8b42a201", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704182707, "uuid": "b85819ad-f8cf-45bb-8d3c-6e1202d3f2e4", "comment": "Malware payload (njrat)", "value": "209e7f98110e2f3dd679673e68b3b6c2891271e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704182707, "uuid": "d930e3d7-ab62-4284-8531-cfb446737c45", "comment": "Malware payload (njrat)", "value": "70bab49d74efbb592e7347aaee7f615fa43253776298ed523a2f02ae19731507a6b0d5939daf2b11f3f65077e4d32766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704182707, "uuid": "944ccd7e-24bd-46ac-bc5f-eec0375e33e9", "value": "T1B183F189F4CCD46FC56C1BBCAD1A8A00275119316936E2CFFD9539F11F893A21C542EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704182707, "uuid": "7f68776b-0d83-428a-a468-752100ee844a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704182707, "uuid": "bd6a2748-97eb-4bec-be64-0ff7f5a24ee7", "value": "1536:Npr3vN9JMFuGXqNzCMfJlGQAXmcHbOH7SYBPYcigK:l9MuGcf/3c7H8RBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704182707, "uuid": "cff53cd2-4c4b-41f9-a349-4d26c8650526", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704182707, "uuid": "25f598a1-7a60-4821-8cc7-2ddf27224bc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704182707, "uuid": "44494b44-77c8-420a-a5ed-8791823a7cb3", "value": "a2ead558f32ff6668b61efacb53eee1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a12b65d-a9a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704222418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222418, "uuid": "f9a75017-1eff-4eab-b312-55871b959ada", "comment": "Malware payload (Socks5Systemz)", "value": "68f8278682a8b3d7c95ac29a64bb56d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222418, "uuid": "0d716275-3f7d-4bbc-aebd-22534ed62a05", "comment": "Malware payload (Socks5Systemz)", "value": "245ab71d310473ead8437bc01a370dfd1497cf3866c9e4adddea277cc3ddacb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222418, "uuid": "e578814c-f788-4efb-ab38-ef8f312911d5", "comment": "Malware payload (Socks5Systemz)", "value": "e02f70b479b5e4987b088fa6143521c5141ee31c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222418, "uuid": "2e87ad7b-1a1f-4cf4-8a13-bbe4a3aced6e", "comment": "Malware payload (Socks5Systemz)", "value": "5767fb28feaa9a03c7559e05fab60c9c3249a87851b36d0bbd882343351ca334b530f6f75979b8f3b10464d561fca9bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222418, "uuid": "7c048416-f2ef-46c5-9f22-030c5256fb93", "value": "T12B26333BC1B0CD71D5199BFA6AD28A353E03B620103933A391CECD5DA768B65AD43787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222418, "uuid": "8fe43a7c-f59e-4695-b0a4-87512278d8bc", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222418, "uuid": "41065abe-6a33-478e-9e95-fb2eba5b0d51", "value": "98304:QTMLRoR7tWp6XJZsXI/KrfwbazttMUiEzuCWRoTrnOv0b1kj4dm8:EM1oR70pu2XYKLwwf3i0iqTjSKG4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222418, "uuid": "2fa394cd-bdbc-427c-aad5-cbb9b10ae93e", "value": 4575309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222418, "uuid": "942629af-63b7-4c54-b655-cb9d1f360025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222418, "uuid": "7c9776ee-6197-4dad-aa50-7da18178ccff", "value": "tuc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e624f84f-a9b8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704232209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232209, "uuid": "1cb49c29-91d0-4a5c-8126-36e44d234454", "comment": "Malware payload", "value": "6c4ff95154c756df1e82316b916e560b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232209, "uuid": "c9eee7b2-757e-44c8-9c9b-08a016eb42b3", "comment": "Malware payload", "value": "247da4e7b039a6ef66e79e642a2d12e42d3a4a8b54de73fd03da4f0e76666f93", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232209, "uuid": "306b034f-6e85-4333-8e6c-1cfc0b72b957", "comment": "Malware payload", "value": "e16e3c253d75204e733371821ae7f213158e639b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232209, "uuid": "07b89c5c-231c-4464-bdd6-c5b79d38cb6f", "comment": "Malware payload", "value": "943c8de12646a7d2836100ba5f7d202dc2c2ba86520dc8757e2e3973ba297ad1e9fe4ca86bb27f3266c50e6fee952011", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232209, "uuid": "50507660-100d-4f0e-ab8f-74196808a126", "value": "T13192C1F1B2669A60C5A2CD39B53944C726921A78C3DE725A3B1843CCD34E18A76FC34B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232209, "uuid": "d1a5be0f-c2fe-4860-8cba-be906709e3db", "value": "384:qa6KucZgASTrqiUAy5jz9V/nacrbsMfv7QpY0CDK8zq5BLr6UiRDbhymdGUop5hQ:qwuKg7m9V4+7Qu0aK8Gr6Bs3UozLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704232209, "uuid": "96d7afba-0a1c-4ce7-8c75-623bbf2b471e", "value": 20964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704232209, "uuid": "36ad519e-2535-44a0-89cc-66f9d0e70f4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232209, "uuid": "9cc2b63b-cf23-4f97-bd88-ffaf1406eaaf", "value": "r.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71df16e4-a91d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704165442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704165442, "uuid": "27305389-b79f-491f-8961-e836ba0979d5", "comment": "Malware payload", "value": "ed5920aa3f7bc30e5c94f43d03e2682a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704165442, "uuid": "be9bb0c3-bf0f-49dd-95cb-ab9f1c3b4478", "comment": "Malware payload", "value": "2490594b4bef9c760dec4dc7a84f7527b0b612951ac880e1d5783422fb2a361e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704165442, "uuid": "7099b837-96eb-40f8-ba87-dd21561bda6c", "comment": "Malware payload", "value": "45d805af159ccde16eb6a5cb2f841bec49fe64ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704165442, "uuid": "0a2e4594-b511-46ff-aa74-d5b5876ce1a0", "comment": "Malware payload", "value": "f0904def324ef4e049d4302c2d8081c412e659e99bce703a43b8cdc315bc1c2f159d61e534910e14d1994fccc6671788", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704165442, "uuid": "c7330b0f-90c0-4ab1-a87d-6acdb473665b", "value": "T1E4F55B12B28C5437D1670A3A5C2BD6946D3ABA602B35888F7FB81DCC0E39B416D3975F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704165442, "uuid": "89751b5f-7cbb-439d-be9f-fcab78ba55ed", "value": "8d08f956b162f33d3757f9726ebf630b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704165442, "uuid": "7b8c6cbd-d3f5-4d6e-a8f2-95d097ae3b50", "value": "49152:FajufyJwSVJUS5cydLn/LPV17oTdM/wkQFWsqYXvnZCQwtR6cMwEUDTfT0O5k8H:F0uyRdLnDoTawkQFWsqYXvnZOb6FgTbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704165442, "uuid": "a13c3ad9-aa43-4332-a90b-ead3f9cdf3b1", "value": 3579424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704165442, "uuid": "4cc2ad15-abda-4769-aa27-360a023ff575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704165442, "uuid": "2d4162e7-fec7-49c7-8c45-2a8c3a9524ca", "value": "SecuriteInfo.com.Trojan.TR.ATRAPS.Gen.24187.23796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e9d1a9-a950-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704187548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187548, "uuid": "677dd9c6-8f05-4070-b00d-7b4802b7c63a", "comment": "Malware payload", "value": "e5b9edf6053dc834337af46bfa1a7429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187548, "uuid": "eb563a96-5806-4944-bc83-08f77cdaa5e1", "comment": "Malware payload", "value": "24acaabe7d3a9df77b0d8dbdcf500d538a99f3128c65a740ef85fbcec6e78294", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187548, "uuid": "5203f217-599e-496e-aca1-47dc86a62469", "comment": "Malware payload", "value": "c4cb044a0695c88ddf1080fda3e870180cd67dbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187548, "uuid": "0a78732d-9876-4edf-bcac-4e10c449068a", "comment": "Malware payload", "value": "1550ec35711dd64deb6b6c771ea81453541dcfca326bd7170a788a6d74771238c408f0e85b9cfcedbae4ed78de24b965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187548, "uuid": "73a111ea-2c27-461a-826d-764db689efab", "value": "T15956331569CA369BF45A73300E4FF86C38F43A290865995EE9AC77CE88F235055FAC07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187548, "uuid": "067c27a0-31d9-4c8a-96e3-138a5999d883", "value": "a25e4210e15552467a253512d673291c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187548, "uuid": "102be11c-7594-4a17-b983-5bf02971b30b", "value": "98304:PWsVv4dfmqwNMizJw/TP46LBC++bIEqW66K0c3moPMMKhxz5Jiu6MqsD+OHV:PWUefmhRlw/TP5w+GIEqWC0cBPMMKhxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704187548, "uuid": "89b7f421-ae0c-4d3d-af28-cdb7954ae0c1", "value": 6206880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704187548, "uuid": "89905461-8528-450c-b4ca-08510d371d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187548, "uuid": "2f22c890-9264-49b9-93d8-8a67030f37fc", "value": "e5b9edf6053dc834337af46bfa1a7429.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0897bf87-a95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SpyNote)", "timestamp": 1704193183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193183, "uuid": "07cf3ff6-3bde-42ba-ab5e-b9096719f2c3", "comment": "Malware payload (SpyNote)", "value": "61d1ed7cf0865bd8ae1d79e2808c1419", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193183, "uuid": "10c4816e-469f-4c80-9411-1e5ccb595fe1", "comment": "Malware payload (SpyNote)", "value": "26247bcb312c2e8610f440582b10d0468c9fb7f5cc3eb0e36491262539361b59", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193183, "uuid": "66985425-f056-42af-8077-263374f6ed8f", "comment": "Malware payload (SpyNote)", "value": "21b7430e3a74df4dfaecdb78fddfea88aca5c712", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193183, "uuid": "80e26ad2-eb90-4337-ba2f-6fcd2bd2c561", "comment": "Malware payload (SpyNote)", "value": "b0ec14773e08ed7637c18daaaf8de5f6e672a285bd7a5d6a4918848abf65dffb9ef6da96752527900b99727784287068", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193183, "uuid": "7de07a1b-3146-4012-a50b-779ea171b4e3", "value": "T14F06E043FB44CAA7D8BA83F16B370DA92E030F54C6429ADB5524767E2DB75D10DC2A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193183, "uuid": "f9ddc987-e1c4-4e03-84b0-ced2ff66a3ac", "value": "49152:Bv3+n40sgtOpCQlMBN4EUcRNqC7P8c2ESmzxzdGGJQTOoGUoYqs0cgp+KMbikXB:ZfJMfucRNB8xESmzxzBGTv0tp+TB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704193183, "uuid": "d5029b7d-8434-4b0b-beab-1c9df104069d", "value": 3944788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704193183, "uuid": "58822471-680d-4782-bab8-1da90ba54ae1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193183, "uuid": "87f756ec-ef71-441b-8dbf-4c4837de8250", "value": "ready.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad26a53-a94e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704186475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186475, "uuid": "e040c419-9530-4527-9284-45ff672aab37", "comment": "Malware payload (AgentTesla)", "value": "5d86666550b01ec2a0362669b68dc26a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186475, "uuid": "1f23d7f6-540a-4ddc-9cf9-437f6b99e380", "comment": "Malware payload (AgentTesla)", "value": "2dbd1e62753945875030670ed801bcdab35435735824bf20557f1af8fdb8e708", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186475, "uuid": "a79a0959-a6ac-4145-a9e6-0b0b86acf681", "comment": "Malware payload (AgentTesla)", "value": "b8aa7144c6963637df6213c2b84d3349e712461c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186475, "uuid": "1d41d26d-b482-4a4c-808c-5bb6d45bbfe5", "comment": "Malware payload (AgentTesla)", "value": "7c9bb72815185f1a33679bd8835c81de6914b9c233e85ea2f7db256d8577d4a0c8096c6615aedfa244c07842fe313f1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186475, "uuid": "b26fee89-2c04-46d5-b337-15411ff29ad2", "value": "T1F2F433AC89C73275C7B0D1897EE354B8623E6CDC922A4B563C7D46E43CB2507978E62C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186475, "uuid": "235391a9-b25c-4a7e-a0ad-0f6c674858c8", "value": "12288:vLnWPpWEOX4BUbDoUUZH2123IQanyyEwxIya6OOHY7JvvBouHSGxLAuwAuzKIEpA:TuOX4BOw21U7yED6BY1vpourmuwAGK/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704186475, "uuid": "35abe910-1e6b-48a4-a21c-f3af63f03942", "value": 755315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704186475, "uuid": "61a50cad-44b2-4e3e-afc6-30ac7670e7fd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186475, "uuid": "5d68395e-8742-4aad-bb4d-02391fa3a8e0", "value": "ENQUIRY 281223.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec86521e-a9ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704227066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227066, "uuid": "552acd22-f667-4e92-8d39-9b44ac27fe26", "comment": "Malware payload (Mirai)", "value": "553b1ebecc1a122c525563d3e0935324", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227066, "uuid": "a19d4e95-bc0a-476b-82de-a2ca60ba6c48", "comment": "Malware payload (Mirai)", "value": "2eb4a525dd3c839e2e3641694d1061eb361fa6e9ada59fcb576669114ef75653", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227066, "uuid": "766bce06-a123-459b-a2a9-7d400031c0f6", "comment": "Malware payload (Mirai)", "value": "90c1658535f77d8ad9b602c0d26f3b80f01ab504", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227066, "uuid": "533cf067-12c5-4c5d-8dc9-cada1280549d", "comment": "Malware payload (Mirai)", "value": "d386638f819853ec0fe548630160dcc2fab1f02e1cd5af24a56d0de44ef16d0948dc2801b9684b83f663b00291d1f64f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227066, "uuid": "1c12675a-ceda-4399-9849-453d4746baeb", "value": "T1D4539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227066, "uuid": "383dfa65-e782-496b-9b5a-6ed0709e12a5", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7B:P/tVz1eUUfwN0T0f+whWONEJ7Jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704227066, "uuid": "52b71919-29f5-4db8-ae37-3c66ad55b25c", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704227066, "uuid": "b85dec3b-d4a9-4799-88bf-4c46c62abe20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227066, "uuid": "3dd62fb5-205c-4f98-8615-d5bad769b376", "value": "553b1ebecc1a122c525563d3e0935324", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11071d25-a9ba-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704232710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232710, "uuid": "ed6b8960-1ae3-48a3-889e-e33a6230c02e", "comment": "Malware payload (Mirai)", "value": "922dd426086bf14b44efbb94d1b545fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232710, "uuid": "614d58f9-0969-48f4-a4e8-29721aa958fb", "comment": "Malware payload (Mirai)", "value": "2fcc3a77545e68783533dc61490c9678a683e97ba3a043dd7c07ea6a4fb2944d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232710, "uuid": "12e31fd0-cc36-4d52-8851-327d911c44a3", "comment": "Malware payload (Mirai)", "value": "1ade5ad6cbf429e9151002c78c950502fb59d2d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232710, "uuid": "ec97e332-1ecd-44a1-971f-aa6693da8ca2", "comment": "Malware payload (Mirai)", "value": "2c05b2431eaef02404b63197c32638ebe305fdeb9d8725b68662020dcf727ca9fed3b5f858f93857f8c228eff659f74f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232710, "uuid": "22613ba1-73c7-4ea5-af52-09d666dcdefc", "value": "T175E2E14B3B699291D3B21935FE6BC24DA3C284F5C9D8057D0EE407D651A2B6B20B4B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232710, "uuid": "879b7da9-dbe9-48cb-8947-f1cd23659e07", "value": "768:eIikU+pCrqHnVsco6xkvzCh7ndqIs3UozA:eIikU+zHVBWq7n8zA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704232710, "uuid": "f089ddc6-cd3c-4b10-8f70-4423a4fc7a52", "value": 32548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704232710, "uuid": "c1e8dc99-57a1-47d3-b6d2-b191bd5759d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232710, "uuid": "2cbafa24-a60d-414e-8174-03e4536260c7", "value": "922dd426086bf14b44efbb94d1b545fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2384b9-a997-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704217806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217806, "uuid": "d97862f7-58bb-4392-85d9-f058079a8048", "comment": "Malware payload (Mirai)", "value": "6716df0b934100abe21f9895aea2edb8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217806, "uuid": "ea0a56a5-b860-42c8-96de-8788ea85a732", "comment": "Malware payload (Mirai)", "value": "302d47a448b2f83f5cfc73f9c08625da04a45978266504082ca72d06ff506da3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217806, "uuid": "9fee9d3d-2e65-470b-bc89-3d8aca2669aa", "comment": "Malware payload (Mirai)", "value": "66974addf28567d3904ce6d623a00a60b7915c71", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217806, "uuid": "f8f12699-d77b-4ff8-99f0-4330f91f3752", "comment": "Malware payload (Mirai)", "value": "772ad592285ec978ab48ad0845b989fb145a5c3d78a161cdc633d9c44bd79e0494e890f3cab0fa37d63f4bfa7a93483f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704217806, "uuid": "235c09e1-07a5-433f-b9a4-44a143f97900", "value": "T179733A84EA57E4F4EC160A302067FF3ADA72E9396164EA5FD78CB923DD61B02D04325C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704217806, "uuid": "e3b9e491-f958-4cb6-9b57-3f4bd26c1607", "value": "768:UpEE/55M3dPJl2aYfpAy/U7NjmggXsqlilC8/1fTPCcwk3GEtaTVSLiJM1UrTZnj:PdPJ3Yd4VZg8qlizYkyELiJLQRcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704217806, "uuid": "65d1d7be-42ad-4fdb-ad24-dc85c2bc1dbf", "value": 75484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704217806, "uuid": "56e952a7-df68-4f2f-b0f7-0a1e8ae188a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704217806, "uuid": "7e1abf28-5262-429f-a6d1-e2a55cb59805", "value": "infn.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc68423-a94f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1704186883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186883, "uuid": "6319fabe-4151-45dc-9a3c-560633dbee50", "comment": "Malware payload (SnakeKeylogger)", "value": "73a86a1bf7f9f17ac6d5f0b001a3590d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186883, "uuid": "53760bc8-fe1f-4c4d-a907-da589729f2a1", "comment": "Malware payload (SnakeKeylogger)", "value": "30352cfbcc257fe2f2ed508076a95f1d2dbf00d0953727e7a2a81b7d450cc1a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186883, "uuid": "25b499b3-a13a-40e2-ba1a-8ccda925b5e0", "comment": "Malware payload (SnakeKeylogger)", "value": "679ea54205c48b9d025e0e9ecf40865a6057cf00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186883, "uuid": "f611e4da-87bd-4ee7-b839-ede206b3ab88", "comment": "Malware payload (SnakeKeylogger)", "value": "3c37900179e0d45666f75b65c68038dfa5b9d14a33314ca41b9f8177369ad9bbd283439b250a48bc5bd3af1eb10b222e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186883, "uuid": "8b1b97e1-281f-4604-991e-937656c563b5", "value": "T17205B13D5BBF122BCC67CAABCBE8DC27B151946B3C11DA6485C3439D5376A4225C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186883, "uuid": "8141d763-22e2-4a74-b893-141bddd31c71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186883, "uuid": "9c4fa08c-c9f6-44b7-8bed-22aa1dc9e6e7", "value": "12288:eU6BlXUVUDS+xkyqshMIfESETkCK8L/M05SiWDBwSmT5JD6:0W+uynB89Ty8z5SiMBwv5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704186883, "uuid": "29f5bfbd-e403-45ea-b67a-961a9ef4e13b", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704186883, "uuid": "66897270-e77a-48be-8f51-f42a350ac066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186883, "uuid": "1c15df96-b794-49da-8704-4edba6395b3f", "value": "Deliery Order Report.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecf8de5-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704221808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221808, "uuid": "c61deb87-7a03-4868-a9ec-e992de73b7ad", "comment": "Malware payload (RiseProStealer)", "value": "0c6af8ca5ace541a278647550954406b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221808, "uuid": "2a36f0b4-94ba-47df-9194-6421daf001a2", "comment": "Malware payload (RiseProStealer)", "value": "320f473e994fdb11ab78274c29f46373fb9beee06fc6d36c4ae088f2205d4339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221808, "uuid": "4e3124dd-e788-49d1-988a-1f8858dd5647", "comment": "Malware payload (RiseProStealer)", "value": "af114a253494f59e91011d854a3c2f0c12f58198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221808, "uuid": "2313f511-cb40-4d4c-b61a-aab5e2dac445", "comment": "Malware payload (RiseProStealer)", "value": "3c131d4afd4916e1b4923b1e815f558a6a7c68684871fe6b130b4f38ecbb64493a506862d34871c9293648a36822c4a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221808, "uuid": "a45338f6-7486-4f6e-8b19-25cbfe61df80", "value": "T1499533866BD18571C6E417B1A4F747C71E34BDB2AA285B1F3580AB8108F26E5F03673E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221808, "uuid": "3b0978f6-770d-49b3-abb3-d3a338a2ff20", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221808, "uuid": "82e1bde2-9218-4b54-9985-62cd465e1dea", "value": "49152:Ju5z1o02R2cFB3gwqQXSjewyeCx/DLO7b8Zf05yPmsn:ME03yB3gwqqSKbWe8IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221808, "uuid": "ef450605-39d1-42d7-9e9c-897863af58f7", "value": 2039296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221808, "uuid": "764bb871-1590-4e68-b99d-a74cf4809ea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221808, "uuid": "715bc4f2-7224-4851-bb34-6ed458f2387c", "value": "320f473e994fdb11ab78274c29f46373fb9beee06fc6d36c4ae088f2205d4339.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0142f9ab-a92f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704172984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172984, "uuid": "37bb938d-1dc9-4740-86f8-0466053ee6c5", "comment": "Malware payload (Mirai)", "value": "1bf87cca1a6c1576d9c538a723efe583", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172984, "uuid": "bfbd277a-fa32-49a3-a738-04595c5eef6d", "comment": "Malware payload (Mirai)", "value": "32a5c3d673316ed7cca78cbf3bcd9c371510edd426436126700598cf1e3a9d32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172984, "uuid": "1f36cd99-9847-4c9e-ac45-9459249888fe", "comment": "Malware payload (Mirai)", "value": "279d016b972ddb068cd7ca64efe213db1ea0c7ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172984, "uuid": "cdc10e4e-3257-45eb-a43c-c1c684eacf68", "comment": "Malware payload (Mirai)", "value": "8a62db2b90a8609cce44c53bd7b96f74f3fffdd55fd98dd9b7e52a619635ae5823204acad120f1323e013c98f0322fa1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172984, "uuid": "e34b3735-2e66-47d3-9d3b-7ff9bfcba90e", "value": "T18D636D95F4009E7CF95BEABA81264E09F92172004F930F2BA677FC97AD730958D1BC46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172984, "uuid": "1a9dd260-35f4-4c5d-b078-28ac1e087df5", "value": "1536:RCR4THBkt07WuFUSRN5gBwWr/euTLNxOVeq3wUz+gOI0px+FyX8kw/N:ROt0quFPRN5gBbechxjWBS+k2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704172984, "uuid": "87a0e7e2-53d8-4cdc-8345-3c2381ad12ef", "value": 73016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704172984, "uuid": "d0782b21-81b8-48da-b9f1-31041a3ad494", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172984, "uuid": "62582f7d-e9f3-48ac-9b5f-902ae60f1090", "value": "1bf87cca1a6c1576d9c538a723efe583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1d34d7-a928-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1704170108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704170108, "uuid": "23592d1b-9bdf-468f-88e8-3b4e7b1b4edc", "comment": "Malware payload (DCRat)", "value": "2008bea371f25005ce0f3aad3129d82e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704170108, "uuid": "9a8fc089-26af-4233-b74a-1918b4fad72f", "comment": "Malware payload (DCRat)", "value": "3477199ac35c44688a69664eb2d722607cff4e3a376a2d066eace87fe016debc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704170108, "uuid": "b7f26837-dc93-4fa9-b225-6a9a6b10f9c2", "comment": "Malware payload (DCRat)", "value": "c2deb609326b26b8320426321bea611e412ec9b7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704170108, "uuid": "3cf583f9-faf9-41ba-8174-e59a98717793", "comment": "Malware payload (DCRat)", "value": "a4b6204bcfb50f1c4d275ac29935cc5b952df80dbeaf90f85ea629c3a46a3bcffd7a4ad842feef2cd80d2c092c00a99f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704170108, "uuid": "eabd9d84-1f66-4f27-87fc-52e144a441f7", "value": "T105062346B9C6E8B2C9F52CB24221F3107A78FA100F198EFF6794495BDB325C0A7357A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704170108, "uuid": "8accc1f3-3119-4a0c-90ad-5efc42761644", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704170108, "uuid": "690bc29c-ffe0-4eb8-9ece-68f17fdbdb4f", "value": "98304:NSOkORFNCFUGA8VSdcCfStASnUPSzaxEKs1ey:aORzCFUGA8VWJ1P6yaey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704170108, "uuid": "0c81640b-fd7f-45b3-b985-f241da0fadcc", "value": 3820872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704170108, "uuid": "d44d6c82-fe73-4c62-a862-881dff5361cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704170108, "uuid": "2207b055-d3fe-434e-a4c0-1e4e8d3eccd3", "value": "2008bea371f25005ce0f3aad3129d82e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bf625b-a9a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704223321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223321, "uuid": "545f73af-9a59-4204-8e9b-98e1d67a69f6", "comment": "Malware payload (RiseProStealer)", "value": "0f3aef4e4a500e6dd71d0e7098734767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223321, "uuid": "55f6e52b-c742-4899-a780-aab1acb08a05", "comment": "Malware payload (RiseProStealer)", "value": "356019c5f0ab89bcaff1639b2b2a427d7777fcfa13c09f889ef5ea8eb1c031c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223321, "uuid": "dcc223af-df24-4210-a495-86810de49ce0", "comment": "Malware payload (RiseProStealer)", "value": "417126e854c6483bca2f22bbfbfdaaf78f76b606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223321, "uuid": "454fcdbb-f114-4c19-bc47-3e008b426a7b", "comment": "Malware payload (RiseProStealer)", "value": "c0eeba7fbc33666bf8ca4d8437679ebe3049c7e597892c436db66958b9cdbfd2eb81b7b8dd41b28002cf2442c8de7a93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223321, "uuid": "4f59651c-02b3-42ad-9d98-caa34f208a68", "value": "T1FD756C31A741B462F86314B5725E57E611A235302B92C8D7F7C16FAEB2A2BD39334E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223321, "uuid": "fd9cb3f1-b8a7-4733-af99-04be0af03313", "value": "a391c991ba6330d6ddb5beaa15ef064c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223321, "uuid": "5331c147-1403-49f5-bcd8-484b9506df4b", "value": "49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704223321, "uuid": "14826e66-c3a4-4174-a18a-f6bb50560c4e", "value": 1701493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704223321, "uuid": "de6f21fe-0cf6-4a9d-a1d2-af25bc5abe1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223321, "uuid": "ec8d2a4f-071a-4b17-b6e7-e5c843836b4f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5999f559-a97b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704205774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704205774, "uuid": "12038550-6e72-4bf0-bf03-5e2fdc32b86d", "comment": "Malware payload", "value": "0c7a7666ffea6807a2cbfeeff04b21fd", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "AresRAT", "colour": "#2B82FA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704205774, "uuid": "acec712c-5b00-4267-8947-b580ce1e5f2b", "comment": "Malware payload", "value": "35eeba173fb481ac30c40c1659ccc129eae2d4d922e27cf071047698e8d95aea", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "AresRAT", "colour": "#2B82FA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704205774, "uuid": "9c00d742-a785-4205-93ab-7e2b826015a7", "comment": "Malware payload", "value": "3ccefe24f8fa0a089f1d296ee32e183de140f365", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "AresRAT", "colour": "#2B82FA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704205774, "uuid": "5c59941b-e859-4526-b4dc-f67b0a7a201e", "comment": "Malware payload", "value": "0c330e4a555010ec553e4480741f7603699d6386debbdff58d87594f84022655a17ec7b2e74256a6646f92cea74706ce", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "AresRAT", "colour": "#2B82FA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704205774, "uuid": "844dee75-c9d2-4006-93bf-d4377652eddd", "value": "T19F5633CAF87758F7CAEE21348DB9D52072A860F7B321C55866C292BA41186F77F1E0C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704205774, "uuid": "c3eb4230-09ca-4458-962e-2b4d71d38f2c", "value": "196608:7lOAjUX/pUNpusLDfoL8bk9hmpQ+yOVqiDT:QAoXCpuqMLehqin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704205774, "uuid": "1edf8bca-fe63-4e53-a519-3b79d74dbaa1", "value": 6347024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704205774, "uuid": "ecd2a463-302c-4abd-8740-9b0d0b21a3e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704205774, "uuid": "bc127126-9b06-49b5-b121-4dbda022932c", "value": "0c7a7666ffea6807a2cbfeeff04b21fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf3bda1-a999-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704218582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218582, "uuid": "c46372f9-f1ec-4cb0-9aba-ad5fcbcd38f8", "comment": "Malware payload (Mirai)", "value": "f800d47b1c602fa04235cc029da7e4eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218582, "uuid": "631740f9-1da6-45f2-af56-f579540c5ae0", "comment": "Malware payload (Mirai)", "value": "36ebbaf82ea51df4f9aa88e2c697afc15ff08ca7e00ad35eb21f7a63db829dbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218582, "uuid": "4dc00a6b-cf9a-440a-962b-a89f5e711e75", "comment": "Malware payload (Mirai)", "value": "0498b68fdc13d1e1a32e1d3e40717635fdbeb818", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218582, "uuid": "b379397a-37f7-4db8-b440-ef47e39e9af3", "comment": "Malware payload (Mirai)", "value": "7330d105c43f76985f3ec0ed75b71e55c33acdd8c8914ce51235a24b42a85f23e971b64d625bd0c26b7cacd692a934f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218582, "uuid": "a28a317e-df72-4c71-81ec-9c02006ea63e", "value": "T196D3938A3FA03FFFEC5ECC3745D5AB06019C991822957FB6AA28D404B65B10E59D3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218582, "uuid": "f8ffc535-c312-4013-9f08-71a608f88789", "value": "1536:9RBabc+ih4qg/myR7P7zv9OrtXOB+C7ob5YF6lkbDr1GEMElI:97sih4j/myljzv9etXM+CO2Mlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704218582, "uuid": "47f165b8-56a2-4cf1-b340-9be68cf76e25", "value": 141444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704218582, "uuid": "b26c7b1d-e3c9-4b6e-b24a-b678ccfc4468", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218582, "uuid": "6c82a467-13b1-4574-a4e7-4f83cb9bce88", "value": "f800d47b1c602fa04235cc029da7e4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948dc1ac-a95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704192988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192988, "uuid": "1bd843cc-9cb0-4adc-8ad5-a285bdc120d3", "comment": "Malware payload (Mirai)", "value": "bbc69aea5270c41ea65a1cf97e98d50a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192988, "uuid": "64699b2c-3777-48c6-9a41-416dbbc4932d", "comment": "Malware payload (Mirai)", "value": "37d21137f581d3e7cc8708b18d21cb0c18f2c823c898d5d7ade5f7688ff19a81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192988, "uuid": "7b681ec0-e4fe-417a-a560-5ee893a14d0d", "comment": "Malware payload (Mirai)", "value": "8ba3742cabee5d3bff0a23598d4362fd4e1d0fc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192988, "uuid": "cab125c0-b7eb-4553-82ee-564f3bbcacb8", "comment": "Malware payload (Mirai)", "value": "e4f0659d92f0b60cc6718f6870f1fd2399686894148fd0dd700c2225451148b71b5f32ee562945b946090f96d7369030", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704192988, "uuid": "cde6415b-d619-47e0-9ab5-48b4bf4a6de6", "value": "T15D930856BD819F11C5C512BBFA2E018E331357ACE2DEB223DD106F20B7CA96B0E67456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704192988, "uuid": "a3d36716-d498-4042-ae5c-fb11eff8365f", "value": "1536:g+nivkMS7UIMghBa6T+uWcg/JbWcs3CXatKeoDSfM7iph2ChevpzV5oYCwbZnIx:I8rggCkSpVsSXadh2ChevpzVu3wbZnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704192988, "uuid": "f12cc54c-33eb-4b6b-a5e4-fcba89333ec1", "value": 92404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704192988, "uuid": "816255e3-247f-4f04-9b40-1f608dc3eb8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704192988, "uuid": "070a48bb-2ee9-4601-a8e0-7b12a2f945cc", "value": "bbc69aea5270c41ea65a1cf97e98d50a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdae4e2-a97f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704207496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704207496, "uuid": "02fae523-0e99-4c17-90cb-33543523e213", "comment": "Malware payload", "value": "1dbfd8561a6d491ba2619ac0234813de", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704207496, "uuid": "12488dea-723b-4aba-a388-1931d051b8c6", "comment": "Malware payload", "value": "3afbef3a92b102f9b0e728f84a2636922406f1575a336e9ba313c1756a065aa7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704207496, "uuid": "28f1b373-af67-4cc0-8c7d-fb4dfaa5d87a", "comment": "Malware payload", "value": "36726fbc8874290e976e7adff812f56d39c7bcbc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704207496, "uuid": "5d34428f-9ddf-4149-a0d2-d91f5f201804", "comment": "Malware payload", "value": "4b00090fd2d11028792f39dde9c0cd1ba70d97e4c4fc1159cb634ed6f1dad08680cac19fa14d013c5e75b71c46683751", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704207496, "uuid": "f3dbc158-86a1-4691-a190-3b0ebd3e7152", "value": "T107C2D03AA82265F6C7ACDCB583DF53D67E30BF0CCA972A4644B195C7A45D70722183A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704207496, "uuid": "9bcf1a59-e012-4b00-bfb8-32c97dc9b08d", "value": "768:haIrb2v4x9VHjWV18KmXtwxFWcD+Fh7XRp:Y0Sv2xyBmizxD+FdRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704207496, "uuid": "33f8fa49-335a-4c57-8880-2e848d38a1d9", "value": 27876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704207496, "uuid": "6155c024-db7a-493b-9ca3-ccca0e6a254b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704207496, "uuid": "6f660a76-0d5e-48da-b9a5-6a785a1a4eb8", "value": "popbang.arm7-20240102-1458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22119078-a9a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704222431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222431, "uuid": "c416b0d6-adb1-4b13-a9a9-fc161ffabddc", "comment": "Malware payload (Socks5Systemz)", "value": "64bd3bc5a01eff4dd3937536ed1ce14c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222431, "uuid": "533e630c-4f22-42c6-806a-3a516bf0dfcf", "comment": "Malware payload (Socks5Systemz)", "value": "3d106114b04dfc52f4f90ac77925e9ccb455b486ac7d7b3d8a53d29568dfdadd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222431, "uuid": "2f27390e-ef2f-4046-a038-b4bce2c9593c", "comment": "Malware payload (Socks5Systemz)", "value": "db05091c76692b0366449bfeb961b5d3a4c0ca84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222431, "uuid": "4398afec-0cb1-41e4-83ef-05c4b9bae460", "comment": "Malware payload (Socks5Systemz)", "value": "98044073898b8e8eab11465c605c9ed92030e64a98118da1c822bb76a68d55a53257be9b782203230a6365d97803e6a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222431, "uuid": "98455a3a-1e77-4cb8-95aa-cb1f8cf22690", "value": "T11926335424E9CCB7F07125F5A8A452C9A9077AA1CC73B03276F86637CBA4C625F3076E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222431, "uuid": "c3cb71ef-ec0d-4410-a00a-6f832a487e07", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222431, "uuid": "388bc422-b56b-4dd1-9338-12495e8cd070", "value": "98304:Q3anREG7npqJkXpacgA+M6zcUQek0GWDsS2D83iLHlhufnFI4dm8:aaV7np75acgAwzcik0YS28iTQq4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222431, "uuid": "31e164c8-fb4f-4a7f-861f-cf1eac435b49", "value": 4575644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222431, "uuid": "0f59111f-b878-475e-bf9c-7f9bc6e916cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222431, "uuid": "ea5306d3-517f-494d-82b0-dece179e320a", "value": "tuc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6d1040-a963-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704195583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704195583, "uuid": "01029e35-551d-40a9-a286-4d7bcaf92945", "comment": "Malware payload (Mirai)", "value": "c8536bbda5a8d624cbf5686cc9676c7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704195583, "uuid": "e1e0379c-e95a-4775-8e1d-102113e64fb5", "comment": "Malware payload (Mirai)", "value": "3e6d80e3fc3ab60cca60c3199eb58f7d01ea062d49dce1de2c9790aa12ce494f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704195583, "uuid": "23ac2b9e-c006-47f4-93ce-caf653ade649", "comment": "Malware payload (Mirai)", "value": "2bec222822cff78bea1849be938a2aa08efdc2e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704195583, "uuid": "13f5bbac-7174-4d78-8954-8ed3f8cc2262", "comment": "Malware payload (Mirai)", "value": "507bf32d80d180b750464d7d250124687ab2121e303818fe6ce328bb4d4f8f819f5daa1ab0fd42981d84046216504fd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704195583, "uuid": "d8cae5c6-1908-43b2-a251-902c60deb3a9", "value": "T1DC835A227E362D27C0D8A17B11F78315F2F1538E24A8CA2E7D721E8EFF2464065972B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704195583, "uuid": "78d313df-87db-43aa-8437-8bad7d2e39cf", "value": "1536:SFdzPAhAeC8iyT58yJOaLg5N0zlDCW8GsZVT54qtpwbZn2V:MojSy/AmzwWwZVN4CwbZn2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704195583, "uuid": "25a9fc08-6798-4692-b358-3e241f00609c", "value": 83896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704195583, "uuid": "1d38b04b-a04a-4735-a136-f07efbeef0ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704195583, "uuid": "8fb3029a-c822-4272-a1fb-c83139fb19d9", "value": "c8536bbda5a8d624cbf5686cc9676c7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573b5d56-a917-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704162820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162820, "uuid": "6252fe5e-9984-44aa-9995-e74072e7efb5", "comment": "Malware payload", "value": "4cfc4e912fabe9dee23daf660162d4ea", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162820, "uuid": "9adbee47-eadd-4f67-b304-c213370fa5ee", "comment": "Malware payload", "value": "414ec49b347b21c68cb49cb6950047000e988e2a6bd1cee4d8a4568c10fe778d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162820, "uuid": "201d51f2-6455-4c6c-ab0e-38cded561b44", "comment": "Malware payload", "value": "911bdbc86b4106a1bb520c28dfe02f0f107ff523", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162820, "uuid": "43c428fc-7d69-4bfe-8236-c337a821618b", "comment": "Malware payload", "value": "891c5523aef09eff111dff303faa25622c2135572b7c7230385d15c56e64bb9287b23fb8bf3a73b329f28d8bbadafc23", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162820, "uuid": "a503e520-a20b-4dbc-9400-77dd1f8a66a0", "value": "T1A4453303085D9314E6AE103DF8A1A9E43466C76BC9573728FAED46476F04DBF346B23A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162820, "uuid": "afc7fa0a-96d3-4296-a723-3e8df640883d", "value": "24576:DC/pX5Lt+NBlGak6I8eJZAHVlNgiMj8yh7ITdkNnk5+at0:m/1YBHItJZA1AivhTdrwaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704162820, "uuid": "1eea6635-5afd-4d80-89c3-e91ba8b92bd2", "value": 1186796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704162820, "uuid": "89bf18b8-2f44-46d4-ae48-e99982ad174e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162820, "uuid": "d45c7a74-7eb3-4b35-b58b-61507b1f67e9", "value": "linux-armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701e851d-a962-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704195074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704195074, "uuid": "dd832eed-30f6-495d-926d-b714bdae2154", "comment": "Malware payload", "value": "0432b60e4135351c57ba2885545d98a3", "object_relation": "md5", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704195074, "uuid": "2eef4031-fbfa-4c20-b4df-93dce8034f18", "comment": "Malware payload", "value": "41fe4cd59c3dfa65a6f2765fba4e8268bde4a976c91ea1d0576e77dadf0a2eb2", "object_relation": "sha256", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704195074, "uuid": "7477aaee-33c2-49dc-870c-a8b8b62d1225", "comment": "Malware payload", "value": "4a90ad4e17b4c9e98f910d549569efc2f9511a81", "object_relation": "sha1", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704195074, "uuid": "db706f9e-e501-43a2-9a87-e96c57014473", "comment": "Malware payload", "value": "4ab2d89c4f4456df223c29aad88cb3534c1c80f893718688604189ec2f013d268276c7350bedf1b84c26e5943cdfdbad", "object_relation": "sha3-384", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704195074, "uuid": "7605f7ea-da64-4c56-af50-9b5c4b2a6f4f", "value": "T1225533880E3722658FBB39CE72E78C771636756148A027DF8AA977027DF1085E1DB361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704195074, "uuid": "79d3e961-aeba-492d-84ae-1a33c27389bf", "value": "24576:1Y3azdwLlaG/5xbaOgk9eK6UNoSDkQhqmZJPkisWq7YZzeq:1Y3tJaAkODDrNobUZJvsYZCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704195074, "uuid": "77290f7d-8ab0-40e4-94ff-7ef593801c2d", "value": 1370043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704195074, "uuid": "24adb007-acf3-4161-b011-7f529506647f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704195074, "uuid": "cec0a041-843c-489b-8146-ce71d8513a2a", "value": "ADB.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085b8d03-a994-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1704216375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704216375, "uuid": "6073877d-ce6e-49e0-9e5b-537e94733fa5", "comment": "Malware payload (Rhadamanthys)", "value": "644353629197d796942abc812203c222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704216375, "uuid": "09bbf6a3-27d8-43ce-bd05-b52f316fd951", "comment": "Malware payload (Rhadamanthys)", "value": "4315c14af0772f50b9b383cae378f26e71e77156886209344791c7f931d6425c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704216375, "uuid": "0deac3ef-fc52-40f5-a190-bb41e9bab525", "comment": "Malware payload (Rhadamanthys)", "value": "3c6eef04307f1da7c8a7856ec839c5912b6294ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704216375, "uuid": "89a9097b-7b4d-4a6c-8cfd-b8c0d37c84e3", "comment": "Malware payload (Rhadamanthys)", "value": "2ace9f0b7c939fd30d112d434bf60be457c22f1c3247090c3a3d487eabc5bc586e619869f9cd4dd0d1a132c564e325b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704216375, "uuid": "9353dd95-bab2-448a-9464-f5ca6f4c86e8", "value": "T119352313BAD2ADF7D6E614311538BB6945FDF3340F1284CB672402425FA26C6DA3E2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704216375, "uuid": "8bbe8bc2-08f0-4114-81c6-795cb9352e60", "value": "40e5756c30e8a97a052538422b8f4b5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704216375, "uuid": "eb163448-5de6-4585-afc1-bb013132af80", "value": "24576:yMwHtUBsAoefXOVZ3PXBV5BMTnu4Cq5c1flhYHaRlIteX:yMwH3A9CZ35gIQcFuYlIte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704216375, "uuid": "d1794493-67a0-4fc0-82c2-4817ac934c72", "value": 1094522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704216375, "uuid": "3b16e6f6-38df-46e4-b39b-da36dd14c3d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704216375, "uuid": "53386fe4-72dd-46c6-90cc-cc36392ef1ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7141586-a950-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704187570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187570, "uuid": "dffa67dc-82df-4843-934a-add4a9a0a4a1", "comment": "Malware payload", "value": "d71e2d55ee0534b06313f71aefd921b9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187570, "uuid": "db09d5cd-5bdd-4997-b557-513a52ca0d6e", "comment": "Malware payload", "value": "43bdd5e0b846271a4bae3a4f74c8310b914497abd2ffe0e1886ec9fec9f25ecd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187570, "uuid": "85e771cb-dd07-48d2-a150-29b71c83ae24", "comment": "Malware payload", "value": "6c7713299bdcb1cc4046b7612775c24ddf68ad82", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187570, "uuid": "8e2ee536-f193-4e30-8437-e0a726440415", "comment": "Malware payload", "value": "d50852e836c286ea3b4053d96a5bbbc28dc42fbf95c9564d1e58695e693f586e0a7c16b9aef9721449743750d4d5bcdf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187570, "uuid": "5b9ee15f-8284-4925-842e-0aea689f475f", "value": "T1C8C012B15449D4B498512B83AA26451EA9D148513461FB53324098986618414071ACA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187570, "uuid": "19f9be8d-8c07-4c04-9f3f-c619d52e43a7", "value": "3:ufInAALWNm2iMILiVuWNiSG7AX+rSF55DAxfwHX+rSF55NqFIJF5DgWpeE8XMFes:ufIlikrqO7DycxfwOyk2LeWjG3SL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704187570, "uuid": "a52d8aa6-d6b3-4ab7-a799-5374eec06c4f", "value": 182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704187570, "uuid": "9a9e60a5-1f14-45b3-9e04-50484c804089", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187570, "uuid": "4f23cabd-8082-43b9-ac3d-873f01aaf614", "value": "shell.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f073d7-a970-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1704201117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704201117, "uuid": "43994e89-0ac1-49f0-acf9-7662e9fd210a", "comment": "Malware payload (NetSupport)", "value": "6062ae1a2625137d9e740133b1f62616", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704201117, "uuid": "a6d7f480-9e0a-4506-9f76-98eb66ca6c9e", "comment": "Malware payload (NetSupport)", "value": "45b46c432bb3857ff98a2f67f3480b85f8fb37f5df55941e875e2d70f87ca24e", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704201117, "uuid": "2afd60f7-1259-4b03-82c7-a031dec4036b", "comment": "Malware payload (NetSupport)", "value": "08e790eae58cf77d34895f3b5965d44e6872d3ce", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704201117, "uuid": "682dab7c-1eae-4b06-ab35-c7def3bd2f42", "comment": "Malware payload (NetSupport)", "value": "65d37db284fafca990faef24ebc8b1bb70759f3b9ca548d8100c269d37364c24acc534b1fba1c28f31e3437a0f0bd640", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704201117, "uuid": "0f1f73b5-a481-4df6-bcb1-8b5fd2f32f10", "value": "T18EC533523A83FB6BC0E2F17BE0ECBC561E2D6468D4FB76A7093EA5A2D535461C43B401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704201117, "uuid": "27029fe7-770b-4d2a-aaad-5b0d30aa1775", "value": "49152:wlAQumelDlEDThXBJOhHLw6J6h2SFFGf0RBNTQfYc9jh23eWeB3/YSBm7WIqR/uf:wl7/FXamhRFY89YYc9jh23redpmQR318", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704201117, "uuid": "3972229b-39ed-4e51-9d6c-696914bbd06e", "value": 2516748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704201117, "uuid": "e8b34c08-8b2e-4c16-bb09-9b67d64248f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704201117, "uuid": "0a474382-3ba9-4ec0-94ba-ca093fafd467", "value": "rtrs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be14d510-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704221834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221834, "uuid": "3e21f8c7-4dac-4c40-a73d-db59107d0a75", "comment": "Malware payload (RiseProStealer)", "value": "d446b22322adb2ee4d2f4b69fdc71dcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221834, "uuid": "d61196af-4c60-4599-8ace-1940829490aa", "comment": "Malware payload (RiseProStealer)", "value": "460be9287a7336de0f0996ef9f6bcedcfb72b693d5d7e8ad38057e64a8ae4f69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221834, "uuid": "af025b9f-64e1-43fa-8270-0fd2f23d2a35", "comment": "Malware payload (RiseProStealer)", "value": "ac5129d56c1610b3ec337eb83e0ad3757753ade9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221834, "uuid": "8e22b349-bdf9-41b7-a30a-c7144b853ce2", "comment": "Malware payload (RiseProStealer)", "value": "b5982fb71854fbb0be41c1a363d67cd0f8ad06aecdef1a8a684852b17bc3bc031e3e3c768493caa1f9594a5f6a118890", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221834, "uuid": "dc335c50-6d40-41b0-9c13-1e5b252d82eb", "value": "T1B5C533836AC14470CEE52770A8FB47CB5A30BEB3A964565F65409AD108F39D1F139B3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221834, "uuid": "fdba173d-fab4-4aa8-95d5-0f9dd6c178db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221834, "uuid": "887cbba5-6eaa-4e79-9648-43ace30ff669", "value": "49152:6z/PMA7iR4Hdl2c2sBKnglGbJtkDM4V39Ikn8qudLGPmin5jZFfNbO:WPp7GklmSKnglGdtoN1JWqn5jZ9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221834, "uuid": "4efe1ecb-b029-4f18-aa7c-7552140d3bdf", "value": 2604544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221834, "uuid": "c0347b36-73c0-4afb-befe-e6f9ebeef721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221834, "uuid": "76e84f9e-2681-4eea-a647-76509e48361e", "value": "460be9287a7336de0f0996ef9f6bcedcfb72b693d5d7e8ad38057e64a8ae4f69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b7c998-a9ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704227085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227085, "uuid": "6b23f93b-fa3b-4459-a854-db902d8b7ee7", "comment": "Malware payload (Mirai)", "value": "bae00cea5c68868a4b699e7a595fb992", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227085, "uuid": "dd5d7a21-745e-4768-8ff3-79a9a85ccf60", "comment": "Malware payload (Mirai)", "value": "46418981d8c7846bc82ac055492dbfd6f30f150c4ffcedd75bd42dbefb2912c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227085, "uuid": "212d92ba-fde4-4de5-a6ed-0bb5154fb2a5", "comment": "Malware payload (Mirai)", "value": "ba6ebf8b05183defadb2ba14f4b82068ddf56467", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227085, "uuid": "23cb1531-a68f-4eff-bbb6-21e7fc861494", "comment": "Malware payload (Mirai)", "value": "abd5b039462afb9bbd08dc7afda3670ae88acdf9d4006e0b6d5f9256c3140f61e0e5ca014dd3ce8f9d25b977fabfed22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227085, "uuid": "70ea4c80-d12c-4c8c-ad27-0e9da6a30c14", "value": "T12AD2E12CC95E6D05CA6D3EB951DE55B5384C70C0635DE6CE1B268458B72BB87EC070B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227085, "uuid": "2d408b4b-6e46-457e-a524-f48906603c38", "value": "768:r1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNhvYcSJbaWUb:rbDs06t4BEub4sU/MbUhbSOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704227085, "uuid": "a477aba8-3642-44fc-b6c4-d27aff4c3de6", "value": 30316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704227085, "uuid": "0688c101-eeb3-4d11-8cfa-2bb4669bb838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227085, "uuid": "67f8a5ba-2c60-4b86-8379-1e41bcc79660", "value": "bae00cea5c68868a4b699e7a595fb992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01519f9-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704221891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221891, "uuid": "6dac819e-314c-40bc-96db-19c2b707ac58", "comment": "Malware payload (RiseProStealer)", "value": "cea32f770e1620de29e73acbc718a38e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221891, "uuid": "f43fadc1-c2e3-449b-96db-dc71ad9fd8b9", "comment": "Malware payload (RiseProStealer)", "value": "46a740caf7240211b8c2eb2ea95f5a8742a6d9002af7053100f62720aa7e5cbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221891, "uuid": "54aaa0cc-dc63-40a5-b8cf-1646b7fbbcd3", "comment": "Malware payload (RiseProStealer)", "value": "32a7f2f7a42a28ea751fc1decc2c67e717295e5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221891, "uuid": "100fe474-be25-4157-8395-77a86bc4b0bd", "comment": "Malware payload (RiseProStealer)", "value": "eb91ee9abee248e7a021c799a96678403ca8ede3e877580c8cf1915f692f6dfcf044a7fe0edf509db4a9cf6d0daefc69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221891, "uuid": "36c8a33d-cc25-4986-bb71-a3d4453a09c9", "value": "T162953303EEE85131E9F95BB498FD138B27347CB06E7493272B60CB570CA3994646636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221891, "uuid": "d3d3996b-907f-49e2-a035-247c10a1b0da", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221891, "uuid": "ac35ac17-430d-401b-993d-2ee7e30f8627", "value": "49152:JW5z1o02R2cFNGLoygKtsbEMZV1rvX50VeV4mhQ:gE03yNFRbEMR5cea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221891, "uuid": "ff3da00d-bfa3-4231-8471-06e2e25e226d", "value": 2040320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221891, "uuid": "f302ad7d-d20a-4751-97cd-6c596b401155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221891, "uuid": "105ddcb3-7d92-4640-acf9-729fb4d62ce0", "value": "46a740caf7240211b8c2eb2ea95f5a8742a6d9002af7053100f62720aa7e5cbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f856f4c9-a92e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704172969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172969, "uuid": "fe136209-d8fc-4f56-b137-d8cee77e312f", "comment": "Malware payload (Mirai)", "value": "0666e35d7a5d52cff7c113b367ddbaac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172969, "uuid": "bdc7c40b-6f80-4476-8e9f-c3e79e8378ca", "comment": "Malware payload (Mirai)", "value": "46e8aaee811d697d728f1d9bc191decac381ed8989aefe0d28a182541e3dbd30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172969, "uuid": "0c2d2968-6d48-4ce7-a343-8a205d81a9d6", "comment": "Malware payload (Mirai)", "value": "15fda64fee5c412d5c69048e023b1b3f0e45ec13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172969, "uuid": "a64dbdd4-da69-4b82-96ba-ac0a8627293f", "comment": "Malware payload (Mirai)", "value": "c8d10068a7ddae512e4c8651854145eb183ee7d4d2d4bfaaab7ffb034702c4be8026239e15d52f0c8f9db29e555f0187", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172969, "uuid": "718b346f-2c76-480d-8e34-e1eeeb881333", "value": "T1B5F2E0CE94862C9BC85E5C3EE39C53A0DC68618370186B1DCB515D2F9B36986FC8F5B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172969, "uuid": "9d430a9a-2f7d-4c09-bc05-3c199d4e4e0e", "value": "768:X2vTZErgtTXmuDmCAxfSg6F3PeoQZclkZDy6Q3WMdk:X2vlEMxX7DLAxfSg692fkkM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704172969, "uuid": "b05e45e9-097f-4176-82cc-44bf518dc333", "value": 34540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704172969, "uuid": "801ca956-1672-4109-9a89-69085d57b1bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172969, "uuid": "19999be0-0f20-4d39-9eba-60e1be37ca1a", "value": "0666e35d7a5d52cff7c113b367ddbaac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11770b38-a9a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704222403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222403, "uuid": "81af4dc9-48db-44f2-aa1d-4abc87be1d92", "comment": "Malware payload (Socks5Systemz)", "value": "ba22528f4ee0e940a3072e216d1113e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222403, "uuid": "cc021075-395b-4d01-9725-9b306ec15c72", "comment": "Malware payload (Socks5Systemz)", "value": "47dad8008a4505593c2626d8d1e4489e4626a13d373e749fd231434a10e1ff54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222403, "uuid": "f2051263-20ff-4e06-9f96-ccaec84c486d", "comment": "Malware payload (Socks5Systemz)", "value": "48dda84e4f1042cca1cdc3747a5033fb28897177", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222403, "uuid": "4d1cb438-d398-488e-96c2-d5e059fb6acd", "comment": "Malware payload (Socks5Systemz)", "value": "af0d94f6145e77e53a0dacbdc4dd22477f12d7881b6af0927286cc25a57fb30266c2031882dd1bad20c9303b57849681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222403, "uuid": "81babc49-1e2a-4bc9-a6c8-3a794dd57038", "value": "T102263342A014557AE171F6B38C44802FD0B7AEFD2E79420ABA6E4EDC6BBBC075550737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222403, "uuid": "1896d607-5bc6-442c-96de-7d0a4a2e3487", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222403, "uuid": "9b9eb173-3b1b-45bf-9b8a-408b0087e816", "value": "98304:QtrQv/c+SBacDCMBhwTUSCzk2qui5OrOrgLQxuskFvZBawmdc4dm8:CQv/cpBacOnUSCzBM6NxUdc4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222403, "uuid": "b672ecc7-991f-4064-9f31-bf8750d97b7e", "value": 4573799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222403, "uuid": "c4d395ac-710f-498c-9a3d-94523a7803cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222403, "uuid": "36426c7b-e2c5-41ef-96cc-30bcea675e61", "value": "tuc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5674f8e-a9ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704227054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227054, "uuid": "75a6ee27-ffe2-4135-a195-3e9b0977526a", "comment": "Malware payload (Mirai)", "value": "7fd0e8dcc1f9258b4bf632464b873c55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227054, "uuid": "05b6bb75-4f32-40d5-99bc-9faa444a7297", "comment": "Malware payload (Mirai)", "value": "4811bf0aa1b3ed16411d205d67811fa107400c7c50b57cd64b30250204fb3fb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227054, "uuid": "450a48bd-4dbc-426b-b384-fad63cb83d8b", "comment": "Malware payload (Mirai)", "value": "74238979f6061df2370a0a695fe3db9cf4127146", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227054, "uuid": "4c06ce61-a63a-4be3-b007-14f66d457fdf", "comment": "Malware payload (Mirai)", "value": "229ff3b1de6bde6d10edc5531ebe20455c615876ec6a49bdab93aa8ca03a936ab069ed44cc69febc00c68830ce54ae71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227054, "uuid": "cc4fe0a5-f667-413f-b08e-560b012f822c", "value": "T17F735D24A97D2E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227054, "uuid": "73e5c3c6-dfd7-4cad-a075-56abacf364d3", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8Jf:YwfdNu4cmZvFqI3w7Jf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704227054, "uuid": "8cde757d-2d8a-4652-8e24-d06c371704cb", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704227054, "uuid": "4556bdf6-da50-49f0-a4ed-c47c2cb9334e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227054, "uuid": "70a5f24e-e0fe-462d-9833-5e0802dedcf6", "value": "7fd0e8dcc1f9258b4bf632464b873c55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b971dcd0-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704221826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221826, "uuid": "eed1bdd1-12f0-40c0-9c10-ac463932c563", "comment": "Malware payload (RiseProStealer)", "value": "45bfa537b4d47af96b95de098be10f44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221826, "uuid": "3ce0bab2-e633-4a23-8d4f-ac9dd88a2e26", "comment": "Malware payload (RiseProStealer)", "value": "4c062e33871e165914ef7883c4c82492b2e2d4623b30e0288d3c1ac9038f1e7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221826, "uuid": "07877a8c-1aba-44b2-9157-210152c4b2f8", "comment": "Malware payload (RiseProStealer)", "value": "47ed1c9a0e88769d5a19bc0f3188b5dad8a81663", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221826, "uuid": "8e45f695-01ef-4120-a1ec-088436b2bad6", "comment": "Malware payload (RiseProStealer)", "value": "3eb7c11c6f6a46bab2187e2e97f5d83944dfd2d5144b69f98c6bcd117d9bc3fab6da621b72815130932517f6700016e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221826, "uuid": "b823af9e-3c6e-4fb0-97af-8d6617317f66", "value": "T139953343EEE85131E9F95BB4D8BD038B17347CA06E3493372B50CB570CA3995A86636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221826, "uuid": "8f9b6a49-6460-44e6-a99e-f5bc46ee3bab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221826, "uuid": "142dde82-8fa1-4487-8ad2-ca811b44e038", "value": "49152:mU5z1o02R2cFNGLoygKtsbEMZV1rvX50VeV4mhQ:lE03yNFRbEMR5cea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221826, "uuid": "9db86287-a90d-4328-bd73-a3b969bbeb3d", "value": 2040320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221826, "uuid": "dd69f42a-01fa-4f17-b237-d2e1966841c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221826, "uuid": "ee6d7d92-cf07-46af-bb50-87885a4f417e", "value": "4c062e33871e165914ef7883c4c82492b2e2d4623b30e0288d3c1ac9038f1e7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d27d86-a914-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704161664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704161664, "uuid": "50190cdb-d445-415b-9e6b-36273e0be6e1", "comment": "Malware payload (Mirai)", "value": "a46fb07977551d234d162eb3cb157b43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704161664, "uuid": "4f4d7f90-e016-4111-aaed-3dc4d50b3620", "comment": "Malware payload (Mirai)", "value": "4da1443a2e9fbc8b88ef8d6653142568c586ddbeaa2dedeb743ca9cec3eb0552", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704161664, "uuid": "76744a08-2639-4cc5-b6bb-4bba086efed9", "comment": "Malware payload (Mirai)", "value": "5fe8981f409a277bb7f846cb4c3132c09d50b057", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704161664, "uuid": "bb63a030-9a83-4059-afb5-63acdbcd2b48", "comment": "Malware payload (Mirai)", "value": "90464079523ff2a829b97c2938db57eb4c57a977bb5667f1f9b62c7c84b1e25a883e53eda4420f7ee301cd63ede46a93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704161664, "uuid": "b150b06f-f764-46df-9171-824f44e77c39", "value": "T12613F18396A5CBC1EB2AE8F2BD7D36B96D2ADE92B0FF56938108545D0F8E040016F175", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704161664, "uuid": "e6397a85-86bb-4006-86c2-8d9dd2c0921a", "value": "768:6phrICtiuoeSax6z9rAMWvwl6J6rHDxAF50pOSPZ/rjuwsw+jrFYww7XRt:6phDB8ax6tFNwsD65uPM7NfARt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704161664, "uuid": "481debe5-73c1-488e-aae8-4e8e2bac2a94", "value": 42884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704161664, "uuid": "82ec5871-0c3b-4e67-adbb-8979b4459619", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704161664, "uuid": "56ef2f06-8cd0-4fa3-b433-323d22a58df9", "value": "SecuriteInfo.com.Linux.Siggen.6334.9424.21028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355661c5-a9a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1704223322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223322, "uuid": "0e20e779-6eda-4175-805c-af078c87477f", "comment": "Malware payload (GuLoader)", "value": "8efc22ce2ce859b7b2f19802b4798c5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223322, "uuid": "1fed1b3e-f9d0-408a-9cf6-ea1a69a338dc", "comment": "Malware payload (GuLoader)", "value": "52ec0772eb7a1e76c0f99e8dcc8b377a9de782fb744d5be7386ce8c765162409", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223322, "uuid": "1117dcef-3499-4c1c-8c25-721993e68151", "comment": "Malware payload (GuLoader)", "value": "1172be08007abbdf2782c9f5a6f4cbf97dd01b58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223322, "uuid": "2fb1c523-ed04-4adc-8dbd-198a82e426b8", "comment": "Malware payload (GuLoader)", "value": "c6e23cb240518dbe0d34070a6106893d59b8c3894f24bc5543c8ecb9ca101b704ff8c14c5520218ba9ebd0f526d99ed0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223322, "uuid": "300358b7-c50e-48cc-85e0-330ffb2290e1", "value": "T14E263301BA34EB23CE2886710E7553DC1B52FD7511209966FBA83FAC7CB97939401B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223322, "uuid": "9e1a8ddd-a81c-40f7-a96a-49567d7df7f0", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223322, "uuid": "b3decc27-f5b3-4ba8-b630-bd9d62626c4f", "value": "49152:vP7OO75f2R6Hjz40wOUNvzsaSSq7tceaMget9WD5W5VN+JCuyz9p7kuc7ioYRpuj:LfAEHbwOGz5ytu/scOoYOQxwzvkiArI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704223322, "uuid": "22d34b67-709f-4cf1-8709-e5a5329558bc", "value": 4544047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704223322, "uuid": "fd47eeac-a5a2-4ced-8ba2-c0776aa134f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223322, "uuid": "9779283b-f5ad-4cb2-93b8-a3a199163cd3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdabe447-a9ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704227095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227095, "uuid": "4e03ac71-4760-4fbc-85dd-f092c863cba4", "comment": "Malware payload (Mirai)", "value": "60dddfdc2897815088f1e6aef25ff966", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227095, "uuid": "0358faa6-ba55-4e27-9b32-60c36150f2c7", "comment": "Malware payload (Mirai)", "value": "5b39f491dcda7d995b7fc7e304641335df795fc3dcc0d97eab76dd075d3b2d64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227095, "uuid": "b3b9b28e-4844-4b1c-801a-c4e85990580c", "comment": "Malware payload (Mirai)", "value": "52df6c486d05601ca5ef9e64cd5a43af260e4e97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227095, "uuid": "4b9b61a2-4bb0-4d13-81f8-d7f5e4b62fa8", "comment": "Malware payload (Mirai)", "value": "e92c769250b0ab140c4586e267c7d40bacbe47099ce2e4ab89f2587c931311219efb01ca1cff356add2fde88d3877f5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227095, "uuid": "b941aaf9-1cf8-458c-a7ad-6ed6f98b99fa", "value": "T1DBC2D044F082DE06DFEA29B03E40DAD7BBD06F1E79628E80669593D25A1D3A34305DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227095, "uuid": "1a6682b3-2c6f-4100-b87f-6a161022bc4b", "value": "768:CVdafO76jpmNJJKehmA7trpfIX9KeA7PBd4uVcqgw09k:mam+AnKehPRa9aZd4u+qgw09k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704227095, "uuid": "d2b1441b-fcb9-4c9f-92fa-6003a647692a", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704227095, "uuid": "0a241d4c-9489-462e-a34c-5c7563d1e6e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227095, "uuid": "a403e998-2eeb-4062-ac68-6ecb47829486", "value": "60dddfdc2897815088f1e6aef25ff966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0925e457-a9ba-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704232697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232697, "uuid": "3314cc82-d07b-4d90-93b8-9aef4bef9d51", "comment": "Malware payload (Mirai)", "value": "05a5c5d5af0b551337a26f8164a8c950", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232697, "uuid": "f7141e6a-6d7c-4d3a-9c87-5833883217c3", "comment": "Malware payload (Mirai)", "value": "5d1c1302458cd715172c06fb186d4e0281cd1adfb09fa40be22a4b2459f57191", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232697, "uuid": "77416c5b-4bac-4d73-92ae-22a62b8487cd", "comment": "Malware payload (Mirai)", "value": "7919906d8ee0fe06a820e4cf2b76c3422cb74a3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232697, "uuid": "dc2169e7-dac4-4f06-a25c-e1db06433180", "comment": "Malware payload (Mirai)", "value": "60e7e7a25852079669a02d127aa513826688db5dc2cbb69f9977c3d6b1d4c1816c0da148a039dd6fba0ce653cda24e86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232697, "uuid": "cec88b6a-756f-46b0-b566-3bafeddfff81", "value": "T193F2F1A3F3757C85CA320036B5968265BE2B56B5F2EF7077711819180783E836EB65C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232697, "uuid": "17aa7b68-9bb6-49a8-b679-da8a287821a4", "value": "768:qevqcHC7btdbQLj8l4Xsf86bwKUX9ErbewXQm0qys9q3UELE56:tvqB7JEj8L86bwKG9E3Qq4LR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704232697, "uuid": "4ef3f3cd-3a4b-41ca-ac04-316b891299df", "value": 37260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704232697, "uuid": "b69fa5ba-9c4a-495e-bd1d-c261d5b55c38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232697, "uuid": "a4be7550-3a21-4161-a11d-182759a52ea6", "value": "05a5c5d5af0b551337a26f8164a8c950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5f6436-a907-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Carbanak)", "timestamp": 1704156091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704156091, "uuid": "8e5bde52-6aac-47c9-b650-738a516e86e3", "comment": "Malware payload (Carbanak)", "value": "a25c475045e24d3c832cca216935890f", "object_relation": "md5", "Tag": [ { "name": "Carbanak", "colour": "#11C35A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704156091, "uuid": "7ca88b6a-a5ce-45b9-a74d-922c2b025f28", "comment": "Malware payload (Carbanak)", "value": "5ddea1187e48e56a27f1878198a899c68a4a690105eb8bc5d687a698a94d64d3", "object_relation": "sha256", "Tag": [ { "name": "Carbanak", "colour": "#11C35A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704156091, "uuid": "1c2d978a-b44b-4b39-a632-e3537eb38a4c", "comment": "Malware payload (Carbanak)", "value": "52b14d9ffa6fe9c451ec854adfce8bec63da188f", "object_relation": "sha1", "Tag": [ { "name": "Carbanak", "colour": "#11C35A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704156091, "uuid": "c73e7d90-dced-42c2-a7a0-b0810ad27b09", "comment": "Malware payload (Carbanak)", "value": "83b8ec6a5a0969690d6c8d1932cb47e849e8e76ffb26505dbe1552b4352fb4b01e5a16218fb375addd246837888bf808", "object_relation": "sha3-384", "Tag": [ { "name": "Carbanak", "colour": "#11C35A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704156091, "uuid": "ae3fe103-3983-4d8e-a54f-5c7ec2cfe4a3", "value": "T12074CF8B72A402BFD17AC138C9935616D3B2B85186759B6F03744AAB1F73360AD3E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704156091, "uuid": "dca54c55-f4a4-4115-ac8d-c97c1ad6b2b1", "value": "5d1a41d2e6f1f5f2a0598d90de6ada88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704156091, "uuid": "e840265c-95b8-4072-9878-6d9885446893", "value": "6144:OWhNtMnYjAngU9o+Fmd5cDG/OzevLYZMl4c+3nJr1DLXbhhbQiN:ZUgU9ooQcD+Ozevc+Wc+Z5LXbhxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704156091, "uuid": "6a4eb1f6-1729-4ad6-b3c4-020dd903c77e", "value": 352536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704156091, "uuid": "b7f38cd0-752f-48fc-971e-99d5f8d0ddf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704156091, "uuid": "5ed6962e-333d-42d9-b697-8214797e79f1", "value": "out.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe82020-a9ab-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704226535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704226535, "uuid": "39238821-af4b-42ea-b85b-95de21566421", "comment": "Malware payload", "value": "f981f6cd61dbd17127d32962b460befc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704226535, "uuid": "549df56d-2c73-4da8-ac4e-470cd7d63fc5", "comment": "Malware payload", "value": "5df31e46f15c77096b313abf366db8a95da24d37c81be89de970a457c120c543", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704226535, "uuid": "46499107-a76d-4b44-a0b8-71e9d796e4e7", "comment": "Malware payload", "value": "cbe874a5d6d2549c22734bb7ff5eeb9982a52324", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704226535, "uuid": "3269e203-92f8-4e64-97fa-712a4656a002", "comment": "Malware payload", "value": "7037d87fe5d5cc693392a065d7c0efd8ae880fdf5c2d43183472e2561cd8afc0051d3a05c8bb7d19399b76b408a7460d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704226535, "uuid": "0a34b7fe-7019-4dec-8c30-7a73bc70acb4", "value": "T14962C02ED287A629E71DBC747BAE52E7C33DE08E1295872B568846700ED8741F07D9F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704226535, "uuid": "ddd528e9-3d51-42b7-8d27-ccd9d948ecb8", "value": "384:rs1A4KmgvJ1AlhKVj39INAZ8vFfZnIu+d9E/Zu16afqcdVnWSm:rNI41GhKVZa0GF+aZuwahdVWSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704226535, "uuid": "f8750cd2-4980-4747-9316-7385d85fb75a", "value": 15052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704226535, "uuid": "3daa9808-30db-49b3-8602-563ee03113c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704226535, "uuid": "7cf1b285-cbce-4ef5-a061-18a6c2cd5206", "value": "SecuriteInfo.com.ELF.Gafgyt-AN.22662.9789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7349c6c-a94f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704187114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187114, "uuid": "ab4a8c95-5c7d-4abe-8402-bd4c49ee09dc", "comment": "Malware payload", "value": "56460744d85bdaa85ee5c03a914a2403", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187114, "uuid": "b4f04a64-1817-496a-9e82-9f2f854ced0b", "comment": "Malware payload", "value": "5ecd5c944add5f8f1e5210d7e671e45747ae13d94a993db46c3d8bf049086adf", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187114, "uuid": "3f2346dc-1da9-44c5-b446-252f8461e24d", "comment": "Malware payload", "value": "a0c1a9059f7e9a97966d81572659a7b2b38d97f8", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704187114, "uuid": "c620570d-45d0-4036-b961-b947e454df43", "comment": "Malware payload", "value": "abeec6ba5fc32646e8b818a8ecff1aab0c28642b70d2e1efd26633246dcdf55df7da9a1ed0fc64f384905e15756ccb09", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187114, "uuid": "1574d720-2efa-4546-9970-5ff9e303d96f", "value": "T1B5925BE7473E337AD73D2E61989E39838A83F92497D0F8702DF20A8B6A381955D13754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187114, "uuid": "6f1da28e-c281-43d1-b360-1ecc7b3606b3", "value": "384:V9RJ0a13EBlwg7Kdi8jRgzcOo7R+cJNWo/9pt9RJ0a13EBlwg7Kdi8jRgzcOo7Re:V9RJL13e97KdiAgzcOoV+cJNWG9pt9RK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704187114, "uuid": "b5536d3b-5092-4dfb-9c9d-aea2224ce47d", "value": 21183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704187114, "uuid": "3d53f4c6-c453-42b7-b9ae-817fc412b579", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704187114, "uuid": "53031f45-f960-4416-aa88-73f25e796c86", "value": "wxQQfcx.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67794840-a9a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704222118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222118, "uuid": "619c5d8b-027b-4ee9-b080-dd7f33f03dfe", "comment": "Malware payload (RiseProStealer)", "value": "e61ce9b038b0c8577003098487f20471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222118, "uuid": "820e5a73-7f90-40ca-b261-7943a43f056a", "comment": "Malware payload (RiseProStealer)", "value": "602575847ec3c1ff6d89ec1f78db941311bcca756de620433038c9d440127f6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222118, "uuid": "26811927-49fd-4fd1-91a2-5fb246d21df8", "comment": "Malware payload (RiseProStealer)", "value": "b6dd20cec3e770ffb9b397fabe71059026a43990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222118, "uuid": "8b67fad5-74d8-4d7f-9ec7-7b4cebc2f0b5", "comment": "Malware payload (RiseProStealer)", "value": "e8502062ad46204d4dad0d758ab11bb6d39d1b6426c7a1b34b2a27662a5d2bd86c4c537c7ce797a61919048f778ddbe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222118, "uuid": "3e6b2beb-157f-4490-87c6-34dddd6c5543", "value": "T137C533C657C15572C9F01771A8FA52C71638BE73AB2C670B7580EB9408B39D4B439B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222118, "uuid": "8d27a6a3-d2e2-46b4-825e-b56f9460706c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222118, "uuid": "52c47103-4f68-4e57-8dfa-a8257852a215", "value": "49152:Gahvwh5C2RmtdI2gVSOzJWg63I+TYoj8+s9lnKwy5hI2hYftBW:FhuC/vI2gVSOJEJRtUG5u2hUtBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222118, "uuid": "da4aab74-3d30-4c56-9f01-68486050c9d3", "value": 2605056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222118, "uuid": "2610dec0-6131-4401-9031-8466d41b790d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222118, "uuid": "a8d237c8-3b9e-48de-8e2b-719f6ffe6719", "value": "foxi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56072dee-a917-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704162818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162818, "uuid": "e6a378bc-9e3e-4467-b85f-08857262413b", "comment": "Malware payload", "value": "a62c7e0e471b256befe80979a4e83226", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162818, "uuid": "a1223855-57fa-4db6-8ef6-ee284f5efbd8", "comment": "Malware payload", "value": "60465cd81a381108fe19dee84619cda10837847f9d4be8a7642dff797cc8754c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162818, "uuid": "90c62ef3-a653-4f32-a612-3f5772e8ac00", "comment": "Malware payload", "value": "40139531938c87062dfc30a923946af1ca4b2b10", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162818, "uuid": "9ecf74b6-7ca1-432a-a8b4-84b35fb3d77b", "comment": "Malware payload", "value": "328cdea73a7560aaadc8b9797b3acc265ae8d758519978d32c3c1a91e808bb29be0e284a2928cc3e3c2de0a168a45955", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162818, "uuid": "a11ee646-a1f9-4d9b-97a8-fa5434846e78", "value": "T1E0453325CB8DE61017DD12BB5EF71263782040A2DD7BE6F31601A2438DD62626A87FDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162818, "uuid": "1a9269dd-b18b-4d2c-8ed8-7af397a50f5b", "value": "24576:QEAXsqgg/JQJNW3ioLSwNT0aXyZM3uUDEqQ4BbO+RH6c59K:lAXRJGNW3ioFNT0mL3uUDEPabJac59K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704162818, "uuid": "e383a783-30c6-455d-bd23-04fdb1bd87c4", "value": 1189408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704162818, "uuid": "90555cf9-535c-4f61-8022-f0865bb2793a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162818, "uuid": "1c67e622-30b3-45d4-8c8a-233e63aae20e", "value": "linux-armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b83152-a957-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704190527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704190527, "uuid": "21dc2733-72cb-4b5f-b3d6-d50de52540d1", "comment": "Malware payload", "value": "a164eec975f5cceb02bb9125d78a905d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704190527, "uuid": "dd01a791-3c09-42b0-a612-74a21f58be96", "comment": "Malware payload", "value": "60ae7d873b841b49cf5a7ac0d679428faab3a695148c62428f430f24f1e1f7c3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704190527, "uuid": "f26afd82-ada8-42f8-85d5-909564b218eb", "comment": "Malware payload", "value": "d6d48d26a52718cb21871fb6182be223c5ada3e3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704190527, "uuid": "fc2bf73f-13d5-49cd-9169-8586b8cc914f", "comment": "Malware payload", "value": "bec759833e37ab3cc63dc0a1c2d68ddb60bc31f3f7a99dbfc3ee8d67276a82cbcf40f02ee3f97c455729bacc06a6d530", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704190527, "uuid": "368a62e9-ef9d-4775-943b-bd2766283a17", "value": "T1B5D3124AB828E95CF62BC8705CD1CC64DF877A4641FB93AF6F8C807080D59A5A85BF35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704190527, "uuid": "28a3309f-b9ed-4d5e-a849-e8625d36a5ef", "value": "1536:J0yzl1hB6YcSfp6MjMFH6H3agEkuS6DMvNDbvQrOXpwGA+HhSuh7Tv3u/pSJgG6h:RHH6YbAFHUagUDeNDPwR+/v38Yv6gBSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704190527, "uuid": "976fa49d-2778-42f3-b54b-854c2ea83bce", "value": 131426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704190527, "uuid": "2a7475a7-9f2b-401f-8192-b91789105287", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704190527, "uuid": "08c1548a-bf8e-422d-bdcb-3dabc59a1216", "value": "02-01-2024_Dosya.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3824fd-a9ba-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704232702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232702, "uuid": "79ef7dee-6d10-45c4-bfea-192a855dd8e3", "comment": "Malware payload (Mirai)", "value": "a41dcfe3d2b113ed5692c8661266367b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232702, "uuid": "5b0f3474-11cc-4604-a18d-335fd138e14e", "comment": "Malware payload (Mirai)", "value": "62c0df2b5fab25055637bc768cc8614f352d552aed567e78f296ac3d8e7d4d9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232702, "uuid": "1cf82e6c-f767-405f-a382-02390f002a4c", "comment": "Malware payload (Mirai)", "value": "d7b6438727d4181ec8c32db1f33b3a22ca22f7d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232702, "uuid": "31465c45-889d-4c8a-9bb5-d6db014a281f", "comment": "Malware payload (Mirai)", "value": "18ab63543de465c5fdbfdbf192a8e63180622e6f7e424b79d049a2e5e9a6d9a22ed2b0f0c3a37de3093222fc908496b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232702, "uuid": "d305fde8-e90f-4cf2-8e62-de130e0e368e", "value": "T106634CDAF800DD7DF80FDBBB84270509B531A39601830F36676BB957AD721A91827F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232702, "uuid": "92c6a1bd-7a1d-484c-9abf-f1666818150a", "value": "1536:JeQg4n3WxLLOUBzH5i580qbfmPHhfs00t4T3BBI5ybNQ:JeQgl5VH5i5w0hf30WoeNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704232702, "uuid": "485a3cc4-f354-4cb6-a7e1-eddb6180e0fd", "value": 69232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704232702, "uuid": "33ab0109-6a9e-416f-9020-7531d45a14bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232702, "uuid": "57c3b320-6403-4765-baa2-6420d13cba4b", "value": "a41dcfe3d2b113ed5692c8661266367b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1ab707-a997-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704217804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217804, "uuid": "184fb9d7-0b66-49ea-a4e7-66ce42e58f21", "comment": "Malware payload (Mirai)", "value": "bba79335e66b8f84b6afb3e9aa1de158", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217804, "uuid": "5ea6bf54-3d20-4dc8-ba27-178d4e59ccdf", "comment": "Malware payload (Mirai)", "value": "64a71dcd27b0b121917720b2726f78c21bff7854635b1c7963df902aab407d30", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217804, "uuid": "1152302e-d832-495d-9357-c33c25106d01", "comment": "Malware payload (Mirai)", "value": "ef8cb5f82c6dab96db05d0922720fa519b88f62b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217804, "uuid": "90037035-20a1-45b4-bdf1-03afbaacfd79", "comment": "Malware payload (Mirai)", "value": "55034399dc2dcee5c72cd1e16d77e1132d08c6aa590335ea13c7537ecfbe50fdf4d25a99ae80a7ef86c7d09aceb5b002", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704217804, "uuid": "02f09fb8-d3b5-474c-959e-0f1698646b7f", "value": "T133E35B46FA818A13C4D527BABAAF414D3322E754E3DB73068D186FB43F8675E0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704217804, "uuid": "f7a16889-7f9c-49f8-8893-21c2e7a90bdb", "value": "3072:QpSPwv7itGt2U5IHqCT7BxSmWKXnF1YWS6b3+7yyaM/90bp2V:QpS4v7iwt2U5IHq2TWKXnF2F6y7yrM/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704217804, "uuid": "7197b050-81d2-491c-bd23-fb2456d79181", "value": 152972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704217804, "uuid": "f1a43f48-c098-4c8b-91bd-70b2bf83f046", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704217804, "uuid": "affbcbc9-bb82-4e89-b9ea-231f33874ab1", "value": "infn.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671854f6-a928-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704170148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704170148, "uuid": "21800d9d-affa-4cde-a3e7-71212d574575", "comment": "Malware payload (Mirai)", "value": "9fb00b0fec19bd706c035145fafeb45e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704170148, "uuid": "e28c167a-71e9-4646-8389-9099b6f17776", "comment": "Malware payload (Mirai)", "value": "64ce40182934176edcf9fa7f97507ead52d5da9a9a5f35be2f6a67344d3e9bcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704170148, "uuid": "3dd0a456-a72c-45f2-b415-e2700c549155", "comment": "Malware payload (Mirai)", "value": "bf4fbc1fb6ee78b1b45f4c3f4a5a18dc764b5a39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704170148, "uuid": "de45dace-3926-4aae-869d-11d959d439c0", "comment": "Malware payload (Mirai)", "value": "bf8b6e97a6651edc45cc8ce782d6f3a55512e0fe506bf4aecd65744e7395b889425e4e411d989c2ccb8a69130dbdc86c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704170148, "uuid": "3d0945e9-9b9e-4f2c-8abe-8b92b3349b70", "value": "T1C11302BE7480CF10D1F9267256454A6EF92B8AC9DCCF3502B78468A83FD2EC1C26C599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704170148, "uuid": "faf27cf0-29e6-4692-ae3e-c19ba5c1cc35", "value": "768:qpbymIQFehKALeCPIHbHfDuWKEZGoSNCYK7NOtgGZbJudAjIDHrPmRZsdVS:YumIwehnLa7WEZGomCYBtrZaAjIDHrPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704170148, "uuid": "773bc9ad-f5df-4c3b-b0de-3149d33d2bd7", "value": 42288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704170148, "uuid": "bd3a1e21-0779-4a04-8afa-9d9291d3ee86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704170148, "uuid": "c9d5e845-fd1e-4b44-8ebc-76bc34f422c3", "value": "9fb00b0fec19bd706c035145fafeb45e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819b1833-a90f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704159455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704159455, "uuid": "f162bdbd-761b-4e3c-a9a7-016731b0b033", "comment": "Malware payload", "value": "d71f1c7acb3a6956566b882cad135f86", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704159455, "uuid": "23976d9d-b50c-41ab-8395-9aa2e5839f55", "comment": "Malware payload", "value": "64ef1ad529910b2fcb07dc3064d79a688b6237cda97b68074cdab1ea2a3024c6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704159455, "uuid": "10ade427-2c4e-42d2-925b-696eeec806db", "comment": "Malware payload", "value": "60dce95145ab22b64e73586cf52a8f2e2e8a2e2e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704159455, "uuid": "7cbc29d1-7524-4863-830f-78aa11eeaaa0", "comment": "Malware payload", "value": "10a9009b01be630dd31d8ce88b34fb2606cf05ae45c58a6614855b7a9af20bac6fa09edf072f0b00eea6e26c1e86a3cc", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704159455, "uuid": "025d4ece-d3c8-4d0c-b2ed-26e9cc210d45", "value": "T14F26BF217D9EC136E63F06319A59EA2B953D6DE20BB104EB73E4BC5A16709C25332F43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704159455, "uuid": "794f9500-8814-40c6-b4e7-3c42e94de739", "value": "49152:26QFBeWK9YwPhH9D+g5jvum36W547vM9kgMV3NSmzoDWM5LnbE53ChpP9gY0dB0l:2VmD+nmq3AW+mP0a9H23Xs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704159455, "uuid": "4bc563f1-48fa-4424-8755-a7890948d248", "value": 4788736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704159455, "uuid": "7163813a-e46c-4373-b923-e6b42e6bf073", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704159455, "uuid": "ba826aa7-5eb8-4b49-bad8-c3a4139b61c1", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e38206-a95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704192995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192995, "uuid": "208f8ee8-b725-49ad-b129-2d20d743b96c", "comment": "Malware payload (Mirai)", "value": "266ebd51ed60e32cb07f9fa2caf762d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192995, "uuid": "ce14dc1f-b113-4198-be60-24f2e7c0c0b8", "comment": "Malware payload (Mirai)", "value": "652b0786d3823c81a6c94a6696e7685ba3b373f0d662e3b2fc4a7ee4c0d3ca37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192995, "uuid": "fe8455e0-aaa0-4f96-917b-edb488e963bd", "comment": "Malware payload (Mirai)", "value": "b7533f02b3fb804837b5a72a95d74eff7b3f9766", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192995, "uuid": "f6f9d08b-f8a7-46bc-b0dc-d2a00bb5e4fe", "comment": "Malware payload (Mirai)", "value": "71ec6839b77a0312a805cdfcdc9b1f27e320d6a784ec48082bf8052b5240b3de2c2486fb29e37e3bffef33301b7e53d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704192995, "uuid": "0bf8bebc-8ae7-4b90-a7f4-31cfe96abbfe", "value": "T17F734A0273180E03D1661EB12A3F1BE1B3EEE9D021F4F688694FEA46C175E375585EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704192995, "uuid": "12aa158d-82be-40ea-b9ac-3ad55c527d36", "value": "1536:T9aBb6uTAhibM6VRx4ZhASSck0VrZ8wbZnlN:T9aBHMaiPSc5V98wbZnlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704192995, "uuid": "d38af393-69a3-4849-8d8a-39b0e4283624", "value": 79264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704192995, "uuid": "d9f2b6d7-6397-4b2b-a37d-a3c5a0404ea8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704192995, "uuid": "2fc0134e-7f00-48cf-a74c-9a7aa4635eae", "value": "266ebd51ed60e32cb07f9fa2caf762d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd308c7a-a906-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704155690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704155690, "uuid": "095ef857-b3ae-4a93-86b2-0fe97631e2fd", "comment": "Malware payload (Mirai)", "value": "23fc31520d57369530432433db899477", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704155690, "uuid": "bc497abe-00f2-41e3-96ab-4951b6c24dba", "comment": "Malware payload (Mirai)", "value": "658ae1fc3bb053631cdae5cd3c443a7dc76688909a3f6e1bb1f928e734f5afc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704155690, "uuid": "bff939aa-ce4b-4fd0-9353-7a2799b31e1b", "comment": "Malware payload (Mirai)", "value": "3a97797889787fe4ea5429721cabd41290a4e1ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704155690, "uuid": "0251c942-1dcf-4f3f-881f-ea7cb15d7d67", "comment": "Malware payload (Mirai)", "value": "9bd2926692264328b649b50472e87ca096ced471c32fd572283f9610e8095d08b5ae160e4371f967b39ca2c3edc34037", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704155690, "uuid": "7e628ccd-716f-4bdc-8c4b-5550eb1ba830", "value": "T167D3F845FC405F23C6C612B7FB5E428D3B2A17E8D3EE720399256F61378A95B0D36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704155690, "uuid": "c6ac7efe-a14d-4fb8-9f6f-303d1502304d", "value": "3072:gHZ+X7AoVxFOV48wlP1z0RraPuk8d+Ow9L3sibx:gHZcASAV48MP1zuQ9LsiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704155690, "uuid": "e26db53b-b585-4da7-b8ee-5e76d2062953", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704155690, "uuid": "2d4a4fe0-005e-4359-8a1a-779e0b0060f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704155690, "uuid": "da645e71-3069-407b-89ba-ec9c8c6a0f23", "value": "23fc31520d57369530432433db899477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccf2a2e-a95b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1704192009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192009, "uuid": "54037bce-8d6f-4550-b20c-b421dd9f5c79", "comment": "Malware payload (DCRat)", "value": "ab14fea5f377f94ce060c5dbd38fc7f9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192009, "uuid": "0d005ec5-586c-4a9d-b79e-d6bde22e05ad", "comment": "Malware payload (DCRat)", "value": "66050765be8e3bca709568c2a3e249cd904336a9ed0f7d3ace407f43e7c4501a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192009, "uuid": "649bd6f7-f02a-4208-ace7-d340cb407c6c", "comment": "Malware payload (DCRat)", "value": "616a395f388b84c92100b7a547bee19aa97ca4e7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192009, "uuid": "07f6d271-0bc3-4029-b1ba-2c74ea3a62cb", "comment": "Malware payload (DCRat)", "value": "4d2743baaf74475ad782b72321b03e9307261f7d4662b9ae2750b519f5e0f6decdfdf014f9ce408ec62cb7fd7bce84d5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704192009, "uuid": "ffd472d8-af87-4f31-8b86-303c47de21ef", "value": "T18995BE0699926E33D69C3F7188D7402E82B4D6273653FF4B365F31B9A9166708F132B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704192009, "uuid": "00c3d832-dd9d-4603-82de-426d024cd3c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704192009, "uuid": "59b7f024-dda9-40bf-aace-2a3ff94ab4d7", "value": "24576:616VyGiagTqcOiFweTdJZbcK7RDdAAR+gbVkTO7pmmFYybivD17m2HpHE497L4K:61XGiaCimFb/RZAPgb8OIDybEBpkaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704192009, "uuid": "c8ba0963-886d-4fca-bccc-e1ec0395770d", "value": 2000896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704192009, "uuid": "c9bc8f29-827d-4393-be9a-ec1865fa8b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704192009, "uuid": "3d2e98db-7fe7-43bc-8692-1badee35247f", "value": "ab14fea5f377f94ce060c5dbd38fc7f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa75a692-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704221801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221801, "uuid": "fbbebe8c-587e-4801-8ac9-7ab88fa2ee38", "comment": "Malware payload (RiseProStealer)", "value": "f4e12ccaabddc9024adda74dacadb681", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221801, "uuid": "b34fba6b-d730-4332-a188-7677c5526a8a", "comment": "Malware payload (RiseProStealer)", "value": "66694f7dcb467cd242471f76c58bc236c458761d22bcb4682a07605e0d7bd384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221801, "uuid": "226ac615-285a-40aa-a4fd-2f89bec32701", "comment": "Malware payload (RiseProStealer)", "value": "672e1c2b35cd863c6bcc281604893ec78f168cc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221801, "uuid": "ebda5d42-a242-4175-8e51-e220107c40c9", "comment": "Malware payload (RiseProStealer)", "value": "5e1cecdcfc7dc350e5b492035ff69b794d4f1cf39f653b512dfda467e69b0a5c6c1ad950508ab35a0e94f958fc910f45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221801, "uuid": "b8673ba0-d67a-4132-aa22-e5fdbc32292a", "value": "T108B533C357E29571C9E12770A4FB02C71935BEA3AA24571F3E80EA9408B35E1F53A739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221801, "uuid": "e22d6f78-9121-40c8-9c1b-013223b56a59", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221801, "uuid": "3c9ff959-27e8-4064-810b-f1de2051fefc", "value": "49152:xLuYoz262V1lcg/2aRdbDwvDoo/LaKsc8hwwefPmynPnWiy2wf:Uz+blcg/2+dsjPq3g3P/y2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221801, "uuid": "e5fad3fb-7f32-4493-b6e1-c78fec0298a4", "value": 2476544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221801, "uuid": "428edb83-182f-42dd-b428-42c06780cd0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221801, "uuid": "e647d3d4-c2ae-410d-bced-cd359f7c8f2b", "value": "66694f7dcb467cd242471f76c58bc236c458761d22bcb4682a07605e0d7bd384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea02392-a99f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704221405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221405, "uuid": "460f6151-12e0-43af-919b-cdc25fdcdf46", "comment": "Malware payload (Mirai)", "value": "9be928c5374fe583874f1b0313b06f4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221405, "uuid": "c715c2c8-71a7-4eeb-af91-8fd295a99305", "comment": "Malware payload (Mirai)", "value": "6737d88486bee3a1f95cfddc00935749da9b37933d1ca13128ec068b3fab4ea4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221405, "uuid": "b01a2d5e-8e37-491e-8602-1d8d872f3f56", "comment": "Malware payload (Mirai)", "value": "fc944acf89a6d06fbb681b8ac334417d4b9ac151", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221405, "uuid": "86f28db9-e7f1-48f2-bb0a-279c7021a9e7", "comment": "Malware payload (Mirai)", "value": "67fcd6c34279adf0a58327409e37ccf318d03eef671372689444b4bf82843cf9e2bff2daf8108ef7442fe49a1ec8bb49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221405, "uuid": "af50cc44-2b96-465c-966c-1e2c46226f8e", "value": "T169736B21A97D2F07C0F4E47E22F78765B2E1274E39A4C65E7D620E4EFF2265066531B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221405, "uuid": "40a05b18-d4ef-4f69-af30-cecfa01b0bcb", "value": "1536:9q6v0mwflpO7yG5y9pMWSv43Wq48TOtCr:E12dv4Xr0Cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221405, "uuid": "2da3a4a7-1fbb-42e2-845e-e95cb3243f97", "value": 79432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221405, "uuid": "c560e0be-b66b-45f3-a66f-1495c9987018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221405, "uuid": "b89fb935-63a0-46e3-80ed-de695c1f80fe", "value": "9be928c5374fe583874f1b0313b06f4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2068df3f-a9a8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704225005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225005, "uuid": "d70f0290-3a6e-4084-bc2b-84a4b8e252af", "comment": "Malware payload (Mirai)", "value": "eb4189966b030ca6ffe2081f3c14c23a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225005, "uuid": "2382fe81-f15f-4179-b408-3a39c348d139", "comment": "Malware payload (Mirai)", "value": "6926581df13527c07c4b0677102523929fc2873ecddd99034fd72f9159f22533", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225005, "uuid": "e8780e4f-bdfc-495d-8514-400bf98dd80f", "comment": "Malware payload (Mirai)", "value": "1f95fae055567af2b1fbf5dc2abdd3580d500217", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225005, "uuid": "92ca3e51-249d-4ce1-964f-afede803e3df", "comment": "Malware payload (Mirai)", "value": "3e04d10ba68eafc9f9a8a286187d3ef2ec67f45e33cd08ba224f629f5abe3c2a7466284f5b32f30beeea7f85fe3fcfa4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704225005, "uuid": "4dc09783-e75f-4b83-affe-1ba1d13351f0", "value": "T1223302626BAD29E251B09777BC33FC5A669C17E84C7730DA2CF0661973C18024FF6686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704225005, "uuid": "61108548-0334-4463-9c7a-1851a246d360", "value": "1536:M9O/ZMAXIxNUk0cLcPqF1aBexo4opKZbP:M9O/ZNKywLGqFUF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704225005, "uuid": "ea61ef23-f905-4544-b213-cc35b0a8b588", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704225005, "uuid": "71a78b94-d9fa-443b-8b35-54c92da9abce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704225005, "uuid": "38a660b5-c72a-4267-9ab7-75ca4b2e148e", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c0ab28-a9ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704227080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227080, "uuid": "53e4b233-080b-4f71-984b-f4ce33289927", "comment": "Malware payload (Mirai)", "value": "ecf2d4bab2ce6bc56bffe3d031b05754", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227080, "uuid": "a6daf6f9-5dde-49ec-8afe-a801dfc12f44", "comment": "Malware payload (Mirai)", "value": "6a310e25d2181dcc4e96f9bcdef2017c448c6942e07baeb617da865ac6e5006b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227080, "uuid": "460840e5-0ebc-48a4-929c-ca01a68a600d", "comment": "Malware payload (Mirai)", "value": "01b0175f8c575c62f6316902f427ebe75b7f11b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227080, "uuid": "9cf99245-7410-4e44-9822-d7ca15f31b1d", "comment": "Malware payload (Mirai)", "value": "adfdab7d850e7f2afcf092fe86b30d447f79ea2c06ba072c8b1021566db6e7cbe5069ed866ff9ff2d272512cf4f0846e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227080, "uuid": "7a84784a-c513-472f-b11c-374328bd775d", "value": "T135D2E18876E253F68C8DD57E770F003A30AA74D9B7B19363B305D453472A181F655E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227080, "uuid": "ba3c353b-e7db-4216-b9de-8c904410874e", "value": "384:MSd/PxEDLd2TwURz06lowYcEaqsD9aC450LQixBfE4jdlz0lewZ90BKwmmuhNyw:llxKd21RhxEnsD16IHE4RlY9909rZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704227080, "uuid": "12051927-d646-46e7-9a87-933a55be023d", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704227080, "uuid": "556e3a33-3a13-4469-a03f-28e1005b1fdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227080, "uuid": "d5f96319-15c6-4108-99b0-7873d1307d65", "value": "ecf2d4bab2ce6bc56bffe3d031b05754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39eee8cc-a9a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1704223330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223330, "uuid": "affc02e6-b408-4ee7-955a-9355f82ad4fd", "comment": "Malware payload (Arechclient2)", "value": "0bbd1c6be94ca1e2d26e1031429737ad", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223330, "uuid": "86db89bb-cb6e-49a7-af70-a31773b09769", "comment": "Malware payload (Arechclient2)", "value": "6a546d75556d9fec84c5a82dcafe0dbca854020ff13e3292c0e9b1efc5cca2a4", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223330, "uuid": "e2ec343b-85fd-4887-8959-3d54ff715741", "comment": "Malware payload (Arechclient2)", "value": "398220549689ffbbff65daffa8aad76a72ba3341", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223330, "uuid": "17f0b6fb-2cd8-4e8f-9018-582ee01926e3", "comment": "Malware payload (Arechclient2)", "value": "58207cd2790acca09a1b7718763d691bbbc58e62ccb0c3ce62d4f99e25a4d98cd1cfe2123a49dd9d4c6c1fe39e01c8ab", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223330, "uuid": "0a9a51c1-e67d-4503-bc91-1c380a39522e", "value": "T1D446AF003595DE40D079A3FBCFCB902883F97856A1B5DB1A6ECB33DA56027960D06BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223330, "uuid": "f4ac7b8e-ebc1-4640-9524-317733f2c3fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223330, "uuid": "1f76d682-f2d2-45fc-9b17-475c9ab06a39", "value": "98304:bqnYPKX0xuaex+EnkzIWvwQgkAhc3RCmF:WnYPKXVaePnmIWvkkAuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704223330, "uuid": "777a821b-ba74-4754-a691-6795098e8d03", "value": 5455888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704223330, "uuid": "8a730f80-87ed-41eb-873f-226ac53c6d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223330, "uuid": "6fb46160-d3bc-4a61-aa72-10adc72cc2c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c95934-a999-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704218592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218592, "uuid": "ada8d944-e126-4d7f-879d-bbae363be78e", "comment": "Malware payload (Mirai)", "value": "3a552b76147a670ba4fc6a77db54cedc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218592, "uuid": "b13bd08e-ef0e-4d16-a6aa-c6399535877c", "comment": "Malware payload (Mirai)", "value": "6ac22a2ffff11e63d6ff1b8c08d5fcff2e12ef16e4a72c17a52adef74e9766e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218592, "uuid": "58754a56-e100-4a3f-b2d8-fe93f906be04", "comment": "Malware payload (Mirai)", "value": "888bf2ad1c6d3133ab344a61adb30afd1511bac6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218592, "uuid": "a44bf3b7-31da-463f-ae1c-7c5827514c50", "comment": "Malware payload (Mirai)", "value": "8b81c810d30660c33d41ec64996272dc78ff7e2ee923f6a59caefd492c8855d5d53a47cb3aa8f5bc671efdd973670ba6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218592, "uuid": "f81f4058-32ae-4fa9-8f56-9a7310f7c720", "value": "T165739E35F0245CA6C59106F969ADC8384702AD7574FA2C725FCD8EC454ABBE8F20DBB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218592, "uuid": "939b9c75-8ae0-420d-885a-0cec0c6cdf0e", "value": "768:TfOUZ///7TR6MRcCeu1YkZG1Yc3GeAT2+BFsqoOBV9VcPWUcH/ar4QbccuqSAN1t:TX/nf9RNA8UYS116suDsuUcH6SRK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704218592, "uuid": "ac675e1f-f602-48a5-a452-4fec0ce777f6", "value": 78452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704218592, "uuid": "b203a767-d6fb-4cb6-a924-efc9965d0e11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218592, "uuid": "f636b345-e601-410b-97d3-8f1f2ea586f1", "value": "3a552b76147a670ba4fc6a77db54cedc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ca8cca-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1704221927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221927, "uuid": "fb309c3c-d2a4-4a20-9250-359e6b631a30", "comment": "Malware payload (LummaStealer)", "value": "14e777412523173eb4dc71e384bf6f57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221927, "uuid": "d6cb3e2c-4d47-4d7e-92da-52df861b6bc1", "comment": "Malware payload (LummaStealer)", "value": "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221927, "uuid": "6d97299e-7646-4296-beb3-9cafbe07e10e", "comment": "Malware payload (LummaStealer)", "value": "69cb197a2336a58924f8f71bb65ac43e6668533a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221927, "uuid": "7ce23230-c2d2-4163-9511-117c79331e10", "comment": "Malware payload (LummaStealer)", "value": "f95a5ee9b03a030f40e357d42526181bb7c8c8fc18855fd6c2e66d0431102482ab247c51160516f4e4a4eea829e16c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221927, "uuid": "f44665e7-1cda-4a40-be30-81b575a0ccee", "value": "T11AC5334256C15932C9F56B70A4F706C71A30BEA3EE244B1F3981EB9408F39A5F536B39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221927, "uuid": "97afb248-db07-4cb8-adf3-fb014f574fdc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221927, "uuid": "f96d7026-5880-415c-8631-dfb402a4ac2f", "value": "49152:EPTt5uBMb2Rw/y0bgJjFmriZ7IT2dPWR8lFPYwPmfn3HQIyOcf:+pBb160bgJjwrF6gqp7yXQIyO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221927, "uuid": "22ed7f5d-db8c-4837-aea9-46204d26ebc2", "value": 2603520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221927, "uuid": "c212157c-d271-48ba-a3d5-5f71b3c78b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221927, "uuid": "c3ea6f9e-f798-437e-ba47-9b40b6f3c3f6", "value": "6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434a06b4-a98a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704212179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704212179, "uuid": "16bb7153-9fc5-4c15-9ef7-899700320386", "comment": "Malware payload", "value": "51f9ee982973650b695e39152ec3226e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704212179, "uuid": "c70549e5-0e79-4e52-abec-3cdcecb48e4f", "comment": "Malware payload", "value": "6b9a43948a22157bf3ae9d78e67f0bc96f8a7a418c22702be2026685a61c9d7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704212179, "uuid": "4f6e3559-5469-42f2-8481-40b5dafe33a1", "comment": "Malware payload", "value": "bbc871e2c9fc7d1a8333c5b2160579b4fb592aa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704212179, "uuid": "1d1ae663-ca40-4d08-b60c-ffe54dc26f66", "comment": "Malware payload", "value": "99ca9c12e8ec88bb4e24664778710bb880456c4894ffdbd54788e524f47cadf58f78ba35f4a13549d4536549fa664fba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704212179, "uuid": "402119f0-24c8-4e91-951c-ea7ab38417c4", "value": "T13752D0B773C3315DC32A0A35DBDB82D4E180527A8046AB2BDE565954BAEB354403CDE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704212179, "uuid": "42edacb1-2ca4-4238-bb6e-31e27ad42670", "value": "384:bc/558iMFt/z8F69w1b58gJpSfPLF1JcIuVrBsoiqcdVHX9:bc/D87/z8Fuw1bCgqfPLF1Jhu1BsrdVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704212179, "uuid": "ab0f1233-3f46-4bf3-ba35-47bde49071bd", "value": 14396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704212179, "uuid": "9cdb9f2a-5984-476d-b057-c40fa88955dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704212179, "uuid": "a30710d4-e83f-4f7d-875b-f373ab7821cc", "value": "SecuriteInfo.com.ELF.Gafgyt-AN.32349.7759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7ac77b-a9a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704222829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222829, "uuid": "34fded30-f004-4dd7-b4c5-d1cb090a1396", "comment": "Malware payload", "value": "2dbca579d5438924eb64d303a51212ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222829, "uuid": "f3184048-90b0-4f8b-a954-c9a6153a4bdc", "comment": "Malware payload", "value": "6d037779c2fc7194e31211c125d34c62cf379746c99ba315d6f183bfcb393623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222829, "uuid": "af2b963a-aeb0-435f-92c7-1a01f177fe73", "comment": "Malware payload", "value": "3a02566cdca7a91a0b93ea2280848ec019680dc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222829, "uuid": "18d02968-5236-4991-bfcf-62ef8160628f", "comment": "Malware payload", "value": "5725b8b29a52d76a4a0adfa1d4b6a116a9b3a2acfe735a0e2a8f1168925898a9ffaca2ec7bcb1eae26d61c7752f5c866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222829, "uuid": "d2a3d015-cdcc-439c-8ab6-cbbedd078d1f", "value": "T13F463349E98017C9CA6A1CF09752BD2CB8F85E360A84844D6C7879EBBCB3657C0F7953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222829, "uuid": "6f3d6aba-e9c9-456a-9900-0aae42f4ec00", "value": "7106f7f21b5a6e69fd7cbbc19f3ecd14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222829, "uuid": "974401c9-b66b-4c1a-8099-d15f714391a2", "value": "98304:+UuycPKVtL240Nh23rpNk6jFqgBLdxEfSs4pC4uflHGz0EF1MorDWqcwIftwQAW+:+UuyxZ2400sIqgVdOSs4wH9GIGOoXLOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222829, "uuid": "9ca41180-8e3b-489b-b2d7-286666a20c77", "value": 5519264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222829, "uuid": "825e17c3-78c2-4bfc-a98d-46877486106c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222829, "uuid": "865f6bcd-f526-40c3-a704-4a857c82ffa6", "value": "cp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138f057a-a92f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704173015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173015, "uuid": "32ab635e-a07f-456d-a5d3-ea256448d49f", "comment": "Malware payload (Mirai)", "value": "62e38bc235e8b71c6408f149da66743f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173015, "uuid": "7ab36f5c-9b66-4070-af35-57e89810fcdc", "comment": "Malware payload (Mirai)", "value": "6d7749a61e35adeaf5b1b91a7a3dd60e0e02d3df1a1bc3202b66db49623f48a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173015, "uuid": "3d578db4-5645-446d-858d-c64ed1dca439", "comment": "Malware payload (Mirai)", "value": "5390c83c82f51b686182ba1208c92460a7addbe2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173015, "uuid": "d2cd059d-b5e0-475e-9952-0dcd7d38329e", "comment": "Malware payload (Mirai)", "value": "b3f964edd2f6e0fb2bd6667959f453c9d8dbd2fef6c9833ede4121b367a08b75c551ef03156baa6c72ba43be2884312e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173015, "uuid": "50a977b5-f212-405c-8c98-e22dcd5fa83c", "value": "T170D2E025F1DD39C8FBFF24F494A0CDE3B3E50E493E848DA26B49FD202CA982812214D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173015, "uuid": "6f4bf62f-e7c5-49ea-ad30-0176cd29cb7a", "value": "768:0BuT7v9ZAPr0k2JA4ROxaSbfSlHvZuWcRKGk4uVcqgw0RTWXM:0BuHv9Y6GFNihuWwLk4u+qgw01WXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704173015, "uuid": "61762b78-8c12-459a-ad0c-d4d3c13c4bc0", "value": 30748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704173015, "uuid": "8e6d9e7b-e8f1-4a48-8a2a-2cfea2e0c9aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173015, "uuid": "1de37f2f-ce50-46ac-aa66-38bd0d3090cd", "value": "62e38bc235e8b71c6408f149da66743f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5842d17a-a917-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704162822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162822, "uuid": "61567cae-4c93-4a49-8ebe-ef30f23b156b", "comment": "Malware payload", "value": "67cb4f0b2d18ce9169853f9e1ad21ce0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162822, "uuid": "ff49518f-f46d-4333-b772-d9221a007819", "comment": "Malware payload", "value": "711be1c67b261cb5410e8601e64901e778e08d3fb96aaaa59efca1cd33a2e332", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162822, "uuid": "eafe3bac-1c79-47d4-ad86-6611c8280959", "comment": "Malware payload", "value": "c3765ea2ca9cd49c11f88ccd401728b3a7ccf421", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162822, "uuid": "8caaec0c-e408-4dac-b8e3-c40403d75992", "comment": "Malware payload", "value": "b2b1c63e98154993e57e22ce5718915c54f3082f778a0cb7d7130f3d1c7cb2ed40bb34f4b475c30b2412a7316e382e17", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162822, "uuid": "38bf55b2-53a5-4d7a-ac59-6d3a96d6ad67", "value": "T1813533D39DDEB0FEE5975FE0132643402CB79E3D079AB496E5896AEA780003732DD186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162822, "uuid": "5110082c-b35c-4786-968f-badf7e233305", "value": "24576:7aqKFawDC/2iswNrlV6ioqqLTG6YubOFw9176qBqNaX6G0:7v8DC/2hwNrlV6io3L6c6FCcNaX6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704162822, "uuid": "21cb4f8c-2605-4c1d-9f07-f7528e686d62", "value": 1154256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704162822, "uuid": "b766077a-6089-46bd-8432-ce7ba4eadf0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162822, "uuid": "739fd5c0-c745-47e1-96f4-bbd4b952f4e4", "value": "linux-mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7de696-a9a8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704225004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225004, "uuid": "965f69aa-4188-4ada-be5c-3de50fe3728c", "comment": "Malware payload (Mirai)", "value": "d744ce0b0315b1593d62aca7b718f590", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225004, "uuid": "fe23eecb-5533-4214-b0a2-2e9bf786bb3d", "comment": "Malware payload (Mirai)", "value": "715640a7e295ce0ecc07be1cc686389f1d8f9d57cd12cb8202e142cc61ddb425", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225004, "uuid": "cd4fe9b6-6687-426a-a708-6e5a66fdfa83", "comment": "Malware payload (Mirai)", "value": "09c76e9ab4c2b15231eeb6d9ee6c56939b6c44c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225004, "uuid": "abd7fee7-6ec7-4845-b235-517fb49e15c2", "comment": "Malware payload (Mirai)", "value": "dc4ce72c6c62360fd5ef98da91e16d7701bfe0f0d54331d06d8dd2aec70e7bb5d1fcb32e5a54c536b2dd873ff570f8fb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704225004, "uuid": "1d601e81-4d33-428a-aac0-26cdb59fda3d", "value": "T176C2D0BC7EFB6E47CE1610356888EA3782B0A5A5C35B76D7B24540026C030E6BF67CD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704225004, "uuid": "39fe6b63-7c5d-4753-ac2d-0ef19f185657", "value": "384:MX1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjUpHo:qMw4DZdFbBy6x3K/KdWnH55tq0Nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704225004, "uuid": "069d1bf5-412a-4674-b8ef-0d5b3c447216", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704225004, "uuid": "0ca2369c-34ee-49f9-98fa-d88c10be8f8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704225004, "uuid": "53cbfd49-99a6-49e2-b6df-da141811a325", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64c81f0-a912-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704160805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704160805, "uuid": "a9408fa8-da78-4851-8dfd-8f24133e41c8", "comment": "Malware payload (Mirai)", "value": "a61a04ea2bbe2d4950a23ae3b5fb5dd0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704160805, "uuid": "a996e23f-bf7d-48d2-b1b5-35ee5fda9d65", "comment": "Malware payload (Mirai)", "value": "73e54277221abfde9d86dee8e4b5ede6ace8ab062c13055d360b89c1b63e42f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704160805, "uuid": "e5b4f9c2-ede8-4203-b341-b31c490009b8", "comment": "Malware payload (Mirai)", "value": "1bd12b91a94616fec6a03de4a159c2683f0e7289", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704160805, "uuid": "c76bd266-4bfa-4b8c-a767-bfe3c312cb43", "comment": "Malware payload (Mirai)", "value": "e521a81a62628f3e657aa8455da567a423d7becda00a11d5f059ff806f82d7095400fa55147bf2c259ad7ea7ac3b8838", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704160805, "uuid": "b13f87b1-2d36-4417-9974-8ab51b7f6e05", "value": "T17333F1D3847F93723BD10E36F11A8742279EA66D96E93B124359F6C05297C0BC3F9A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704160805, "uuid": "590a71db-98b4-423f-954e-3c1fa9d6b7c3", "value": "768:IlR/LfaPe7NrOlUUh9t3yS+XJ3NmiWkYvg1Z9q3UIWGVcX8iv2XYXsfiLblL:IePekXt0XJMiW9vYKWGVjmxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704160805, "uuid": "6bb3f80f-aa75-4843-b6d3-27d935406d36", "value": 52840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704160805, "uuid": "c3e2b70e-38ac-42ae-921a-327070c6b913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704160805, "uuid": "e6c0ec99-ee13-427e-ab03-c3949fce7fc1", "value": "cta.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5426c22-a9b8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704232208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232208, "uuid": "e6364481-5664-4c99-8216-17127cfd55c4", "comment": "Malware payload (Mirai)", "value": "826e5509ad9e54740dd716a5336a7e2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232208, "uuid": "77dc1b47-c664-44a7-a99c-6c8c6fb9a799", "comment": "Malware payload (Mirai)", "value": "75f6172c7ebe95e418db8a0cd444e2e6056c3fca118c140693ed8b8ffae607ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232208, "uuid": "6c0ed407-dbf8-4093-8e4f-a331c99860c3", "comment": "Malware payload (Mirai)", "value": "e9a36d6db0d82e9fbdd5868282c191ade93bf4fd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232208, "uuid": "8b2e4ffa-ac50-4674-a930-d0d8d2bb4b91", "comment": "Malware payload (Mirai)", "value": "49cf37ee756fc38c8713d8b8b0772a1c488d192f3290a15cbe9edbb8cc159c895af5c40d4d6e4a26a13aa6efa683609d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232208, "uuid": "0824384e-8091-47a6-bc36-1c881b3c789d", "value": "T10DE2F20CA14F8E86FCE8117F26170D9E7D6ABE18AD37125A35E741806D23CA1D271F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232208, "uuid": "c727be0e-ba0e-4403-9abe-baba85e33bb6", "value": "768:Vp6ARLrVQMI9I403JSbB6g3X2Lj1HJyRMY:H6ARLrVQMIen3JSbEgsJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704232208, "uuid": "d8591ed0-6a8d-4f40-9e30-0dd80367632a", "value": 31616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704232208, "uuid": "3ae9d3df-2aab-4cc5-b3c2-0a25a7bb62e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232208, "uuid": "64ed5b05-b21c-41a1-af93-e14383db5bc0", "value": "r.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd19e46-a9bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704234905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704234905, "uuid": "f8b38bfc-e208-4f77-bbbf-14eb0285229e", "comment": "Malware payload (RedLineStealer)", "value": "cc4fb678689ad3ae5f93a8a0d2a04ab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704234905, "uuid": "ea55dc1b-9414-4e93-8128-49a358a79ff3", "comment": "Malware payload (RedLineStealer)", "value": "79658843a0028941539f3b437a8d262c78b15e6e58f4b1f7b96bf357b06fa84f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704234905, "uuid": "9ce68b08-5c47-4186-9fb4-7cb3f0232a0d", "comment": "Malware payload (RedLineStealer)", "value": "0986ae066ecfab007149a657070f8202e75f69bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704234905, "uuid": "d72fc5f7-1719-418a-a82b-bda7c875b2b9", "comment": "Malware payload (RedLineStealer)", "value": "f202f1b612bb24e0c82673f645e3261afe02d6d676f9d51268e013ee5bf89e6b46a97d3bd0c4de6ce6a9658679a1fb98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704234905, "uuid": "87ca7547-6f71-4eb6-9d16-2576b145282e", "value": "T1A205C33C99BD2227A4B5E692DBD58833F120996B311D6D7598E3C355730AE4338C3A3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704234905, "uuid": "ca6a9936-3829-4fd0-a4f2-883dac8037be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704234905, "uuid": "77e797ab-dc5f-4522-b8bf-8995c03d2296", "value": "12288:YFRc7yGiQ3f3MsgMsM3AdGZmuEEuUscefF+Q/STar6Zv:mYyGi8MsgMrZKNUsR/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704234905, "uuid": "83a49b0f-f775-4c9c-80cc-c4408d9adb8f", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704234905, "uuid": "4df393ad-8a8e-40b3-89d3-4b3dde51b3ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704234905, "uuid": "be7a4b1f-8d06-4d38-babc-4f4cfdc68d40", "value": "cc4fb678689ad3ae5f93a8a0d2a04ab5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8830f3-a9ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704227089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227089, "uuid": "2a1d63f6-b9b4-43be-9681-c906f48e0449", "comment": "Malware payload (Mirai)", "value": "697d6e596d13ecc58bb381de3cc352c1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227089, "uuid": "853c46f2-96dd-4466-9e34-92e3afc6e677", "comment": "Malware payload (Mirai)", "value": "7caed28559989416f8b853ae4b5e5604ef41077e711f61e5f10a2f5ec9ff9632", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227089, "uuid": "9b2e578a-bf16-487f-b2b5-4888b9a763e5", "comment": "Malware payload (Mirai)", "value": "c5c9a1463425942b1bb8c13ef607722fe724e003", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227089, "uuid": "9242ef30-7de5-42b6-a06a-2b050e728f94", "comment": "Malware payload (Mirai)", "value": "3288eccb3180b12e5c051821d0aee49961466da5c149d5cf4372e8cb3d46d9d45a8f49b630a26241b9eb658f86fd507c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227089, "uuid": "d3625678-9d58-4ce3-9e00-4b2d74134e6b", "value": "T1F3D2E0EB20BFF273C072B874345015C4FB383516E329576B0CEABDB969B66913760A61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227089, "uuid": "64f6c196-90db-4762-966a-1928191395f6", "value": "768:UYSoXdJZ5U05VxmHSSc+H2c+lPXmSx0sf:UYJdJZ5UQVH/+KXZtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704227089, "uuid": "54e9bc8b-79f4-4b9e-9451-176a0218ae43", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704227089, "uuid": "c5617711-ebb9-4b2d-955c-2cf5c0b80171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227089, "uuid": "6840f981-7036-4ab7-84bf-62c5080ab418", "value": "697d6e596d13ecc58bb381de3cc352c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d6d4fc-a9a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1704222493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222493, "uuid": "df1d2f49-a7bb-433c-9b82-3497c3e6c369", "comment": "Malware payload (Stealc)", "value": "0eb259c9bb69e54c47142edabc61c6c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222493, "uuid": "98482482-9c55-4918-b7c3-0ecc12f4ae60", "comment": "Malware payload (Stealc)", "value": "7d0eb3e819a8aad18bdcdf7f212c77663a79b3d048636878655dbe3730ff82ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222493, "uuid": "ed896b4e-d24a-415c-9fb7-3d137dd41776", "comment": "Malware payload (Stealc)", "value": "992e444b163be213ecaa0bb1d12be5d74093a54d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222493, "uuid": "e1bbd905-4b70-4d8b-8671-174ee25a364a", "comment": "Malware payload (Stealc)", "value": "a21a449f1cf8d000ea448f3238fd985591a1fd4070dedd75a31ee3d669c4b2f69fa06fa022a7cc9cfa3cb20ba5fed4ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222493, "uuid": "87ca9949-64ff-46a2-9a3a-6f49b1495b72", "value": "T1F1248C2135F5C072F2B3597549B0CBB42E7BF8A37A369A8E6EC406790F256D18E21317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222493, "uuid": "ff387372-678b-4c1f-802b-d2fee4e889c5", "value": "628b5625e44ec4d4a2ba4078ce3026c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222493, "uuid": "b074ee28-598d-46df-8d25-26e3754efed7", "value": "3072:s3Lm1avguXOep+fJicd5t+thg1UpV2pFgrooLMMCS165DxZREYyUD:s3LmPgOep+zdJ1Up0pDoLrCT5yw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222493, "uuid": "6ca04343-9293-416d-8e9a-d623d0189c59", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222493, "uuid": "0ced7543-a55d-4fa6-82da-f9cb8deb977c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222493, "uuid": "44bed2fc-1c2d-49ec-a4ba-09dfcad1203e", "value": "syncUpd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077eb554-a92f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704172994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172994, "uuid": "4376f048-5d4a-480c-be5c-b67ba6cc1c25", "comment": "Malware payload (Mirai)", "value": "0fe7c5948124fcfd90ef9fb17e82faa0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172994, "uuid": "f5c2832f-80d8-4cb8-a840-912724ac511d", "comment": "Malware payload (Mirai)", "value": "7d9e2013c4e402f0a690c35879cc45482dd6daccfeb055f8f90738b51fcb47c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172994, "uuid": "229ebef7-45d1-48c7-87bc-a68612e86149", "comment": "Malware payload (Mirai)", "value": "9ee0d7f4b651c69f27a074856d5aa934e6b2ca62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172994, "uuid": "6398d548-2bdf-4993-9b55-e37ddf24bd97", "comment": "Malware payload (Mirai)", "value": "4f0f20daa63c1fadec3d39994754ced02aca605edb78ceb3dca0cdf6caf70e16befb9ca8eba3096a2898b7bb8c5ef50b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172994, "uuid": "1520867c-81f5-411b-8550-2c9307a584a2", "value": "T19BC2D0A093C576A1CFE01C36EABCCE4212A30EF579F571A8265803142DF709957BEE1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172994, "uuid": "6129a89e-a295-40ed-a2e9-e08ad39020bb", "value": "768:Vss8/uqwIQUJ5XukvvwoTZErc9evSF0P3Ub1:VsV/+IQAe4wodErcUvej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704172994, "uuid": "240558fe-3f30-41a1-b995-a8be48a9609a", "value": 28236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704172994, "uuid": "fba01b96-a56b-4bc1-b3c0-0a66406e0ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172994, "uuid": "6252bb45-d288-430c-ba54-62ffda4ea6a5", "value": "0fe7c5948124fcfd90ef9fb17e82faa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e01792b-a999-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704218559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218559, "uuid": "30d2f59a-22bd-4a0b-a18b-db288c236630", "comment": "Malware payload (Mirai)", "value": "5404173ceb25ebfe8ae83919fde7e3cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218559, "uuid": "48b5f4cb-69b3-4442-b29f-b4596e335cf3", "comment": "Malware payload (Mirai)", "value": "7e455b30878e3e01139eb0e29725ac81f19590d1b47eaedb780146196578cb4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218559, "uuid": "487823d2-e369-4732-a0dc-dc7e7932733a", "comment": "Malware payload (Mirai)", "value": "35dba04a412ed1fd1ee9685e1a442b118f3cb758", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218559, "uuid": "9ae041a5-732c-41fe-ad95-4ea442c95d3d", "comment": "Malware payload (Mirai)", "value": "a6360f47028f01d8f81cc0a8f72ace5187b93db61d0650a81d8ed94c7b152c70e0119545cadc27f40c267eae0a133546", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218559, "uuid": "4b98c65d-2f14-4240-a4f6-d54964118ae0", "value": "T189E3745A7E208F2CF79C873406FB6D25834923972AE6D589D09FDA001E7171E680FBB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218559, "uuid": "db5eca9f-9d19-4cc0-8df0-bb14f20c157b", "value": "3072:QfHWLgJNSYeVt4wU82m9torpg3AULzgrUotpN+9IAFLFb1luWvV:QPRJNSYeVt4wU82mmpg3AULzgrUGWFbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704218559, "uuid": "46e460b2-2c89-4448-8cea-76a2c62a47ab", "value": 148612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704218559, "uuid": "f0b8ad88-5609-41eb-97fe-ebc99fe3e234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218559, "uuid": "7f69006f-e310-458b-b5b6-67faea6d8b88", "value": "5404173ceb25ebfe8ae83919fde7e3cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638d8989-a992-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1704215669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704215669, "uuid": "05e8b58e-db2b-4f7c-82a2-2b40a115b3f4", "comment": "Malware payload (Formbook)", "value": "b129bac9787c0f54ffa432167609b32e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704215669, "uuid": "6bd37b63-f312-4953-9b77-96598940ae3f", "comment": "Malware payload (Formbook)", "value": "7e924017dc6019c756ee6dd390babd32bef51fc7aa0722c18a65b8d2260056d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704215669, "uuid": "0090c91c-4d99-423d-832c-5baefa8b13b5", "comment": "Malware payload (Formbook)", "value": "59bca808393387b5534ccbe78b2b400466c108b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704215669, "uuid": "8e001b66-d006-4a9e-9f39-925890f0e161", "comment": "Malware payload (Formbook)", "value": "ee0236d1ba54d7a38f9dde870309235f15e6f1b6d11302c89b07479aa47b6b027f28f2a8dd9fabe142b81f86ef9265fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704215669, "uuid": "0d4997ae-b935-4241-ae8c-667895de059e", "value": "T1B4341F037E88E715D1A87E3792EF6C2413B2B0C71633C60BAF49AF5618512966C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704215669, "uuid": "bd5ebcd9-0afe-42d9-a098-c3275124c332", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704215669, "uuid": "df623397-98c9-442a-b4ca-0887b97454aa", "value": "3072:OVoUEQ8wEQnvXmohpF+ojbkTToy5IuR4F+O:lUEQ8wEQnPx7FVbaM4Rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704215669, "uuid": "8f57f352-73c8-4d3f-8bb1-f49587dfd942", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704215669, "uuid": "c439a7ab-329f-478c-b1f6-03b2b574b9a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704215669, "uuid": "52ac16c9-7ded-4854-a521-6c5baf24103c", "value": "b129bac9787c0f54ffa432167609b32e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c1c51c-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704221795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221795, "uuid": "c9322c06-8272-476c-9a8b-9d2a5587f8d3", "comment": "Malware payload (RiseProStealer)", "value": "eda78f518cd0a5fd88c694c21f2eb473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221795, "uuid": "e1d4f500-74ab-4e85-a9eb-97cf8bfceca3", "comment": "Malware payload (RiseProStealer)", "value": "7f921526449963559a911dffeb3fff1cbbfa64dd3189ad36d9b91c495e83446c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221795, "uuid": "5c52711e-9cfe-4b62-bd7b-ba503f93d82a", "comment": "Malware payload (RiseProStealer)", "value": "23c4ea260ab26e5d30422749b048055ddac18405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221795, "uuid": "d9f580b9-1b5f-454a-91bd-153ee0ed7439", "comment": "Malware payload (RiseProStealer)", "value": "c238370c9a0779ac1faa68847d3585d42e3cd38b662a9dda6193460bcda1ea421e12130cdd729e0c70859d379a5a99a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221795, "uuid": "67fe8f63-2b0e-42d1-b526-f80ea62777fc", "value": "T152952343EEE85131E9F95BB498BD038B17347CA06E3493272B50CB5B0CA39D5686636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221795, "uuid": "8c78d6c2-c233-4ebc-a8f7-a4ad44c87554", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221795, "uuid": "d4de40e4-d6d6-4222-9a7b-31adfa26230b", "value": "49152:qy5z1o02R2cFNGLoygKtsbEMZV1rvX50VeV4mhQ:jE03yNFRbEMR5cea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221795, "uuid": "394932cc-f7e5-4637-83bf-eb96c384c3c6", "value": 2040320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221795, "uuid": "b275414c-d9a1-41aa-91e4-eadb83b54605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221795, "uuid": "f8ed7d5f-5bcb-4662-9418-6f9738f3bfad", "value": "7f921526449963559a911dffeb3fff1cbbfa64dd3189ad36d9b91c495e83446c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030b6576-a941-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1704180718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704180718, "uuid": "d90d6ca3-df90-47ca-908a-c9f7ccfb8e6f", "comment": "Malware payload (LummaStealer)", "value": "a2a34f5e87577aa59d00e6fcd6e68fee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704180718, "uuid": "48feb28f-16a3-4285-91b3-f5ebe0fd12f3", "comment": "Malware payload (LummaStealer)", "value": "8019a5a5fbb0b100c2d3189fc6fc5a755563f7fc9b635cff45cdb427706e5619", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704180718, "uuid": "7d864bc6-1174-498c-808c-96f7e04fcc86", "comment": "Malware payload (LummaStealer)", "value": "bc2958ada0a0c2e6d211fcb7587dd440d8370618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704180718, "uuid": "01621694-d79c-46ba-bcbf-75e8354e7129", "comment": "Malware payload (LummaStealer)", "value": "6032277610edf8a3733dd0ac676e1834f61df5cb4b1ddaafadc835319d683e9469814c7e0c8bab391f9b5169d0985f85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704180718, "uuid": "e8099759-e735-4d8c-879a-b42d69459a39", "value": "T1B956492690507843FBE2A2F879C7C05DC0A56EB4AF1180DB35642E979274FF4AF315AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704180718, "uuid": "fdf4920b-6bce-42ca-ac13-83a27e9edf14", "value": "05bcd4190d470aa4a86d74b5dee18228", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704180718, "uuid": "bdfd0f4c-1ebf-4a5f-be72-76d685afa2c4", "value": "98304:20/8ZNzuKJ1zL8OGUEz9AJOrLp/nLgMXYcwz33:20/8ZNzuKJ1zLMzDrLZgMXYPz33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704180718, "uuid": "de4ae918-0352-4515-a551-6d3a9a4e5d26", "value": 5938976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704180718, "uuid": "c4c20710-a018-4886-a495-7053afb0ab4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704180718, "uuid": "d569cb7d-c6c4-46b1-b64f-06ac161b2801", "value": "a2a34f5e87577aa59d00e6fcd6e68fee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bebf684-a965-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1704196195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704196195, "uuid": "da00ea32-3488-461a-9b11-a09b59f85935", "comment": "Malware payload (SnakeKeylogger)", "value": "aaea6cf42726217d2ad73028dd781478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704196195, "uuid": "50020e4c-4599-4899-9788-e774b4726041", "comment": "Malware payload (SnakeKeylogger)", "value": "80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704196195, "uuid": "92a6db2b-5519-4e0e-8493-0316476cbf30", "comment": "Malware payload (SnakeKeylogger)", "value": "7da9bf7a71246dffc089f8186c5a0912e0a70fd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704196195, "uuid": "b8631c77-1754-4853-8db0-fd1ade2dd7c4", "comment": "Malware payload (SnakeKeylogger)", "value": "fb3877b9e40076e17b404d5077082322bf5034d8379ca344b3a5c3daaeb121ba7f56c7a95b3405529bbb6abb1f6120a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704196195, "uuid": "c412b7ce-a2e4-4d82-8b2a-33a38fcea554", "value": "T1F5455B28FBD0822AE6EA4734BC7655646C3DFA56A702C36F311C5AFD1B57B080D722B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704196195, "uuid": "60e72d18-9bc4-4523-9833-f57ab7a0e1aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704196195, "uuid": "e6327e57-656e-4a17-b697-9f098c561a7e", "value": "12288:PnaPjK9IBlnj0T94KxKNBNkCVr5B8TdtGUy+dXUixJCbBghM/Oy+4Oi+4hfKRzrt:PnaPDZYT9sS61ijy7KNrkntJ3cNkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704196195, "uuid": "3da7fae1-38ec-4a5a-a96d-4bb9c677165d", "value": 1263616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704196195, "uuid": "2fcb3c89-a7b4-4004-84ec-8671bfd29bfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704196195, "uuid": "afd5ae59-ff41-4719-8ebf-43b8fa953009", "value": "Bank Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfb707d-a9a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704223686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223686, "uuid": "4536b25d-5dc3-4c81-af7c-269a1d30baf6", "comment": "Malware payload (RiseProStealer)", "value": "9f06693538587d7eb9af17a8db09c402", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223686, "uuid": "c7c5dfe4-e30e-4497-a332-8f7796ddc6c0", "comment": "Malware payload (RiseProStealer)", "value": "81e0f965f92b1b5ab9e12f818e2751bde8b8119f6a83fa84035434f38920c91c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223686, "uuid": "83b3d97b-2bae-4403-b53e-66572e26ea2e", "comment": "Malware payload (RiseProStealer)", "value": "391ebd258f1ce59e588e94a6da2e5ba994d707e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223686, "uuid": "6c6f8a04-4196-48d4-9b25-384c9a05cd3f", "comment": "Malware payload (RiseProStealer)", "value": "e727d05b4a0d0b6d7c86dbcdee3bb6b68701f1ac4349864219d314b424a64a9e2c9c01c9cfe4d7d7795d37a0ed1ca96b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223686, "uuid": "51cacfeb-fe3e-4170-8b85-b03aff7e6f6d", "value": "T10A6533B7B3310DFBF54F15784D8AD8EA350450B6E86DDC2CCA58D28EEED55E28C14829", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223686, "uuid": "96cce224-345b-4939-8792-b1127746e73d", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223686, "uuid": "42effcad-fcda-41e7-83af-6cb8fce77c14", "value": "24576:yD3agrasWMncIpj4ubVbFpAx9ZMFco00WYNwyAFiUXkRbrnvl6iZT/dpBomShyoJ:yD3n2jMncIplDpk9WCnBowyAYbLwCT/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704223686, "uuid": "f26925cb-469c-455a-a10f-4999a745ab61", "value": 1526272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704223686, "uuid": "9779df70-ca43-4351-8cc0-98f097774d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223686, "uuid": "cce09aa4-37df-4fc5-86fa-b75c5821f3c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9153ff36-a9a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704223047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223047, "uuid": "32ad6475-f9eb-4f0e-936e-c29b13305d87", "comment": "Malware payload (Mirai)", "value": "5f0d3e7c0d7b104e6b8538a0d265d229", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223047, "uuid": "3daf8b86-d8ef-421a-8862-72aa3a5b64c5", "comment": "Malware payload (Mirai)", "value": "832aaeebe836290917751917d95614dee04051b970be82fd498fc5f403bf3998", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223047, "uuid": "791b345c-0659-4a3c-966e-15541fb60913", "comment": "Malware payload (Mirai)", "value": "e9a1c67b3aff6282344fd63906b6683342b1304d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223047, "uuid": "677df171-1564-47df-bf64-b8ca8132fb63", "comment": "Malware payload (Mirai)", "value": "636d7298cdfeb9e46bcfc256fc9b9ee1edb73ff02782c9ab78cde23c4e021c84760ed14401847db3a5a897fac9891283", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223047, "uuid": "f91f8412-63ac-48f4-9bee-c99b3a960757", "value": "T135D34B46FB818F13C4D6177ABA9F82453323D79193DB330659286FB43F867AA0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223047, "uuid": "800ccf87-7048-4400-b091-e09b0c72fe06", "value": "3072:/5AzGwNEcN9z9jhSCX/lBmeHmgjgeyPSjUHM/9pmywPoIlq:/5AzGwNl9JECX/lB9mhFPSjsM/9pmyw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704223047, "uuid": "ebd1d83d-1854-4b17-892c-5690b319d758", "value": 131723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704223047, "uuid": "0f53a3d7-2d2e-4942-9919-a166dfac93da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223047, "uuid": "08ab6cb5-7ab3-49da-9efb-4b30c1aa1dd3", "value": "botx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95456bf6-a9a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704222624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222624, "uuid": "b6ab1aaa-ada6-4077-910f-099fa471b7c2", "comment": "Malware payload", "value": "7ecd26bfdf31355c9b5901db6d614f47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222624, "uuid": "ec8713b9-60dd-4a1e-8d73-9ac1442a8d95", "comment": "Malware payload", "value": "8346fd8577212a80d6899c2c718aeea5eda3b385da5143185aea6e8a41a36d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222624, "uuid": "3ba7f93e-c007-4ba8-a3c8-d1dcf00f5cd8", "comment": "Malware payload", "value": "8633f2573948522a61961efe6ed833cea9c25759", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222624, "uuid": "29f9242d-8801-4c1a-a46c-b19f45479467", "comment": "Malware payload", "value": "5f43e976a9c0f8ca6d48109498d54b3414103fff8919ba4881d81222478079ba9189b8a60d5a23c819aefd54085d2da6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222624, "uuid": "41d522f7-e4f1-4515-ba3c-a8ea0fc61ff1", "value": "T175E53321BECA9172E0B7553B2A928730BFBD7E210F358AC75314661D0F644E18E297B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222624, "uuid": "938d8045-eaa5-40f0-8031-bfcaaff69211", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222624, "uuid": "5420a977-112a-406d-88d4-24538ca8e9f0", "value": "49152:acbz6nkFADyZjLYnRQhYeATaqpe8nXbIawJpU7fEXenIpZgPPuUpvZAc:acbIkFfh+aq8UkawJwboZSPln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222624, "uuid": "78a03509-e42e-44c4-b444-73640c68a08b", "value": 3214825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222624, "uuid": "22d08a1e-bc29-4317-adee-aa720ce910c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222624, "uuid": "5a475987-2624-4d42-8e01-39167cd105a5", "value": "setup294.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96871a27-a94f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704186978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186978, "uuid": "cc49b2aa-7a23-43a8-a906-8588e09e928f", "comment": "Malware payload (AgentTesla)", "value": "e9146cd8451d45fea2fa4fa0f2aa4bf7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186978, "uuid": "8885a404-b557-4aaf-8da7-a4f2fb283907", "comment": "Malware payload (AgentTesla)", "value": "84e6f00d114d875964b9a4d54d53ec6668e325653d3d5b9fb3d6c767040e8143", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186978, "uuid": "3d72756d-4bc5-4897-9deb-854b95f2140e", "comment": "Malware payload (AgentTesla)", "value": "3d333bff0ecd8dc7098c831a373f63b094852fff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186978, "uuid": "d53e67a8-ee7f-4c8a-ae22-b7f321838f32", "comment": "Malware payload (AgentTesla)", "value": "1997520830b7ce75faa849b0241ccce2a89caeee139bf894a9d08b98b51be4e021a59bade7eba97f07479c537d318303", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186978, "uuid": "bceb72a8-918a-4719-b10d-e47c0def5e60", "value": "T1DEF48F3C5BBF1627CD67C6ABCBD8DC27B25094AB3C11EA6459C3439D1376A4225C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186978, "uuid": "cbd53818-6204-4999-bcd3-4d519709e4e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186978, "uuid": "ac4bdbbf-edf4-4dcf-b620-5272a0e1cb4b", "value": "12288:3XUVU6CQ4omeimqqhX3VmXjLod30Frw+NGiU3zPVU:vQq3XTpGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704186978, "uuid": "4b225f9c-1efd-429c-8e43-100134d5df0c", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704186978, "uuid": "095ac80e-4b7a-402f-aa98-41f6c5347a97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186978, "uuid": "0b2f5c32-2409-4ad9-9e72-911351930518", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76403db-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1704221876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221876, "uuid": "9aca30cd-fda6-468c-b787-1925cfe0e037", "comment": "Malware payload (LummaStealer)", "value": "331286ccfef0f9d93edce15d5ab89f23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221876, "uuid": "07e923bb-e508-45e7-9865-a6d5c751c6ba", "comment": "Malware payload (LummaStealer)", "value": "8640e6333193359bb71c47135ffdd3011eaf882c3987a7c6d54490d15b537486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221876, "uuid": "907bfd42-b501-47f7-87f9-bb10a44e2c8b", "comment": "Malware payload (LummaStealer)", "value": "f569d725f16d033dbd6479cbde513ee4003492c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221876, "uuid": "b7e51508-f233-4e0e-9c78-a1d722b090c9", "comment": "Malware payload (LummaStealer)", "value": "e6e21bbb6fbe93331a819560c7a7baf626b3bcc8afa8ffb93cda82d447ca1b229898957ad24c40c22118ec7ea660fbfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221876, "uuid": "13da7458-225e-4290-93a3-38b115b15dd7", "value": "T1B1B5338267E24471CAA51B71A8F707C71A307DA3BB24571F3A81EB8508F35D1B536B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221876, "uuid": "95b082b6-14a3-4c3b-b1bd-1826b8f7a719", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221876, "uuid": "17c10f0c-950d-40a8-9bee-bcda7cb3ad6e", "value": "49152:SLzYog2T2VZh0g/WKxprHwn9+I/9ut7M8hwJ5FPmynogyRwf:qVgxPh0g/WkpMFjqOP3ogyRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221876, "uuid": "4f44faea-2867-40ef-826e-ebff44f3e2b2", "value": 2476544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221876, "uuid": "c0a5a759-a9b5-49f4-9898-189e566d4459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221876, "uuid": "8eabdf2c-f3d2-41df-9026-29a0b30de527", "value": "8640e6333193359bb71c47135ffdd3011eaf882c3987a7c6d54490d15b537486.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39e8e9f-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704221870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221870, "uuid": "38817b61-42f8-475e-98ae-30625639dc97", "comment": "Malware payload (RiseProStealer)", "value": "f123d75e6ab188abc937c1c5d21274c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221870, "uuid": "51af4ac3-5086-4230-99f7-c5f15afcdb64", "comment": "Malware payload (RiseProStealer)", "value": "864535296e9af54c499f6c263b0e892c0c21194b4e3b9ec4f2e1514004d5b147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221870, "uuid": "e26be11a-08a2-48e7-988a-29bb605536eb", "comment": "Malware payload (RiseProStealer)", "value": "32d89ffddf983989f0a432bc0fd014cb970c8fac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221870, "uuid": "d0c83167-ef97-4c67-bb8f-b77491f0212f", "comment": "Malware payload (RiseProStealer)", "value": "15ea246f555f4f8707f1abe9abb27183d6619532fe4c0709376960f62c3b0f35ab850bd0f02696bdc4da21383a6fe144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221870, "uuid": "4aad3cf0-c2aa-43fd-b5bd-0a2c0a16c886", "value": "T11E9523866BD18671C6E017B1A4F747C71E34BDB2AB285B1B35809B8148F36E5B03673E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221870, "uuid": "eabfade3-3187-4126-ab27-cb36cb954c95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221870, "uuid": "dd9a623e-9961-4607-90d4-da177d9ddaab", "value": "49152:Y65z1o02R2cFB3gwqQXSjewyeCx/DLO7b8Zf05yPmsn:JE03yB3gwqqSKbWe8IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221870, "uuid": "4556a545-7c8a-49f7-86b9-7e8f67d02831", "value": 2039296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221870, "uuid": "5c7e0b37-be4e-4ded-9b33-1d9393efc994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221870, "uuid": "6c5d602c-5ca3-4db0-ad1b-ea041f818b12", "value": "864535296e9af54c499f6c263b0e892c0c21194b4e3b9ec4f2e1514004d5b147.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9fc0c0-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704221883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221883, "uuid": "cf63bb69-2064-4178-ad39-318a54e2d38a", "comment": "Malware payload (RiseProStealer)", "value": "1a24421bed22f901ccd66d66cba8250c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221883, "uuid": "a587fbfa-fa4c-4cad-af64-9ac0b0b952ea", "comment": "Malware payload (RiseProStealer)", "value": "8647351f3a2882d4d6c37d3d41e4c42b1bdc80d61f9f7572e262f7e7381b9144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221883, "uuid": "9274c8f6-7e8a-4c1f-8fa7-e1dac66780e1", "comment": "Malware payload (RiseProStealer)", "value": "560a9710a44769dd83ef01a43929808bae2fa6a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221883, "uuid": "1fbe242d-1755-4d97-a96f-7a70c337ba82", "comment": "Malware payload (RiseProStealer)", "value": "f985cf5c952501edf44f52f1c072c1df36d28ebb7786ab47247098eb4768ec178a65eb785265fc84d21c4d0f3d090a3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221883, "uuid": "795d9cd9-3e31-4f30-822d-d127cc11950a", "value": "T1B0C533866BD55471C9E51B3194BB1BCB2A30BEA3B738871F2D40DA8508F34D1B635B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221883, "uuid": "28f01e1d-9c0c-4366-be2b-85d2cdad0a66", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221883, "uuid": "bb13ef98-3dc3-4440-8da4-d868d380066e", "value": "49152:AsBZfN9yei2T2EtHagHclR8RnS6b1c4H7k8/CWf9PmFnMFrvGf:vZ1ZixsHagHcr87+fsJ1sMFrvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221883, "uuid": "dfdad84d-9351-48de-8f37-47de93906e4e", "value": 2605056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221883, "uuid": "dded54d8-d79d-47be-afeb-2a6ceabb0dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221883, "uuid": "39cf3fbd-59c9-4620-99aa-371c8705f968", "value": "8647351f3a2882d4d6c37d3d41e4c42b1bdc80d61f9f7572e262f7e7381b9144.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca532879-a9b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704228726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228726, "uuid": "f6b232c3-5491-4a3c-b4f6-e0ea0817dad7", "comment": "Malware payload", "value": "7e042555efbb31b00c5e2aa99200a1e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228726, "uuid": "d1b16514-9fff-4b2c-9bd4-c6ac44c7f3e4", "comment": "Malware payload", "value": "87a11f0978c920e56e599a311e1dcab9fc287bf194de9622100cd44cb5c600de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228726, "uuid": "9f5ddfda-92fa-44d1-a73c-306a237a5fa4", "comment": "Malware payload", "value": "edd892960df1bc10158a9819443717bcc0786178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228726, "uuid": "b953243a-e28d-44dc-a0e1-2886a597002a", "comment": "Malware payload", "value": "5ed37bc34ff06d929fcf293eeadeb66b4c238901fbd644fd1fefd4bbafa2bf48eb254e46ddbce6ade0c1e6f7edf1ca35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228726, "uuid": "5e7e26b3-e607-446b-bc1b-d471c5e27d1b", "value": "T1DDC4125273AA2310C56D84B8C5F7447003F2AB8B35B3E75A3E49468A4F57BDACE84BC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228726, "uuid": "12b23521-413b-400f-be18-85ddeb81f71c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228726, "uuid": "5677232f-2e6c-485d-b9b1-5f98edb8cec6", "value": "12288:h5n0b8WEVi3Qyq2hC3rJjKhRWjYFbL0x0hjRue6Y0LZt:h50b8/i3QyqIC7GRW0FcC1Ruep0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704228726, "uuid": "7be70fcf-b2d5-4170-b52a-90bbe76aef0f", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704228726, "uuid": "5a237f3a-78e9-4d01-9cc3-3103787768ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228726, "uuid": "c448e081-8086-46a8-8120-daa45b082c23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85920c12-a992-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704215726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704215726, "uuid": "9b084d8f-3b64-4f95-a80f-3be4cdeda8b6", "comment": "Malware payload", "value": "041d46e37a3b659aea9935b77f044f9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704215726, "uuid": "feeb34d4-6ca4-4d43-b81f-e81ae1e4ebbb", "comment": "Malware payload", "value": "880a57b45cb30cebd23b796fde0dd57259f5988c540dca1e196be0f6776a6db2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704215726, "uuid": "cf8390d9-4dc0-4958-bfb3-2f836e6bd2f9", "comment": "Malware payload", "value": "269a05b698c0ef34158f913725cb3f03270d203a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704215726, "uuid": "e38b7247-6027-420f-89d2-d2a01e178659", "comment": "Malware payload", "value": "36c7750154e4625410b62feed941d7604a6d60cffa99003a13f5c7aae968615f033a110541d32e5af7dc68626f235f22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704215726, "uuid": "72432f48-6500-4e70-9309-9cc47ba42686", "value": "T1BC52D0B373C3315DC32A0935DBDB82D4E280527A4046AB2ADE565A54BAEB364403CDE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704215726, "uuid": "a4d6313b-7ddf-476f-befc-d29f1e377398", "value": "384:bc/558iMFt/z8F69w1b58gJpSfPLF1JcIuVrBsoQqcdVHX8:bc/D87/z8Fuw1bCgqfPLF1Jhu1Bs5dVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704215726, "uuid": "b77f2b5b-58b8-4632-b84d-2a123a15df2d", "value": 14396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704215726, "uuid": "9ca42b17-3202-4f81-a74c-bb86ce41e5b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704215726, "uuid": "de3b21da-770c-4f2d-93de-274870cb6ba3", "value": "SecuriteInfo.com.ELF.Gafgyt-AN.10678.31003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c051257c-a979-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704205087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704205087, "uuid": "fb8f8d68-22c3-4457-b8e5-739e60f4a4dd", "comment": "Malware payload", "value": "fdcc05ddc7bddc66a9aaa8804cfc328d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704205087, "uuid": "faf607f7-5dcd-4c06-8b45-11e32b47e93d", "comment": "Malware payload", "value": "8836e9f5373e2030728938432ad14b81076cf5205cd6d862d9fc9d1452ff584b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704205087, "uuid": "f0dad58c-ca5f-44a6-82dd-e3e7d834a7ed", "comment": "Malware payload", "value": "625694e16d7a1db69f75eb11c72179db0ae6c2dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704205087, "uuid": "eb437859-13df-44e8-8e00-316f3edb7dc4", "comment": "Malware payload", "value": "5437347d39695ae86cc39cebefcb3a378c2ae551340d4ca70986d4eac04a653d357c6a9d1bc2f2b2d87c0b897c5f586b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704205087, "uuid": "70cd8f7f-317e-4b08-8a98-b0654d235f38", "value": "T114758D223680807AD27A3670D72EB37DB2FD95704E314287B9A10F397E35492962D7DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704205087, "uuid": "f71c97b3-8e40-4bf0-902a-02dea293a196", "value": "12fbd1bc75de00e13e4da8fd25e68e9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704205087, "uuid": "11f473b1-ff22-4da3-9d5d-f848ac9dadaf", "value": "49152:c7Q2CH7FiYk7q8wOP2nyh9VgFdJYZL6MsQv4Pvg3KIA8wuSgKakXTT3+1s8ipm:lZH7FZk7LP2nyh9VgFdJYZL6NQgPVIAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704205087, "uuid": "8165d1a8-b5a4-4d40-9f87-331ab1d44ca5", "value": 1640960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704205087, "uuid": "5adfff8e-faba-49ec-8ab4-34076c0de242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704205087, "uuid": "0ddae93e-3b1a-4679-b0f8-3aeb4f6de3d8", "value": "UIxMarketPlugin.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3b836d-a906-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704155693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704155693, "uuid": "5790db30-5112-49a5-8b03-e1baebe60974", "comment": "Malware payload (Mirai)", "value": "e67829576567cbe033dcb7f040ac9450", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704155693, "uuid": "969e3815-4843-4e80-841f-86c9e0c50280", "comment": "Malware payload (Mirai)", "value": "88b383081c46232d2a0c46cf8c35b84ac92417eeae25a386f1de3dc2d8336269", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704155693, "uuid": "99c5486f-8b15-4df1-a352-bdc1f01b2e94", "comment": "Malware payload (Mirai)", "value": "54cc8b6cdf966f6f56591680c6bd4bda55838781", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704155693, "uuid": "8ef66ea7-8607-4227-92f7-24df66f73c91", "comment": "Malware payload (Mirai)", "value": "0ee9a085f5dfff9c7766cf3611f73f7e7c86470181aa29d5d65d0851ae8f74440faefe4447c9e4629c9e06a01bc78379", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704155693, "uuid": "b485e349-4dc1-4cec-90c8-25c77820fbb1", "value": "T153042A46EA404B13C0D627B5F6DF42453333ABA497EB73069628ABF43F8679E4F22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704155693, "uuid": "c724d887-de17-48b1-8627-5535ce092d2f", "value": "3072:HK/lcgNbBLbcBCkoajwdyqkk4/T/6EBp3u/hJjogM/RHWT+M:HK/dBLbEloajwdybkwRBlu/XMgM/RHWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704155693, "uuid": "2bacf601-5e94-4a58-b60a-7dabc50a0381", "value": 179805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704155693, "uuid": "e6497df1-988b-4c73-bdc8-44e3ea4576ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704155693, "uuid": "a2c2f0b0-487e-465b-821d-3e784dc2b013", "value": "e67829576567cbe033dcb7f040ac9450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5443ad2f-a917-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704162815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162815, "uuid": "65ecfb7b-90f3-484f-86d4-8b94e5e23643", "comment": "Malware payload", "value": "0f851734dfa49e9d57a0921df907f737", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162815, "uuid": "5c5ff849-102d-4627-a6e2-f5e870aadda9", "comment": "Malware payload", "value": "8b4fa0c77e55b191f3249468db847a346235f682398d37642488c1f26b6cc9fc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162815, "uuid": "0efb61eb-c0de-4e6a-9e9e-48a281627127", "comment": "Malware payload", "value": "bb47ba301374f3346d90bf2345867e589e8dbb4a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162815, "uuid": "dca7290d-6d95-4d90-831d-13b12fd86d8b", "comment": "Malware payload", "value": "cbb14e99262229bf3a8d7bbaf8dbe3ed226850915901f3ec3817f57a45cafbf749bec016782c93a10e7720b6d10aa8d2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162815, "uuid": "736b0df3-117a-4ba8-bee2-ea200ce7897b", "value": "T1FE453350E70B7324E09E48FE8B02E196897F4DBB3C81BA0F5EAD07607798911A5E53DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162815, "uuid": "2a6c931b-7f47-4cb3-b01b-527eb92e5c53", "value": "24576:tM3qMp3d2y3xOlDUC4V5D2FgMaLkdjU7EDESM+xUgmZYeNcEyRg:tM6+d2yhOlY7V52gL0jUoASM+yaEyRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704162815, "uuid": "cfb198a9-3e6a-4e54-991b-4bc97aa8661c", "value": 1250768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704162815, "uuid": "cdf8f955-f73b-406f-95ff-e84195fffa44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162815, "uuid": "4afe1d45-2bb5-4eb3-8d58-1ed1c66e72a0", "value": "linux-arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c0d021-a976-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1704203516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704203516, "uuid": "362f8cec-0a4b-4aa1-9705-fc8a02f5ad07", "comment": "Malware payload (DCRat)", "value": "b13bc34181b47944d82a7daf9b1243af", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704203516, "uuid": "3af9260d-3576-4eb8-9596-69971f60dadf", "comment": "Malware payload (DCRat)", "value": "8d4d7a9744daead89a8e5af92249aa6d709e4f91ff33c774ba6e8c8289ec2020", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704203516, "uuid": "30f369a1-fdcc-4b36-a0bd-2dd19c0d75ba", "comment": "Malware payload (DCRat)", "value": "964d5f5f3eff0edf9da9e3a7256f779884530f3c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704203516, "uuid": "7526aee1-1bea-43c4-9d62-26ee84be3c34", "comment": "Malware payload (DCRat)", "value": "0c865b39a0ff5b2a69c4bd8bc273e4895153e871579985825e47a224dcea530d9c85cb7b690ad1e913122e9fb7b5c1ca", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704203516, "uuid": "bfba1a37-ebc4-4d6e-9367-0c46c3d6354f", "value": "T1702623A1ABC05973C5762B386211FB31E47E2D687F96CEC293E8BD0BB8335D15630946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704203516, "uuid": "8265c3e3-a7b7-498b-918e-68695d6bd845", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704203516, "uuid": "2881ef54-0767-4493-bdf3-62d2ebf27158", "value": "98304:hgZmDxM5pfnV14xJIviRgoYTl9+yj5PcXKuEagqCEKcHii/JtlotZSgd:emDMnuJIviyTbhcXKuEJqrK4iySeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704203516, "uuid": "26d669be-8239-4de0-8c18-17c9ae948bd6", "value": 4730880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704203516, "uuid": "c2d3e66e-f975-4666-a4d1-38fbe2455252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704203516, "uuid": "71647c1b-fb26-4bd7-a355-e865367a323d", "value": "EGN RU1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d606adf-a9af-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704228060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228060, "uuid": "bc76c09f-63c4-4447-92b8-3d1eef4db276", "comment": "Malware payload", "value": "9f229df785e9c754203604ac4bdd027c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228060, "uuid": "62ab6e46-4e86-4edc-b149-45c94083832b", "comment": "Malware payload", "value": "8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228060, "uuid": "d766dd16-8929-4dd8-abcc-b2defbb5e7de", "comment": "Malware payload", "value": "0cd6aec7a015467cddcb37fd44a0d986cd95334f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228060, "uuid": "244e4842-b826-4178-836c-b9b3f1b10cf9", "comment": "Malware payload", "value": "0fa5d2dfdeeb73eb82bcbceec64685d2b6fe028990b6bbc58c9bbd7962bf60f5494334dca7b886dfa19845d089594aca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228060, "uuid": "e6ea497b-2970-48e3-b65d-65134cce2380", "value": "T175C40102B7D64321C44C117AC4B7556103F2BF8722B3D38EBD4D1B9A4D927E6EE8AB85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228060, "uuid": "ae1dfdd7-e0b3-4994-82d9-63e8934d829a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228060, "uuid": "d3092a64-aa20-4eca-87b5-d5f7a20c81a9", "value": "12288:LqzxxE/84PA9h2b4u7ccF4PksIvrG/XQ6FynsDBO4:Lq1C/8wA9h2k7Puq/XQWwUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704228060, "uuid": "75d65f11-1e8e-4b4e-8ece-39eeb7b6720d", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704228060, "uuid": "9737f759-a8ba-4d06-ba18-f13148219e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228060, "uuid": "b480c898-85b3-49df-8780-4dad9188bc43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652c9d18-a92a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1704171004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704171004, "uuid": "762cd562-4760-45ea-a340-e1b97af29bac", "comment": "Malware payload (Gafgyt)", "value": "b7cc955cb7e496663a97072071e654a5", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704171004, "uuid": "818fa3ce-73d5-46e1-b950-178f532c794f", "comment": "Malware payload (Gafgyt)", "value": "8de19052409f19885f4c5c4088ec31254f5d35c6b5348d53d5ccb6f94210a684", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704171004, "uuid": "6dc05708-05d8-4633-ab76-28c67ceb8566", "comment": "Malware payload (Gafgyt)", "value": "ed1771390dd896a8f7f5c264b196d9f4076b1d36", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704171004, "uuid": "d9a635d1-0902-4aa5-9abb-05a9dc9aa78d", "comment": "Malware payload (Gafgyt)", "value": "67042a5f4d488ab297209fc922ffbe028784fe60c953c40ec3498ad9fd732f0f731d2ac82ad37eb0504b72920615d501", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704171004, "uuid": "eb8172ea-c306-4df4-a2a3-81e17cb70390", "value": "T1B2E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704171004, "uuid": "a0d09cba-e641-4bb5-9117-5741249d027d", "value": "3072:dgZc9h1jlnLA2PiXYeyCcBVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZBVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704171004, "uuid": "dbf4a49c-65b8-4402-a146-0f55bac67862", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704171004, "uuid": "8c963dc9-dfcb-4999-aa1a-79a00a596336", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704171004, "uuid": "8eff0549-08a0-4284-a251-e2fb7ea74639", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf0a052-a9c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1704236410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704236410, "uuid": "7187be24-2e60-4510-9d6f-47d6ebebcd37", "comment": "Malware payload (Arechclient2)", "value": "cc8f56e23b5803bf1fbfe5a2b8fcb28d", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704236410, "uuid": "dfe45a25-dcd2-43e5-ae86-e922212df6fe", "comment": "Malware payload (Arechclient2)", "value": "9133b62cf224ab836d86d3aff622629e91730a557ade8fc281261a9f49e7b319", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704236410, "uuid": "9ff30250-a548-4cf6-b446-0c0bfbb55c49", "comment": "Malware payload (Arechclient2)", "value": "25bff308eb6e33cbf4b94e98cf6e3e2e9f845b09", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704236410, "uuid": "e59e4b40-c029-47e7-a2ac-53a91d17778a", "comment": "Malware payload (Arechclient2)", "value": "720fe030b36a691d0f3a8c2bf90e16e4c75cfd7ba6a228933e7f8ff251ac50c06a79f9139a12dd1aa32b1325e29a3f14", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704236410, "uuid": "2f91a649-abe4-4730-9b21-27efc538b843", "value": "T1A7055AFFB64BED25FEE837FC48FF5C4842A552A79591520B088C88D01FA536E8748AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704236410, "uuid": "96231c34-2a3f-4602-b405-5d9dccadeee0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704236410, "uuid": "7685c1c2-cf76-4726-b581-0b35153a3313", "value": "12288:0vAzqb0aVcdzBEbk+ZFtHcwnt7o4ayE11xtwuK3t1:0Izqb0zpBmZF3M4JEoXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704236410, "uuid": "db0988bf-8a22-4143-9757-1ed09c1bed77", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704236410, "uuid": "3ed105e5-8fb8-40e5-a7c1-54b4c4470a6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704236410, "uuid": "48417c77-69d8-434d-8491-b6924edf6810", "value": "CC8F56E23B5803BF1FBFE5A2B8FCB28D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cbc1c2-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704221842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221842, "uuid": "13f260dc-06b8-44fc-8a9b-0606ef30c64d", "comment": "Malware payload (RiseProStealer)", "value": "dfed4e36537ae0dcc15fd7ecf432e074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221842, "uuid": "98909db3-33e1-4e7b-b8ce-985f99e07a5d", "comment": "Malware payload (RiseProStealer)", "value": "94627d8117da7cccd8c34a1d8ad88d988a26ec6337d0d66559ee6943f2c2a233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221842, "uuid": "7f31fb7a-c476-48c0-b1d5-0e8929eb1639", "comment": "Malware payload (RiseProStealer)", "value": "da095b411cb6c6e49cc04eda43a839e0141da075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221842, "uuid": "2427e193-38d3-4e2b-ad98-9cb5385e9bde", "comment": "Malware payload (RiseProStealer)", "value": "5068781c5ccaa492ca107e2cc3fcf87b9f709dc7ad58a166c3c0002f84058cfe38a499a287ba86121b1a4765a6f8fc70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221842, "uuid": "a741b9f9-56c7-4b52-91e3-1ab6e0398a59", "value": "T1ECB53383A6D19531CAE127B164F767C31A30BEA3AA28171F3940DBD508F35A5B13673E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221842, "uuid": "20d1a660-0dc7-4591-b26d-3c3608872728", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221842, "uuid": "1fd0d47f-d102-43c8-9040-e291b41fe8ad", "value": "49152:ZOng5rnpYo9282VV9Mg/WihJvjwbE9o/NYswY8hwjVpPmynUz61ryRwf:B5rnP9AX9Mg/WkJ01Zqgv3H1ryRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221842, "uuid": "62d3d964-0dc9-42a3-880e-2808290f02fe", "value": 2476544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221842, "uuid": "c2f646e3-8dbc-487f-9fa8-272698dd6667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221842, "uuid": "a71ff231-ca33-4730-946d-f49ba7582414", "value": "94627d8117da7cccd8c34a1d8ad88d988a26ec6337d0d66559ee6943f2c2a233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e282fb9-a9a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704222425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222425, "uuid": "9a22c808-4821-4b79-887b-e70a7ca6fe3c", "comment": "Malware payload (Socks5Systemz)", "value": "de3414bb300bb4acbc629ecf1d0fc391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222425, "uuid": "54b4014d-f548-42d6-923c-cb8234e290b7", "comment": "Malware payload (Socks5Systemz)", "value": "9581ec377f2622120a2ad56ef162c292c8fc5775cbc42ed3e8dbf565efca0d31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222425, "uuid": "c3801bfd-348c-4df1-9e5c-cfa72a62fa40", "comment": "Malware payload (Socks5Systemz)", "value": "21650b9e2a3ca3250cc9736eb2a7ce6d126d13b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222425, "uuid": "1e3519c8-7f6b-44a0-b123-135b882d04ec", "comment": "Malware payload (Socks5Systemz)", "value": "2ee543ea5d973b61595a4d64c96fc464f0d474bece0d3b7b54fc14cc4a224399095ed39cf8346ff84f8838be5af647a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222425, "uuid": "f6267a75-1256-4230-aacf-d91be459b239", "value": "T18F26339681479238C01487B53429847AD9457C974F3FBE1034A9DD9EDF6AC80A87B3EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222425, "uuid": "246e439e-7a88-48a3-919e-0654dfd282d3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222425, "uuid": "310a5462-73dc-4578-8c64-ffe58d605eed", "value": "98304:Q+A/0vQuldSM2OsBes/stC3x+uDX2yPmj4/7eSPU04dm8:5A/e9rgOU4c3tDX2yPmQ7jD4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222425, "uuid": "04b7bdfb-2370-4952-95b9-d48eb677ad2a", "value": 4576716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222425, "uuid": "4ca49e9f-a8bf-4948-bd75-5bfd2750ebd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222425, "uuid": "f3aab7de-2bc0-4041-9017-063dc1bc87a5", "value": "tuc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f93a3c-a9a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704222411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222411, "uuid": "0fb6c878-9e82-4c86-8381-813fbab178b0", "comment": "Malware payload (Socks5Systemz)", "value": "ec851ae60fe713a68ff1f02c0f8763e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222411, "uuid": "cfc193f9-2b46-4981-b10d-30dbf3c4a5d4", "comment": "Malware payload (Socks5Systemz)", "value": "961db0c18fc8e1e0c1b7f8f0da3db4a1ecc2533d0a6159c1de01640db7925315", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222411, "uuid": "e03795c7-b2e6-47a8-b677-92cdbf528419", "comment": "Malware payload (Socks5Systemz)", "value": "45804b83a99130a67f938324d10b6f7bfa71b1b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222411, "uuid": "542e9f32-fce3-49f2-80d1-5f4d50ff9768", "comment": "Malware payload (Socks5Systemz)", "value": "24995cd49695c15a5c4d77c3caf9eddec591e3641ae4eb2e3d642a13e6c074c08280afb4cb5f70aba84765a95f8093a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222411, "uuid": "85c534e2-e492-45dc-95ac-e8beacc89f21", "value": "T1082633828C585CF8D0B4063D482B453C17FF2A6329B4272DF5AD85BB5DAACD9824B3DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222411, "uuid": "4e886be5-b0b6-47ba-82a3-b1349ffaa5d8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222411, "uuid": "cccd6fdf-4fe7-4f8a-9c5f-522b8cf30055", "value": "98304:QzV/1MerrGxfu7LLMZhuau9KStmDHEXil1mQHJ7g9O4dm8:CVvrrC27LgOau46mgXijmQFg9O4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222411, "uuid": "d118ef9c-fb62-45ca-9727-61a285aaabbd", "value": 4575590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222411, "uuid": "89f6d7c4-0258-45e4-a67a-86fe44fdcdf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222411, "uuid": "48697f55-6c35-4da9-9b21-275bf06ac31a", "value": "tuc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a690ed8-a9a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1704222875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222875, "uuid": "2edc7c05-c663-49b7-8a5e-d286fadb308e", "comment": "Malware payload (Smoke Loader)", "value": "7b2592bee2a2b4cfb28502892c619612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222875, "uuid": "14373d38-aad6-4c84-b27f-bb754c81d45d", "comment": "Malware payload (Smoke Loader)", "value": "9c98f0f798b53d28919e7c8f7331619c509e24045d1f4dd192f86f2a6115d483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222875, "uuid": "e43dd31f-4bde-4579-ba66-973c0c548270", "comment": "Malware payload (Smoke Loader)", "value": "c4477fef847e926783d54efb7c577fdb8d2407f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222875, "uuid": "50265f49-b600-4a72-a143-717006c88fa4", "comment": "Malware payload (Smoke Loader)", "value": "574940e6bf6eff01c6158cb9427f672a7f7b33757dbd65da1dbb4ec42ae0dafb8a138c427f1133df0c366cfe3b527b5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222875, "uuid": "cb9f380f-6c72-4d94-a507-8d1d912ab44c", "value": "T1F0149D2131F0C072E6F369B549B4C7B44E7BB8A32A72964F6BD416792F256D18F2031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222875, "uuid": "e1da8c6d-2ffd-4cfe-8a24-29d8d8b7dfcd", "value": "628b5625e44ec4d4a2ba4078ce3026c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222875, "uuid": "0fdbd5d7-7b2b-4d79-a90d-b6874bba1b07", "value": "3072:dDoO2LbVS5fgevom6PJiMrt+NqaDD3LP2uHv49GriBditdi16kwxZRUiaD:S3LbfGMTI3LPJPqG2Bkeia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222875, "uuid": "90fa22d8-cb0a-47ee-ac04-8b99d599494b", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222875, "uuid": "3da235c7-f794-4a73-9350-8c18af45773b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222875, "uuid": "dfac5e5d-f2e9-424b-a451-2c961ec33b92", "value": "toolspub1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a911c83b-a95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704193022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193022, "uuid": "77de5fff-9a4c-4ac8-80a6-c71c4eadbb40", "comment": "Malware payload (Mirai)", "value": "34e2c8600bdd8802683f9357889ad433", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193022, "uuid": "af6be9ca-a804-4254-a3ff-2d2e97280ed2", "comment": "Malware payload (Mirai)", "value": "9f48a3bdfe0cc51c921a110a22d044e3017c428129b02895d3ad1e88b86853ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193022, "uuid": "e1953736-c8dd-45a3-ab85-f54501ed63bd", "comment": "Malware payload (Mirai)", "value": "f397cbf5192533c7f1b8f5a32b8e10c1fb7174df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193022, "uuid": "f58355ac-93c1-4fb5-b18e-317c91b50d0b", "comment": "Malware payload (Mirai)", "value": "01a90061c7fc86c15e9a7f678d44c55feac1fb98ce56289c003fe36a5e71641883b2c17437637df0c47c08bd118761f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193022, "uuid": "2a2fc2a9-f302-40c8-b411-e75a1822d5d4", "value": "T1F9833AD6B800DD7CF81BD7BB8023090AF171B2510BA31F3AA3A7BD63AD261A54D56D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193022, "uuid": "4ada05f8-280c-4432-be17-c8199de4ce3a", "value": "1536:E/rLr2axwfkhFVKY9u36YdNqmq88ncePQC6m89J4X7f6N1sBeTBnbG:QwfkhbKiubfqmqeOlGJ6zBeTBnbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704193022, "uuid": "9c9686ba-4b44-4814-b2d6-01ba67d8110f", "value": 84516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704193022, "uuid": "aea222e6-3260-4d8f-a779-abcf2f4d4eba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193022, "uuid": "4e8332ed-b234-43f5-a7bb-4fe34621d0d5", "value": "34e2c8600bdd8802683f9357889ad433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923930bb-a9a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704223049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223049, "uuid": "345c6187-be51-4d68-bff1-b19d89550378", "comment": "Malware payload (Mirai)", "value": "a4794bb37006b30ce3c5130f5995539d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223049, "uuid": "fcaf2a27-d1d3-4ce2-90a2-1801997f0e90", "comment": "Malware payload (Mirai)", "value": "a22e3e18da3a7ff50e1079ef579a200f3e5143dbfb6e45d97467e9f4638b9e6c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223049, "uuid": "3f3382a0-5ad5-483e-a768-7307e97b9aad", "comment": "Malware payload (Mirai)", "value": "507e778072907136be778b5af52702954f0da95b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223049, "uuid": "519ae7a1-5766-49be-b1de-0796d956e1d9", "comment": "Malware payload (Mirai)", "value": "b878bb500f8f13519f9321c93c1845e17211bc05476a360d8da4080721baffc4105ed31a375773454f21774c5848a638", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223049, "uuid": "80b31fcd-2034-45c2-81e1-18b50be2af89", "value": "T179334CC5F543DBB5D84204703076EF339E3AE6FA215DDA87D3E5A532AC83502A50BA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223049, "uuid": "5ff0c8fb-f5ab-4e6b-9497-2783b39b6eee", "value": "768:ytYRSjaQ9DaZFoJlExakbMqu8iHERkvKy+hRlOTm/4RsvKQLDJ1gMjz:WYRSjaCurwlP/4ly+h7Oq/4G3LN1gMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704223049, "uuid": "60042e91-0d67-4f28-a07b-0c21ff422988", "value": 51380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704223049, "uuid": "a42d848f-02c3-439f-9006-92e1f5507361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223049, "uuid": "205e6f5a-b089-40be-a4c5-ea9cc55ba452", "value": "botx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2dbaf5-a996-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704217566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217566, "uuid": "ab7e4994-0bfe-403a-91f2-0c414364eadb", "comment": "Malware payload", "value": "f163841b5de5f1f60df5b59c3323595f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217566, "uuid": "bda93bc7-5757-4ff5-8ae5-7ce362f7ff07", "comment": "Malware payload", "value": "a669c566ce3a37ff309f341c95dffc017f2b77df2815b34ba1ec0f700dc7b0e7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217566, "uuid": "e5e0e8fa-65f8-430a-a631-d66eead4d002", "comment": "Malware payload", "value": "8aae2e6fe3b4e35e04107cc349dbe1991bd3845d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217566, "uuid": "3980a879-91f3-4ce7-8d11-05622c6c4bcc", "comment": "Malware payload", "value": "78b47de2d44c6503e7804598a217598ebcec7b64444804e63741670249375cde4d57094415ead078e913b7e6520d2942", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704217566, "uuid": "8e6b9675-8cf2-4234-88d9-fedcacd24cce", "value": "T128D2E2C0B961D846DB19DE70A5BB3954DD13DD3C5B2C414A03A60FD6BBC9263FA21BB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704217566, "uuid": "d53fe0d7-f569-424e-978f-ebb6d94759fe", "value": "768:XnH5mlV9v4AfFYK0w36bGI9PXJZqFoR46H/vk7XRdc:XHMlV9v4AtbF3S9vAk9XERK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704217566, "uuid": "3522e697-f2f5-4bfb-9eac-4e96f100591f", "value": 28588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704217566, "uuid": "7efe8cf0-97fb-4c0b-a2fe-09587dd5b43f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704217566, "uuid": "b47e1313-3c54-4d44-ac1d-695f4f582f0e", "value": "popbang.arm7-20240102-1746", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9133fc7-a9af-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704228322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228322, "uuid": "f9c7215f-d6bf-47d1-817e-f74503be8fd8", "comment": "Malware payload", "value": "553cc8aee992da42454595e76d7afb37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228322, "uuid": "a390c387-d894-4b81-b6be-9516465d5ee9", "comment": "Malware payload", "value": "a8a3130c779904e23b50d69b4e73a714b345e296feebb9f64a732d5c73e7973b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228322, "uuid": "dd9e439b-2b14-4305-bb1b-68e779071219", "comment": "Malware payload", "value": "47a5850ad4c2b7e6708fa28300f8fdaf54839ebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228322, "uuid": "852f2c5c-0774-497d-9654-ab43d4fb3920", "comment": "Malware payload", "value": "52e8b0b16368ce2057d4b70b6d931b28fbf0fe5b7e957e7ed163b76841dd99a3e9c9c5674d29d158a52f3d94ced10238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228322, "uuid": "92ee71d2-8cb1-486d-9c4b-afd76a818517", "value": "T10724C0027580D872C9A250348C38D2F5777FBC679A695A8776683FAF7E323826771312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228322, "uuid": "d6ba8c5c-316b-46d8-b843-6c54c697ea0a", "value": "b2e3875b9432f537090e379200a83dca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228322, "uuid": "e06cef98-11fc-42d0-87a7-a33be3991a17", "value": "6144:u4sxL7SMoJcll5+CZNdX9O3LidITCW2HTfKs0qxIT:u4UHSMecXhJg3LiGTCW2HDKrqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704228322, "uuid": "59591f96-1f46-429c-aa3f-bf4c355def6a", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704228322, "uuid": "d60aec5c-0497-4f43-8a38-1981bd561927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228322, "uuid": "a0c9a60d-c3a3-4be8-b98c-3424ec65f0ec", "value": "pax_389.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3db117e-a927-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704169848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704169848, "uuid": "324c7184-43d1-4a0c-8562-147f131922d6", "comment": "Malware payload (Mirai)", "value": "e3ada8014ed4de4ff183d007320bb14f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704169848, "uuid": "1d701a31-1dca-470b-bbb6-1a56ec0479d4", "comment": "Malware payload (Mirai)", "value": "ab74f0b951d0f7862d3f21786d05e13857ece4f306ba78b5c58ec98ad3ea69a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704169848, "uuid": "fc66eb77-5d9e-429d-83d0-eb1fa89928b8", "comment": "Malware payload (Mirai)", "value": "725fbc029e8fcbf091804fb8044e969da0e30c76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704169848, "uuid": "368b6be3-a32c-47cb-81a0-87f0078a5a8c", "comment": "Malware payload (Mirai)", "value": "c28353d7b347882142baecc46376c17963ead3cac25d4c1f5585ad647e943acb2a946e6ea098af4a74c3367ee140b001", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704169848, "uuid": "e612aeaf-9937-46c2-bda6-e85ef516af13", "value": "T176330260CAD4DB80E48D6DBB7D3D6280CEC55678509D7A0163927C958A4D7C3C26FEA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704169848, "uuid": "7d3a69d0-8c8a-4154-8e7e-de75967329ef", "value": "1536:Lzskl0dypu4mU9T/4TXP7L0fePsKeoRCCWRkt:Cypu4ZR4TXP78eEKfCnkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704169848, "uuid": "e82b119b-1382-4ffd-b434-ef3f34f85a0c", "value": 53580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704169848, "uuid": "cf4526e2-cfb8-45e2-8419-71047a594e4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704169848, "uuid": "d472a9c7-9693-4241-bdd2-a91e51f8fc7d", "value": "e3ada8014ed4de4ff183d007320bb14f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff3502f-a95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1704192980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192980, "uuid": "c7fa28fa-3c40-48d2-a965-72c21def4baa", "comment": "Malware payload (Gafgyt)", "value": "18f12ab4eaa7cca1ed46bd3a6a21d9a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192980, "uuid": "9743e142-9ba3-494e-834c-632fbac3509c", "comment": "Malware payload (Gafgyt)", "value": "abf520ca91767dbfd1b806f097db517ef8d51a8031b2a20fba275d68f25ec502", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192980, "uuid": "757f22f5-ae32-432c-902f-b3b2bf7ba6aa", "comment": "Malware payload (Gafgyt)", "value": "86fd98b57615c0524a95a764ea3415c75ca97228", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704192980, "uuid": "c3cc0a63-dda8-4600-b76a-0f6017baaf68", "comment": "Malware payload (Gafgyt)", "value": "e476161397a8044dd872c0825c4da1454d647525432c28e0a281d401f7ebcc8b31f31bca3abdd49453ce180f31db3d73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704192980, "uuid": "66a7c9bb-d205-4333-9452-41497c1b4988", "value": "T1C463ADA3CB5A2C40C14C827470A88D3D7763F65581A72FBA09E6D2AAD447EDCF1097F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704192980, "uuid": "5a6e0f46-f3ca-4b31-9352-06c16db51a19", "value": "1536:m/RsT2BYFatLjMI0wUWJbSpnkTkBwf+KkHLscPyICNmBVwbZnN:m5p+KjMI0ruSkqGxk1PyI3VwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704192980, "uuid": "77e17bbe-f33d-416d-a3e9-49770d7dcea0", "value": 71768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704192980, "uuid": "b99b9db1-146f-49ed-95c8-71c91795ef81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704192980, "uuid": "cec6dc41-08d7-4500-bb28-a1b6220cfbdf", "value": "18f12ab4eaa7cca1ed46bd3a6a21d9a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe74db66-a95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SpyNote)", "timestamp": 1704193166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193166, "uuid": "eec972b8-12e8-4f04-afd5-00ca67a828f5", "comment": "Malware payload (SpyNote)", "value": "b7ea13727968715caaa338a76abb9987", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193166, "uuid": "f52da144-eb5d-4314-89b9-276e6f00c5d5", "comment": "Malware payload (SpyNote)", "value": "adb7cba1d60f35b90d8d178da2eac4a157e5d05f78914847584022cdf3c91afa", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193166, "uuid": "48102c51-d657-42e6-b5f8-88aedc1f7663", "comment": "Malware payload (SpyNote)", "value": "41b1c357a5298cb837dd0b7147f77d015b9b4809", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193166, "uuid": "3937f938-1993-4a49-8d7b-14544c1e78af", "comment": "Malware payload (SpyNote)", "value": "8d14f842963945f08aad557a607c3e91bc7fea3d9ef88ecf6213ca2ff269475ab17d8402ec873e846746cb4940cd6de0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193166, "uuid": "77534e09-a876-4215-9ca7-5480eded3d64", "value": "T1B706E003FB48CAA7D9BA83F16B370DA92E171F44CA4296D754517A7D2E772D00DC2A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193166, "uuid": "d3a2b46f-7602-433f-8019-2557cb1805aa", "value": "98304:IwqNEZtsxOqwTPn0KvWwKtfmzJzB/TA0tJjLT:IwqNEZ4wTP9cOznrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704193166, "uuid": "0e1db6c1-c8b6-4e97-8a3e-fc5daee1265a", "value": 3965273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704193166, "uuid": "a6b5f0ef-3d9b-465c-a257-032fc651b8fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193166, "uuid": "2ebef6ea-c084-4a4c-a9fd-cc196c187682", "value": "bahislion.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1d4d81-a999-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704218554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218554, "uuid": "16f51e6c-2aa2-4797-95d4-7b34ac6641e3", "comment": "Malware payload (Mirai)", "value": "162caf16a33a65715e0ebbc4a5a7ef83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218554, "uuid": "400ea44a-10a8-40e8-a424-1f270032a832", "comment": "Malware payload (Mirai)", "value": "aec176a9c4563b039872b19219404e0e362c0b098d87fb8f17a4e904119531db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218554, "uuid": "c94491e2-e1c6-4ec8-8156-0e279ec56915", "comment": "Malware payload (Mirai)", "value": "81bbefbc106518b37ac5b45c7aa952bf5de353de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218554, "uuid": "ccaa84ec-c62f-4945-9c55-5e39bbcdac57", "comment": "Malware payload (Mirai)", "value": "270ee1d6953986a98a6f7507d3de3dd5488604a392bf0e6ef968cfaaa2bdbb808afbc13f0eef4c60045bce5900255c68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218554, "uuid": "d73ee211-1435-437a-ad19-ddd9b26a7729", "value": "T11B931986B8818E16D5D413BAFD2D01CD33226BA8E2DF7107DD156F2037DA91E0E7BA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218554, "uuid": "af8c0148-f056-4b55-a855-54150bdce31b", "value": "1536:2gXnuAnd7ND8HoyGO1tqP9Fj2lTj+nH8TM0wawcsDf1w9E7fgKA8IYGlYoOOtZsC:2XAnd4knd8TVefOUfLd4KFQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704218554, "uuid": "8676c7e9-f1da-4ce1-8155-49559932d9c2", "value": 90844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704218554, "uuid": "f6fbde45-82e6-440c-8170-2c9a925a90c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218554, "uuid": "2446ec45-3f64-42b2-b789-046b667181a3", "value": "162caf16a33a65715e0ebbc4a5a7ef83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ece251d-a997-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704217809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217809, "uuid": "b1cdcde5-c5e4-4943-bdde-36ecb4be3bbe", "comment": "Malware payload (Mirai)", "value": "157dcb2cda3d85e28e6eb9b505c62544", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217809, "uuid": "64f7bc1f-6045-4e63-ab07-9d479a58f7d9", "comment": "Malware payload (Mirai)", "value": "b471287dac14c4ce3c675d9d3ef9bda965ff4f3db1eb45af72549a9794425770", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217809, "uuid": "bee02f72-84b0-480f-a6e9-03e15bdb436d", "comment": "Malware payload (Mirai)", "value": "efeefbc1be907697c5d62fb3892fcd92a3e5398c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704217809, "uuid": "3ac54b34-7576-41bc-bfd4-f80ce54a1e54", "comment": "Malware payload (Mirai)", "value": "50b622175764af11d98d6731123af2910ee8ae784a7a05289f85a6c97609bcdc5bc3d63640919fdd384a20fa4e51ab8d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704217809, "uuid": "b0ac19be-9236-459a-9fae-89059d204c45", "value": "T13E630A45BC858D1ED5C423BABA6D16CE33257398E2CF7217CD045F643ACA90F0D67A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704217809, "uuid": "b912121a-40bf-403b-bef4-bb7e0b1290e7", "value": "1536:0AlZanc8BMe31oCMYJ1VaNH1E9F58Cg6TH33LT2llS1fhr1F10:d18vAc9HHnL9ZrT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704217809, "uuid": "82235a48-9f33-4692-b0ab-6d2d662fa6bf", "value": 66912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704217809, "uuid": "25259feb-340d-42c9-a393-82b152b528c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704217809, "uuid": "d084270e-d3de-44a2-a315-57be8c5ce233", "value": "infn.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6def1fe-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704221849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221849, "uuid": "de16ffee-19cc-4b95-9f10-6da98fcef1c1", "comment": "Malware payload", "value": "da5ffbe5ca612a03fadbcef8f3fd38de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221849, "uuid": "2b8d0a8b-ed9c-4178-842a-c982c286a1e1", "comment": "Malware payload", "value": "b57fe599791c010401a65bd6064dfd0ea26c71853999077198056bb821a8d1a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221849, "uuid": "ccd57e92-abb7-4cbe-b081-1fb9267bcce5", "comment": "Malware payload", "value": "0b12f1b7bda89f18f84586e31e4ffde1e3379847", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221849, "uuid": "52049ebb-bf51-4825-a5c7-7dfd669d4754", "comment": "Malware payload", "value": "05674c7d967d195960052ae7049c11a40481404b8c4a96d7b7455a157c420689ebe470e793f8a33e856a166f4b82b6f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221849, "uuid": "99926b93-f404-4e16-a8b5-f4d1bb182a5e", "value": "T132C5331277E5DEF0E2B324B2AE8AEB350C78E269371545C357A48A064C75BC39B7C5C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221849, "uuid": "12820c08-4587-4518-9ae4-8e989195c826", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221849, "uuid": "eadb975a-2893-4ee0-a242-fe6dfcfd35f8", "value": "49152:X95tQNQaAGEbSFfSgf6uW1govv74BKHcJiUnJ/i+1oHeXvshN:X952bA1kWuWdvzMXtJ/i+1oHUshN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221849, "uuid": "e69a6ad5-7b0d-4947-a51a-cf2e63ca70be", "value": 2649048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221849, "uuid": "9865a69c-ee83-4aff-8a34-3cc11fa6744a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221849, "uuid": "e597fbd7-77b4-4934-a24f-365130422797", "value": "b57fe599791c010401a65bd6064dfd0ea26c71853999077198056bb821a8d1a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411042ea-a94f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1704186835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186835, "uuid": "733328b3-7d84-452b-be56-92b192c77f3f", "comment": "Malware payload (Formbook)", "value": "8bc12f4c63c7cd1eac3b317628526489", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186835, "uuid": "01acbf81-135f-46bf-b395-9baf3c828af1", "comment": "Malware payload (Formbook)", "value": "b60d52fb9609a44a180110b46007bfc5f21e16189a667a17eb54e16cb3890c3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186835, "uuid": "68bab51b-dc9c-4c21-983d-24834cdbb7ea", "comment": "Malware payload (Formbook)", "value": "535425182540ac5b5ea21a13b9357632baf68313", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186835, "uuid": "082c92c9-da8a-4cb2-b89c-75701e6e7844", "comment": "Malware payload (Formbook)", "value": "1c51a99f306e228f96c1122782274787d2ca05fac41d78e742a29323c2c9836835b090ee1b7a14e63d4bbc3097da701b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186835, "uuid": "70d7a7b1-e822-42c3-883e-ba7bbb179726", "value": "T13B05BFFD08BD12FB806DF6A58BD99B27B018987B3110696794D34397430AA9235F31FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186835, "uuid": "0d076216-6728-405a-a337-62ffc2f57181", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186835, "uuid": "cdd5b13b-84c4-485e-9388-fc37588e7ba0", "value": "12288:EYto84q93sDOWY0vt9V5zLSYBocoOxQQffyAgs/LyUW/z9RKq90JlS:EEo1qNsDOWY0vt3BeYBocnXnyAJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704186835, "uuid": "540f8180-eb41-4a8b-9498-c436de3ae716", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704186835, "uuid": "6357acf7-6db0-4ead-9084-604a9630ee11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186835, "uuid": "f627dc33-2f3a-4957-9bcc-08543d3b1868", "value": "PS23-107.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c2741a-a9a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704223697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223697, "uuid": "24f4ec93-cabc-42ee-894c-6c6f0afbb303", "comment": "Malware payload", "value": "8c3e7b6b72018052253153eeac5d10a2", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223697, "uuid": "fcc72115-9336-4c50-9416-19cdc2c9f463", "comment": "Malware payload", "value": "b7a46b6c3fd98866134d8a5831a82b7444c0c2d5fe6692adfab92051e3541c7f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223697, "uuid": "bab5b9f9-11f8-400f-9a95-b4e9647c8458", "comment": "Malware payload", "value": "e71b4799ace996616f042f3ee5d6d32418f8c687", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223697, "uuid": "9bc5d41f-bcba-4cef-b887-b3a85ae3cd31", "comment": "Malware payload", "value": "7e27b63d01e313f90819f703d9e3acb3ff0f084c6b5032ad493db5daca61b65b1b3b8d679168c8dfb89b161c4ea674dd", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223697, "uuid": "7a625eb9-0fa6-4e28-95d5-c4cebddd6a0d", "value": "T16984F10533A64760E9E50178C0E7856013F2BADB32B7C3893E8C428F5E627D9DE49BC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223697, "uuid": "cb37e024-0ee5-4b71-b16c-87f93dc80740", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223697, "uuid": "0254e827-09d0-4154-8e5e-0875408a4ecf", "value": "6144:vK4zpQJTuer7D8PX6Jzgw61RKjWMw376FZKWAlBCqf670vb06WgGZqb5loqQr:vPXuD8PX261RKuc4UqfwD6zMqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704223697, "uuid": "5bb78ee7-2963-4e64-b9e4-e9f9067d236a", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704223697, "uuid": "065a98fe-ad2b-4bc6-99cb-0b1ee202489d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223697, "uuid": "dd3a9582-0f8a-45cd-9edf-04cf3aecaa93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4fb92bb-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1704221819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221819, "uuid": "3454724b-a53b-4dd8-9ed5-9651c521da95", "comment": "Malware payload (LummaStealer)", "value": "0f3a1dd12b96fd6d5d1d2dc599659059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221819, "uuid": "ab34c59d-ee8e-4d92-a1eb-c91dbe5b3f1d", "comment": "Malware payload (LummaStealer)", "value": "bcec8f25d0fcce6b453b9bc363d15b3fa84f2bca0afc7c5bb9f3620386b4dabc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221819, "uuid": "8793b94a-34ba-403e-8b19-59cf613cc5ab", "comment": "Malware payload (LummaStealer)", "value": "bb52f7bfa7d627b84bbf332e962393ef3829b681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221819, "uuid": "58594d26-9c74-416d-9ffd-e344f950a576", "comment": "Malware payload (LummaStealer)", "value": "6119d7e3879d3a27691543b0e4005fc40b6be9fb630fb699b6f00374a7499ce808a17532dca0eeaa5f3d40410699b144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221819, "uuid": "d2a2dc79-ac0e-4e67-8a73-93f6bb5ec032", "value": "T1ACB533426AE54570C9B51BB0A4FB53C75E35BEB3AA64570F3A80EB8408B38E1B13573D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221819, "uuid": "e9c1d236-59df-4e09-b357-70c49e1ae296", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221819, "uuid": "e728dfc4-28cf-468f-af9b-07514a18893b", "value": "49152:GsSoYo52RhV51Qg/uahtHnwShPk/TGN3A8hwyATPmyntyuUf:K85G31Qg/u2t1crNq9q3tyuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221819, "uuid": "6b6420a2-7249-4205-9eec-668685e87014", "value": 2475520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221819, "uuid": "e356d98e-280f-48a3-92d0-2f1ede77b651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221819, "uuid": "3e740bba-1f51-4d04-8159-df3ceb2e52d7", "value": "bcec8f25d0fcce6b453b9bc363d15b3fa84f2bca0afc7c5bb9f3620386b4dabc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b01124-a988-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BadBazaar)", "timestamp": 1704211351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704211351, "uuid": "9f9f6b4c-f182-471d-a0c7-1b81a5175b61", "comment": "Malware payload (BadBazaar)", "value": "d547fa7b2e32d8dc1dbaa3275000bd1c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704211351, "uuid": "72f7430e-ad14-45d7-93b1-516cade04584", "comment": "Malware payload (BadBazaar)", "value": "bdb84b702752c4065fa36f7c6f7038eed2bfda6d09c32d69512896077b66c097", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704211351, "uuid": "b2d9cb65-7f49-4d03-ab5e-4aece11c4251", "comment": "Malware payload (BadBazaar)", "value": "f100c916c632bdb3eb04238c302ac2bb3d68895e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704211351, "uuid": "9240a74b-8bb9-4c41-9d14-4470094fd4cb", "comment": "Malware payload (BadBazaar)", "value": "8c0b12d5292b9e213b1c5df9018cd1e8784ff5244e0bbc00112c60646e035d8938ece600e90d751612597d911009362d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704211351, "uuid": "a4642c3c-700c-4af8-8b80-2b5cd3975ae0", "value": "T1D80823E3E37D9C29D5338535927613A2A9684F50A211E32E6905F52CFEF7AD24E01FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704211351, "uuid": "c2beddc4-b07f-4a71-897e-0161f7946467", "value": "1572864:NX0/SEG4QR+WZ+gGUqj/N7cN2e+zAK3eHz+NntrxpwZBk5Vt69b:NASP4QR++3Im2e+zk0nt1pUE69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704211351, "uuid": "10b3293e-c580-4a27-9984-89e24c737a21", "value": 79024482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704211351, "uuid": "f6c11085-9aab-4b3d-8a7d-81bbf4522dac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704211351, "uuid": "f7d9245e-ce83-48ad-8e2e-754b28fc376d", "value": "Telegram\u4e2d\u6587\u7248.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80cd1de9-a94f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1704186942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186942, "uuid": "f221863c-7019-4753-a1f3-7754ec0760ba", "comment": "Malware payload (Formbook)", "value": "3228fe5642312eaf4af9536a14a67baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186942, "uuid": "bbd086f9-7cee-4aeb-ae05-8d13650da88d", "comment": "Malware payload (Formbook)", "value": "bea42a753715b080ac6a74256cd563aef533f837b9dd45797d50c99d2af989fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186942, "uuid": "d4012f06-3507-4690-a011-831bea084769", "comment": "Malware payload (Formbook)", "value": "a1ce112314ef31a5bfabfd47927e51a79373ced3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186942, "uuid": "a9bdaf9e-6011-47bc-bd08-803ead949499", "comment": "Malware payload (Formbook)", "value": "0ce59922278232eedf9e0b3083f484b901892bfc9d7afe87e41db1988697cac208fee9f87529bf690c23301d3469fc04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186942, "uuid": "abe63a6d-9717-45e7-afe3-436ab1bfdb3d", "value": "T11C15BF3D6BBF5227CC67C6ABCBD4DC27B15084AB3C11EA6555C7439D1372A8228C326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186942, "uuid": "51cf8365-3ed2-44d6-92f6-2a09a421dfa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186942, "uuid": "4dc97ddf-277e-4afb-ae22-59bce9fb3959", "value": "12288:2RhQBXUVURGJc14/YDhEhuQc+1M01TqrHVCpeW+OouqHZqx1Nn:MgNTihciM0BCHQbXouaZA11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704186942, "uuid": "48c33e60-1f7d-45ab-a5c7-b5a8bc7d703e", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704186942, "uuid": "4fdc39fd-92b1-4196-a20b-ffca1b234bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186942, "uuid": "868fe3c4-17b5-4c0c-8375-54c5c02fcf09", "value": "PO_CW20488707-A & CW201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b09fbc-a94e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1704186517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186517, "uuid": "7554875f-3e47-4869-8bec-4d9b061cbe06", "comment": "Malware payload (GuLoader)", "value": "4f9d76ea7b2a35dd03a4c2f398c07329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186517, "uuid": "e6f40424-359b-4709-b592-652a1b5b2a44", "comment": "Malware payload (GuLoader)", "value": "bf1b72b0469fe09e9e544ec62774f07d6c568aadb8aecbdbefe8b35d8e586c55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186517, "uuid": "efb2acb2-37f9-4fc5-940c-fdda011ee358", "comment": "Malware payload (GuLoader)", "value": "223a687ff0525c2bb51c0b5c9c285efd3c700fc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186517, "uuid": "5fd17aa4-ac3a-4bb6-b1f6-a17b625f2209", "comment": "Malware payload (GuLoader)", "value": "8b0bf95bed0b8bc3ff5b12550ef47be15f72c731a160e0247295421aa6df3905dca7a2dd7dc9dbcbddbf9e5f198c8392", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186517, "uuid": "70f48787-07ad-4a4c-aa0d-41bb773a546d", "value": "T11CE40212636DDD07C4132D78C965D6F9BA389A502FAE8E0291E17D3FFD29E46FD0900A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186517, "uuid": "38a7c2d7-5268-4d8a-946b-cc319c45ff67", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186517, "uuid": "5fc4ce26-b9f5-413d-918a-9bd2e5b9828e", "value": "12288:13K4CdvtoL5XHL6f+MIo3SSkKMaZNsf6TcBHRNsZe7+843+Kr:13/evW9Xm+N4/4YcBR6Zeq84V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704186517, "uuid": "2ccd9b54-1aad-43d5-99bc-356cdc8a0b05", "value": 668663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704186517, "uuid": "ef9bc3b2-0879-4229-8f0d-06e3983dd4fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186517, "uuid": "d9935a65-da94-452c-b6c4-4101db6f314b", "value": "PO# HTS-PO-0209.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89235142-a917-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pony)", "timestamp": 1704162904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162904, "uuid": "68e74e28-ea6a-483e-8f68-5b5cccd6bee6", "comment": "Malware payload (Pony)", "value": "1a2211aec6c3e5e27a67f6907a7611f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162904, "uuid": "e0bef1cb-d1c4-4a6a-aec8-004e860df12b", "comment": "Malware payload (Pony)", "value": "c1be3c17f856344daf7ab2ad08074e94145f371698f52bc93b5dde4030c53f62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162904, "uuid": "10565d12-d078-4fcc-8486-b51479a581fc", "comment": "Malware payload (Pony)", "value": "169f9ea72a8cc089614e74353240dc57898732ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162904, "uuid": "f69976d1-866d-44ad-899a-2998c0fb8a8e", "comment": "Malware payload (Pony)", "value": "2af49421c00d9c96b555b5762ca094e07adbfe1f3f3d9966bbea2d5121cfaf7fcb5a14ae91f955c337ef3af25ba574bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162904, "uuid": "361f2011-6680-421b-90b4-a0ab6928dfa8", "value": "T1D393E843F881E0F1C1A226723BC11771E7FD9E797C768D4AEF8D5845ADB2687AB12042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162904, "uuid": "694bddb1-31fd-4d4d-a9fa-a68b733693ad", "value": "085f942c74d09a78dcd2b95a4c1c7441", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162904, "uuid": "de624d22-0e21-4b73-b99a-fc655316162f", "value": "1536:n/nzp0YL6qTSC9UGBzmJr4A4ZrqYBmAE4KA9JOnJOBfTvSkzbk1S8/b:/z6aIImJRbOBzkt/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704162904, "uuid": "bad85adc-d337-4bf2-8e78-899ba5e3740a", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704162904, "uuid": "c7c79493-6eee-466b-b0b3-f3bb04dfee2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162904, "uuid": "13133db6-f9da-4534-a3d2-0f4516e89520", "value": "1a2211aec6c3e5e27a67f6907a7611f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1274beed-a95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SpyNote)", "timestamp": 1704193199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193199, "uuid": "f36f8696-ea3b-477b-aa7b-71222b8b6a8f", "comment": "Malware payload (SpyNote)", "value": "016a49a49b0a3d440028a446cb28f0c5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193199, "uuid": "740fb2b3-5744-4d1b-884f-18f45cd91fee", "comment": "Malware payload (SpyNote)", "value": "c2cf46261df0f61df62319361825093b588b28e77bde74c92968a3631090f6d8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193199, "uuid": "ae21f436-ff51-4f5c-9090-cbae84828de4", "comment": "Malware payload (SpyNote)", "value": "bf1e013a0eaf00ff937776d9302a1e8867790294", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193199, "uuid": "17cc87a4-183a-4101-a836-cd34b8b19e2c", "comment": "Malware payload (SpyNote)", "value": "18832a7a72011293ae12c3ac6506fcb161e00dee6375f82267f2f2d07a0dc02c4d243bad4ed2d5b74da40ec9c92c3f10", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193199, "uuid": "5cff06e5-2180-40eb-96bf-b9502a181953", "value": "T13016E043FB45CA97E4BA83F16B370DA929070F05C642AAD704557A7E3DB72D10EC6A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193199, "uuid": "46b25753-d048-4c82-a293-3629444f9dc0", "value": "98304:64cCNHSN1VZOw6h/xHMimzRzBxTV0tJDuUK:6V1rih/qNz9q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704193199, "uuid": "de833b35-039b-4ba5-9c26-7de9b160be01", "value": 4055386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704193199, "uuid": "165da8b3-ec45-4ac2-acf1-35647dc48ba2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193199, "uuid": "d14e5639-24c4-4803-8cf7-3f85e0c8bd87", "value": "a101.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedbb02a-a9a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1704222667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222667, "uuid": "c3c31ad9-73d9-4d6b-a2ef-e94051c1660d", "comment": "Malware payload (Smoke Loader)", "value": "1c4afaf122db4aa6233be22a3f761b4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222667, "uuid": "de9eb33d-1238-4876-a592-900f437e18b7", "comment": "Malware payload (Smoke Loader)", "value": "c444868d4cbbecd4c7083de14310fcc934d9e60a2c41de4a30057044acd9b962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222667, "uuid": "80b4fc94-d5bc-4dd1-90cb-398164f31eb9", "comment": "Malware payload (Smoke Loader)", "value": "0c65463254fefdcb1af5332245c181c45594d5ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222667, "uuid": "118a517b-d276-4958-b31b-b604254f0b24", "comment": "Malware payload (Smoke Loader)", "value": "f8cc09cd1a61a1622a07939c8865f2b6c2bb10d064f7e2a0a9b54636b381cbd9965aa342a495fe37e7bf7602d0b9168f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222667, "uuid": "0099b23c-5ad3-494a-80b6-19902e4d53df", "value": "T152149D1131F4C072E6F3697649B4C7F44E7BB8A72A72958E6BD806792F256D1CB2030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222667, "uuid": "75bb791d-d538-4bfa-81af-740cf7a8a0b0", "value": "628b5625e44ec4d4a2ba4078ce3026c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222667, "uuid": "1b25f47e-da5b-4e11-9977-d30235f8ed62", "value": "3072:+DtO2LbVS5fgevom6PJiMrt+NqaDTQIdEsrTjeJplaYD16TxZRUr7D:c3LbfGMT05BvKExSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222667, "uuid": "793adedf-4c0d-43b1-8297-276e64178542", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222667, "uuid": "9e91abcd-0bdd-4ffe-9ac3-0feb4ca718cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222667, "uuid": "9f733199-d8ba-4b8b-afc4-38126be01b13", "value": "815b5917.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e851d479-a9ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704227059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227059, "uuid": "01ca9b2c-db29-402c-ac76-3e6edba38d87", "comment": "Malware payload (Mirai)", "value": "a87e94cde8595dd8a9e08c228d2d6f57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227059, "uuid": "378291c5-4a9d-4fbc-97c1-cdda6e1e5928", "comment": "Malware payload (Mirai)", "value": "c5293f07122b212e9c0a8d978861219e7567b47fbbc6640b4b4b9f8393cf5791", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227059, "uuid": "e3bff0b5-8992-491b-9924-4613be7cf439", "comment": "Malware payload (Mirai)", "value": "4cd8d612479a5b229b43ff3ad8059859156cb278", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704227059, "uuid": "989495df-7b4f-4d29-840b-6742fa8357f2", "comment": "Malware payload (Mirai)", "value": "997522ddc58853be91a1160a624daacd831457ccfd9b83dedc4085ec538a1a8d5289255d2000eaf82f922ff80019e633", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227059, "uuid": "f6701f4d-5d9f-44e7-af1a-889f9c1e6055", "value": "T1F4536DCAB8119E7DF5CBE77E84220D0EB821726150931B17BB6FFC837D721648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227059, "uuid": "5665dc00-70c5-48d2-ab76-8bec08330d2e", "value": "1536:AXyRgQF4TbSX5lxLepSGY5cFnehON2PPB+qG76E8k2:N1TjJ8EVGOC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704227059, "uuid": "3d46f940-1a0c-4ee6-b9ed-fc1db3a1aa6f", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704227059, "uuid": "f851a171-521c-433f-88e3-74ba2e9c0dd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704227059, "uuid": "3332a7cb-a85a-4542-aaa6-6e9e38487518", "value": "a87e94cde8595dd8a9e08c228d2d6f57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb156628-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704221856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221856, "uuid": "0b33d197-23b8-45f6-93f1-844361c6f9e4", "comment": "Malware payload (RiseProStealer)", "value": "13e4fd84565e203dd8e001ee6ff70a9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221856, "uuid": "b5a73078-75f8-4c29-8979-df3308087586", "comment": "Malware payload (RiseProStealer)", "value": "c7c312035f6694f1941a1fc437a68c9c3e1aabdae242d1e3fd557dda53bdfcb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221856, "uuid": "4e539ad7-c5e2-4653-832e-3dcf6378d044", "comment": "Malware payload (RiseProStealer)", "value": "ae08d24286917a28ca6f33ead019d2698d76bfc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221856, "uuid": "ce6cf279-5792-459f-8cfa-1ab0e205c0c4", "comment": "Malware payload (RiseProStealer)", "value": "b7e49eff9a77318d0d1251fe87321f650dda9a7b1846c9f74f280986dacf5b4e6775eee64713e579ff71cc1d3a3dfe48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221856, "uuid": "ae805f50-cfc9-45af-907a-3215d88fe1f6", "value": "T1C99523866BD18671C6E017B1A4F747C71A31BDB2AF685B1B35809B8108F36E5B03673E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221856, "uuid": "3118d5f1-b7e1-4398-8c53-ef1b8f47792b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221856, "uuid": "bc7758d8-3369-4835-bb3f-d03ef47ddce3", "value": "49152:Uu5z1o02R2cFB3gwqQXSjewyeCx/DLO7b8Zf05yPmsn:RE03yB3gwqqSKbWe8IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221856, "uuid": "54c2dd87-f7ea-4d77-9f28-036834ee6d9a", "value": 2039296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221856, "uuid": "d57a4a7c-0d95-4acd-b901-737c2eef165f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221856, "uuid": "4131cc2a-6cd2-46ae-8855-5ac4398103b0", "value": "c7c312035f6694f1941a1fc437a68c9c3e1aabdae242d1e3fd557dda53bdfcb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17c9a9a-a94c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704185708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704185708, "uuid": "e279d82d-0940-4271-82f8-337cc04a515d", "comment": "Malware payload (RedLineStealer)", "value": "a5da1c543de7a2b64cca216f069cc38c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704185708, "uuid": "522d72d1-ef89-4a43-9519-9fa6730aaa44", "comment": "Malware payload (RedLineStealer)", "value": "c8b92119a5b562bbcea0562512a45db5a9695166b8950617604ced871f604bc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704185708, "uuid": "5e6118d6-9909-4acf-9ee1-af9e2e3b1c9e", "comment": "Malware payload (RedLineStealer)", "value": "cd30536a382c56e0b453f0946c4ba8c7f218088f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704185708, "uuid": "97572873-25fb-4c1c-a072-f14e6d2e5b85", "comment": "Malware payload (RedLineStealer)", "value": "da67898ad315c6f3658258b945e37f1f9c20a1b1ba2177f44dcad3b7d69a7be6b8ef811c99bc91e4a05562c0463f06b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704185708, "uuid": "57d932f2-c997-428d-bbf1-388093970ce5", "value": "T1A246338662F4E0DDEEE517B75AE31262193274F03A68D3DB228063F988715D45A73F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704185708, "uuid": "53a97783-0af7-4867-8aa6-e5ce102c2ac3", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704185708, "uuid": "c517659e-cc24-411b-aa5f-3bbb84105d9a", "value": "98304:p4d/KGTw5gKwO7jOH3geiL8guptTzJbpnkj3TuR8KbCaJdJbDOls:puij7aH39iL6tNqj3TJaZOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704185708, "uuid": "23d20b54-98dd-4727-9b8d-a63e834bf03a", "value": 5449216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704185708, "uuid": "a2b8e30b-f4a9-40cf-851d-c0dcde9c0b4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704185708, "uuid": "83df0d65-e31b-4f45-8607-b35bd8903ab1", "value": "a5da1c543de7a2b64cca216f069cc38c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5818f0-a92f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704173001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173001, "uuid": "2b5b51c0-1b68-4b5d-9311-c403314f913a", "comment": "Malware payload (Mirai)", "value": "439b68948a58bc876accc263b2959de9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173001, "uuid": "568903c5-19d8-4417-aa4c-a0b5b73e73b1", "comment": "Malware payload (Mirai)", "value": "ccb522743975c843639ce11f87a13aa9a687f5782b65368a0828372e74737921", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173001, "uuid": "805dd90d-5e40-49f2-a1ca-5ad00c89af77", "comment": "Malware payload (Mirai)", "value": "417e5330933980f73884f766acaa34ae896e4efa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173001, "uuid": "392570f5-6e40-4492-915f-49ab4b8bf366", "comment": "Malware payload (Mirai)", "value": "395645c46f88c992eac905ba682c55e33019d6c91a47c4e0cc2f895eea837e2752bc5445337f6e004fbf0968e6eb8bd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173001, "uuid": "28226490-29dc-4b53-9100-05fd8c59aad9", "value": "T143F2E101A611D94178323D33A7974D2273EE183DE57758C43906EB5AFB930C76B79306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173001, "uuid": "1b79bd80-395d-4ed9-9e46-070ca95c3484", "value": "768:jLeHeXqzWnUBWCMqnIejrVkRxvdaA6BM2MFxVj4q3UIlE:jLSzWnUcL0rVkRxvda5MzFxVj/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704173001, "uuid": "29343c3b-ac33-46a4-9876-6ce8bd002d8b", "value": 36292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704173001, "uuid": "db838a26-4798-4b62-a698-bf404c961ad2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173001, "uuid": "00250bb1-d5af-4112-a177-b454b29b3d9f", "value": "439b68948a58bc876accc263b2959de9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c4084a-a999-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704218597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218597, "uuid": "31484c7f-bcac-43f6-b0aa-c36dc0a5a73c", "comment": "Malware payload (Mirai)", "value": "98b7a4e65d62d3576e1ecd1a3edbe6de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218597, "uuid": "6a084fdc-1c3e-4754-9a77-9b54c9d742a3", "comment": "Malware payload (Mirai)", "value": "cd10ab58c8cb5119d76ebba24a76835da97587461b1b1f69dcb4dd5d93aff460", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218597, "uuid": "5c5f4c29-61e1-436b-b899-5ffa51cad8cd", "comment": "Malware payload (Mirai)", "value": "edb989961e3604cf40d446a3d6fcbb062226245f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218597, "uuid": "219b5eef-28ff-40d2-8af9-6a2484d7e67c", "comment": "Malware payload (Mirai)", "value": "45238dd564c8ee285cd63b853937988ca039c85f56ee24243082def3d2b53ada62c5eddfb221f459dae7d7da08de73d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218597, "uuid": "f258873e-03af-4d09-96dc-00aa93064e8e", "value": "T1F383290136680E4BD4E24EB06A2F1BF187FEDD9224E4B249690FEF464632D72544AFDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218597, "uuid": "42705424-4a59-436f-8185-13cb93872c45", "value": "1536:eX4ATdUo/m0I4PSBxeExJ5YAmS6sk4hQiT5LwHJV:ePdUo/90nf5iV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704218597, "uuid": "890cc748-1c3c-4957-9477-6aeaa930eb58", "value": 86684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704218597, "uuid": "ef2a8afe-f7a9-4951-91af-229bc7956df1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218597, "uuid": "b97c6e92-dd53-4103-86dd-49cb636131c1", "value": "98b7a4e65d62d3576e1ecd1a3edbe6de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39633e84-a9a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1704223329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223329, "uuid": "03276fc4-ffe3-458b-b541-1a3cb8cc04ac", "comment": "Malware payload (Adware.Neoreklami)", "value": "6961fdff0413cbf19ea2d5ea7fe1cb0c", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223329, "uuid": "ce96dc56-5007-49f6-bb5b-0d9ee52ee1db", "comment": "Malware payload (Adware.Neoreklami)", "value": "ce87fbd823460dbdbb143117bf228723562f9bc20650565e28da5a9d21442087", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223329, "uuid": "efffb7f7-6ebe-411f-82b0-f33ac32da3fb", "comment": "Malware payload (Adware.Neoreklami)", "value": "69d0c06ba32d57c52913971dee55e33b02a66277", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223329, "uuid": "bab94702-3bd1-4a13-854e-46ed4c18ceb8", "comment": "Malware payload (Adware.Neoreklami)", "value": "39fbcc80011ce28e2d5fc943daf05d6b44c4226c075a09cdae032792cd2844ad32bdd1a335f34c84f3d0ad1b40bc0612", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223329, "uuid": "00acebbb-651a-440a-a5ee-61656f6c9cea", "value": "T10576336A3AD1C0FCF6259C338D8C4BE6FEA4C7434FB6A533A79C151D7ABE8650058A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223329, "uuid": "804ab2b7-b605-4815-bf3a-b0c6827c5e54", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223329, "uuid": "650e7fa4-1155-4ef3-962c-0ba94f0f4ebd", "value": "196608:91OmA7FIhxq4RPkOpER2Vqk62l/Cvd7vT/cB7h:3Osq4TpvL6GCvk7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704223329, "uuid": "f65c70a9-8f1d-4e2b-9d6e-6d96c1dd148b", "value": 7604496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704223329, "uuid": "0ce63b24-fca3-48cf-b381-36f2ab58de59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223329, "uuid": "5609b850-305d-4cb7-bd64-9963f1f17f68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b441a39-a92f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704173028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173028, "uuid": "6ec0b9a0-e1d1-4732-b578-f35c1113e771", "comment": "Malware payload", "value": "9b8a05314c09db5ef6ae5410b40e109a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173028, "uuid": "d35cfafe-bcad-49b3-8870-300ba3a976ba", "comment": "Malware payload", "value": "d244f5129dd0da39e8808311b3fd46120f5ddd4aa4b67be258f8ef42a3a6dafa", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173028, "uuid": "140c1a07-d5c3-4a9c-9d36-4c93605b7be1", "comment": "Malware payload", "value": "4b418b45d629f2d80eaded84ba7f93f5ba4f0ba4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173028, "uuid": "7d3a1806-9cca-43de-8ae5-964d78ad9d88", "comment": "Malware payload", "value": "c085e3186d50c712a1ff52e909091dd0b688e2f5167904c3e9349406b72b3d2fa634b08d710e920929a759c196c114c4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173028, "uuid": "08492fc2-cd4b-4b7c-95ca-cba07d255eea", "value": "T155734B6BB35604F8C692927CCD934A9BC372B94D4722A7CF43A0521E1F363F4AD7A950", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173028, "uuid": "c05877d1-c008-474b-a191-a1a04390a894", "value": "ca8d77a8c136f16663f67be0ffbd6385", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173028, "uuid": "84aad49c-b20d-433b-95dc-83755cfdf211", "value": "1536:DRlBHDZoHXAVebwV/dtgRQcM5ieEbtdNsue2L2Jx2jvL5kpos:FbH1WsYwVe8iRhsueWvL5kpos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704173028, "uuid": "4a2f17fb-6dc3-48f6-b1f9-8be0a77785e4", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704173028, "uuid": "931ac1cf-1607-4918-a1d9-d0b5c930d48c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173028, "uuid": "a1724dd5-93b6-488c-9292-b0f3df6f4323", "value": "9b8a05314c09db5ef6ae5410b40e109a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261be20e-a999-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704218572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218572, "uuid": "55092cef-1afc-464a-95b5-b9f60d5fe349", "comment": "Malware payload (Mirai)", "value": "e182d158096d7a7d26f4b620a74a6e4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218572, "uuid": "9ee5badc-d868-4749-9bab-8f158c12e2b3", "comment": "Malware payload (Mirai)", "value": "d364cbdbfe2aeebf45a785f703255c05ec61d5f28e4ba255200f9ca9fea2f553", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218572, "uuid": "470aa35b-01ad-4d0f-8873-8cff333b9e84", "comment": "Malware payload (Mirai)", "value": "c698eee2b509cb54621f72ea26a190bc4544d9c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218572, "uuid": "8ee5e21f-16a7-4c29-8412-f79f67653ff3", "comment": "Malware payload (Mirai)", "value": "e38ade97682c6b86430df2af7c7f47ffda27820fec9177ffc2a06af297d6a8c82389182d355be631966aecc42d37b9dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218572, "uuid": "1a4bacc9-2571-4ed4-8e6b-46fcdf2de548", "value": "T115932945B8818E16C6D813BBBA2E11CE332073A8E2DF72039D262F5573CA91F1E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218572, "uuid": "90ab7b40-f0d5-4264-86e8-3532cd63ae34", "value": "1536:VWeHLv6DHwDdaPj+jhQ7prpQojLnYMQC4Dr4B1mQ/4apZ7PkFPEGDOm:VLrv1DdhW7pruojEI4YQQ/nTzkFMGDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704218572, "uuid": "1ee3e666-3de7-4e46-86ea-681610852da2", "value": 91284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704218572, "uuid": "b14f5bb6-c6bb-4f60-b466-9da4a19206aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218572, "uuid": "cfead32c-4242-43a8-b443-b07664a29439", "value": "e182d158096d7a7d26f4b620a74a6e4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2190b32a-a9a8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704225007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225007, "uuid": "993a1c3d-5804-4a84-b34f-4f282135da2d", "comment": "Malware payload (Mirai)", "value": "57dd313c41a840faa4b80b660af28b56", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225007, "uuid": "8d50658a-9f06-4075-8c45-09d7e69c94ac", "comment": "Malware payload (Mirai)", "value": "d3c1c6b9d6562722772c1d747067bec031bf3f8f04931fb1555afb6fc08ae35d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225007, "uuid": "eabba7b4-3089-4912-a208-88b34899b3ec", "comment": "Malware payload (Mirai)", "value": "1860bd4fc958228461f720ec39543783275b80f4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704225007, "uuid": "899d1238-d68b-423e-8d69-8d92311dd77a", "comment": "Malware payload (Mirai)", "value": "096450c1932ae1b8471b61e1d36f63fc4ae46cc6b774b01e72f0a26ad50e78b24dce8e5b7bda3ec6c7e9cd7d10fb67ee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704225007, "uuid": "cc9d51ce-a404-4cca-b7ce-6019bbce3884", "value": "T1A1C2D130A6AD2CB5C6600571FBB866C9BE534F7DF9FE3890214147BB384190529EE9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704225007, "uuid": "e843c071-2176-43df-a498-4e5f26914d21", "value": "384:A/t/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE5fTRI8ihymdGUop5o:AFsoTAZ3alkXLvFh8nNENTRI8is3Uozo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704225007, "uuid": "3c5486b2-1b48-4b1f-92db-53ddaf8cb29d", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704225007, "uuid": "422778a3-e28a-4907-b1a0-173615bcfb98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704225007, "uuid": "5c291ea6-e622-461e-93a2-3e366b0d6e35", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614a989f-a9a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1704222537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222537, "uuid": "5b3675ed-eceb-40f6-9aca-6f20c96632a9", "comment": "Malware payload (Stealc)", "value": "f0677305b00049f5cbc571fd35c7e67a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222537, "uuid": "6147d1d8-4944-45a7-af66-648cd28167b8", "comment": "Malware payload (Stealc)", "value": "d63a83fb534fd92df1de5373ce6fa7febf6ca715c7528a2a806de49da2889078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222537, "uuid": "55755d7d-fb88-449e-a588-a0675251aad3", "comment": "Malware payload (Stealc)", "value": "6f50f8948a2a9e716cffdc07538f2753a6b9ed32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222537, "uuid": "6aea5311-8797-4546-a9e5-038b6be5d2a0", "comment": "Malware payload (Stealc)", "value": "bc7c004aadcd56f35ce8af7cb21fe82b47780e344eaa6f9a385ff4aa4d199f8099ea2c45a2ed5e4f8e83cfb4d8926962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222537, "uuid": "db63298a-8ca7-4c48-bffc-0741d94a1342", "value": "T17A248C1135F5C072F2F3697558B0CBB45E7BB8A32A32958E6BC416790F266D2CE2131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222537, "uuid": "461242a5-ffc8-4707-a991-2b6580471522", "value": "628b5625e44ec4d4a2ba4078ce3026c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222537, "uuid": "c3954ae0-b077-493a-8192-1033ecb655a6", "value": "3072:x3Lj1avguXOep+fJicd5t+th7W/XTtgxRM7pQYrHjbpk16wmxZREDilD:x3LjPgOep+zdUW/JVFxHjbphw/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222537, "uuid": "f4f92700-a3be-4d9d-8d4f-c1e146dfe2bc", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222537, "uuid": "583c7355-1be7-4280-822b-05c0de960fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222537, "uuid": "e8be7452-2647-4005-a91a-bcdd94296af6", "value": "timeSync.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5e6be0-a9b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704228490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228490, "uuid": "2961ceab-88aa-4e77-badf-522d0e249835", "comment": "Malware payload", "value": "6123480eed61c4ca3bd561ed47209642", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228490, "uuid": "88e51547-c6af-48d9-bf62-0b42d66bdd81", "comment": "Malware payload", "value": "d6b34e4d6ae059a7d26daa9d1aef34f505a0015560afaa87f6c47721ad020699", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228490, "uuid": "9eb52d98-b1e8-4a18-995e-4d7fe260f9a8", "comment": "Malware payload", "value": "b42522ffa84aed388238c0983e0a49be454c8427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704228490, "uuid": "bb4765ad-eb81-4474-9311-f244fd0a5ec9", "comment": "Malware payload", "value": "1c8d29fcc5cdd62c1149d787a2f3a89795da588fab40dd4f33f964d5421e376f3d3d67e4e05e0fadb9093efe97467f60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228490, "uuid": "59f3dde8-6b8f-434e-89bb-edefb1d6f0a4", "value": "T1AEC4014336DA0760D58C25B8C0A3847007FAABC726F7D7493E8C1BDA1D867E18D9A7D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228490, "uuid": "8b9211ca-96eb-41c4-a272-ab53abfd557b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228490, "uuid": "baedda05-8902-4528-954d-07ada8a1ff5d", "value": "12288:bfKmKtBU5V7u/gQjp1RfN7P6CS7snb3wFiNuHAB:bfKmEBU5V7ZQjn7SL7sn3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704228490, "uuid": "edbd489f-6800-4e37-b56a-7333a388f42d", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704228490, "uuid": "d5a2f05d-ed6a-49a4-900f-b7e7fd57551b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704228490, "uuid": "c521fbd3-0583-4e83-90b1-584b8bbec107", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349937ab-a9a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1704223321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223321, "uuid": "17234a73-1a0f-4b8a-bfa8-9156458130ba", "comment": "Malware payload (Smoke Loader)", "value": "f3f4a4624d1582e449b54bb8df87ce03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223321, "uuid": "00a89814-873e-4d20-b127-b4845237c7b2", "comment": "Malware payload (Smoke Loader)", "value": "d993da5b179af8c4c4a3a29ba72182f51e47311205c7830f9cca88ec71328240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223321, "uuid": "5ab7a93a-2eab-4e38-ac52-198d4ed5b97f", "comment": "Malware payload (Smoke Loader)", "value": "87d3fe682b21f26708a1ad47d8abfe14c745016d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704223321, "uuid": "6c5d02f8-c41f-4596-8eed-e6aa9821ec48", "comment": "Malware payload (Smoke Loader)", "value": "4cad4725ae193e83adf6a1e3583ab8b83dec8cd261d4471e94a8a0702751adf1145619123adcf6ef98478291f4f7a165", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223321, "uuid": "91eff07d-afb7-4479-8b88-e2af0f4d597d", "value": "T1BD14BF2175E1C073D9B79A3489B4EAB46ABFF86167A581CF23940B3F1E217D18A35313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223321, "uuid": "1d87fc2e-5d85-41ac-8dac-f8e4ad44e99a", "value": "57c906ac3e205b6d86a540919628ea1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223321, "uuid": "9483268d-83b3-46ba-9246-7a965e196ba1", "value": "3072:X894PLOYs3gaZRjtceAOkBPJKDrWNXkprqo6+hrPREQpCfG+o:M9gLOY4gaZFmRpJKGArFFPRuf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704223321, "uuid": "be8ddb15-073a-4dd5-9445-c07524c2ffc7", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704223321, "uuid": "727c4c06-9a2e-4c88-b04b-9fa1740ef1b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704223321, "uuid": "018b9b27-ed4f-428f-a07f-b9901f1e45a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a645e3-a941-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1704180724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704180724, "uuid": "150dde93-befa-461f-9a2d-88a1e011234e", "comment": "Malware payload (zgRAT)", "value": "6fe5c520921886d9a51978f7c611a53b", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704180724, "uuid": "43ec1fc9-1393-42cb-8483-a94b07d17427", "comment": "Malware payload (zgRAT)", "value": "dca046105d494683efab5e3ac33d9948c978c255d1cfc8783f03a1414d458c09", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704180724, "uuid": "1bf3efaf-ab80-44e7-938e-eca26c318f7c", "comment": "Malware payload (zgRAT)", "value": "60dddcdcc5e1073bd3d40b1ee9b8227ace02bb3b", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704180724, "uuid": "78bb0ff0-b693-40ac-a4a8-286813195187", "comment": "Malware payload (zgRAT)", "value": "592354fbd49fdc893f1d458d2f95de185beb524615a408a2f64d8fe8913b2796d0a57880ac2321f3caea0648de82ecaa", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704180724, "uuid": "2474188b-bc28-45e6-8f87-55571a50a7e6", "value": "T11C95E061FF65DE27C66F6371916307144BF4C2CA9386E707AFC4A8F42C873191E11AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704180724, "uuid": "3a83cd98-4f0f-4ba3-80b2-e802287103b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704180724, "uuid": "6829bd64-5c88-4cc1-a06e-cfd9aa83c6a8", "value": "24576:6HxHDSiI98xJTJ7+6LVAkjggGw0AFiaBHQsqyIsCgajzXUwWuGux/BKto:6HxxJnjgfotJK7sCLzbWhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704180724, "uuid": "812450dd-45a5-4d89-9d7f-b5f6f915f53d", "value": 1976832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704180724, "uuid": "e47424d6-5368-4d8f-bfaa-cae71f0037aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704180724, "uuid": "ee712c3f-b8c5-4c1e-a4e4-c0c999899b9a", "value": "6fe5c520921886d9a51978f7c611a53b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c2d4e8-a9b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704230271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704230271, "uuid": "bac99326-e786-41cd-8290-08a0ad9c6b32", "comment": "Malware payload", "value": "f1fc784bf2d5493cdeeb9628ec943054", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704230271, "uuid": "4166d386-372a-4572-8d0f-8c8e6eb1f9a8", "comment": "Malware payload", "value": "dd54e7a7307c55e4197bc0ebba88e088f413a3747739a312b4afd5b74c229ca3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704230271, "uuid": "f219e6a1-7758-4f59-b7d6-ec20da75b124", "comment": "Malware payload", "value": "09972d95aa09ca389ed03673ae83d7bcd57860b3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704230271, "uuid": "4641894c-9c73-4e00-865e-6f12544cfcc9", "comment": "Malware payload", "value": "a6f347ae5efd7b9bc23675d15d31e8284bcec68aeb225e45227b4bf728ec6049147c53d74e29707efbc54cc345f90cd9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704230271, "uuid": "c287e595-294d-40e8-8d34-8edacdb84c97", "value": "T159E423E6F660854853DA41BCF38C5322A9FFBD4C7628570F3A12E2DD83417EB93A6941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704230271, "uuid": "78399857-c865-4760-926c-5eaacecda0b2", "value": "12288:CU1JhX4TQN9xTlS+qAW2Y+2kY8ImbK4HWB/+5xZ1V8skFuYPUP0RHcH+FS/Yuu:FhX4kvxI+fUkH1WmXXV8sksI9HS/Yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704230271, "uuid": "9634663d-0561-4917-8b23-894270b1d166", "value": 671014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704230271, "uuid": "05886d0f-5d81-448a-be6b-22aebc81cfb4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704230271, "uuid": "0e4101b5-0032-46d0-91fa-55df96b0ca48", "value": "Orden de compra.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d42529b-a90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704158079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704158079, "uuid": "7ee27a8f-69ef-4946-a588-616e339be5c1", "comment": "Malware payload (Mirai)", "value": "877ee080da31d5f5f13af27816a61534", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704158079, "uuid": "f76e4959-f584-4de7-b55a-923b9346cc3f", "comment": "Malware payload (Mirai)", "value": "e24e13274eb611c22cbf4f339e8f80a346e3f6e9435a6f212b6a53254bed47fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704158079, "uuid": "fbc6bdfe-8961-430a-85eb-1433cd4810e9", "comment": "Malware payload (Mirai)", "value": "d5f0ce05005a3596e0d87f66e9bbdc3d313b09cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704158079, "uuid": "822795a0-4826-401c-b18e-0b1ebc90689e", "comment": "Malware payload (Mirai)", "value": "603d9ad8671de5c399e4fdd8ae032e753f43ed5d22fffcb418e42446555fb74b9bc903e5ad3b427e83193c355df2103a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704158079, "uuid": "6330be55-438a-45f3-a97b-9528e93ac956", "value": "T1E333F1F1A28C5AC5D22E7CF7B93B1145E12145BEE5D6E710A03D96E3C74B88083D7E2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704158079, "uuid": "c587163f-a3b0-4c73-82c9-560aec16404d", "value": "768:IiPNyJszoguGofsU4qEuBDuVG7CLykvyFA36OrVxjRUBqDeUKT1Ikh9mR6ZlKyma:vcJsSGwqQuVVykvoW7gqDg1I7AKeF5Rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704158079, "uuid": "af71c07b-6b95-463e-8bc6-cb31e3f2f4eb", "value": 54052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704158079, "uuid": "bf257810-340f-4690-9792-bd3d8492b41f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704158079, "uuid": "b042027e-6e3c-42fd-aef5-d1fd55bd1776", "value": "SecuriteInfo.com.Trojan.Linux.Gafgyt.15491.29523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f058633-a992-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704215661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704215661, "uuid": "992692a9-6d32-40e7-8012-ce19bd8634c3", "comment": "Malware payload (AgentTesla)", "value": "e9842bf433f26625b045c29fff01928e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704215661, "uuid": "0fabe070-9386-4420-a74e-e0ccf79884b8", "comment": "Malware payload (AgentTesla)", "value": "e47adcbfc33657d6751d44bde7860ae8e46fdc0aa328614d2adf27fe3e32720b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704215661, "uuid": "7a708a9e-6e6d-478b-8edb-63837b5c6346", "comment": "Malware payload (AgentTesla)", "value": "5b13def6a4bbc8053e809419bf87351f88f1f088", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704215661, "uuid": "0d123a81-d873-4ad9-85d6-bfc4e4a4cd8d", "comment": "Malware payload (AgentTesla)", "value": "94a2a36008b66807370639b71aeb22ac04cffccbaa8b85ae84ab29371eaa48793f01980fd7686d2c3a78c181b44fa7aa", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704215661, "uuid": "e052149d-53fe-4e20-8473-ea54514a1d52", "value": "T1DF74E615EE750E29F92D9433E5AE120C8792C85166FBF33F0C71B0B6AD86151788AFD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704215661, "uuid": "6b1a65e5-3c9e-4054-9e46-8de29673606a", "value": "6144:vK7M1TVCBrDU+fL3lFinSos2gUMym4V+zXtIPKA5o:isTVqPU+fL3zHDrT4eyPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704215661, "uuid": "16c1d30b-70be-4b6b-bf98-d40f0af0f5a9", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704215661, "uuid": "19330dda-cdd5-4027-b5d2-f3e1009af86b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704215661, "uuid": "c6c39cde-6e61-4f01-a4a8-6ec72bbc9a28", "value": "e9842bf433f26625b045c29fff01928e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a9bc78-a917-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704162811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162811, "uuid": "c129b216-62aa-4357-b0af-d1aca512571c", "comment": "Malware payload", "value": "f89076db2fef4602875a3ac1048c5808", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162811, "uuid": "21b4a015-e742-46a6-947e-291f53d1059a", "comment": "Malware payload", "value": "e4bfdf450f02733fd21e24d0bab012f263f5366fe62a922248dc45c3d42accad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162811, "uuid": "0ae56297-defd-4552-bd9b-c1adfa528d28", "comment": "Malware payload", "value": "61795c4560538cf5be81c53949881e5000ab6dc2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704162811, "uuid": "d984c03f-d0c6-4fea-863a-3f3c4c97757f", "comment": "Malware payload", "value": "95b5db3abab044055a04f25d34d6b182927c7d9fdfa82d9bcccbac8216c4d6c952ea578b157e300cb499e2077acad9fd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162811, "uuid": "998a6991-5d93-42cf-888b-252e21f456ac", "value": "T14A4533A911E881653D2D3F31B6230D81A5EC92F0BAB5F66382D783C4859814BAFCD7DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162811, "uuid": "95dee87d-5798-4a7a-8332-63380674927a", "value": "24576:dUnsaEsFF6cyVvLfeCDSNpp/xOkgSPGTFCJpV5g/RdGKOidmsJZUtFp:S2sFYBVjmC+vgSPIAJlgJdG/icgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704162811, "uuid": "dd79cbc1-3b3c-4a4e-ab5b-2b09d0e62109", "value": 1195132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704162811, "uuid": "30856e5c-7663-4e80-a1bf-906d9468998e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704162811, "uuid": "76709bee-b298-4c0c-8167-fb89dd5d090b", "value": "linux-arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b9832d-a940-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1704180499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704180499, "uuid": "78dd226d-9148-41f4-95cc-66077e9a78d7", "comment": "Malware payload (Stealc)", "value": "86326543d6e1e6a8e0a5dfe4a9b74316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704180499, "uuid": "3ac71072-350b-4c6b-a1dc-1c5b33c55cd5", "comment": "Malware payload (Stealc)", "value": "e6e1106fec7137b46da15bdd0853b1b9a6104bce649a24145793e4d451261c6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704180499, "uuid": "2ebf9f71-9263-40ff-8275-1c55ac30ebe0", "comment": "Malware payload (Stealc)", "value": "b7040791665ed59f20c50ec9196f659a36707ac6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704180499, "uuid": "d8035e98-f2b8-4590-b5e2-71d650f19c43", "comment": "Malware payload (Stealc)", "value": "bea6e37829e363776b6fa3c43c6fe6b19e845b1afce0735ab68421a811cc74eac36d0e3e000f32ed4a02c7587355ee62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704180499, "uuid": "47e14b1c-7619-4ed7-94ba-48a4dda3a391", "value": "T1CC0533F7F7E23CE5E51436BAD1D4A85766AE045D80F923741CF91407182BA623A3AB3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704180499, "uuid": "8e43055c-d5b7-455f-b31f-d65f03ac3a1a", "value": "b12336fa8cbb9bd1c3e11ad0d8477f71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704180499, "uuid": "fd46c6e7-b259-4044-86cd-9edd9a29ce22", "value": "24576:PICbJ2gncB8pRSF510hCd3d45PpCBSy4ZEprT:PXbHcipIShCBi5B7K3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704180499, "uuid": "c6e60aff-42df-4f21-971e-c05a059df107", "value": 818912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704180499, "uuid": "b899c627-4543-4b17-9b8f-e5d870ec1a62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704180499, "uuid": "1d60d438-8d38-4229-b131-2042e6b59572", "value": "86326543d6e1e6a8e0a5dfe4a9b74316.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56140e5-a912-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704160804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704160804, "uuid": "03eac105-2193-4136-a429-fe303a7f97b5", "comment": "Malware payload (Mirai)", "value": "fc85e85cce8d448419bce9f7d49e5d5d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704160804, "uuid": "f8c08698-6c3b-4efa-af19-09591a80febc", "comment": "Malware payload (Mirai)", "value": "e6e8f9c514a81f8297958f07a86d1f95d4b5b92307cb837a4ac8c4d1120e8c72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704160804, "uuid": "ddde575c-092b-42f4-8cd4-5841ab6e6a2a", "comment": "Malware payload (Mirai)", "value": "dfc2d80074a88c8f1bd776912c07977fe81aafba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704160804, "uuid": "f0ad88e8-8a1f-4e01-889b-02db3f7e88b7", "comment": "Malware payload (Mirai)", "value": "204300a88a9398cc08d7889aa68f99ddd4b7ba256342a8240e49b05d995db04445023bb12049e5dab3463fd0129035f5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704160804, "uuid": "8c523284-1f21-48c4-8c50-0de799aeb222", "value": "T1D8D2E17D57D84E87FE3C93BBC6C70B43331017F987056A85EE2581E6EE220CA9556984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704160804, "uuid": "e3de2406-8aef-4f48-ae43-a5f14a3f5c0b", "value": "768:YPglXhOQ2TdsR8Be57nH8m9J06KCyiwSWv4Kq:VX2ThBe57nHJ9RwSWgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704160804, "uuid": "e2bf5ecf-a4b7-4abf-8b0d-bd444267044c", "value": 28628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704160804, "uuid": "a9977b33-29b4-48d1-af3a-fd639bbb1335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704160804, "uuid": "0828b928-d5cd-4286-9f79-1f3473925114", "value": "cta.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04762810-a9ba-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704232689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232689, "uuid": "400a6899-9760-4de4-8582-c0be0aaefdf6", "comment": "Malware payload", "value": "75e7ef59306528f0e7a8f25fcd3754d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232689, "uuid": "1b3b41e9-09b4-4f79-9f89-290ab70606ca", "comment": "Malware payload", "value": "e8884be11c02bfb630f1e52b9f062f816e98cea492d05378f72fb496ca029c32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232689, "uuid": "73543933-1539-4de2-8073-df28d05e1ecc", "comment": "Malware payload", "value": "7228c54d639532ef5f78959b690b98076fc094e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232689, "uuid": "641692d2-2169-47a8-9a88-a49ab2a0284d", "comment": "Malware payload", "value": "883e0be2be325ecc6878be28fae484d655a661c4b988cacd5d2014f2d1c44fae2dc2e789a862ab2444d8484f8c0d9edb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232689, "uuid": "64cf0dcd-a2b3-49ee-bb15-fd97127b0dce", "value": "T1D6F2D0CFF7B07290C71C8E7E458D27A00CC8B0C635769BCDAF5259CCAD6A9AA7185468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232689, "uuid": "70ea677b-3760-4fd7-99a9-b9a32b6a9021", "value": "768:YCaPWd8I4HGXvsQYI7UJfr+C+rdNamXQNgWv:faOaLHGXvsiofr56dNZXaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704232689, "uuid": "3166d8da-c720-498e-a12e-f611c7814063", "value": 34948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704232689, "uuid": "7c4f7d82-e75e-4d50-a377-367a2a52d09b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232689, "uuid": "1fac3d97-d70a-4d3b-b166-03b384195387", "value": "75e7ef59306528f0e7a8f25fcd3754d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8f38ca-a969-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1704198160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704198160, "uuid": "591aaec1-63d2-436c-b05f-c890710c2ee1", "comment": "Malware payload (LummaStealer)", "value": "89829ec5f41dfba39309deadf7666cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704198160, "uuid": "da8f101e-123f-457b-9f82-b443f2577ead", "comment": "Malware payload (LummaStealer)", "value": "ebf36abacdc2c0a0960f10db12171e48a0fd1a962f2497223fa411d645a78469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704198160, "uuid": "e285e2ee-9944-4397-91da-c00010d6f825", "comment": "Malware payload (LummaStealer)", "value": "2dfaa91bb9ca4e9c95a1fe88c831eca5be655c57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704198160, "uuid": "42fc591f-a915-4bca-a28d-9c7117b81b08", "comment": "Malware payload (LummaStealer)", "value": "8fd3174128d4608687a7b94a8b2d9e42568cd1571827db1978abff22d4522507ca47a378e8622dc629b32938186eaf2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704198160, "uuid": "9121ab01-d745-44be-8612-90b49ac664d3", "value": "T19955333C258AA3AAD55E3CB385501127062B7A397BE13037155B29CD6BF09D6AB1F30F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704198160, "uuid": "0416b59f-c766-46f5-9ad6-678e2b91ae1b", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704198160, "uuid": "69861459-7fcb-4699-82d6-67e2a05faf58", "value": "24576:10x2d0wn3ZJ6dSyExkK+KvZeMcGaVtUwPJUXphdAhtSb:u1A3ZhmKQvFUwP2hdAPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704198160, "uuid": "c52ca944-d138-4ba1-8a13-b1d195cbe06e", "value": 1382912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704198160, "uuid": "ec9f247a-c195-49b3-b6b5-bdf067f8cecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704198160, "uuid": "b9a95c3b-589b-4f41-9601-0d4fac28afe1", "value": "SecuriteInfo.com.Win32.MalwareX-gen.26271.4384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6ccdf6-a92f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704173008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173008, "uuid": "632c2a4c-6aff-4bbc-a3a0-e0581ec1d259", "comment": "Malware payload (Mirai)", "value": "873cefdf768b3aeb79819d5e20252d3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173008, "uuid": "b74e239f-9e53-42a6-833b-6cff66c17830", "comment": "Malware payload (Mirai)", "value": "ec290f43906d38164409c75f65b4bd1515a3a20da00f29ae7028d1f9561fb7fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173008, "uuid": "7afbfdc7-ecb5-450e-895a-6418e68031a2", "comment": "Malware payload (Mirai)", "value": "e0785c1f493f1948e3f9fb6a70a964ecf6933667", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704173008, "uuid": "7f245eeb-f40e-4fe7-8b6c-8929229c8fe9", "comment": "Malware payload (Mirai)", "value": "b0686f715fa78c675e180a4147bde1fceae842a14731fc2e1d96a242a2dd5042af58d8fada74dd0d1fdf45e798e09cff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173008, "uuid": "d401483c-2c2f-463b-8999-edde9c298fd8", "value": "T10CE2F16361E5ED2FED665BBBD1B1AB4A39007A69C0F53235E7B8004E48F010E7E296C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173008, "uuid": "f0cd5417-c3e4-4e66-a3a5-35462a713b8d", "value": "768:ar7y3AWzDZU5LS4Ucgb7/LSks4xL1M7guqE7JWhh5o2e:jHzlUhS4Uc7sL1M0+gh5o2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704173008, "uuid": "03d8e3d6-f42c-4e88-9302-128b8fddd070", "value": 32996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704173008, "uuid": "d01f99a5-3a5a-4001-8342-25bf5e8da237", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704173008, "uuid": "23ca7c30-b157-49b1-8048-7b0c75a419c7", "value": "873cefdf768b3aeb79819d5e20252d3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ab8d4b-a95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704193008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193008, "uuid": "c3e0d374-5a0b-4ada-854f-b4e91924f27f", "comment": "Malware payload (Mirai)", "value": "bde63487e19ba53575a38ce7a9cb5063", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193008, "uuid": "fa0b2a63-d7c6-4ef9-ab22-cd121efaf638", "comment": "Malware payload (Mirai)", "value": "ecfb33cfd3a8fb92e1097c93143e816701a4aaf44ff817acd0c7e1f6bcdb4481", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193008, "uuid": "d246e206-05fe-4f82-82d4-a00a4f16adec", "comment": "Malware payload (Mirai)", "value": "e3cb69d439e78ceb328cd516b637e871d3e0d442", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193008, "uuid": "d888c5c2-9893-4919-a52c-97bdedb55778", "comment": "Malware payload (Mirai)", "value": "6ff1172cfb0663f99c93e5cee582e17c6274da081cce85fcb6cf134535fbdcd4170085418a74b37e6706c4034c88101b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193008, "uuid": "0a025a8c-dbbd-4e9d-89c9-f1740e39660a", "value": "T123832A41BD825A12CAC513BBFA2E01CD372613E8D2EF7217CD116F11B78696F0EA7562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193008, "uuid": "bc8f25bb-dca4-40b8-a1da-a77b33860d40", "value": "1536:Tzpzj9mEs5yCwpMYPwbc4sjxQ/oT/0aIC1NYa7vFXVJvKwbZnN:T9zj9mlLLbjyxf/0aIC1NY8fKwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704193008, "uuid": "01d3239f-024f-4514-bd07-ce7071a181dd", "value": 83264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704193008, "uuid": "4cab46fe-8344-4e96-b23a-5516d9a92bc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193008, "uuid": "3117f1d5-4346-4cfc-b56f-8e1f8c6af976", "value": "bde63487e19ba53575a38ce7a9cb5063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22da0719-a999-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704218567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218567, "uuid": "47df35db-ce05-47fc-ab26-10b3592c45e9", "comment": "Malware payload (Mirai)", "value": "a0d57d0ac1a9cb25d3bb3f3e2c1d1f93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218567, "uuid": "a032c08d-7956-4807-95a6-4d41f347f40a", "comment": "Malware payload (Mirai)", "value": "edc1a7fda1d6a02bbcc94a09be6b886b90d6c2aca1e5830c1a4bb841e0466bf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218567, "uuid": "d163b271-d152-497e-a0a9-6507b506c623", "comment": "Malware payload (Mirai)", "value": "88520a3f4946294202773a9b18dc50f9a7b9d25b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704218567, "uuid": "ea8913a1-47af-47cb-95f3-0ec35a28313b", "comment": "Malware payload (Mirai)", "value": "150d87bfca8e2a4efad1cc01f4758bbe8659f18c4974be38b9a1df2989b27e33e3a511ff4a5a50148d076fff82a4b861", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218567, "uuid": "56cc80ab-a191-448a-8dd7-fd51d7b5b002", "value": "T1D7734DC9F4018D7CF94BEABE94624A09F932270076930F1B76A7FD936D631A47D02D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218567, "uuid": "cb9b6627-f7c0-4811-8caa-2e789d12473d", "value": "1536:oHfVv05lvwAfa/kAqcaqiVnTkGi6T9EeIPEm8l1Qov3GlvYI:oHiounA16E8fQ/lgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704218567, "uuid": "828412e9-b6d9-4ebd-8ace-e3469872c1aa", "value": 75528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704218567, "uuid": "0833afdc-3f7e-4572-83eb-0d66e084122a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704218567, "uuid": "2552516b-5bb4-4986-8be2-af6264c9ea5c", "value": "a0d57d0ac1a9cb25d3bb3f3e2c1d1f93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260dd513-a9a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704222438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222438, "uuid": "1ac06e54-3e07-46cc-ae43-4a4d0ba4a9cb", "comment": "Malware payload (Socks5Systemz)", "value": "0a106fad7692d0da1762cde6f63bceef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222438, "uuid": "2e6d692b-bf12-4dd1-923c-47b8ec785ee6", "comment": "Malware payload (Socks5Systemz)", "value": "ede93512a69d3d17e3e881f934c08df17bcd1855f872b674ad1c2480dda3e816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222438, "uuid": "323876a3-6e97-494f-a516-eff1e409d4f8", "comment": "Malware payload (Socks5Systemz)", "value": "75ddf46acb86f72f7ba5b0b6625f01f2ec308e92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222438, "uuid": "7ba1595c-d6a9-4929-b1fb-724ac43620d8", "comment": "Malware payload (Socks5Systemz)", "value": "84319070e3fcffd45c9bfc124e342a35f982d00224aea53e32b550948d657ea178fdb5f074411fe690d007eec8f2e662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222438, "uuid": "943f1c9d-acaf-4a04-a7fa-52fd823c905f", "value": "T1EA2633090CE039B3E0F28D39EF959FA509377B008F32972D26D5CDCA9B679168716369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222438, "uuid": "ed221da0-fb56-4acb-9cde-1c6ccc4eca67", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222438, "uuid": "f58eea1e-61d7-4ada-88dd-dc79251dc57f", "value": "98304:QF24nptX4Rd7E/83gsmd3fgVFttcj2yXjfpr4n4dm8:A24p94Ik33md3oVrqjxXjRE4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222438, "uuid": "08b9be4e-3c06-47dc-8ba5-62f833cad7ee", "value": 4576057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222438, "uuid": "e502ba47-0e72-4023-b9f3-f88ea5bb9439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222438, "uuid": "c987fea7-eabc-475a-9ff9-c3bbe837f9b0", "value": "tuc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40724c1-a92e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704172962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172962, "uuid": "e2204faf-0d39-45ea-a35e-61a8a4adadb6", "comment": "Malware payload (Mirai)", "value": "abda7ad000cf3df8ded39f40b4c4f564", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172962, "uuid": "daeec7b2-68a7-41aa-a5c5-96c2c558b1d3", "comment": "Malware payload (Mirai)", "value": "ef63306be89446e2924db9eb7e9a8dcaee3125d5125917957d935f6f528ac84c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172962, "uuid": "1543d232-8671-4280-b7f0-84b945a5f89f", "comment": "Malware payload (Mirai)", "value": "70d14bb65a871c7a3ebf38d8a3b368c4cb72ea28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704172962, "uuid": "814a4e69-a738-4dea-a3cf-1c9144e9709d", "comment": "Malware payload (Mirai)", "value": "5b57bd1a76e312e74e7b4ff68044ad1c648abb6c131de086773f4330f2eb73dd3b28b577e5d6891aed3beef7d52df9a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172962, "uuid": "f9b3a275-a53b-412a-a9f5-2cbc98fc7b86", "value": "T1837319B41986F27CEDF180B9E45710D624A20A1C7BACE1E3B8C7543AEF79B0C7169D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172962, "uuid": "7c2a2c7f-721a-41d5-b589-cc28886bf3a3", "value": "1536:TUeiGsZhY81utQts8nd7/WGed6l4QaYjV2m:TUH7ZhY3tQtsQ7/Wsl4QFjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704172962, "uuid": "a28bcd5c-6fa6-4d38-9633-93a203086caf", "value": 75132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704172962, "uuid": "b672ec83-b28f-45c2-aa1a-021aade7d12a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704172962, "uuid": "77141cbf-1f07-491c-a66c-0de6ccd65bb3", "value": "abda7ad000cf3df8ded39f40b4c4f564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bc3e47-a94e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Phobos)", "timestamp": 1704186653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186653, "uuid": "a754bcaf-35f3-4644-af4c-e11cc3ce4fb5", "comment": "Malware payload (Phobos)", "value": "88389a265bd9b1e9c59fb7053cf45b07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186653, "uuid": "2571fb6c-8d8d-4780-821b-f126dab992c2", "comment": "Malware payload (Phobos)", "value": "f146915a0298daff26ffe85a42b9a9ef68e7a148e3dbe3bc43abb283d96facbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186653, "uuid": "ee0db81b-9ab5-487d-a932-f94ac75be265", "comment": "Malware payload (Phobos)", "value": "900b980b7ef5bbbc6a255cffd66900fb68802c25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704186653, "uuid": "2c2bcd1d-328e-46f8-b1ce-2ce1065beae1", "comment": "Malware payload (Phobos)", "value": "a85f182440c2d0c9464bf0a06f6ba813f9188c7adc4b6a6a08bfa8eabb81d1a09438f94d0654981ee171aab75eac9ea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186653, "uuid": "72d1e5b2-a981-455e-88d9-8431c90cc9aa", "value": "T1E743B046706980B3CE6246B0253A2F4B8FBF540540B888978F3D5D963FD5476EB2E37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186653, "uuid": "c6490869-2c2c-4227-ad26-05781b7f3566", "value": "851a0ba8fbb71710075bdfe6dcef92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186653, "uuid": "35891175-5462-4364-976b-652e133a45d3", "value": "1536:ENeRBl5PT/rx1mzwRMSTdLpJMGl5dPZjlkWBFj:EQRrmzwR5J1VPZiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704186653, "uuid": "1eb1ae52-8408-49d2-a883-6a17819bc7b4", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704186653, "uuid": "ac2ce50a-2dfd-4f52-a804-1209a1d0e30b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704186653, "uuid": "d641cf79-0b7c-4fd4-a605-0997d8b630ad", "value": "wikilab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a94100-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704221899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221899, "uuid": "5dafca80-f695-4ac2-8624-7986df7c6ac2", "comment": "Malware payload (RiseProStealer)", "value": "40f29b8b300c2805c637fa92e1a65317", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221899, "uuid": "ed150cce-70a6-406a-9940-cef5e9e6d01a", "comment": "Malware payload (RiseProStealer)", "value": "f4273f9df8bca6ecf2fad75248105d1ac87cf4bb01dd69c50511b62199f71988", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221899, "uuid": "f0d8b1a7-115f-4351-b37f-22743cb477c8", "comment": "Malware payload (RiseProStealer)", "value": "4568fdc4c4585b744527c33d8054e039f8765138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221899, "uuid": "1269d0a5-3c5f-4449-8c66-21a9e8a5005d", "comment": "Malware payload (RiseProStealer)", "value": "f49ed2373cca02ba1aee36281a0fc9717eb3aaf983ea7a01db98d38946651b3e12d7bef195ce8887d550a87c91ff7b85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221899, "uuid": "38fbd6b9-e61e-4db6-9694-df216d07e4d7", "value": "T133C53343BAF46276E9BA27B00BF612C31B3F7D919A48B14B31927D1C0C316D45A25F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221899, "uuid": "5f3d85f8-055d-49e2-b268-9376c71a3c86", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221899, "uuid": "8a6261f8-dfdd-4ce7-98a1-4decffc04b89", "value": "49152:2g8hPlDVEd7PKvDqabBXgnp42koYWGi9LiUpQYVHp2QhYvBc4AgyTzyfN:X8hPlDVEd7PKLrwOgFGiLiU9p3YvBzDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221899, "uuid": "e3fcd046-ea00-49bc-9089-1be2f71d6efb", "value": 2498048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221899, "uuid": "e16e7d0c-d0e5-411e-9f81-a90719b99637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221899, "uuid": "ca7a6162-0eb9-42be-baf9-22d3f5bd65b9", "value": "f4273f9df8bca6ecf2fad75248105d1ac87cf4bb01dd69c50511b62199f71988.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc5fcb0-a95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1704193002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193002, "uuid": "e29fdf8b-f3eb-43f3-baab-c56d4f87b57c", "comment": "Malware payload (Gafgyt)", "value": "c4cfe4653f0718f7e12f8d2e1ca3b79b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193002, "uuid": "ca5dab2c-8ee1-4bed-928e-1ef1006e24c2", "comment": "Malware payload (Gafgyt)", "value": "f5caeea5742112353d290b4bc5c2b8041f52f9d37bbfc45e03fa9373e6595350", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193002, "uuid": "ce22caa4-94b4-4080-b131-ea63b68d0b36", "comment": "Malware payload (Gafgyt)", "value": "4ab8a02db5598e140a143d8d1534f906de0122dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704193002, "uuid": "5f21b03f-2d05-4677-9e27-4f9164edf253", "comment": "Malware payload (Gafgyt)", "value": "0403ae70da1f91eb83195d741bd58ca26359e610aea09bc6063a682357f6c6b6a904bbedf75078f4b6f761b056733ef3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193002, "uuid": "83508d79-96d0-4d0a-81fc-a63850a0537a", "value": "T1FDF33B46AA418F13C4D6177ABAEF424933239B54D3EB73068918BFB43F8679E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193002, "uuid": "7b1eceee-b560-44c0-b24a-85a0e5a3bfbe", "value": "3072:UiIorHdKkav9ytn1na269kP7YXb6JLW+NnbwbZn5N7ozNM/9Kq/3:UBEsxslta269kP7Yr6JXbwR5N7ohM/9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704193002, "uuid": "0b54debe-edc1-4709-9e77-ee362470fecf", "value": 168899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704193002, "uuid": "1a4a195d-ea01-43bc-8aa5-38a9e86fba5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704193002, "uuid": "e11513a3-0da4-4b6c-a693-327b8c630b5b", "value": "c4cfe4653f0718f7e12f8d2e1ca3b79b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c03639a-a9b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1704230206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704230206, "uuid": "676a2640-2866-47e6-acd1-302afd299116", "comment": "Malware payload (VenomRAT)", "value": "590bc27b1f9787ebaaef5768a2eab6df", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704230206, "uuid": "9d02ed6c-24c6-478f-aea3-9cdbec193050", "comment": "Malware payload (VenomRAT)", "value": "f623ac67ec512f227ef0b5c0e2f3da59125f2ecd0f24fc550b0f7f39254de196", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704230206, "uuid": "bcfe7782-7aa1-49f6-9aa7-629e8f6e6822", "comment": "Malware payload (VenomRAT)", "value": "c0c19fa9518f381e549721b7d66d5bbec7f7dcd3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704230206, "uuid": "e311ffbc-0e01-4b6f-ab30-12150a5c2900", "comment": "Malware payload (VenomRAT)", "value": "1723403ea719b766f9c95fd3b621f562e5ee818866d8528ee259c8d00f07381d71eb5e5452eb0ba3d51b9cf5fc8c3759", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704230206, "uuid": "f6915700-53a1-4e7f-9b41-17e29e6efe92", "value": "T19A44CF44E2F29A2746D7FB5926061C6C42896E8757D0A9F0C40C9BF5D7FBDB8C438C62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704230206, "uuid": "595a342e-e68c-415e-b385-1c9f8a679217", "value": "6144:XUaMBH7RAdyo9HLeNGw4GjyCurG2J7YXVBE:XUaMN9Wz9yAVDCurGIoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704230206, "uuid": "ca92861a-9373-4dce-ab6d-7ed10baea00c", "value": 269343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704230206, "uuid": "5d8b723f-f0e7-4c16-8a37-29549c7e668a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704230206, "uuid": "88f7c0ec-2db4-41c5-99b4-f7b91d535484", "value": "Adobe_Reader_Software_Update.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e445ba3e-a9b8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704232206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232206, "uuid": "e62ebae8-1349-4773-ac83-44c3d5b03b9d", "comment": "Malware payload (Mirai)", "value": "08f4c5922075254540922f40706e8502", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232206, "uuid": "12bc6ad7-9235-4f5d-8569-74d31d0dd83c", "comment": "Malware payload (Mirai)", "value": "f76f3d2a4869993480d8d78173440b74d79206085f27d43c2531faffe99121e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232206, "uuid": "ce140839-bf58-46d0-b96f-a3c7f2f9f0b2", "comment": "Malware payload (Mirai)", "value": "79b9c5a9e378cdfaa579767e9f1915fefd02bae6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704232206, "uuid": "b7a28b1b-db39-4556-945f-9442862c9ce6", "comment": "Malware payload (Mirai)", "value": "5e8e70fa515d4d12124671d784ab23cae950d42d3b2bd3bedadb4f1212bd0010682e2dc1cb508e9fd43dd160e037bea3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232206, "uuid": "554ecac5-5255-43b6-b70a-6393e956ba06", "value": "T150430292387A297A56E15CBA3EB4BD8E9C2C07F1F5F63E503368178CB9A03625DD1407", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232206, "uuid": "adf46d39-037a-4c0e-961b-982b6c248cdd", "value": "1536:jtFA7HNhtkIua2eJuZIMRdgCmKiDyhLtK53DBK7YQ:jEtsPKsRdgNKKyhLCsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704232206, "uuid": "ce100aec-5d6b-4a66-b08d-183a7e8a7191", "value": 58596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704232206, "uuid": "94b818d6-d9c4-4152-9476-d2d8fd4404aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704232206, "uuid": "c09e85d8-fb2d-4c37-9586-c4084d8fe12d", "value": "r.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1795bac-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704221920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221920, "uuid": "7355a15c-d601-426f-b9b7-1e9c3b732817", "comment": "Malware payload (RiseProStealer)", "value": "6243f8dbc9f366cd7685080a2846c246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221920, "uuid": "997ee54c-3343-4f63-a78d-a899b9624940", "comment": "Malware payload (RiseProStealer)", "value": "f865504f075fc498d14904055734c4c5e70d9a852e9362414b1fff6a46fc9123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221920, "uuid": "8f97b6a3-6173-4348-8d68-ea7a60e93eed", "comment": "Malware payload (RiseProStealer)", "value": "4f1c55b97ec4302ef86d41fa2092ebdf49759bcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221920, "uuid": "baaa3f15-9393-4bb7-ab0c-062de28d4a84", "comment": "Malware payload (RiseProStealer)", "value": "169938c4fac336835b6e46b280b96779110bd36034d2e7981c507aa73572d9eecba18e749fa78e205a2e0577b082d135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221920, "uuid": "86a93e5c-c0bb-4443-8e6f-0370fb3e7548", "value": "T1609533866BD18571CAE417B1A4F747C71A34BDB2AF285B1F35809B8108F26E5B03673E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221920, "uuid": "08c2b7a7-d40e-4a6e-b64a-cada3f288b2a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221920, "uuid": "c58361b0-fbdb-407d-8964-301a20dd4ad1", "value": "49152:E05z1o02R2cFB3gwqQXSjewyeCx/DLO7b8Zf05yPmsn:vE03yB3gwqqSKbWe8IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221920, "uuid": "8483d5d8-b543-40b7-a7af-e08ab0a9174b", "value": 2039296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221920, "uuid": "b9c70e21-98d4-49de-966d-0617e4bf41f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221920, "uuid": "cdd90cd5-1dae-4e5b-b624-8847a2b18b1b", "value": "f865504f075fc498d14904055734c4c5e70d9a852e9362414b1fff6a46fc9123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b7ec70-a9a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1704222922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222922, "uuid": "e1fa918c-08f4-4129-9a2c-279d3b2123f4", "comment": "Malware payload (Smoke Loader)", "value": "a2dfd2f2415ea68079e23e7556b7dc0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222922, "uuid": "beeda51b-7649-4b24-a11b-b160ead6df29", "comment": "Malware payload (Smoke Loader)", "value": "f95b01b35d47756420ec9c626d56865c687323473b11e51f141277c746db03a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222922, "uuid": "b68de70e-b6f1-456a-9863-96d72c8bd01f", "comment": "Malware payload (Smoke Loader)", "value": "43a08afc2797f44720d05190960ca7425426f334", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704222922, "uuid": "66433dd2-8147-4cc7-af4a-fe41cc8ca97d", "comment": "Malware payload (Smoke Loader)", "value": "221cf1e4dab1a9cb7fc5eacb83a96a20be4eaaa34e405a6187dbb7319adceecc128921e4dc3aee738d775aacb2238516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222922, "uuid": "d363a59c-8e17-454f-b28e-728c34348cdc", "value": "T1B7149D2231F0C076F6F3697589B4C7F00E7BB8566A72958F6BD906792F257D18A2030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222922, "uuid": "8a9609fc-6c6a-41b0-9931-458ff81d79ae", "value": "628b5625e44ec4d4a2ba4078ce3026c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222922, "uuid": "39eab871-a087-4666-89d9-82469b0c03f9", "value": "3072:iwKO2LMVS5fgevom6PJiMrt+NqaDGngsYrBp8OBwpssGnJyYK+p16jxZRU9SD:63LMfGMTxFYP8xpsrJyY0C9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704222922, "uuid": "5d100494-ed96-46bf-803e-46ddb25b2c45", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704222922, "uuid": "5a10aeb5-da54-4410-a705-dba069fa1734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704222922, "uuid": "b719a2eb-121e-48ac-83f1-71ea15e153ce", "value": "5bd893f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18eed07-a9a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704221786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221786, "uuid": "8f01ad97-acb3-42c8-bb77-bc379e07057b", "comment": "Malware payload (RedLineStealer)", "value": "cc4d59c981a4263d1dca120b913c2ea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221786, "uuid": "1ddbcd48-3808-4381-b1b1-180398f9fca0", "comment": "Malware payload (RedLineStealer)", "value": "fa146cfe8c5719a3b2f0cd36f32334956da9fe4eb83aabc0a2ad6e88dd33b430", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221786, "uuid": "587ee8fc-0316-466a-8802-5a68006ee5d2", "comment": "Malware payload (RedLineStealer)", "value": "6bf5edda90baf13bfb9e3aa0ed506cc53118351f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704221786, "uuid": "b3fef727-c42c-425a-a73d-d776a2d182b8", "comment": "Malware payload (RedLineStealer)", "value": "1b52decc90f047d08b4aa99348e14e961db8f471ad9e7bd9e4c10e82914ddc91dde15274cd57b8694ffdef41449227f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221786, "uuid": "6af098bb-6945-437f-b38c-553f1d32aaaa", "value": "T142C41217A6E89132D9B11BB00DFA07C30F367CE059689B5B738A6D1A0CF15D4A871B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221786, "uuid": "5578b5e7-9be4-4fac-b9f4-a1b5f745e86c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221786, "uuid": "25f1078a-e182-4991-8e1e-29ce049d0d4e", "value": "12288:CMrZy90HltuNIECJkLPQpPvCjPagP+8leRLB/T:7y4GIEC2LP+ClG8leRd/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704221786, "uuid": "e0725400-a4cd-4f6b-87aa-08d68ee0b34e", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704221786, "uuid": "e4942576-2488-431f-bdfd-b0794c8b67c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704221786, "uuid": "864bdd61-c5ff-47d4-8500-ee4220e6c968", "value": "fa146cfe8c5719a3b2f0cd36f32334956da9fe4eb83aabc0a2ad6e88dd33b430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }